> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt
> Use this file to discover all available pages before exploring further.
# What's New
> What changed in the Red Team revamp — the current /rt API versus the previous /redteam API
The Red Team API was rebuilt. The current API lives on `/rt/*`. The previous API
on `/redteam/*` is archived and still documented under
[Red Team (Legacy)](/api-reference/redteam-api-reference/endpoint/health).
New work should use `/rt`.
This is not a version bump of the old paths. `/rt` is a new contract: new
resources, new payload, new report shape. A body written for `/redteam` will
`422` if you post it to `/rt`.
This page is the map: what changed, what each old field and test became, and a
side-by-side payload you can translate from.
Submit, track, and read a `/rt/redteam` run
The four blocks of a current payload
Full `/rt` schemas
## What changed
| | Previous (`/redteam`) | Current (`/rt`) |
| ----------- | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| Job model | `task_id` on a task | `run_id` on a run (`Queued` / `Running` / `Finished` / `Failed`) |
| Scope | Named tests (`bias_test`, `pii_test`, …) | 8 [risk categories](/get-started/redteam/test-catalog) **or** 6 compliance frameworks |
| Attacks | Nested `basic` / `static` / `dynamic` trees, one method per encoding | Flat `attack_config` object keyed by [attack ID](/get-started/redteam/attack-methods-reference) |
| Target | `endpoint_configuration` / `target_model_configuration` (\~25 fields) | Flat `target` (endpoint, key, model, provider, modalities, tools) |
| Dataset | `dataset_configuration` mixed into the same POST | `context` + `generation_config`, or a separate threat-modeling pass |
| Validation | Unknown fields often ignored | Unknown fields are **rejected** (`422`) |
| Saved model | `POST /redteam/v3/model/add-custom-task` | `POST /rt/model/redteam` — drop `target` entirely |
The revamp also adds four entry points the previous API did not have:
* **Threat modeling** — generate or analyse a dataset without attacking
* **Playground** — probe one goal against a target
* **Eval** — score prompt/response pairs you already have
* **Relay** — reach an LLM inside a private network over one outbound connection
## Endpoint map
| Previous | Current | Notes |
| ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| `POST /redteam/v2/add-task`, `/redteam/v2/add-custom-task`, `/redteam/v3/add-custom-task` | `POST /rt/redteam` | Returns `202` with `run_id`, `status_url`, `results_url` |
| `POST /redteam/v2/model/add-task`, `/redteam/v2/model/add-custom-task`, `/redteam/v3/model/add-custom-task` | `POST /rt/model/redteam` | Saved model via `X-Enkrypt-Model` **and** `X-Enkrypt-Model-Version` — both are required |
| `POST /redteam/model-health`, `/redteam/v3/model-health` | `POST /rt/model-health` | Body is `{ "target": { … } }`, not `target_model_configuration` |
| `POST /redteam/model/model-health`, `/redteam/v3/model/model-health` | `POST /rt/model/model-health` | Same saved-model headers as `/rt/model/redteam` |
| `GET /redteam/health` | `GET /rt/health` | Liveness. `GET /rt/status-check` is the deeper probe |
| `GET /redteam/get-task` | `GET /rt/runs/{run_id}` | Status only |
| `GET /redteam/task-status` | `GET /rt/runs/{run_id}` | Same |
| `GET /redteam/v3/results/summary` | `GET /rt/runs/{run_id}/results` | ASR overall, per category, per sub-category, per attack |
| `GET /redteam/v3/results/details` | `GET /rt/runs/{run_id}/records` | Individual prompt / response / verdict rows |
| `GET /redteam/v3/results/summary/{test_type}` | `GET /rt/runs/{run_id}/results` | Filter client-side; results are already grouped |
| `GET /redteam/v3/results/details/{test_type}` | `GET /rt/runs/{run_id}/records` | Same |
| `POST /redteam/findings` | `POST /rt/findings` | Unchanged job — pass the current summary |
| `POST /redteam/risk-mitigation/system-prompt` | `POST /rt/risk-mitigation/system-prompt` | Same |
| `POST /redteam/risk-mitigation/guardrails-policy` | `POST /rt/risk-mitigation/guardrails-policy` | Same |
| `GET /redteam/download-link` | `GET /rt/runs/{run_id}/records` and `GET /rt/datasets/{dataset_id}` | No separate download-link call |
| `GET /redteam/list-tasks` | Dashboard | Not an `/rt` API |
| `PATCH /redteam/cancel-task` | `POST /rt/runs/{run_id}/signal/{name}` | Cooperative signal, not a hard cancel |
New on `/rt` — the previous API had no equivalent:
| Endpoint | What it does |
| ------------------------------------------------- | ------------------------------------------------------- |
