Protect Your AI App

Gate model calls with the new Axiom scanning backend.

1. Endpoint and Auth

POST

https://api.axiomsecurity.dev/v1/scan/input

Headers

Authorization: Bearer <YOUR_API_KEY>
Content-Type: application/json

Body

{ "content": "user input goes here" }

2. Response Handling

An allow action alone does not prove that protection completed. The protected-turn helper checks scan completion, enforces blocks and applies semantic routing before releasing a response. Keep failure behavior closed and display only a displayed result.

Your application owns approved responses, review delivery and session termination. A flagged mention may continue; prohibited intent follows the selected profile's intervention policy. Monitor mode observes proposed decisions without enforcing normal policy blocks.

3. Examples

Install the supplied SDK bundle server-side. Supply the response map, buffered generation and review/termination callbacks used below. The curl request only inspects a decision. Guard retrieval and tools separately before using retrieved content or executing tool calls.

curl

curl -X POST "https://api.axiomsecurity.dev/v1/scan/input" \
  -H "Authorization: Bearer $AXIOM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content":"Review this customer request"}'

Node.js protected turn

import { AxiomClient, runProtectedTurn } from "@axiom/sdk";

const axiom = new AxiomClient({
  apiKey: process.env.AXIOM_API_KEY!,
  baseUrl: "https://api.axiomsecurity.dev",
  failurePolicy: { input: "closed", output: "closed", retrieval: "closed", tool: "closed" },
  timeouts: { scanMs: 60000, toolGuardMs: 3000 },
});
// Reuse this handle for one end-user chat, never across unrelated users.
const conversation = axiom.conversation();

const result = await runProtectedTurn({
  input: userMessage,
  approvedResponses,
  scanInput: (text) => conversation.scanInput(text),
  generate: generateBufferedResponse,
  scanOutput: (text) => conversation.scanOutput(text),
  requireCompleteProtection: true,
  streaming: false,
  onReview: routeReview,
  onTerminate: closeConversation,
});
if (result.status === "displayed") {
  displayToUser(result.displayedText);
}

Python protected turn

import os
from axiom_sdk import AxiomClient, run_protected_turn

axiom = AxiomClient(
    api_key=os.environ["AXIOM_API_KEY"],
    base_url="https://api.axiomsecurity.dev",
    failure_policy={"input": "closed", "output": "closed", "retrieval": "closed", "tool": "closed"},
    timeout_s={"input": 60, "output": 60, "retrieval": 60, "tool": 3},
)
# Reuse this handle for one end-user chat, never across unrelated users.
conversation = axiom.conversation()

result = run_protected_turn(
    user_input=user_message,
    approved_responses=approved_responses,
    scan_input=conversation.scan_input,
    generate=generate_buffered_response,
    scan_output=conversation.scan_output,
    require_complete_protection=True,
    streaming=False,
    on_review=route_review,
    on_terminate=close_conversation,
)
if result.status == "displayed":
    display_to_user(result.displayed_text)

Environment

AXIOM_API_KEY=ax_live_your_generated_key
AXIOM_API_BASE=https://api.axiomsecurity.dev

Security Notes

Keep API keys server-side. Generated keys are shown once in the dashboard and stored by Axiom only as hashes. Never put keys in query params.