The signatures endpoints let you inspect the detection signatures that InferenceWall has loaded. Use them to verify that custom signatures are active, inspect signature metadata, or build tooling on top of the signature catalog.
InferenceWall ships with 100 built-in signatures covering prompt injection, jailbreaks, content safety, data leakage, system prompt extraction, and agentic attacks. Custom signatures in ~/.inferwall/signatures/ are merged at startup and appear in the same list.
GET /v1/signatures
List all loaded signatures. Returns an array of signature objects with their ID, name, category, severity, and other metadata.
Example
curl http://localhost:8000/v1/signatures \
-H "Authorization: Bearer iwk_scan_YOUR_KEY"
[
{
"id": "INJ-D-002",
"name": "Direct Prompt Injection — Instruction Override",
"category": "injection",
"severity": 7.0,
"confidence": "high",
"engine": "heuristic",
"direction": "input",
"enabled": true
},
{
"id": "DL-S-001",
"name": "API Key Leakage in Output",
"category": "data-leakage",
"severity": 12.0,
"confidence": "high",
"engine": "heuristic",
"direction": "output",
"enabled": true
}
]
Response fields
Unique signature identifier (e.g., INJ-D-002).
Human-readable signature name.
Detection category (e.g., injection, data-leakage, content-safety).
Signature severity score, between 1 and 15. Used in anomaly score calculation.
Confidence tier: low, medium, or high.
Detection engine that handles this signature: heuristic, classifier, semantic, or llm-judge.
Whether this signature applies to input (user prompts), output (LLM responses), or both.
Whether this signature is currently active in the loaded policy.
GET /v1/signatures/
Get full details for a specific signature by its ID.
Path parameters
The signature ID to look up (e.g., INJ-D-002).
Example
curl http://localhost:8000/v1/signatures/INJ-D-002 \
-H "Authorization: Bearer iwk_scan_YOUR_KEY"
{
"id": "INJ-D-002",
"name": "Direct Prompt Injection — Instruction Override",
"category": "injection",
"severity": 7.0,
"confidence": "high",
"engine": "heuristic",
"direction": "input",
"enabled": true
}
Use cases
- Verify custom signatures are loaded — after adding a file to
~/.inferwall/signatures/, call GET /v1/signatures and check that your signature ID appears in the list.
- Inspect signature details — retrieve the severity, confidence, and engine for any signature to understand how it contributes to scoring.
- Build tooling — use the signature list to power dashboards, audit reports, or policy management interfaces.
After adding custom signatures, call POST /v1/admin/reload to hot-reload them without restarting the server, then verify with GET /v1/signatures.
