AI Security API Reference for Developers

Test AI applications for security vulnerabilities programmatically. REST API, SDKs for Node.js and Python, runtime adversarial testing, and compliance evidence generation — all from one API.

REST API Node.js & Python SDKs Vulnerability scanning Compliance evidence API

Test Your AI App for Security Vulnerabilities

AI applications introduce new attack surfaces — prompt injection, PII leakage, tool abuse, RAG poisoning. HAIEC's API lets you test your AI app against these threats programmatically, integrate testing into your CI/CD pipeline, and generate audit-ready compliance evidence.

Security scanning API — test your AI app against prompt injection, PII leakage, tool abuse, and more
Runtime testing API — send adversarial inputs to your live AI app and see how it responds
Compliance evidence API — generate SHA-256 signed artifacts mapped to SOC 2, HIPAA, EU AI Act, ISO 27001
CI/CD integration — scan on every PR, gate deployments on security results

Authentication

All API requests require a Bearer token in the Authorization header. Get your API key from the HAIEC dashboard or via the /api/keys endpoint.

Authorization: Bearer haiec_sk_your_api_key_here

API Endpoints

POST/api/ai-security/scan

Security Scan

Run a static security scan on an AI app endpoint or repository. Tests for prompt injection, PII exposure, hardcoded secrets, and missing input validation.

Parameters: target_url, target_type (endpoint, repository), scan_profiles (optional: DEFAULT, VOICE, AGENTIC)

POST/api/runtime-security/test

Runtime Security Test

Send adversarial inputs to a live AI app endpoint. Tests prompt injection, multi-turn manipulation, RAG poisoning, tool abuse, and PII extraction in real-time.

Parameters: endpoint_url, endpoint_type (llm, voice, webhook, agent), attack_categories, mode

GET/api/ai-security/results/:scanId

Get Scan Results

Retrieve detailed scan results including findings, severity ratings, remediation steps, and evidence artifact URLs.

Parameters: scanId (path)

GET/api/evidence/:scanId

Get Compliance Evidence

Retrieve SHA-256 signed compliance evidence artifacts mapped to SOC 2, HIPAA, EU AI Act, and ISO 27001 frameworks.

Parameters: scanId (path), framework (optional: soc2, hipaa, eu_ai_act, iso27001)

GET/api/baselines

Get Baseline Tracking

Track security posture over time. Compare scan results against previous baselines to see improvements or regressions.

Parameters: project_id, time_range (optional)

POST/api/ai-security/scan/batch

Batch Scan Multiple Apps

Scan multiple AI app endpoints in a single request. Useful for teams managing multiple AI applications.

Parameters: targets (array of {url, type}), scan_profiles

Code Examples

Scan Your AI App (cURL)

# Scan your AI app for security vulnerabilities
curl -X POST https://api.haiec.com/api/ai-security/scan \
  -H "Authorization: Bearer $HAIEC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "target_url": "https://my-ai-app.com/api/chat",
    "target_type": "endpoint",
    "scan_profiles": ["DEFAULT", "AGENTIC"]
  }'

# Response includes:
# - scanId for tracking
# - Findings with severity (CRITICAL, HIGH, MEDIUM, LOW)
# - Remediation steps per finding
# - SHA-256 signed evidence artifact URL
# - Framework mapping (SOC 2, HIPAA, EU AI Act)

Runtime Adversarial Test (cURL)

# Run runtime adversarial tests against your live AI app
curl -X POST https://api.haiec.com/api/runtime-security/test \
  -H "Authorization: Bearer $HAIEC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint_url": "https://my-ai-app.com/api/chat",
    "endpoint_type": "llm",
    "attack_categories": [
      "prompt_injection",
      "pii_extraction",
      "multi_turn_manipulation",
      "tool_abuse"
    ],
    "mode": "thorough"
  }'

Node.js SDK — Full Workflow

// Node.js SDK — Scan your AI app for vulnerabilities
import { HAIECClient } from '@haiec/sdk'

const client = new HAIECClient(process.env.HAIEC_API_KEY)

// Run a security scan
const scan = await client.security.scan({
  target_url: 'https://my-ai-app.com/api/chat',
  target_type: 'endpoint',
  scan_profiles: ['DEFAULT', 'AGENTIC'],
})

console.log('Scan ID:', scan.id)
console.log('Critical findings:', scan.critical_count)
console.log('High findings:', scan.high_count)

scan.findings.forEach(f => {
  console.log('  [' + f.severity + '] ' + f.category + ': ' + f.description)
  console.log('  Remediation: ' + f.remediation)
})

// Get compliance evidence for your auditor
const evidence = await client.security.getEvidence(scan.id, {
  framework: 'soc2',
})
console.log('SOC 2 evidence artifact:', evidence.artifact_url)

Python SDK — Full Workflow

# Python SDK — Scan your AI app for vulnerabilities
from haiec import HAIECClient

client = HAIECClient(api_key=os.environ["HAIEC_API_KEY"])

# Run a security scan
scan = client.security.scan(
    target_url="https://my-ai-app.com/api/chat",
    target_type="endpoint",
    scan_profiles=["DEFAULT", "AGENTIC"],
)

print(f"Scan ID: {scan.id}")
print(f"Critical findings: {scan.critical_count}")
print(f"High findings: {scan.high_count}")

for f in scan.findings:
    print(f"  [{f.severity}] {f.category}: {f.description}")
    print(f"  Remediation: {f.remediation}")

# Get compliance evidence for your auditor
evidence = client.security.get_evidence(scan.id, framework="hipaa")
print(f"HIPAA evidence artifact: {evidence.artifact_url}")

CI/CD Integration

Integrate AI security scanning into your deployment pipeline. Scan on every PR, gate deployments on results.

# GitHub Actions example
name: AI Security Scan
on: [pull_request]

jobs:
  ai-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run HAIEC Security Scan
        uses: haiec/security-scan-action@v1
        with:
          api-key: ${{ secrets.HAIEC_API_KEY }}
          target-url: ${{ vars.AI_APP_URL }}
          fail-on: critical

FAQ

How do I scan my AI app for security vulnerabilities via API?

POST to /api/ai-security/scan with your app endpoint URL or repository URL. The API runs prompt injection, PII leakage, tool abuse, and multi-turn manipulation tests. Results include severity, remediation steps, and SHA-256 signed evidence artifacts.

What SDKs are available for the HAIEC security API?

HAIEC provides SDKs for Node.js and Python. Install via npm install @haiec/sdk or pip install haiec-sdk. The SDK wraps all REST API endpoints including scanning, runtime testing, and compliance evidence generation.

Can I integrate AI security scanning into my CI/CD pipeline?

Yes. Use the HAIEC GitHub Action or call the API directly from GitHub Actions, GitLab CI, or Jenkins. Every PR can trigger a security scan, with results posted as PR comments. Gate deployments on security scan results.

Does the API generate compliance evidence?

Yes. After each scan, the API returns SHA-256 signed evidence artifacts mapped to SOC 2, HIPAA, EU AI Act, and ISO 27001 frameworks. You can retrieve these via the /api/evidence endpoint.

What types of AI apps can I test with the HAIEC API?

Any AI application that uses LLMs: chatbots, voice agents, RAG systems, AI agents with tool access, custom GPT wrappers, and enterprise AI workflows. If your app sends prompts to an LLM and returns responses, the HAIEC API can test it.

Start Testing Your AI App

Get your API key, install the SDK, and run your first security scan in 5 minutes.

Quickstart Guide SDK Installation Security Testing Guide