SDK Quickstart

npm install indigiarmor

yarn add indigiarmor

pnpm add indigiarmor

import { IndigiArmor } from 'indigiarmor';

const ia = new IndigiArmor('ia_sk_your_key_here');

const ia = new IndigiArmor('ia_sk_...', {
  // Base URL (default: 'https://indigiarmor.com')
  baseUrl: 'https://indigiarmor.com',

  // Request timeout in ms (default: 30000)
  timeout: 10_000,

  // Custom fetch implementation (default: globalThis.fetch)
  fetch: customFetch,

  // Lifecycle callbacks — triggered after every scan() call
  callbacks: {
    onBlock: (result) => console.error('Blocked:', result.explanation),
    onFlag:  (result) => console.warn('Flagged:', result.explanation),
    onAllow: (result) => {},
  },
});

const result = await ia.scan('Tell me about John Smith, SSN 123-45-6789');

console.log(result.tier);             // 'red'
console.log(result.action);           // 'block'
console.log(result.risk_score);       // 9.5
console.log(result.signals);          // [{ domain: 'pii', type: 'ssn', ... }]
console.log(result.sanitized_prompt); // 'Tell me about [REDACTED], SSN [REDACTED]'
console.log(result.explanation);      // 'Detected SSN and full name...'
console.log(result.latency_ms);       // 12

const result = await ia.scanDocument('Student ID 12345 IEP records', {
  filename: 'report.pdf',
  mime_type: 'application/pdf',
});

console.log(result.tier);   // 'red'
console.log(result.signals); // [{ domain: 'education', type: 'student_id', ... }]

const check = await ia.scanResponse(llmOutput);

if (!check.clean) {
  console.log(check.signals);
  // Use the sanitized version instead
  const safe = check.sanitized_response;
}

const result = await ia.scan(userPrompt);

if (result.action === 'flag' && result.token_id) {
  // Show user a warning, then confirm if approved
  const confirmed = await ia.confirm(result.token_id);

  if (confirmed.confirmed) {
    // Use confirmed.sanitized_prompt to proceed
  }
}

const { safe, prompt, result } = await ia.guard('user input here');

if (safe) {
  // `prompt` is the sanitized version when applicable
  await callLLM(prompt);
} else {
  console.log('Blocked:', result.explanation);
}

// Override the yellow strategy per call
const { safe: strict } = await ia.guard('user input', { yellowStrategy: 'block' });

const { output, inputScan, outputScan } = await ia.protect(
  'user input here',
  async (safePrompt) => {
    return await callLLM(safePrompt);
  },
  { scanOutput: true },
);

import express from 'express';
import { IndigiArmor } from 'indigiarmor';

const app = express();
const ia = new IndigiArmor(process.env.INDIGIARMOR_API_KEY!);

app.use(express.json());

app.post('/api/chat', ia.middleware({ promptField: 'prompt' }), (req, res) => {
  // req.body.prompt is now sanitized
  // req.scanResult contains the full scan result
  res.json({ reply: 'ok' });
});

// app/api/chat/route.ts
import { IndigiArmor } from 'indigiarmor';

const ia = new IndigiArmor(process.env.INDIGIARMOR_API_KEY!);

export const POST = ia.nextHandler(
  async (req, scanResult) => {
    const { prompt } = await req.json();
    return Response.json({ answer: await callLLM(prompt) });
  },
  { promptField: 'prompt' },
);

import OpenAI from 'openai';
import { IndigiArmor } from 'indigiarmor';

const ia = new IndigiArmor(process.env.INDIGIARMOR_API_KEY!);

const openai = ia.wrapOpenAI(new OpenAI(), {
  yellowStrategy: 'sanitize',
  scanOutput: true,
});

// All user messages are scanned before reaching OpenAI
const completion = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages: [{ role: 'user', content: 'Hello' }],
});

import Anthropic from '@anthropic-ai/sdk';
import { IndigiArmor } from 'indigiarmor';

const ia = new IndigiArmor(process.env.INDIGIARMOR_API_KEY!);

const anthropic = ia.wrapAnthropic(new Anthropic(), { scanOutput: true });

const message = await anthropic.messages.create({
  model: 'claude-sonnet-4-20250514',
  max_tokens: 1024,
  system: 'You are a helpful assistant.',
  messages: [{ role: 'user', content: 'Hello' }],
});

import { GoogleGenAI } from '@google/genai';
import { IndigiArmor } from 'indigiarmor';

const ia = new IndigiArmor(process.env.INDIGIARMOR_API_KEY!);

const genai = ia.wrapGemini(new GoogleGenAI({ apiKey: '...' }), {
  scanOutput: true,
});

const response = await genai.models.generateContent({
  model: 'gemini-2.5-flash',
  contents: 'Hello',
});

