What's New

The Red Team API was rebuilt. The current API lives on /rt/*. The previous API on /redteam/* is archived and still documented under Red Team (Legacy). New work should use /rt. This is not a version bump of the old paths. /rt is a new contract: new resources, new payload, new report shape. A body written for /redteam will 422 if you post it to /rt. This page is the map: what changed, what each old field and test became, and a side-by-side payload you can translate from.

Quickstart

Submit, track, and read a /rt/redteam run

Payload Guide

The four blocks of a current payload

API Reference

Full /rt schemas

What changed

	Previous (`/redteam`)	Current (`/rt`)
Job model	`task_id` on a task	`run_id` on a run (`Queued` / `Running` / `Finished` / `Failed`)
Scope	Named tests (`bias_test`, `pii_test`, …)	8 risk categories or 6 compliance frameworks
Attacks	Nested `basic` / `static` / `dynamic` trees, one method per encoding	Flat `attack_config` object keyed by attack ID
Target	`endpoint_configuration` / `target_model_configuration` (~25 fields)	Flat `target` (endpoint, key, model, provider, modalities, tools)
Dataset	`dataset_configuration` mixed into the same POST	`context` + `generation_config`, or a separate threat-modeling pass
Validation	Unknown fields often ignored	Unknown fields are rejected (`422`)
Saved model	`POST /redteam/v3/model/add-custom-task`	`POST /rt/model/redteam` — drop `target` entirely

The revamp also adds four entry points the previous API did not have:

Threat modeling — generate or analyse a dataset without attacking
Playground — probe one goal against a target
Eval — score prompt/response pairs you already have
Relay — reach an LLM inside a private network over one outbound connection

Endpoint map

Previous	Current	Notes
`POST /redteam/v2/add-task`, `/redteam/v2/add-custom-task`, `/redteam/v3/add-custom-task`	`POST /rt/redteam`	Returns `202` with `run_id`, `status_url`, `results_url`
`POST /redteam/v2/model/add-task`, `/redteam/v2/model/add-custom-task`, `/redteam/v3/model/add-custom-task`	`POST /rt/model/redteam`	Saved model via `X-Enkrypt-Model` and `X-Enkrypt-Model-Version` — both are required
`POST /redteam/model-health`, `/redteam/v3/model-health`	`POST /rt/model-health`	Body is `{ "target": { … } }`, not `target_model_configuration`
`POST /redteam/model/model-health`, `/redteam/v3/model/model-health`	`POST /rt/model/model-health`	Same saved-model headers as `/rt/model/redteam`
`GET /redteam/health`	`GET /rt/health`	Liveness. `GET /rt/status-check` is the deeper probe
`GET /redteam/get-task`	`GET /rt/runs/{run_id}`	Status only
`GET /redteam/task-status`	`GET /rt/runs/{run_id}`	Same
`GET /redteam/v3/results/summary`	`GET /rt/runs/{run_id}/results`	ASR overall, per category, per sub-category, per attack
`GET /redteam/v3/results/details`	`GET /rt/runs/{run_id}/records`	Individual prompt / response / verdict rows
`GET /redteam/v3/results/summary/{test_type}`	`GET /rt/runs/{run_id}/results`	Filter client-side; results are already grouped
`GET /redteam/v3/results/details/{test_type}`	`GET /rt/runs/{run_id}/records`	Same
`POST /redteam/findings`	`POST /rt/findings`	Unchanged job — pass the current summary
`POST /redteam/risk-mitigation/system-prompt`	`POST /rt/risk-mitigation/system-prompt`	Same
`POST /redteam/risk-mitigation/guardrails-policy`	`POST /rt/risk-mitigation/guardrails-policy`	Same
`GET /redteam/download-link`	`GET /rt/runs/{run_id}/records` and `GET /rt/datasets/{dataset_id}`	No separate download-link call
`GET /redteam/list-tasks`	Dashboard	Not an `/rt` API
`PATCH /redteam/cancel-task`	`POST /rt/runs/{run_id}/signal/{name}`	Cooperative signal, not a hard cancel

New on /rt — the previous API had no equivalent:

Endpoint	What it does
`POST /rt/threat-modeling`	Analyse + generate a dataset in one call
`POST /rt/threat-modeling/categories`	Suggested sub-category phrases. Free, generates nothing
`POST /rt/threat-modeling/data`	Generate a dataset from a (possibly edited) profile
`POST /rt/playground`	Single-goal probe
`POST /rt/model/playground`	Same, against a saved model
`POST /rt/eval`	Judge samples you already have
`GET /rt/runs/{run_id}/stream`	Live events (SSE)
`GET /rt/runs/{run_id}/compliance/{framework_id}`	Map a finished run onto a framework
`POST /rt/runs/{run_id}/resume`	Resume a failed or paused run
`GET /rt/datasets/{dataset_id}`	Fetch a generated dataset

The Relay bridge is new too, but it is not under /rt — it kept its own prefix:

Endpoint	What it does
`GET /redteam/relay/v1/relay/bridge`	The bridge’s outbound WSS connection (upgrade, not a normal `GET`)
`GET /redteam/relay/v1/relay/bridges/{bridge_id}/status`	Relay bridge health

At the gateway

/rt is served through the same API gateway as /redteam, and a few things that look like backend behaviour are decided there. Auth is unchanged. The same API key, in the same apikey header, on every /rt endpoint. The one addition: GET /rt/runs/{run_id}/stream also accepts ?apikey= in the query string, because a browser EventSource cannot set request headers. Two legacy shapes are still accepted, so a partial port does not have to be all-or-nothing:

A top-level model object is read as target.
A target_model_configuration block is converted to target — but only when target is absent, and only if the model is expressible as one (see the warning below). An explicit target always wins.

Everything else legacy — test_name, dataset_configuration, redteam_test_configurations, endpoint_configuration — still 422s. X-Enkrypt-Policy still works. Name a saved Code of Conduct policy in the header and the gateway renders it into context for you — a Policy Wizard policy as the structured context.policy_rules, an older Policy Atomizer one as the free-text context.policy_description, with the other field cleared. A header policy outranks both the context you sent and the one a saved model was stored with. POST /rt/redteam probes your target before it accepts the run. An unreachable endpoint or a bad key comes back as a 400 on submit rather than a run that fails minutes later. The other endpoints are not probed — /rt/playground answers synchronously anyway, and /rt/model-health is the probe. Attacks that are not yet generally available are rejected at the gateway with a 400 naming the attack, before anything is charged. hades is the only one today.

What costs credits

Charged: POST /rt/redteam, /rt/eval, /rt/threat-modeling, /rt/threat-modeling/data, /rt/playground, and POST /rt/runs/{run_id}/resume (free by default — a resume re-drives work you already paid for). Everything else is free. Every GET — status, results, records, compliance, datasets, the SSE stream, /rt/health, /rt/status-check — plus the POSTs that are not work:

POST /rt/model-health — a single probe call
POST /rt/findings and POST /rt/risk-mitigation/* — reporting over a run you already paid for
POST /rt/threat-modeling/categories — analysis only; nothing is generated or stored
POST /rt/runs/{run_id}/signal/{name} — a control verb

The /rt/model/* saved-model variants are priced exactly like their inline twins: the gateway resolves the saved model before pricing, so an agent target earns the same multiplier either way. Rates are in Credits.

Payload map

Side by side

Previous payload (`/redteam`)

{
  "test_name": "banking-assistant-001",
  "dataset_configuration": {
    "system_description": "A retail banking support chatbot.",
    "policy_description": "Must never reveal another customer's data.",
    "max_prompts": 10
  },
  "redteam_test_configurations": {
    "harmful_test": {
      "sample_percentage": 50,
      "attack_methods": {
        "basic": { "basic": { "params": {} } },
        "static": {
          "base64_encoding": {
            "params": { "encoding_type": "base64", "iterations": 2 }
          }
        },
        "dynamic": {
          "iterative": {
            "params": { "width": 5, "branching_factor": 9, "depth": 3 }
          }
        }
      }
    },
    "pii_test": {
      "sample_percentage": 50,
      "attack_methods": {
        "basic": { "basic": { "params": {} } }
      }
    }
  },
  "endpoint_configuration": {
    "testing_for": "foundationModels",
    "model_name": "gpt-4o-mini",
    "model_config": {
      "model_provider": "openai",
      "model_endpoint_url": "https://api.openai.com/v1/chat/completions",
      "apikey": "sk-..."
    }
  }
}

