> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Credits and Usage
> How Enkrypt AI meters and prices Guardrails, Red Team and AI Proxy usage when credit-based billing is enabled on your account
This page applies to accounts with **credit-based metering enabled**. If your
account is metered by request count, none of the pricing below applies and
none of the credit headers described here are returned. Not sure which you
are on? Send any request and read the `X-Enkrypt-Credits-Mode` response
header — see [Which mode am I on?](#which-mode-am-i-on).
Credits are a single usage currency across the platform. There are two separate
balances:
| Balance | Covers |
| ---------------------- | ----------------------------------------------------------------------------------------- |
| **Guardrails credits** | the Guardrails API **and** every guardrail evaluation performed by an AI Proxy deployment |
| **Red Team credits** | Red Team runs, threat modeling, evaluations and playground probes |
Both are granted monthly and reset with your billing period.
Rates on this page are current as at **2026-08-06** and may change. The
`X-Enkrypt-Credits-Cost` header returned on your own calls is always
authoritative — build any internal reporting against the headers, not against
a copy of these tables.
## The three principles
1. **You are charged for work performed, not for bytes sent.** Cost tracks the
number and kind of model invocations your request causes. Two detectors cost
more than one; an LLM-judge detector costs more than a regex one.
2. **Cost is computed from your request before it runs.** If the cost would take
you past your limit, the request is rejected with `402` and **nothing is
charged**. You are never partially billed for a blocked request.
3. **Reads are free.** Fetching results, run status, records or datasets never
costs credits. Only work that generates or evaluates something is priced.
## Guardrails
The cost of a detect call is the sum of its **enabled** detectors. Only
detectors you switch on are counted — a policy with ten detectors defined but
two enabled is priced as two.
### Detector rates
| Detector | Credits | Scales with text length |
| ------------------ | ------- | -------------------------- |
| `keyword_detector` | 1 | No |
| `pii` | 1 | No |
| `nsfw` | 1 | No |
| `toxicity` | 1 | No |
| `topic_detector` | 1 | No |
| `injection_attack` | 2 | Yes — per 1,024 characters |
| `sponge_attack` | 4 | Yes — per 4,096 characters |
| `bias` | 5 | Yes — per 4,096 characters |
| `policy_violation` | 5 | Yes — per 5,000 characters |
| `copyright_ip` | 0 | Not yet implemented — free |
| `system_prompt` | 0 | Not yet implemented — free |
The rate reflects the compute behind each detector: `1` is an in-process regex
or a single small classifier, `2` is a two-stage model, `5` is a self-hosted LLM
judge.
### Length scaling
Detectors marked *scales with text length* are charged per unit of text:
```text theme={"system"}
detector cost = credits × min( ceil(characters / unit), 25 )
```
So `bias` (5 credits per 4,096 characters) on a 10,000-character input costs
`5 × ceil(10000 / 4096)` = `5 × 3` = **15 credits**. Scaling is capped at **25
units**, so a single detector can never exceed 25× its base rate however large
the input.
Detectors that do not scale are charged once regardless of length.
### Discounts
`nsfw` and `toxicity` share one model inference. Enabling **both** subtracts
**1 credit** per text, so together they cost 1 rather than 2.
### Explanations
Two detectors accept `need_explanation`, which adds a second LLM generation to
explain a finding. Both are charged **2×** when it is on:
| Detector | Base | With explanation | Default when you omit the field |
| ------------------ | ---- | ---------------- | ------------------------------- |
| `policy_violation` | 5 | 10 | **on** — you pay 2× |
| `injection_attack` | 2 | 4 | **off** — you pay the base rate |
**The two defaults are opposite.** `policy_violation` generates an explanation
unless you send an explicit `need_explanation: false`, so omitting the field
still incurs its 2× rate. `injection_attack` does the reverse: it only costs 2×
if you explicitly send `need_explanation: true`.
An explicit `true` or `false` always wins; the default applies only when the
field is absent. Sending `null` counts as absent.
### Batch requests
Batch endpoints are priced **per item** — each text is costed on its own length
and summed. You are never charged the longest item's length multiplied by the
item count.
