Scanning

Scanning checks agent traffic for PII, prompt injection, toxic content, and secrets. Use the built-in detection, plug in an existing tool, or bring your own scanner. The receipt is the same either way, because what matters is the signed record of what a scan found, not which scanner found it. Asqav signs that result server-side, so it cannot be quietly backdated or rewritten.

Asqav's own content scanning detects PII, prompt injection, toxic content, and secrets in agent payloads. Scans run automatically on every signed action, catching sensitive data before it leaves your infrastructure, and the findings are attached to the signed record.

Running guardrails

Guardrails run automatically on every signed action on all plans, including Free, with no configuration needed. Findings are attached to the signature record and available via the API.

python

# Guardrails run automatically on signed actions
signature = agent.sign(
    "llm:generate",
    {
        "prompt": "Summarize this document for user john@example.com",
        "model": "gpt-4"
    }
)

# The scan detected PII (email address) in the context
# Results are stored with the signature automatically

Scan Categories

Four built-in scan categories cover the most common content risks:

Category	Detects	Examples
`pii`	Personally identifiable information	Email addresses, phone numbers, SSNs, credit cards
`injection`	Prompt injection attempts	Ignore previous instructions, system prompt overrides
`toxic`	Toxic or harmful content	Hate speech, threats, explicit content
`secrets`	Leaked credentials and keys	API keys, passwords, tokens, connection strings

Viewing Scan Results

Retrieve scan results for a specific signed action:

bash

# Get the scan result for a signature
curl https://api.asqav.com/api/v1/scanning/results/sig_abc123 \
  -H "X-API-Key: sk_live_your_key"

# Response
{
  "signature_id": "sig_abc123",
  "overall_passed": false,
  "total_findings": 1,
  "blocking_findings": 0,
  "category_counts": {"pii": 1},
  "category_types": {"pii": ["email"]},
  "scanned_at": "2026-06-11T12:00:00Z"
}

Scan Statistics

Get aggregate scanning statistics across all agents:

bash

# Get scanning stats
curl https://api.asqav.com/api/v1/scanning/stats \
  -H "X-API-Key: sk_live_your_key"

# Response (truncated)
{
  "total_scans": 1204,
  "total_findings": 37,
  "total_blocked": 5,
  "block_rate": 0.4,
  "by_category": [
    {"category": "pii", "findings": 21, "blocked": 3, "types": ["email"]}
  ]
}

Custom Scan Patterns

Define custom regex patterns to detect domain-specific content:

bash

# Create a custom scan pattern
curl -X POST https://api.asqav.com/api/v1/scanning/patterns \
  -H "X-API-Key: sk_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "internal-project-codes",
    "description": "Detect internal project code references",
    "pattern": "PRJ-[A-Z]{2,4}-\\d{4,6}",
    "severity": "medium",
    "should_block": false
  }'

# List all custom patterns
curl https://api.asqav.com/api/v1/scanning/patterns \
  -H "X-API-Key: sk_live_your_key"

Warning

Custom patterns must be valid regular expressions. Invalid regex will be rejected at creation time. Test your patterns before deploying to production.