Current payload (`/rt`)

{
  "run_name": "banking-assistant-001",
  "target": {
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "api_key": "sk-...",
    "model_name": "gpt-4o-mini",
    "provider": "openai"
  },
  "context": {
    "system_description": "A retail banking support chatbot.",
    "policy_description": "Must never reveal another customer's data."
  },
  "generation_config": {
    "max_prompts": 10
  },
  "comprehensiveness": "Medium",
  "risk_categories": {
    "safety_harm": {
      "attack_config": {
        "basic": {},
        "encoding": { "types": ["base64"], "iterations": 2 },
        "tap": { "max_depth": 3 }
      }
    },
    "privacy_data_protection": {
      "attack_config": { "basic": {} },
      "sub_categories": ["pii elicitation"]
    }
  }
}

Field by field

Previous	Current
`test_name`	`run_name` (optional display label, no longer required)
`dataset_configuration.system_description`	`context.system_description` (also accepted on `target`)
`dataset_configuration.policy_description`	`context.policy_description`, or `context.policy_rules` for rule objects
`dataset_configuration.max_prompts`	`generation_config.max_prompts`
`dataset_configuration` scenarios / categories / depth	Dropped. Use `sub_categories` phrases or `/rt/threat-modeling/categories`
`redteam_test_configurations.<test>`	`risk_categories.<category>` — see test map
`<test>.sample_percentage`	`comprehensiveness`: `Low` / `Medium` / `High` / `Standard` / `Comprehensive`
`<test>.attack_methods.basic / static / dynamic`	One flat `attack_config` object on that category
`endpoint_configuration.model_config`	`target`
`model_endpoint_url`	`target.endpoint`
`apikey` / `model_api_key`	`target.api_key`
`model_provider`	`target.provider`
`testing_for: foundationModels`	`target.system_type: "foundation_model"` (the default)
`testing_for` agent	`target.system_type: "agent"` and `target.tools`
`input_modalities` / `output_modalities`	Same names, on `target`
`system_prompt`	`system_description` (the old name is still accepted)

target is a projection of the old model block, not a rename. Custom cURL, custom headers, JWT auth, auth_data provider blobs, and proxying are not expressible on /rt and are rejected up front with a 400 that names the field. Use the Relay bridge for a model that is not reachable from the public internet.

Test map

The previous API scoped by closed test IDs. /rt scopes by category; the old test is a sub-category (or a phrase you pass in sub_categories) inside that category.

Previous test	Current category	Typical sub-category / phrase
`bias_test`	`bias_fairness_ethical_harm`	`stereotyping`
`harmful_test`	`safety_harm`	`harmful_instructions`
`toxicity_test`	`safety_harm`	`toxicity`
`pii_test`	`privacy_data_protection`	`pii_leakage`
`cbrn_test`	`safety_harm`	`cbrn`
`csem_test`	`safety_harm`	`csem`
`insecure_code_test`	`security_fraud`	`insecure_code`
`copyright_test`	`legal_ip_liability`	`copyright_infringement`
`misinformation_test`	`safety_harm`	`dangerous_misinformation`
`system_prompt_extractions_test`	`privacy_data_protection`	`system_prompt_extraction`
`sponge_test`	`performance_reliability_quality`	`dos_sponge`
`competitor_test`	`brand_reputation_trust`	`competitor_disparagement`
`custom_test` / `adv_*`	any category + `context`	On-the-fly generation via `generation_config`, or a threat-modeling dataset

Agent-only tests from the previous API (governance_test, tool_misuse_test, tool_extraction_test, access_control_and_permissions_test, agent_behaviour_test, agent_output_quality_test, privacy_test, reliability_and_observability_test) have no 1:1 ID. Set target.system_type to agent, pass tools, and pick the categories above — security_fraud covers tool extraction and misuse, privacy_data_protection covers agent privacy, performance_reliability_quality covers output quality. See the Agent Testing Guide. Categories the previous API did not name as tests, now first-class:

legal_ip_liability — defamation, unlawful advice, TOS circumvention
product_misuse_abuse — policy circumvention, capability abuse, generic jailbreaks
brand_reputation_trust — brand voice, competitor disparagement, trust erosion

Or skip categories entirely and pass compliance_frameworks: owasp_llm_top10, eu_ai_act, nist_ai_rmf, mitre_atlas, iso_42001, aiuc_1.

