Payload Guide

A Red Team payload is a JSON object built from four blocks: what to test (target), what to test for (risk_categories or compliance_frameworks), what the system is (context), and how many prompts to use (generation_config).

Coming from the previous API?

The payload is no longer test_name / dataset_configuration / redteam_test_configurations / endpoint_configuration. Those were the /redteam blocks. /rt uses target, risk_categories (or compliance_frameworks), context, and generation_config.

Migrating from /redteam? Open the changelog

The What’s New page maps every previous test, attack keyword, and endpoint onto /rt, with a side-by-side payload.

Risk Categories

The 8 categories and 35 sub-categories you can test for

Attack Methods

The 21 attack techniques and when to use each

Configuration

Field-by-field reference for every block

Examples

Ready-to-run payloads for common scenarios

Payload structure

{
  "target": { ... },                  // Required: the system under test
  "risk_categories": { ... },         // One of these two is required —
  "compliance_frameworks": [ ... ],   //   never both
  "context": { ... },                 // Optional: what your system is and its policy
  "generation_config": { ... },       // Optional: how many prompts, or which dataset
  "comprehensiveness": "Standard",    // Optional: how exhaustively to test
  "run_name": "my-run",               // Optional: display label
  "user_metadata": { ... }            // Optional: your own tracking fields
}

Unknown fields are rejected, not ignored. The API validates payloads strictly — a typo in a field name returns a 422, it does not silently pass through.

The two required decisions

1. What to test — `target`

The minimum viable target is an endpoint, a key, and a model name:

{
  "target": {
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "api_key": "sk-...",
    "model_name": "gpt-4o-mini",
    "provider": "openai"
  }
}

Add system_type when you are testing something other than a raw model, and tools when that something is an agent. See Configuration Reference.

Already saved this model in the Models API? Use POST /rt/model/redteam instead and drop the target block entirely — the saved model supplies it.

2. What to test for — scope

risk_categories and compliance_frameworks are mutually exclusive. Supply exactly one; supplying both, or neither, is a validation error.

By risk category
By compliance framework

Name the categories you care about, and give each one an attack_config:

{
  "risk_categories": {
    "safety_harm": {
      "attack_config": { "basic": {}, "encoding": {} }
    },
    "privacy_data_protection": {
      "attack_config": { "basic": {} },
      "sub_categories": ["pii elicitation", "account takeover social engineering"]
    }
  }
}

attack_config is required on /rt/redteam. It is an object keyed by attack ID — a bare list like ["basic"] is rejected.
sub_categories is optional and takes free-form phrases, not taxonomy IDs. Omit it and the whole category is expanded; supply phrases (usually from /rt/threat-modeling/categories) to narrow generation.

Name the frameworks, and the platform expands them into the categories and sub-categories their controls map onto:

{
  "compliance_frameworks": ["owasp_llm_top10", "eu_ai_act"]
}

Supported: owasp_llm_top10, eu_ai_act, nist_ai_rmf, mitre_atlas, iso_42001, aiuc_1.

Quick reference

Risk categories

Category ID	Name	Sub-categories
`safety_harm`	Safety & Harm	7
`privacy_data_protection`	Privacy & Data Protection	4
`security_fraud`	Security & Fraud	5
`bias_fairness_ethical_harm`	Bias, Fairness & Ethical Harm	4
`legal_ip_liability`	Legal & IP Liability	4
`brand_reputation_trust`	Brand, Reputation & Trust	4
`product_misuse_abuse`	Product Misuse & Abuse	3
`performance_reliability_quality`	Performance, Reliability & Quality	4

Full list with sub-categories: Risk Category Catalog.

Attack methods

Bucket	Attack IDs
Baseline	`basic`
Evasion	`encoding`, `obfuscation`, `lang`, `word_masking`, `long_character`, `fc`, `figstep`, `camo`, `waveform`
Adaptive jailbreak	`deepinception`, `single_shot`, `graph`, `tap`, `goat`, `rt_agent`, `rt_agent_v2`, `derail_yourself`, `attack_in_the_middle`, `audio_goat`

Full descriptions and modality applicability: Attack Methods Reference.

