What's New

The Red Team API was rebuilt. The current API lives on /rt/*. The previous API on /redteam/* is archived and still documented under Red Team (Legacy). New work should use /rt. This is not a version bump of the old paths. /rt is a new contract: new resources, new payload, new report shape. A body written for /redteam will 422 if you post it to /rt. This page is the map: what changed, what each old field and test became, and a side-by-side payload you can translate from.

Quickstart

Submit, track, and read a /rt/redteam run

Payload Guide

The four blocks of a current payload

API Reference

Full /rt schemas

What changed

	Previous (`/redteam`)	Current (`/rt`)
Job model	`task_id` on a task	`run_id` on a run (`Queued` / `Running` / `Finished` / `Failed`)
Scope	Named tests (`bias_test`, `pii_test`, …)	8 risk categories or 6 compliance frameworks
Attacks	Nested `basic` / `static` / `dynamic` trees, one method per encoding	Flat `attack_config` object keyed by attack ID
Target	`endpoint_configuration` / `target_model_configuration` (~25 fields)	Flat `target` (endpoint, key, model, provider, modalities, tools)
Dataset	`dataset_configuration` mixed into the same POST	`context` + `generation_config`, or a separate threat-modeling pass
Validation	Unknown fields often ignored	Unknown fields are rejected (`422`)
Saved model	`POST /redteam/v3/model/add-custom-task`	`POST /rt/model/redteam` — drop `target` entirely

The revamp also adds four entry points the previous API did not have:

Threat modeling — generate or analyse a dataset without attacking
Playground — probe one goal against a target
Eval — score prompt/response pairs you already have
Relay — reach an LLM inside a private network over one outbound connection

Endpoint map

Previous	Current	Notes
`POST /redteam/v3/add-custom-task`	`POST /rt/redteam`	Returns `202` with `run_id`, `status_url`, `results_url`
`POST /redteam/v3/model/add-custom-task`	`POST /rt/model/redteam`	Saved model via `X-Enkrypt-Model` / `X-Enkrypt-Model-Version`
`POST /redteam/v3/model-health`	`POST /rt/model-health`	Body is `{ "target": { … } }`, not `target_model_configuration`
`POST /redteam/model/model-health`	`POST /rt/model/model-health`	Same saved-model headers as `/rt/model/redteam`
`GET /redteam/get-task`	`GET /rt/runs/{run_id}`	Status only
`GET /redteam/task-status`	`GET /rt/runs/{run_id}`	Same
`GET /redteam/v3/results/summary`	`GET /rt/runs/{run_id}/results`	ASR overall, per category, per sub-category, per attack
`GET /redteam/v3/results/details`	`GET /rt/runs/{run_id}/records`	Individual prompt / response / verdict rows
`GET /redteam/v3/results/summary/{test_type}`	`GET /rt/runs/{run_id}/results`	Filter client-side; results are already grouped
`GET /redteam/v3/results/details/{test_type}`	`GET /rt/runs/{run_id}/records`	Same
`POST /redteam/findings`	`POST /rt/findings`	Unchanged job — pass the current summary
`POST /redteam/results/risk-mitigation/system-prompt`	`POST /rt/risk-mitigation/system-prompt`	Same
`POST /redteam/results/risk-mitigation/guardrails-policy`	`POST /rt/risk-mitigation/guardrails-policy`	Same
`GET /redteam/download-link`	`GET /rt/runs/{run_id}/records` and `GET /rt/datasets/{dataset_id}`	No separate download-link call
`GET /redteam/list-tasks`	Dashboard	Not an `/rt` API
`POST /redteam/cancel-task`	`POST /rt/runs/{run_id}/signal/{name}`	Cooperative signal, not a hard cancel

New on /rt — the previous API had no equivalent:

Endpoint	What it does
`POST /rt/threat-modeling`	Analyse + generate a dataset in one call
`POST /rt/threat-modeling/categories`	Suggested sub-category phrases. Free, generates nothing
`POST /rt/threat-modeling/data`	Generate a dataset from a (possibly edited) profile
`POST /rt/playground`	Single-goal probe
`POST /rt/eval`	Judge samples you already have
`GET /rt/runs/{run_id}/stream`	Live events
`GET /rt/runs/{run_id}/compliance/{framework_id}`	Map a finished run onto a framework
`POST /rt/runs/{run_id}/resume`	Resume a failed or paused run
`GET /rt/relay/bridge/{id}/status`	Relay bridge health

Payload map

Side by side

Previous payload (`/redteam`)

