Prompt Scan API

Check the text before it reaches the model

One HTTP call. Send untrusted text, get back a verdict, a recommended action, and the evidence behind it. No signup to try, and nothing about the text you send is written down.

bash

curl -sX POST https://api.pgbeam.com/v1/scan/text \
  -H 'Content-Type: application/json' \
  -d '{"text": "Great product, five stars!<invisible payload>"}'

json

{
  "verdict": "suspicious",
  "action": "block",
  "action_reason": "a structural technique with no ordinary explanation was found at high confidence",
  "advice": "Do not place this text in a model prompt. The finding names codepoints that do not occur in text a person typed...",
  "has_structural": true,
  "findings": [
    {
      "layer": "structural",
      "technique": "tag_smuggling",
      "confidence": "high",
      "offset": 14,
      "evidence": "ignore all previous instructions",
      "detail": "32 Unicode Tag codepoints decoding to \"ignore all previous instructions\""
    }
  ],
  "engine": "promptscan/1",
  "quota": { "free_limit": 100, "free_remaining": 85, "resets_at": "2026-09-05T00:00:00Z" }
}

A boolean would not be enough to act on

The two things this endpoint finds are not the same kind of thing, and an agent that treats them the same either blocks its own support queue or ships the payload. So the response separates them, and recommends an action for each.

Structural

Acts on it

Reads codepoints and scripts. Invisible-character runs, Unicode Tag smuggling, unterminated bidirectional overrides, words mixing scripts that render alike. None of that appears in text a person typed, so a structural finding is a byte-level fact rather than a guess. Measured at 100% precision and zero false positives on the benign corpus.

Lexical

A reason to look

Exact-phrase matching over a short phrase set, after normalization that folds homoglyphs and drops invisible characters. A bug report that quotes an attack contains the attack, and this layer flags it. That is why a lexical finding recommends review and never block.

What defeats it

Every one of these is known to work and none of them is claimed. A detector that hides its evasions is a detector somebody will trust in the wrong place.

Base64, hex, or any other encoding of the payload.
Leetspeak, letter-spacing, hyphen-splitting, and deliberate typos.
Synonym prose that never uses a listed phrase.
Text that is hostile only in what it asks for, with no byte-level tell. Neither layer reads meaning.
A payload split across several calls. Each call scans one value and holds no memory between them.

The answer to that last class is not a better scanner. It is scope, so the agent cannot reach what the injection asks for, and budgets, so the volume is bounded whatever the agent was talked into. That is what the rest of PgBeam does.

What happens to the text you send

You will send this endpoint text that may contain your own users' data, so the answer has to be specific rather than reassuring.

Not logged

The request logger records method, route, status, latency, and a request id. The handler passes no submitted value to the logger on any path, including its error paths, and a test drives a marker string through every branch and fails if the marker appears in the captured output.

Not stored

There is no scan table, no queue, no object-store copy. The only durable state a scan creates is an integer in a metering counter. An Idempotency-Key is refused rather than honoured, because honouring it would cache the response, and the response quotes your text back.

Not trained on

Nothing you send tunes the phrase set or anything else. If you would rather send us nothing at all, the detector is a published Go library you can run in your own process.

The findings you receive do contain your own text, going back to you. Send include_evidence: false if you do not want spans of it in the response at all.

Free to try, metered above that

A free daily allowance, counted per organization when you send an API key and per source address when you do not. Every answered scan reports what is left, so the limit is never a surprise. Past the allowance the endpoint answers 402 with a payment challenge, and a request carrying the resulting proof is served from the units it bought.

The accuracy figures, the full corpus behind them, the evasion list, and the exact retention answer are all in the documentation. No accuracy number is published there that has not been measured.