API Request Formats

How ProbeSix sends test prompts to your LLM endpoints

Why This Matters

When ProbeSix runs a security scan, it sends hundreds of test prompts to your AI endpoint to check for vulnerabilities. Each LLM provider expects API requests in a slightly different format, so we need to know how to package these test prompts correctly.

The Request Body Template tells ProbeSix exactly where to place each test prompt within the API request. Without this, your AI provider would reject our requests.

How It Works

When you select a provider preset, we automatically generate a template with a {{prompt}} placeholder. During scanning, this placeholder gets replaced with each test prompt.

// Template:

{"messages": [{"role": "user", "content": "{{prompt}}"}]}

// Becomes:

{"messages": [{"role": "user", "content": "Ignore previous instructions..."}]}

Provider Request Formats

OpenAI / OpenAI-Compatible

Works with OpenAI, Groq, Together AI, Anyscale, and other OpenAI-compatible APIs

{
  "model": "gpt-4o",
  "messages": [
    {
      "role": "user",
      "content": "{{prompt}}"
    }
  ]
}

Required fields:

model - The model identifier (e.g., gpt-4o, llama-3.3-70b-versatile)
messages - Array of message objects with role and content

Example providers:

OpenAIGroqTogether AIAnyscaleFireworks AIPerplexity

Anthropic Claude

For Anthropic's Claude models via their direct API

{
  "model": "claude-sonnet-4-20250514",
  "max_tokens": 1024,
  "messages": [
    {
      "role": "user",
      "content": "{{prompt}}"
    }
  ]
}

Required fields:

model - Claude model version
max_tokens - Maximum response length (required by Anthropic)
messages - Array of message objects

Google Gemini

For Google's Gemini models via the Generative AI API

{
  "contents": [
    {
      "parts": [
        {
          "text": "{{prompt}}"
        }
      ]
    }
  ]
}

Required fields:

contents - Array of content objects
parts - Array containing text parts

Google Gemini API documentation

Cohere

For Cohere's Command models

{
  "model": "command-r-plus",
  "message": "{{prompt}}"
}

Required fields:

model - Cohere model name
message - The prompt text (single string, not an array)

Custom / Other Providers

For APIs not listed above, or custom deployments

If your provider isn't listed, select "Custom" and enter the request body template manually. Check your provider's API documentation to find the correct format.

The key requirement is to include {{prompt}} wherever the user message content should go.

Model Name

The Model Name field specifies which AI model to use when sending requests. This value gets embedded directly into the request body, so it must be the exact identifier that your provider expects.

If you enter an incorrect model name, the API will reject requests and your scan will fail.

Valid model identifiers by provider:

OpenAI:gpt-4o, gpt-4-turbo, gpt-3.5-turbo

Anthropic:claude-sonnet-4-20250514, claude-3-5-haiku-20241022

Google:gemini-1.5-pro, gemini-1.5-flash

Cohere:command-r-plus, command-r

Groq:llama-3.3-70b-versatile, mixtral-8x7b-32768

Check your provider's documentation for the full list of available models.

Response Parsing

ProbeSix also needs to know where to find the AI's response in the API response. This is handled automatically for known providers, but for custom endpoints you may need to specify a response path.

// OpenAI response:

json.choices[0].message.content

// Anthropic response:

json.content[0].text

// Google response:

json.candidates[0].content.parts[0].text

AWS Bedrock

For AWS Bedrock endpoints, you don't need to configure a request body template. ProbeSix handles the model-specific request formatting automatically when you select the "AWS Bedrock" endpoint type and provide your cross-account role ARN.

Need Help?

If you're unsure about your provider's request format, check their API documentation or contact our support team. We're happy to help you get set up.