| `POST /rt/threat-modeling` | Analyse + generate a dataset in one call |
| `POST /rt/threat-modeling/categories` | Suggested sub-category phrases. Free, generates nothing |
| `POST /rt/threat-modeling/data` | Generate a dataset from a (possibly edited) profile |
| `POST /rt/playground` | Single-goal probe |
| `POST /rt/model/playground` | Same, against a saved model |
| `POST /rt/eval` | Judge samples you already have |
| `GET /rt/runs/{run_id}/stream` | Live events (SSE) |
| `GET /rt/runs/{run_id}/compliance/{framework_id}` | Map a finished run onto a framework |
| `POST /rt/runs/{run_id}/resume` | Resume a failed or paused run |
| `GET /rt/datasets/{dataset_id}` | Fetch a generated dataset |
The **Relay bridge** is new too, but it is *not* under `/rt` — it kept its own
prefix:
| Endpoint | What it does |
| -------------------------------------------------------- | ------------------------------------------------------------------ |
| `GET /redteam/relay/v1/relay/bridge` | The bridge's outbound WSS connection (upgrade, not a normal `GET`) |
| `GET /redteam/relay/v1/relay/bridges/{bridge_id}/status` | Relay bridge health |
## At the gateway
`/rt` is served through the same API gateway as `/redteam`, and a few things
that look like backend behaviour are decided there.
**Auth is unchanged.** The same API key, in the same `apikey` header, on every
`/rt` endpoint. The one addition: `GET /rt/runs/{run_id}/stream` also accepts
`?apikey=` in the query string, because a browser `EventSource` cannot set
request headers.
**Two legacy shapes are still accepted**, so a partial port does not have to be
all-or-nothing:
* A top-level `model` object is read as `target`.
* A `target_model_configuration` block is converted to `target` — but only when
`target` is absent, and only if the model is expressible as one (see the
warning below). An explicit `target` always wins.
Everything else legacy — `test_name`, `dataset_configuration`,
`redteam_test_configurations`, `endpoint_configuration` — still `422`s.
**`X-Enkrypt-Policy` still works.** Name a saved Code of Conduct policy in the
header and the gateway renders it into `context.policy_description` for you.
A header policy outranks the `context` a saved model was stored with.
**`POST /rt/redteam` probes your target before it accepts the run.** An
unreachable endpoint or a bad key comes back as a `400` on submit rather than a
run that fails minutes later. The other endpoints are not probed —
`/rt/playground` answers synchronously anyway, and `/rt/model-health` *is* the
probe.
**Attacks that are not yet generally available are rejected at the gateway**
with a `400` naming the attack, before anything is charged. `hades` is the only
one today.
### What costs credits
Charged: `POST /rt/redteam`, `/rt/eval`, `/rt/threat-modeling`,
`/rt/threat-modeling/data`, `/rt/playground`, and
`POST /rt/runs/{run_id}/resume` (free by default — a resume re-drives work you
already paid for).
Everything else is free. Every `GET` — status, results, records, compliance,
datasets, the SSE stream, `/rt/health`, `/rt/status-check` — plus the `POST`s
that are not work:
* `POST /rt/model-health` — a single probe call
* `POST /rt/findings` and `POST /rt/risk-mitigation/*` — reporting over a run
you already paid for
* `POST /rt/threat-modeling/categories` — analysis only; nothing is generated or
stored
* `POST /rt/runs/{run_id}/signal/{name}` — a control verb
The `/rt/model/*` saved-model variants are priced exactly like their inline
twins: the gateway resolves the saved model *before* pricing, so an `agent`
target earns the same multiplier either way. Rates are in
[Credits](/resources/credits).
## Payload map
### Side by side
```json theme={"system"}
{
"test_name": "banking-assistant-001",
"dataset_configuration": {
"system_description": "A retail banking support chatbot.",
"policy_description": "Must never reveal another customer's data.",
"max_prompts": 10
},
"redteam_test_configurations": {
"harmful_test": {
"sample_percentage": 50,
"attack_methods": {
"basic": { "basic": { "params": {} } },
"static": {
"base64_encoding": {
"params": { "encoding_type": "base64", "iterations": 2 }
}
},
"dynamic": {
"iterative": {
"params": { "width": 5, "branching_factor": 9, "depth": 3 }
}
}
}
},
"pii_test": {
"sample_percentage": 50,
"attack_methods": {
"basic": { "basic": { "params": {} } }
}
}
},
"endpoint_configuration": {
"testing_for": "foundationModels",
"model_name": "gpt-4o-mini",
"model_config": {
"model_provider": "openai",
"model_endpoint_url": "https://api.openai.com/v1/chat/completions",
"apikey": "sk-..."
