openapi: 3.0.1
info:
  title: PromptArmor Analyze API
  description: 'PromptArmor is an LLM application security platform that detects and blocks indirect prompt injection, data exfiltration, phishing, and system manipulation in production AI applications. Content submitted to the API is run through a detection engine of default and modifiable detectors and a fast verdict (for example containsInjection) is returned so the calling application can block or allow the content before a completion is acted on.


    NOTE: PromptArmor''s full API reference at https://promptarmor.readme.io is gated behind authentication. This specification reflects the endpoints, authentication scheme (Api-Key header), base URL (https://api.promptarmor.com), and request/response fields that are publicly documented in PromptArmor''s architecture overview and integration guides. Field names beyond the confirmed `containsInjection` verdict and the `content`, `text`, `session_id`, and `detectors` request parameters are modeled conservatively and should be reconciled against the authenticated docs.'
  termsOfService: https://www.promptarmor.com/
  contact:
    name: PromptArmor
    url: https://www.promptarmor.com/
  version: '1.0'
servers:
- url: https://api.promptarmor.com
  description: PromptArmor production API
security:
- ApiKeyAuth: []
tags:
- name: Analyze
  description: Analyze LLM input and output through the detector engine.
paths:
  /v1/analyze/input:
    post:
      operationId: analyzeInput
      tags:
      - Analyze
      summary: Analyze LLM input.
      description: Analyzes LLM input (for example an email your LLM is about to summarize) and runs the detectors - including adversarial input detection - returning a verdict. When a session_id is supplied, session-based anomaly detection is also run.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnalyzeRequest'
      responses:
        '200':
          description: Detection verdict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AnalyzeResponse'
        '401':
          description: Missing or invalid Api-Key.
        '429':
          description: Rate limited.
  /v1/analyze/output:
    post:
      operationId: analyzeOutput
      tags:
      - Analyze
      summary: Analyze LLM output.
      description: Analyzes LLM output (for example the summary your LLM produced) and runs the detectors - including data exfiltration detection - returning a verdict. When a session_id is supplied, session-based anomaly detection is also run.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnalyzeRequest'
      responses:
        '200':
          description: Detection verdict.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AnalyzeResponse'
        '401':
          description: Missing or invalid Api-Key.
        '429':
          description: Rate limited.
components:
  schemas:
    AnalyzeResponse:
      type: object
      properties:
        containsInjection:
          type: boolean
          description: True when the analyzed text matches a known injection / threat class.
        detectors:
          type: object
          description: Per-detector results. A detector value of true indicates an issue was found for that detection type (for example data exfiltration, phishing, system manipulation, adversarial instructions).
          additionalProperties:
            type: boolean
    AnalyzeRequest:
      type: object
      required:
      - text
      properties:
        text:
          type: string
          description: The LLM input or output text to analyze (for example an email being summarized, or the generated summary).
        session_id:
          type: string
          description: Optional session identifier enabling session-based anomaly detection across multiple analyze calls.
        detectors:
          type: array
          description: Optional list of detectors to apply for this request.
          items:
            type: string
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: Api-Key
      description: PromptArmor API key passed in the Api-Key request header.