### Worked example
A `/guardrails/detect` call with `pii`, `nsfw`, `toxicity` and `injection_attack`
enabled on a 3,000-character input:
```text theme={"system"}
pii 1 = 1
nsfw 1 = 1
toxicity 1 = 1
injection_attack 2 × ceil(3000 / 1024) = 2 × 3 = 6
subtotal 9
nsfw + toxicity discount = -1
-------
total 8 credits
```
The same call with `injection_attack.need_explanation: true` doubles that
detector's term only — `4 × 3 = 12` — for a total of **14 credits**:
```text theme={"system"}
pii + nsfw + toxicity = 3
injection_attack (2 × 2) × ceil(3000 / 1024) = 12
subtotal 15
nsfw + toxicity discount = -1
-------
total 14 credits
```
### Endpoint rates
Endpoints that are not a plain detector sum have their own rate:
| Endpoint | Cost |
| ------------------------------------------------------------ | -------------------------------------------------------- |
| `/guardrails/detect`, `/guardrails/batch/detect` | detector sum (above) |
| `/guardrails/pii` | 1 |
| `/guardrails/detect-image`, `/guardrails/detect-audio` | 4 per enabled multimodal detector |
| `/guardrails/adherence`, `/guardrails/relevancy` | 8 |
| `/guardrails/scan-url` | 3 + detector sum, then +1 per fragment scanned (max 200) |
| `/guardrails/scan-pdf` | 2 + 1 per 100 KB, then +1 per page (max 300) |
| `/guardrails/policy-wizard/infer-document` | 10 + 2 per 100 KB, then +2 per page (max 300) |
| `/guardrails/policy-wizard/generate-rules` | 10 |
| `/guardrails/health`, `/status`, `/models`, `/hallucination` | Free |
Multimodal detection (`detect-image` / `detect-audio`) supports `toxicity`,
`nsfw`, `injection_attack`, `pii` and `policy_violation`, and is charged a flat
4 credits per enabled detector — it does not scale with file size, and the
explanation multiplier does not apply.
`scan-url`, `scan-pdf` and `infer-document` reserve an estimate up front and
settle to the true cost once the number of fragments or pages is known. If the
work turns out smaller than reserved, you are charged the smaller amount.
The minimum charge for any priced Guardrails request is **1 credit**.
## Red Team
A Red Team run is priced from the scope you submit, before the run starts.
```text theme={"system"}
cost = Σ over categories [ base(category) × Σ over attacks multiplier(attack) ]
× target multiplier
```
### Category base rates
| Category | Base |
| --------------------------------- | ---- |
| `safety_harm` | 12 |
| `security_fraud` | 10 |
| `privacy_data_protection` | 10 |
| `legal_ip_liability` | 8 |
| `product_misuse_abuse` | 8 |
| `performance_reliability_quality` | 8 |
| `bias_fairness_ethical_harm` | 6 |
| `brand_reputation_trust` | 6 |
### Attack multipliers
Roughly, the multiplier is the number of model calls the attack makes per prompt.
| Multiplier | Attacks |
| ---------- | --------------------------------------------------------------------------------------------- |
| 1× | `basic`, `deepinception`, `encoding`, `obfuscation`, `long_character`, `attack_in_the_middle` |
| 2× | `lang`, `figstep`, `camo`, `hades`, `word_masking`, `waveform` |
| 5× | `derail_yourself` |
| 6× | `graph`, `goat`, `audio_goat` |
| 8× | `rt_agent` |
| 12× | `tap` |
Some attacks are also accepted under an older name. An alias is the same attack
at the same multiplier — sending both names runs and charges it twice.
| Alias | Canonical |
| ------------------------------- | --------------- |
| `single_shot`, `deep_inception` | `deepinception` |
| `eai_attack` | `graph` |
A category with an empty `attack_config` still runs one `basic` probe and is
charged `base × 1`.
### Attacks that take parameters
`derail_yourself`, `goat`, `rt_agent` and `tap` accept tuning parameters, and
the price moves with them, because the parameters determine how much work runs:
| Attack | Reference parameters | Ceiling |
| ----------------- | --------------------------------------------- | ---------------------- |
| `derail_yourself` | `num_actors: 3`, `max_turns: 5` | 3× the base multiplier |
| `goat` | `max_turns: 6` | 2× |
| `rt_agent` | `max_iterations: 8` | 2.5× |
| `tap` | `width: 5`, `branching_factor: 9`, `depth: 3` | 5.6× |
The multiplier scales by your parameters relative to the reference, floored at
0.5× and capped at the ceiling. Doubling `goat`'s `max_turns` from 6 to 12
doubles its multiplier from 6 to 12; raising it far higher stops at the 2× cap.