}
}
}
```
```json theme={"system"}
{
"run_name": "banking-assistant-001",
"target": {
"endpoint": "https://api.openai.com/v1/chat/completions",
"api_key": "sk-...",
"model_name": "gpt-4o-mini",
"provider": "openai"
},
"context": {
"system_description": "A retail banking support chatbot.",
"policy_description": "Must never reveal another customer's data."
},
"generation_config": {
"max_prompts": 10
},
"comprehensiveness": "Medium",
"risk_categories": {
"safety_harm": {
"attack_config": {
"basic": {},
"encoding": { "types": ["base64"], "iterations": 2 },
"tap": { "max_depth": 3 }
}
},
"privacy_data_protection": {
"attack_config": { "basic": {} },
"sub_categories": ["pii elicitation"]
}
}
}
```
### Field by field
| Previous | Current |
| ------------------------------------------------------ | ----------------------------------------------------------------------------- |
| `test_name` | `run_name` (optional display label, no longer required) |
| `dataset_configuration.system_description` | `context.system_description` (also accepted on `target`) |
| `dataset_configuration.policy_description` | `context.policy_description` |
| `dataset_configuration.max_prompts` | `generation_config.max_prompts` |
| `dataset_configuration` scenarios / categories / depth | Dropped. Use `sub_categories` phrases or `/rt/threat-modeling/categories` |
| `redteam_test_configurations.` | `risk_categories.` — see [test map](#test-map) |
| `.sample_percentage` | `comprehensiveness`: `Low` / `Medium` / `High` / `Standard` / `Comprehensive` |
| `.attack_methods.basic / static / dynamic` | One flat `attack_config` object on that category |
| `endpoint_configuration.model_config` | `target` |
| `model_endpoint_url` | `target.endpoint` |
| `apikey` / `model_api_key` | `target.api_key` |
| `model_provider` | `target.provider` |
| `testing_for: foundationModels` | `target.system_type: "foundation_model"` (the default) |
| `testing_for` agent | `target.system_type: "agent"` **and** `target.tools` |
| `input_modalities` / `output_modalities` | Same names, on `target` |
| `system_prompt` | `system_description` (the old name is still accepted) |
`target` is a **projection** of the old model block, not a rename. Custom cURL,
custom headers, JWT auth, `auth_data` provider blobs, and proxying are not
expressible on `/rt` and are rejected up front with a `400` that names the field.
Use the
[Relay bridge](/api-reference/redteam-v2-api-reference/endpoint/relay-bridge-connect)
for a model that is not reachable from the public internet.
## Test map
The previous API scoped by closed test IDs. `/rt` scopes by **category**; the old
test is a sub-category (or a phrase you pass in `sub_categories`) inside that
category.
| Previous test | Current category | Typical sub-category / phrase |
| -------------------------------- | --------------------------------- | --------------------------------------------------------------------------- |
| `bias_test` | `bias_fairness_ethical_harm` | `stereotyping` |
| `harmful_test` | `safety_harm` | `harmful_instructions` |
| `toxicity_test` | `safety_harm` | `toxicity` |
| `pii_test` | `privacy_data_protection` | `pii_leakage` |
| `cbrn_test` | `safety_harm` | `cbrn` |
| `csem_test` | `safety_harm` | `csem` |
| `insecure_code_test` | `security_fraud` | `insecure_code` |
| `copyright_test` | `legal_ip_liability` | `copyright_infringement` |
| `misinformation_test` | `safety_harm` | `dangerous_misinformation` |
| `system_prompt_extractions_test` | `privacy_data_protection` | `system_prompt_extraction` |
| `sponge_test` | `performance_reliability_quality` | `dos_sponge` |
| `competitor_test` | `brand_reputation_trust` | `competitor_disparagement` |
| `custom_test` / `adv_*` | any category + `context` | On-the-fly generation via `generation_config`, or a threat-modeling dataset |
Agent-only tests from the previous API (`governance_test`, `tool_misuse_test`,
`tool_extraction_test`, `access_control_and_permissions_test`,
`agent_behaviour_test`, `agent_output_quality_test`, `privacy_test`,
`reliability_and_observability_test`) have no 1:1 ID. Set `target.system_type`
to `agent`, pass `tools`, and pick the categories above — `security_fraud`
covers tool extraction and misuse, `privacy_data_protection` covers agent
privacy, `performance_reliability_quality` covers output quality. See the
[Agent Testing Guide](/get-started/redteam/agent-test-catalog).
