This page applies to accounts with credit-based metering enabled. If your
account is metered by request count, none of the pricing below applies and
none of the credit headers described here are returned. Not sure which you
are on? Send any request and read the
X-Enkrypt-Credits-Mode response
header — see Which mode am I on?.
Both are granted monthly and reset with your billing period.
The three principles
- You are charged for work performed, not for bytes sent. Cost tracks the number and kind of model invocations your request causes. Two detectors cost more than one; an LLM-judge detector costs more than a regex one.
- Cost is computed from your request before it runs. If the cost would take
you past your limit, the request is rejected with
402and nothing is charged. You are never partially billed for a blocked request. - Reads are free. Fetching results, run status, records or datasets never costs credits. Only work that generates or evaluates something is priced.
Guardrails
The cost of a detect call is the sum of its enabled detectors. Only detectors you switch on are counted — a policy with ten detectors defined but two enabled is priced as two.Detector rates
The rate reflects the compute behind each detector:
1 is an in-process regex
or a single small classifier, 2 is a two-stage model, 5 is a self-hosted LLM
judge.
Length scaling
Detectors marked scales with text length are charged per unit of text:bias (5 credits per 4,096 characters) on a 10,000-character input costs
5 × ceil(10000 / 4096) = 5 × 3 = 15 credits. Scaling is capped at 25
units, so a single detector can never exceed 25× its base rate however large
the input.
Detectors that do not scale are charged once regardless of length.
Discounts
nsfw and toxicity share one model inference. Enabling both subtracts
1 credit per text, so together they cost 1 rather than 2.
Explanations
Two detectors acceptneed_explanation, which adds a second LLM generation to
explain a finding. Both are charged 2× when it is on:
An explicit
true or false always wins; the default applies only when the
field is absent. Sending null counts as absent.
Batch requests
Batch endpoints are priced per item — each text is costed on its own length and summed. You are never charged the longest item’s length multiplied by the item count.Worked example
A/guardrails/detect call with pii, nsfw, toxicity and injection_attack
enabled on a 3,000-character input:
injection_attack.need_explanation: true doubles that
detector’s term only — 4 × 3 = 12 — for a total of 14 credits:
Endpoint rates
Endpoints that are not a plain detector sum have their own rate:
Multimodal detection (
detect-image / detect-audio) supports toxicity,
nsfw, injection_attack, pii and policy_violation, and is charged a flat
4 credits per enabled detector — it does not scale with file size, and the
explanation multiplier does not apply.
scan-url, scan-pdf and infer-document reserve an estimate up front and
settle to the true cost once the number of fragments or pages is known. If the
work turns out smaller than reserved, you are charged the smaller amount.
The minimum charge for any priced Guardrails request is 1 credit.
Red Team
A Red Team run is priced from the scope you submit, before the run starts.Category base rates
Attack multipliers
Roughly, the multiplier is the number of model calls the attack makes per prompt.
Some attacks are also accepted under an older name. An alias is the same attack
at the same multiplier — sending both names runs and charges it twice.
A category with an empty
attack_config still runs one basic probe and is
charged base × 1.
Attacks that take parameters
derail_yourself, goat, rt_agent and tap accept tuning parameters, and
the price moves with them, because the parameters determine how much work runs:
The multiplier scales by your parameters relative to the reference, floored at
0.5× and capped at the ceiling. Doubling
goat’s max_turns from 6 to 12
doubles its multiplier from 6 to 12; raising it far higher stops at the 2× cap.
Target multiplier
Agents cost more because each probe drives a multi-step tool-using loop.
Compliance-framework scope
Submittingcompliance_frameworks instead of risk_categories expands to the
categories that framework covers, each run with basic and encoding.
Overlapping frameworks are deduplicated — listing three frameworks that all
include safety_harm charges for it once.
Worked example
Other Red Team endpoints
The minimum charge for any priced Red Team submission is 5 credits.
AI Proxy
AI Proxy deployments are charged Guardrails credits, from the Guardrails balance, at exactly the rates in the Guardrails section above. Every guardrail stage your deployment runs is priced as the equivalent Guardrails API call — input detection, output detection, PII redaction and unredaction, hallucination, adherence and relevancy each cost what that endpoint costs. A deployment with input and output guardrails enabled is charged for both.Provider tokens are not charged in credits. Credits cover the guardrail
evaluations Enkrypt performs. What you pay your model provider for the
underlying completion is separate and unaffected.
402 check is applied
once per request, on the input-detection cost.
Reading your usage
Response headers
Every priced call returns:Which mode am I on?
X-Enkrypt-Credits-Mode returns one of:
shadow is useful before switching on: you get real per-request costs for your
own traffic, with no billing effect.
When you run out
A request that would exceed your limit is rejected with402 Payment Required before any work starts. Nothing is charged, and
X-Enkrypt-Credits-Would-Cost tells you what the request needed.
The same applies to per-project limits where your organisation has set them —
the response indicates whether the organisation or the project limit was hit.
If your plan has an unlimited allowance, costs are still computed and reported
in the headers, but no request is ever blocked.
Monthly grants
Contact your account team to adjust an allowance or to enable credit metering.