Generation

Field	Meaning
`max_prompts`	Generate this many prompts on the fly (1–500)
`seed_prompts`	Up to 50 prompts of your own to seed generation
`dataset_name`	Use a previously generated dataset instead of generating
`include_standard_library`	Include Enkrypt AI’s curated prompts (default `true`)

dataset_name is mutually exclusive with max_prompts and seed_prompts. You are either reusing a dataset or generating a new one, not both.

Comprehensiveness

Low, Medium, High, Standard, Comprehensive. Standard runs the normal attack budget and Comprehensive widens it; Low, Medium and High are the equivalent sample-size settings surfaced in the dashboard. Omit to use the service default.

Comprehensiveness affects pricing — a wider budget means more prompts and more credits.

A complete minimal payload

{
  "target": {
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "api_key": "sk-...",
    "model_name": "gpt-4o-mini",
    "provider": "openai"
  },
  "risk_categories": {
    "safety_harm": { "attack_config": { "basic": {} } }
  }
}

Everything else is optional. See Examples for progressively richer payloads.

How the other endpoints differ

The same vocabulary is reused across the Red Team endpoints, with these differences:

Endpoint	`target`	Scope	`attack_config`
`POST /rt/redteam`	Required	`risk_categories` \| `compliance_frameworks`	Required, per category
`POST /rt/threat-modeling`	Not accepted	`risk_categories` \| `compliance_frameworks`	Not accepted — categories must be `{}`
`POST /rt/threat-modeling/categories`	Not accepted	`risk_categories` \| `compliance_frameworks`	Not accepted — categories must be `{}`
`POST /rt/playground`	Required	Not used — a single `goal` string instead	Required, top-level
`POST /rt/eval`	Not accepted	Not used — you supply `samples`	Not accepted

On /rt/threat-modeling and /rt/threat-modeling/categories, each risk category must be an empty object — {"safety_harm": {}}. Passing attack_config or sub_categories there is rejected. Nothing is being attacked; you are only generating or analysing.

Threat modeling: the two-phase flow

When you want to review the test set before running it, use threat modeling first.

Analyze

POST /rt/threat-modeling/categories takes your scope and context and returns a profile of suggested sub-category phrases per category. Nothing is generated, and the call is free.

Generate

POST /rt/threat-modeling/data takes that profile back — edited however you like — plus a generation_config, and produces the dataset.

Run

POST /rt/redteam with generation_config.dataset_name pointing at the dataset you just built.

POST /rt/threat-modeling collapses phases 1 and 2 into a single call when you do not need to review the profile in between.

Configuration Reference — every field, in detail
Risk Category Catalog — what each category tests
Attack Methods Reference — what each attack does
Examples — copy-paste payloads
What’s New — previous /redteam → current /rt field, test, and attack map
API Reference — full schemas

Get Started for Guardrails

Get Started for Red Team

Get Started with AI Proxy

Get Started with MCP

Get Started with Skill Scanner

On-Prem Installation

Coming from the previous API?

Risk Categories

Attack Methods

Configuration

Examples

Payload structure

The two required decisions

1. What to test — `target`

2. What to test for — scope

Quick reference

Risk categories

Attack methods

Generation

Comprehensiveness

A complete minimal payload

How the other endpoints differ

Threat modeling: the two-phase flow

​Coming from the previous API?

Risk Categories

Attack Methods

Configuration

Examples

​Payload structure

​The two required decisions

​1. What to test — target

​2. What to test for — scope

​Quick reference

​Risk categories

​Attack methods

​Generation

​Comprehensiveness

​A complete minimal payload

​How the other endpoints differ

​Threat modeling: the two-phase flow

​Related

Coming from the previous API?

Payload structure

The two required decisions

1. What to test — `target`

2. What to test for — scope

Quick reference

Risk categories

Attack methods

Generation

Comprehensiveness

A complete minimal payload

How the other endpoints differ

Threat modeling: the two-phase flow

Related