// List policies
const policies = await ia.listPolicies();

// Create a strict policy
const policy = await ia.createPolicy({
  name: 'Strict PII Detection',
  action: 'block',
  sensitivity_threshold: 0.3,
  detection_categories: ['pii', 'education'],
  is_default: true,
});

// Update
await ia.updatePolicy(policy.id, { enabled: false });

// Delete
await ia.deletePolicy(policy.id);

// Use compliance templates (Education+)
const templates = await ia.listPolicyTemplates();
const ferpaPolicy = await ia.createPolicyFromTemplate({
  template_id: templates[0].id,
  name: 'FERPA Policy',
});

// Create a new key (raw key returned only once)
const { raw_key, key } = await ia.createKey({
  name: 'Production',
  rate_limit_per_minute: 120,
});
console.log(raw_key); // ia_sk_... — store this securely

// List keys (hashes never exposed)
const keys = await ia.listKeys();

// Revoke a key
await ia.revokeKey(key.id);

// Get usage stats
const usage = await ia.getUsage({ from: '2026-01-01' });
console.log(usage.totals.scan_count);

// Query audit logs
const logs = await ia.listAuditLogs({
  tier: 'red',
  limit: 10,
});

// Get single audit entry
const entry = await ia.getAuditLog(logs.logs[0].id);

// Add a term to bypass detection
await ia.addAllowlistEntry({
  term: 'Acme Corp',
  domain: 'pii',
});

// List entries
const list = await ia.listAllowlist();

// Remove
await ia.removeAllowlistEntry(list[0].id);

// Create a webhook
const webhook = await ia.createWebhook({
  url: 'https://your-app.com/webhooks/indigiarmor',
  events: ['scan.blocked', 'scan.flagged'],
  format: 'json',
});

// List, update, delete
const webhooks = await ia.listWebhooks();
await ia.updateWebhook(webhook.id, { enabled: false });
await ia.deleteWebhook(webhook.id);

// Send a test event
const { success } = await ia.testWebhook(webhook.id);

// Create a team
const team = await ia.createTeam({ name: 'Engineering' });

// Manage members
await ia.addTeamMember(team.id, userId);
const members = await ia.listTeamMembers(team.id);

// List, update, delete
const teams = await ia.listTeams();
await ia.updateTeam(team.id, { name: 'Platform Engineering' });
await ia.deleteTeam(team.id);

// Create a custom entity type
const entity = await ia.createCustomEntity({
  name: 'Employee ID',
  domain: 'pii',
  patterns: ['EMP-\\d{6}'],
  keywords: ['employee id', 'emp id'],
  weight: 0.8,
});

// List, update, delete
const entities = await ia.listCustomEntities();
await ia.updateCustomEntity(entity.id, { enabled: false });
await ia.deleteCustomEntity(entity.id);

// Export audit logs as CSV
const exported = await ia.exportAuditLogs({
  from: '2026-01-01',
  to: '2026-03-31',
  format: 'csv',
  domain: 'education',
});

// Generate compliance summary
const report = await ia.getComplianceReport('2026-01-01', '2026-03-31');
console.log(report.total_scans);
console.log(report.block_rate);
console.log(report.domain_distribution);

// Run simulation
const { summary, results } = await ia.runRedTeam();
console.log(summary.detection_rate);  // 0.95
console.log(summary.missed);          // 2

// List available attack cases
const attacks = await ia.listAttackCases();

import {
  IndigiArmorError,
  AuthenticationError,
  RateLimitError,
  ValidationError,
  NotFoundError,
} from 'indigiarmor';

try {
  await ia.scan(prompt);
} catch (err) {
  if (err instanceof RateLimitError) {
    // err.retryAfter — seconds until retry
    console.log(`Rate limited. Retry after ${err.retryAfter}s`);
  } else if (err instanceof AuthenticationError) {
    // Invalid or revoked API key (401)
  } else if (err instanceof ValidationError) {
    // Bad request payload (400)
  } else if (err instanceof NotFoundError) {
    // Resource not found (404)
  } else if (err instanceof IndigiArmorError) {
    // err.code      — machine-readable error code
    // err.status    — HTTP status (0 for network/timeout errors)
    // err.requestId — server request ID for support
  }
}

import type {
  ScanResult,
  ScanResponseResult,
  Signal,
  Policy,
  CreatePolicyRequest,
  Webhook,
  CreateWebhookRequest,
  Team,
  CustomEntity,
  ComplianceReport,
  GuardResult,
  ProtectResult,
  YellowStrategy,
  // ... and more
} from 'indigiarmor';