{
  "test_name": "banking-assistant-001",
  "dataset_configuration": {
    "system_description": "A retail banking support chatbot.",
    "policy_description": "Must never reveal another customer's data.",
    "max_prompts": 10
  },
  "redteam_test_configurations": {
    "harmful_test": {
      "sample_percentage": 50,
      "attack_methods": {
        "basic": { "basic": { "params": {} } },
        "static": {
          "base64_encoding": {
            "params": { "encoding_type": "base64", "iterations": 2 }
          }
        },
        "dynamic": {
          "iterative": {
            "params": { "width": 5, "branching_factor": 9, "depth": 3 }
          }
        }
      }
    },
    "pii_test": {
      "sample_percentage": 50,
      "attack_methods": {
        "basic": { "basic": { "params": {} } }
      }
    }
  },
  "endpoint_configuration": {
    "testing_for": "foundationModels",
    "model_name": "gpt-4o-mini",
    "model_config": {
      "model_provider": "openai",
      "model_endpoint_url": "https://api.openai.com/v1/chat/completions",
      "apikey": "sk-..."
    }
  }
}

Current payload (`/rt`)

{
  "run_name": "banking-assistant-001",
  "target": {
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "api_key": "sk-...",
    "model_name": "gpt-4o-mini",
    "provider": "openai"
  },
  "context": {
    "system_description": "A retail banking support chatbot.",
    "policy_description": "Must never reveal another customer's data."
  },
  "generation_config": {
    "max_prompts": 10
  },
  "comprehensiveness": "Medium",
  "risk_categories": {
    "safety_harm": {
      "attack_config": {
        "basic": {},
        "encoding": { "types": ["base64"], "iterations": 2 },
        "tap": { "max_depth": 3 }
      }
    },
    "privacy_data_protection": {
      "attack_config": { "basic": {} },
      "sub_categories": ["pii elicitation"]
    }
  }
}

Field by field

Previous	Current
`test_name`	`run_name` (optional display label, no longer required)
`dataset_configuration.system_description`	`context.system_description` (also accepted on `target`)
`dataset_configuration.policy_description`	`context.policy_description`
`dataset_configuration.max_prompts`	`generation_config.max_prompts`
`dataset_configuration` scenarios / categories / depth	Dropped. Use `sub_categories` phrases or `/rt/threat-modeling/categories`
`redteam_test_configurations.<test>`	`risk_categories.<category>` — see test map
`<test>.sample_percentage`	`comprehensiveness`: `Low` / `Medium` / `High` / `Standard` / `Comprehensive`
`<test>.attack_methods.basic / static / dynamic`	One flat `attack_config` object on that category
`endpoint_configuration.model_config`	`target`
`model_endpoint_url`	`target.endpoint`
`apikey` / `model_api_key`	`target.api_key`
`model_provider`	`target.provider`
`testing_for: foundationModels`	`target.system_type: "foundation_model"` (the default)
`testing_for` agent	`target.system_type: "agent"` and `target.tools`
`input_modalities` / `output_modalities`	Same names, on `target`
`system_prompt`	`system_description` (the old name is still accepted)

target is a projection of the old model block, not a rename. Custom cURL, custom headers, JWT auth, auth_data provider blobs, and proxying are not expressible on /rt and are rejected up front with a 400 that names the field. Use the Relay bridge for a model that is not reachable from the public internet.

Test map

The previous API scoped by closed test IDs. /rt scopes by category; the old test is a sub-category (or a phrase you pass in sub_categories) inside that category.

Previous test	Current category	Typical sub-category / phrase
`bias_test`	`bias_fairness_ethical_harm`	`stereotyping`
`harmful_test`	`safety_harm`	`harmful_instructions`
`toxicity_test`	`safety_harm`	`toxicity`
`pii_test`	`privacy_data_protection`	`pii_leakage`
`cbrn_test`	`safety_harm`	`cbrn`
`csem_test`	`safety_harm`	`csem`
`insecure_code_test`	`security_fraud`	`insecure_code`
`copyright_test`	`legal_ip_liability`	`copyright_infringement`
`misinformation_test`	`safety_harm`	`dangerous_misinformation`
`system_prompt_extractions_test`	`privacy_data_protection`	`system_prompt_extraction`
`sponge_test`	`performance_reliability_quality`	`dos_sponge`
`competitor_test`	`brand_reputation_trust`	`competitor_disparagement`
`custom_test` / `adv_*`	any category + `context`	On-the-fly generation via `generation_config`, or a threat-modeling dataset

