API Reference

Full HTTP API documentation. Base URL: https://api.repellox.com/v1. All requests require Bearer authentication.

Authentication

Pass a Repellox API key as a Bearer token in the Authorization header for every API request. Keys begin with rpx_.

Authorization: Bearer rpx_your_api_key

Endpoints

Method	Path	Description
`POST`	`/inspect`	Inspect content for threats; returns block decision, threat class, and confidence.
`POST`	`/inspect/batch`	Submit multiple content items in one request and receive result objects in the original order.
`GET`	`/audit`	Fetch audit log entries with filters for date range, threat class, and context ID.
`GET`	`/audit/:context_id`	Retrieve all audit entries for a context ID, including the complete inspection history for a conversation or pipeline run.
`GET`	`/usage`	View usage statistics for the current billing period, including request counts, quota remaining, and reset date.

POST /inspect

Synchronously inspect one content item for threats through the core endpoint.

Request

{
  "content": "string",            // required: text to inspect
  "mode": "strict",             // optional: strict | monitor | permissive (default: strict)
  "context_id": "string",       // optional: link to existing inspection context
  "content_type": "user_input", // optional: user_input | retrieved_doc | tool_output | model_output
  "metadata": {}               // optional: arbitrary key-value metadata attached to audit log
}

Response

{
  "blocked": false,
  "threat_class": null,        // null if not blocked, else threat category string
  "confidence": 0.12,
  "context_id": "rpx_ctx_abc123",
  "inspection_id": "rpx_ins_def456",
  "latency_ms": 1.8
}

Threat Classes

Value	Description
`direct_injection`	User instruction seeking to hijack the system prompt or override agent behavior.
`indirect_injection`	Adversarial payload hidden in retrieved web pages, documents, or search results.
`jailbreak`	Attempt to bypass model safety guidelines via role-play, encoding, or adversarial phrasing.
`unauthorized_tool_call`	The model tried to call a tool outside the authorized tool set.
`exfiltration_attempt`	Detection at the output layer of context-window content leaked in a model response.
`context_poisoning`	A multi-step attack that corrupts context and affects later agent decisions.

Error Codes

HTTP Status	Code	Description
`401`	`UNAUTHORIZED`	API key missing or invalid.
`402`	`QUOTA_EXCEEDED`	Monthly inspection quota reached. Upgrade or await quota reset.
`400`	`INVALID_REQUEST`	Request body validation failed. Verify required fields and value types.
`429`	`RATE_LIMITED`	Too many requests per second. Retry after the `Retry-After` header value.
`500`	`INTERNAL_ERROR`	Unexpected error. Contact support with the response body's `request_id`.

Back to Quickstart