Prompt Firewall Docs

A security API that screens every user message before it reaches your AI model. One endpoint, one header, under 150ms.

Quickstart

Get your API key from your dashboard after signing up, then add this to your code before every AI call:

Copyimport requests

def is_safe(user_message):
    r = requests.post(
        "https://prompt-firewall-api.onrender.com/analyze",
        headers={"X-API-Key": "YOUR_API_KEY"},
        json={"message": user_message}
    )
    return r.json()["status"] == "PASSED"

# In your chatbot handler:
if is_safe(user_input):
    reply = ask_your_ai(user_input)  # safe, forward to AI
else:
    reply = "I cannot process that request."async function isSafe(userMessage) {
  const res = await fetch("https://prompt-firewall-api.onrender.com/analyze", {
    method: "POST",
    headers: {
      "X-API-Key": "YOUR_API_KEY",
      "Content-Type": "application/json"
    },
    body: JSON.stringify({ message: userMessage })
  });
  const data = await res.json();
  return data.status === "PASSED";
}curl -X POST https://prompt-firewall-api.onrender.com/analyze \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message": "Hello, what are your opening hours?"}'

Authentication

All requests require an API key passed in the request header:

CopyX-API-Key: YOUR_API_KEY

Get your API key from your dashboard. Keep it secret and never expose it in frontend code. If compromised, revoke it in your dashboard and generate a new one.

Base URL

Copyhttps://prompt-firewall-api.onrender.com

POST /analyze

The core endpoint. Screens a message for prompt injection, jailbreaks, SQL injection, XSS, PII, and 70+ other attack patterns.

Request Headers

Request Body

Example Request

Copy{
  "message": "Hello, what are your opening hours?",
  "user_id": "user_12345",
  "target_model": "gpt-4o"
}

Response Schema

PASSED Response

Copy{
  "event_id": "a1b2c3d4",
  "status": "PASSED",
  "reason": "No threats detected. Safe to forward to AI.",
  "latency_ms": 84,
  "pii_masked": false,
  "shadow_mode": false
}

BLOCKED Response

Copy{
  "event_id": "e5f6g7h8",
  "status": "BLOCKED",
  "reason": "Blacklisted phrase detected: \"ignore previous instructions\"",
  "latency_ms": 75,
  "pii_masked": false,
  "shadow_mode": false
}

Response Fields

Error Codes

Python

Copyimport requests

API_KEY = "YOUR_API_KEY"
API_URL = "https://prompt-firewall-api.onrender.com/analyze"

def screen_message(message, user_id=None, model=None):
    payload = {"message": message}
    if user_id: payload["user_id"] = user_id
    if model: payload["target_model"] = model

    r = requests.post(
        API_URL,
        headers={"X-API-Key": API_KEY},
        json=payload,
        timeout=5
    )
    return r.json()

# Usage
result = screen_message(user_input, user_id="user_123", model="gpt-4o")
if result["status"] == "PASSED":
    reply = ask_your_ai(user_input)
else:
    reply = "I cannot process that request."

JavaScript / Node.js

Copyconst API_KEY = "YOUR_API_KEY";
const API_URL = "https://prompt-firewall-api.onrender.com/analyze";

async function screenMessage(message, userId = null, model = null) {
  const payload = { message };
  if (userId) payload.user_id = userId;
  if (model) payload.target_model = model;

  const res = await fetch(API_URL, {
    method: "POST",
    headers: {
      "X-API-Key": API_KEY,
      "Content-Type": "application/json"
    },
    body: JSON.stringify(payload)
  });
  return res.json();
}

// Usage
const result = await screenMessage(userInput, "user_123", "gpt-4o");
if (result.status === "PASSED") {
  reply = await askYourAI(userInput);
} else {
  reply = "I cannot process that request.";
}

cURL

Copycurl -X POST https://prompt-firewall-api.onrender.com/analyze \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "message": "Hello, what are your opening hours?",
    "user_id": "user_123",
    "target_model": "gpt-4o"
  }'

C#

Copyusing System.Net.Http;
using System.Text;
using System.Text.Json;

public class PromptFirewall
{
    private static readonly HttpClient client = new HttpClient();
    private const string API_KEY = "YOUR_API_KEY";
    private const string API_URL = "https://prompt-firewall-api.onrender.com/analyze";

    public static async Task<bool> IsSafe(string message)
    {
        client.DefaultRequestHeaders.Clear();
        client.DefaultRequestHeaders.Add("X-API-Key", API_KEY);
        var body = JsonSerializer.Serialize(new { message });
        var content = new StringContent(body, Encoding.UTF8, "application/json");
        var response = await client.PostAsync(API_URL, content);
        var json = await response.Content.ReadAsStringAsync();
        var data = JsonSerializer.Deserialize<JsonElement>(json);
        return data.GetProperty("status").GetString() == "PASSED";
    }
}

PHP

Copy<?php

function isSafe($message, $userId = null) {
    $payload = ['message' => $message];
    if ($userId) $payload['user_id'] = $userId;

    $ch = curl_init("https://prompt-firewall-api.onrender.com/analyze");
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        'X-API-Key: YOUR_API_KEY',
        'Content-Type: application/json'
    ]);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);

    $data = json_decode($response, true);
    return $data['status'] === 'PASSED';
}

// Usage
if (isSafe($userInput)) {
    $reply = askYourAI($userInput);
} else {
    $reply = "I cannot process that request.";
}

PII Masking

Available on Pro and Business plans. When enabled, sensitive data is automatically redacted from messages before they reach your AI model.

The following are redacted:

• Credit card numbers replaced with [REDACTED_FINANCIAL]
• Email addresses replaced with [REDACTED_CONTACT]
• Phone numbers replaced with [REDACTED_CONTACT]
• South African ID numbers replaced with [REDACTED_ID]
• Passport numbers replaced with [REDACTED_ID]
• SSN replaced with [REDACTED_FINANCIAL]

When PII is masked, the response includes "pii_masked": true and the message_preview in your log shows the redacted version.

Shadow Mode

Available on Pro and Business plans. When shadow mode is enabled, attacks are detected and logged but the message is still passed through to your AI model.

Use shadow mode when you want to monitor attacks without disrupting your users. The response status will show PASSED (shadow mode) instead of BLOCKED.

Toggle shadow mode from your dashboard under Settings.

User and Model Tracking

Pass optional fields to get richer data in your security log:

Copy{
  "message": "user input here",
  "user_id": "user_12345",        // track which user sent the message
  "target_model": "gpt-4o"       // track which model was targeted
}

user_id can be any string that identifies your end user — a user ID, phone number, or email. It appears in your security log so you can identify repeat attackers.

target_model is useful for Business customers running multiple AI models. It appears in your log so you can see which model is being targeted.