### Target multiplier
| `target.system_type` | Multiplier |
| -------------------- | ---------- |
| `foundation_model` | 1× |
| `chatbot` | 1× |
| `agent` | 1.5× |
Agents cost more because each probe drives a multi-step tool-using loop.
### Compliance-framework scope
Submitting `compliance_frameworks` instead of `risk_categories` expands to the
categories that framework covers, each run with `basic` and `encoding`.
Overlapping frameworks are **deduplicated** — listing three frameworks that all
include `safety_harm` charges for it once.
### Worked example
```text theme={"system"}
risk_categories:
security_fraud: attack_config { basic, tap }
target: { system_type: agent }
security_fraud base = 10
attacks: basic (1×) + tap (12×) = 13
10 × 13 = 130
agent target multiplier 130 × 1.5 = 195 credits
```
### Other Red Team endpoints
| Endpoint | Cost |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------- |
| `POST /rt/eval` | 2 per sample |
| `POST /rt/threat-modeling`, `/rt/threat-modeling/data` | 1 per 10 prompts generated |
| `POST /rt/playground` | 2 per attack, × the attack multiplier; no target multiplier |
| `POST /rt/runs/{id}/resume` | Free — re-drives work already paid for |
| `POST /rt/threat-modeling/categories` | Free — analysis only, nothing generated |
| `POST /rt/model-health`, `/rt/findings`, `/rt/risk-mitigation/*` | Free |
| All `GET` endpoints (status, results, records, stream, compliance, datasets) | Free |
The minimum charge for any priced Red Team submission is **5 credits**.
## AI Proxy
AI Proxy deployments are charged **Guardrails credits**, from the **Guardrails
balance**, at exactly the rates in the [Guardrails](#guardrails) section above.
Every guardrail stage your deployment runs is priced as the equivalent
Guardrails API call — input detection, output detection, PII redaction and
unredaction, hallucination, adherence and relevancy each cost what that endpoint
costs. A deployment with input and output guardrails enabled is charged for
both.
**Provider tokens are not charged in credits.** Credits cover the guardrail
evaluations Enkrypt performs. What you pay your model provider for the
underlying completion is separate and unaffected.
Because it is one pool and one setting, enabling credit metering on your account
covers your deployments automatically. The pre-flight `402` check is applied
once per request, on the input-detection cost.
## Reading your usage
### Response headers
Every priced call returns:
| Header | Meaning |
| ------------------------------ | ---------------------------------------------------- |
| `X-Enkrypt-Credits-Mode` | which metering mode this account is on |
| `X-Enkrypt-Credits-Cost` | credits this request cost |
| `X-Enkrypt-Credits-Used` | credits consumed this period, including this request |
| `X-Enkrypt-Credits-Limit` | your allowance for the period |
| `X-Enkrypt-Credits-Remaining` | what is left |
| `X-Enkrypt-Credits-Exceeded` | `true` once the limit is reached |
| `X-Enkrypt-Credits-Would-Cost` | on a blocked request, what it *would* have cost |
These headers are the authoritative record of what you were charged. If you
are reconciling usage, read them per response rather than recomputing from
the tables on this page.
### Which mode am I on?
`X-Enkrypt-Credits-Mode` returns one of:
| Mode | Meaning |
| ---------- | -------------------------------------------------------------------------------------------------------------- |
| `credits` | Credit metering is live. Costs are charged and requests can be blocked at your limit. |
| `shadow` | Costs are computed and reported in the headers, but nothing is charged and nothing is ever blocked. |
| `requests` | Credit metering is off for this account; usage is metered by request count and no credit headers are returned. |
`shadow` is useful before switching on: you get real per-request costs for your
own traffic, with no billing effect.
## When you run out
A request that would exceed your limit is rejected with **`402 Payment
Required`** before any work starts. Nothing is charged, and
`X-Enkrypt-Credits-Would-Cost` tells you what the request needed.
The same applies to per-project limits where your organisation has set them —
the response indicates whether the organisation or the project limit was hit.
If your plan has an unlimited allowance, costs are still computed and reported
in the headers, but no request is ever blocked.
## Monthly grants
| Plan | Guardrails credits | Red Team credits |
| ------------ | ------------------ | ---------------- |
| Free | 10,000 | 100 |
| Professional | 100,000 | 1,000 |
| Enterprise | Unlimited | 10,000 |
Contact your account team to adjust an allowance or to enable credit metering.