--- title: "scanText" description: "Scan untrusted text for prompt injection" canonical: "https://pgbeam.com/docs/ts-sdk/platform/scanText" last-updated: "2026-09-07T20:16:32.000Z" --- # scanText > Scan untrusted text for prompt injection URL: https://pgbeam.com/docs/ts-sdk/platform/scanText Inspects one piece of untrusted text for the techniques used to smuggle instructions into a model's context, and returns a verdict, a recommended action, and the evidence behind it. Two detector families run. The structural layer reads codepoints and scripts: invisible-codepoint runs, Unicode Tag smuggling, unterminated bidirectional overrides, and mixed-script words. None of those has a legitimate reason to appear in ordinary text, so a structural finding is a fact worth acting on. The lexical layer is exact-phrase matching with Unicode normalization, which is worth what exact-phrase matching is worth: it is a reason to look, and a support ticket quoting an attack contains the attack. Neither layer is a semantic classifier, and this endpoint does not pretend to catch prose that is hostile only in its meaning. The measured confusion matrix and the list of evasions that are known to work are published at https\://pgbeam.com/docs/prompt-scan. Authentication is optional. Anonymous callers get a free daily allowance keyed on their source address; an API key moves the allowance onto the organization. Past the allowance the endpoint answers 402 with a payment challenge. The submitted text is held in memory for the duration of the request and is never logged, stored, or used to train anything. An `Idempotency-Key` is refused on this operation rather than honoured, because honouring it would persist the response, and the response quotes the submitted text back. The operation has no side effects beyond metering, so a retry is safe without one. ## Usage ## Parameters Parameter Type Required Description body.text `string` Yes The untrusted text to inspect, at most 65536 bytes. Longer input is rejected rather than half-scanned, so a caller with a large document chunks it and scans each chunk. body.layers `"structural" \| "lexical"[]` No Which detector families to run. Defaults to both. Pass \["structural"] alone for the layer that produces no false positives on ordinary text, at the cost of missing every attack that has no byte-level tell. body.include\_evidence `boolean` No Whether each finding quotes the offending substring back to you. Defaults to true. Set false when the caller must not receive its own end users' text back in a response it will store or forward. ## Response `Promise`: the verdict on the submitted text. ## Example ## Errors Status Description 400 Invalid request parameters. 402 The free allowance is spent and no payment was presented. The `WWW-Authenticate` header carries the payment challenge; the body says the same thing in prose a model can act on. 429 Rate limited. Try again later. 503 Service temporarily unavailable.