Attack map

The previous API put each encoding and each language in its own method under static / dynamic. /rt has 21 attack IDs. Encodings and languages are options on encoding and lang.

Previous keyword	Current attack ID	How the old params move
`basic`	`basic`	`{}`
`ascii_encoding`, `base64_encoding`, `binary_encoding`, `hex_encoding`, `url_encoding`, `leet_encoding`, `morse_encoding`, `rot13`, `rot21`	`encoding`	`types: ["base64", "url", …]`. Previous names like `url_encoding` are accepted. `iterations` is unchanged
`obfuscation`, `eai_attack`	`obfuscation`	`{}`
`lang_fr`, `lang_it`, `lang_hi`, `lang_es`, `lang_ja`	`lang`	`languages: ["french", "italian", "hindi", "spanish", "japanese"]`. `/rt` also accepts German, Portuguese, Mandarin, Korean, Arabic, Swahili, Zulu, Yoruba
`deep_inception`	`deepinception`	`single_shot` is an accepted alias
`iterative`	`tap`	`depth` → `max_depth`. `width` / `branching_factor` are not accepted
`multi_turn`	`goat`	Multi-turn conversational escalation
`masking`	`word_masking`	Image modality
`figstep`	`figstep`	Image modality
`hades`	—	Not currently available. `hades` is not generally available and a `/rt` run declaring it is rejected — use `camo`, `fc`, `figstep` or `word_masking` for image-carrier attacks
`jood`	—	Not carried over. Use `camo` or `fc` for image-carrier evasion
`waveform`, `echo`, `speed`, `pitch`, `reverb`, `noise`	`waveform`	Individual audio transforms fold into `waveform`. Multi-turn audio is `audio_goat`

New attack IDs — the previous API had no keyword for these: graph, rt_agent, rt_agent_v2, derail_yourself, camo, fc, long_character, attack_in_the_middle, audio_goat.

attack_config must be an object, not a list. {"basic": {}} is valid; ["basic"] is a 422.

Behaviour changes worth a rewrite

One scope kind. risk_categories and compliance_frameworks are mutually exclusive. The previous API let you list many tests in one object; /rt still lets you list many categories, but not categories and frameworks together.
Attacks live on the category. There is no run-level attack list on /rt/redteam. Playground is the exception — attack_config is top-level there, next to goal.
sub_categories are phrases, not IDs. Take them from /rt/threat-modeling/categories (or type them). The IDs in the Risk Category Catalog are how results are reported.
Unknown keys 422. A leftover test_name, dataset_configuration, or endpoint_configuration on a /rt body is rejected, not ignored. The two exceptions the gateway converts for you are model and target_model_configuration — see At the gateway.
Reads are free, and so are several POSTs. Findings, risk mitigation, model health, and threat-modeling categories cost nothing. See What costs credits.
Saved-model targets the previous API accepted may 400 on /rt. If the saved model used custom cURL, JWT, or auth_data, recreate it as a standard target or put it behind Relay.

Payload Guide — the four blocks
Risk Category Catalog — 8 categories, 35 subs
Attack Methods Reference — the 21 IDs
Examples — copy-paste /rt payloads
Red Team (Legacy) — archived /redteam endpoints

Get Started for Guardrails

Get Started for Red Team

Get Started with AI Proxy

Get Started with MCP

Get Started with Skill Scanner

On-Prem Installation

Quickstart

Payload Guide

API Reference

What changed

Endpoint map

At the gateway

What costs credits

Payload map

Side by side

Field by field

Test map

Attack map

Behaviour changes worth a rewrite

Quickstart

Payload Guide

API Reference

​What changed

​Endpoint map

​At the gateway

​What costs credits

​Payload map

​Side by side

​Field by field

​Test map

​Attack map

​Behaviour changes worth a rewrite

​Related

What changed

Endpoint map

At the gateway

What costs credits

Payload map

Side by side

Field by field

Test map

Attack map

Behaviour changes worth a rewrite

Related