The response

POST /v1/scan answers a scan object. A chat completion’s assistant message carries the same object, without id, object, created, model, system_fingerprint and usage, which the completion has itself.

{
  "id": "scan-0199c8a25b3e7c419a6f2d8e4b1c7f30",
  "object": "scan",
  "created": 1790000000,
  "model": "nam-shub-v2-20261008",
  "system_fingerprint": "fp_0000000000000000",
  "flagged": true,
  "severity": "critical",
  "categories": {
    "instruction_override": {
      "severity": "critical",
      "description": "Detected the classic ignore previous instructions attack in its many common forms.",
      "owasp": ["LLM01"],
      "mitre_atlas": ["AML.T0051", "AML.T0051.000", "AML.T0054"]
    }
  },
  "messages": [
    {
      "index": 0,
      "source": "/messages/0/content",
      "flagged": true,
      "detections": [{ "id": "instruction_override", "score": 1.0 }]
    }
  ],
  "usage": { "input_bytes": 71, "input_tokens": 12, "output_tokens": 307, "total_tokens": 319 }
}

This example is abridged to one category; the examples show complete responses.

The scan

Field	Type	Meaning
id	string	The scan’s id, scan-….
object	string	Always scan.
created	integer	When the scan was made, in Unix seconds.
model	string	The model that answered: always the release served, even when the request named nam-shub@latest.
system_fingerprint	string	Identity of the detection stack that answered: it differs between organizations and changes when their detection settings, the model or the service are updated. Compare scores only between answers with the same fingerprint.
flagged	boolean	The verdict, and the only decision: true when something that counts was found.
severity	string	none when nothing was detected, else the most severe detection: informational, low, medium, high or critical. It describes; flagged decides, so a request with only informational findings is flagged: false, severity: informational.
categories	object	What was found, keyed by category id; each value is a category.
detections	array, optional	Detections that belong to the conversation rather than to one message: multi_turn, an attack spread across the conversation. Absent when there are none.
messages	array	Every part of the request with something detected in it, in order (a message). Empty when nothing was found.
usage	object	What was scanned and returned, in bytes and tokens (usage).

A category

categories.<id>, one per kind of finding.

Field	Type	Meaning
<id>	key	The kind of finding, such as instruction_override, indirect_injection or data_leak. See categories for the full list; new ids can appear, so treat an unknown one as valid.
severity	string	How serious it is. An informational finding describes the input (an email address, say) and never flags it.
description	string, optional	What was found, in a sentence.
owasp	array, optional	OWASP Top 10 for LLM applications identifiers, such as LLM01, where they apply.
mitre_atlas	array, optional	MITRE ATLAS technique identifiers, such as AML.T0051.000, where they apply.

Categories that decide the verdict come first, the strongest first; JSON objects have no guaranteed order, so do not rely on it.

A message

messages[], one per part of the request where something was found.

Field	Type	Meaning
index	integer	The part’s position among the parts the request was scanned as: each text part, reasoning field, tool call, tool result and tool definition is a part of its own (see conversations). A plain input is one part, index 0.
source	string, optional	Where the part is in your request, as a JSON pointer: /messages/1/content, /messages/2/tool_calls/0/function/arguments, /tools/0/function. Absent for input.
flagged	boolean	Whether this part is flagged on its own.
detections	array	What was found in this part (a detection), by category id.

A part that is not listed had nothing detected in it. Every category in categories is explained by a detection in messages or in the top-level detections.

A detection

messages[].detections[] and the top-level detections[].

Field	Type	Meaning
id	string	The category it belongs to: a key of categories.
score	number	How sure the detector is, from 0 to 1: 1.0 for a certain match. Not a probability, and not the decision: an informational detection can score 1.0 and still flag nothing.

Decide with flagged and severity, never with a score threshold of your own.

Usage

Field	Type	Meaning
input_bytes	integer	The size of the text scanned, in bytes: the whole input, or every part of a conversation, not the request’s JSON.
input_tokens	integer	Tokens in the input, counted with the o200k_base tokenizer.
output_tokens	integer	Tokens in the verdict’s JSON, as a chat completion counts its completion.
total_tokens	integer	Their sum.