Agent-only tests from the previous API (governance_test, tool_misuse_test, tool_extraction_test, access_control_and_permissions_test, agent_behaviour_test, agent_output_quality_test, privacy_test, reliability_and_observability_test) have no 1:1 ID. Set target.system_type to agent, pass tools, and pick the categories above — security_fraud covers tool extraction and misuse, privacy_data_protection covers agent privacy, performance_reliability_quality covers output quality. See the Agent Testing Guide. Categories the previous API did not name as tests, now first-class:

legal_ip_liability — defamation, unlawful advice, TOS circumvention
product_misuse_abuse — policy circumvention, capability abuse, generic jailbreaks
brand_reputation_trust — brand voice, competitor disparagement, trust erosion

Or skip categories entirely and pass compliance_frameworks: owasp_llm_top10, eu_ai_act, nist_ai_rmf, mitre_atlas, iso_42001, aiuc_1.

Attack map

The previous API put each encoding and each language in its own method under static / dynamic. /rt has 21 attack IDs. Encodings and languages are options on encoding and lang.

Previous keyword	Current attack ID	How the old params move
`basic`	`basic`	`{}`
`ascii_encoding`, `base64_encoding`, `binary_encoding`, `hex_encoding`, `url_encoding`, `leet_encoding`, `morse_encoding`, `rot13`, `rot21`	`encoding`	`types: ["base64", "url", …]`. Previous names like `url_encoding` are accepted. `iterations` is unchanged
`obfuscation`, `eai_attack`	`obfuscation`	`{}`
`lang_fr`, `lang_it`, `lang_hi`, `lang_es`, `lang_ja`	`lang`	`languages: ["french", "italian", "hindi", "spanish", "japanese"]`. `/rt` also accepts German, Portuguese, Mandarin, Korean, Arabic, Swahili, Zulu, Yoruba
`deep_inception`	`deepinception`	`single_shot` is an accepted alias
`iterative`	`tap`	`depth` → `max_depth`. `width` / `branching_factor` are not accepted
`multi_turn`	`goat`	Multi-turn conversational escalation
`masking`	`word_masking`	Image modality
`figstep`	`figstep`	Image modality
`hades`	—	Not currently available. `hades` is not generally available and a `/rt` run declaring it is rejected — use `camo`, `fc`, `figstep` or `word_masking` for image-carrier attacks
`jood`	—	Not carried over. Use `camo` or `fc` for image-carrier evasion
`waveform`, `echo`, `speed`, `pitch`, `reverb`, `noise`	`waveform`	Individual audio transforms fold into `waveform`. Multi-turn audio is `audio_goat`

New attack IDs — the previous API had no keyword for these: graph, rt_agent, rt_agent_v2, derail_yourself, camo, fc, long_character, attack_in_the_middle, audio_goat.

attack_config must be an object, not a list. {"basic": {}} is valid; ["basic"] is a 422.

Behaviour changes worth a rewrite

One scope kind. risk_categories and compliance_frameworks are mutually exclusive. The previous API let you list many tests in one object; /rt still lets you list many categories, but not categories and frameworks together.
Attacks live on the category. There is no run-level attack list on /rt/redteam. Playground is the exception — attack_config is top-level there, next to goal.
sub_categories are phrases, not IDs. Take them from /rt/threat-modeling/categories (or type them). The IDs in the Risk Category Catalog are how results are reported.
Unknown keys 422. A leftover test_name, dataset_configuration, or endpoint_configuration on a /rt body is rejected, not ignored.
Reads are free. Status, results, records, datasets, and compliance reports do not spend credits. See Credits.
Saved-model targets the previous API accepted may 400 on /rt. If the saved model used custom cURL, JWT, or auth_data, recreate it as a standard target or put it behind Relay.

Payload Guide — the four blocks
Risk Category Catalog — 8 categories, 35 subs
Attack Methods Reference — the 21 IDs
Examples — copy-paste /rt payloads
Red Team (Legacy) — archived /redteam endpoints

Get Started for Guardrails

Get Started for Red Team

Get Started with AI Proxy

Get Started with MCP

On-Prem Installation

Quickstart

Payload Guide

API Reference

What changed

Endpoint map

Payload map

Side by side

Field by field

Test map

Attack map

Behaviour changes worth a rewrite

Quickstart

Payload Guide

API Reference

​What changed

​Endpoint map

​Payload map

​Side by side

​Field by field

​Test map

​Attack map

​Behaviour changes worth a rewrite

​Related

What changed

Endpoint map

Payload map

Side by side

Field by field

Test map

Attack map

Behaviour changes worth a rewrite

Related