Categories the previous API did not name as tests, now first-class:
* `legal_ip_liability` — defamation, unlawful advice, TOS circumvention
* `product_misuse_abuse` — policy circumvention, capability abuse, generic jailbreaks
* `brand_reputation_trust` — brand voice, competitor disparagement, trust erosion
Or skip categories entirely and pass `compliance_frameworks`:
`owasp_llm_top10`, `eu_ai_act`, `nist_ai_rmf`, `mitre_atlas`, `iso_42001`, `aiuc_1`.
## Attack map
The previous API put each encoding and each language in its own method under
`static` / `dynamic`. `/rt` has **21 attack IDs**. Encodings and languages are
options on `encoding` and `lang`.
| Previous keyword | Current attack ID | How the old params move |
| ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `basic` | `basic` | `{}` |
| `ascii_encoding`, `base64_encoding`, `binary_encoding`, `hex_encoding`, `url_encoding`, `leet_encoding`, `morse_encoding`, `rot13`, `rot21` | `encoding` | `types: ["base64", "url", …]`. Previous names like `url_encoding` are accepted. `iterations` is unchanged |
| `obfuscation`, `eai_attack` | `obfuscation` | `{}` |
| `lang_fr`, `lang_it`, `lang_hi`, `lang_es`, `lang_ja` | `lang` | `languages: ["french", "italian", "hindi", "spanish", "japanese"]`. `/rt` also accepts German, Portuguese, Mandarin, Korean, Arabic, Swahili, Zulu, Yoruba |
| `deep_inception` | `deepinception` | `single_shot` is an accepted alias |
| `iterative` | `tap` | `depth` → `max_depth`. `width` / `branching_factor` are not accepted |
| `multi_turn` | `goat` | Multi-turn conversational escalation |
| `masking` | `word_masking` | Image modality |
| `figstep` | `figstep` | Image modality |
| `hades` | — | Not currently available. `hades` is not generally available and a `/rt` run declaring it is rejected — use `camo`, `fc`, `figstep` or `word_masking` for image-carrier attacks |
| `jood` | — | Not carried over. Use `camo` or `fc` for image-carrier evasion |
| `waveform`, `echo`, `speed`, `pitch`, `reverb`, `noise` | `waveform` | Individual audio transforms fold into `waveform`. Multi-turn audio is `audio_goat` |
New attack IDs — the previous API had no keyword for these:
`graph`, `rt_agent`, `rt_agent_v2`, `derail_yourself`, `camo`, `fc`,
`long_character`, `attack_in_the_middle`, `audio_goat`.
`attack_config` must be an **object**, not a list. `{"basic": {}}` is valid;
`["basic"]` is a `422`.
## Behaviour changes worth a rewrite
1. **One scope kind.** `risk_categories` and `compliance_frameworks` are mutually
exclusive. The previous API let you list many tests in one object; `/rt` still
lets you list many *categories*, but not categories and frameworks together.
2. **Attacks live on the category.** There is no run-level attack list on
`/rt/redteam`. Playground is the exception — `attack_config` is top-level
there, next to `goal`.
3. **`sub_categories` are phrases, not IDs.** Take them from
`/rt/threat-modeling/categories` (or type them). The IDs in the
[Risk Category Catalog](/get-started/redteam/test-catalog) are how results are
*reported*.
4. **Unknown keys 422.** A leftover `test_name`, `dataset_configuration`, or
`endpoint_configuration` on a `/rt` body is rejected, not ignored. The two
exceptions the gateway converts for you are `model` and
`target_model_configuration` — see [At the gateway](#at-the-gateway).
5. **Reads are free, and so are several `POST`s.** Findings, risk mitigation,
model health, and threat-modeling *categories* cost nothing. See
[What costs credits](#what-costs-credits).
6. **Saved-model targets the previous API accepted may 400 on `/rt`.** If the
saved model used custom cURL, JWT, or `auth_data`, recreate it as a standard
`target` or put it behind Relay.
## Related
* [Payload Guide](/get-started/redteam/payload-guide) — the four blocks
* [Risk Category Catalog](/get-started/redteam/test-catalog) — 8 categories, 35 subs
* [Attack Methods Reference](/get-started/redteam/attack-methods-reference) — the 21 IDs
* [Examples](/get-started/redteam/examples) — copy-paste `/rt` payloads
* [Red Team (Legacy)](/api-reference/redteam-api-reference/endpoint/health) — archived `/redteam` endpoints