> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inferwall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signatures API: List and Inspect Loaded Rules

> List all loaded InferenceWall signatures or retrieve one by ID. Use these endpoints to verify custom signatures are active and inspect per-signature metadata.

The signatures endpoints let you inspect the detection signatures that InferenceWall has loaded. Use them to verify that custom signatures are active, inspect signature metadata, or build tooling on top of the signature catalog.

InferenceWall ships with 100 built-in signatures covering prompt injection, jailbreaks, content safety, data leakage, system prompt extraction, and agentic attacks. Custom signatures in `~/.inferwall/signatures/` are merged at startup and appear in the same list.

***

## GET /v1/signatures

List all loaded signatures. Returns an array of signature objects with their ID, name, category, severity, and other metadata.

### Example

```bash theme={null}
curl http://localhost:8000/v1/signatures \
  -H "Authorization: Bearer iwk_scan_YOUR_KEY"
```

```json theme={null}
[
  {
    "id": "INJ-D-002",
    "name": "Direct Prompt Injection — Instruction Override",
    "category": "injection",
    "severity": 7.0,
    "confidence": "high",
    "engine": "heuristic",
    "direction": "input",
    "enabled": true
  },
  {
    "id": "DL-S-001",
    "name": "API Key Leakage in Output",
    "category": "data-leakage",
    "severity": 12.0,
    "confidence": "high",
    "engine": "heuristic",
    "direction": "output",
    "enabled": true
  }
]
```

### Response fields

<ResponseField name="id" type="string">
  Unique signature identifier (e.g., `INJ-D-002`).
</ResponseField>

<ResponseField name="name" type="string">
  Human-readable signature name.
</ResponseField>

<ResponseField name="category" type="string">
  Detection category (e.g., `injection`, `data-leakage`, `content-safety`).
</ResponseField>

<ResponseField name="severity" type="number">
  Signature severity score, between `1` and `15`. Used in anomaly score calculation.
</ResponseField>

<ResponseField name="confidence" type="string">
  Confidence tier: `low`, `medium`, or `high`.
</ResponseField>

<ResponseField name="engine" type="string">
  Detection engine that handles this signature: `heuristic`, `classifier`, `semantic`, or `llm-judge`.
</ResponseField>

<ResponseField name="direction" type="string">
  Whether this signature applies to `input` (user prompts), `output` (LLM responses), or `both`.
</ResponseField>

<ResponseField name="enabled" type="boolean">
  Whether this signature is currently active in the loaded policy.
</ResponseField>

***

## GET /v1/signatures/{id}

Get full details for a specific signature by its ID.

### Path parameters

<ParamField path="id" type="string" required>
  The signature ID to look up (e.g., `INJ-D-002`).
</ParamField>

### Example

```bash theme={null}
curl http://localhost:8000/v1/signatures/INJ-D-002 \
  -H "Authorization: Bearer iwk_scan_YOUR_KEY"
```

```json theme={null}
{
  "id": "INJ-D-002",
  "name": "Direct Prompt Injection — Instruction Override",
  "category": "injection",
  "severity": 7.0,
  "confidence": "high",
  "engine": "heuristic",
  "direction": "input",
  "enabled": true
}
```

***

## Use cases

* **Verify custom signatures are loaded** — after adding a file to `~/.inferwall/signatures/`, call `GET /v1/signatures` and check that your signature ID appears in the list.
* **Inspect signature details** — retrieve the severity, confidence, and engine for any signature to understand how it contributes to scoring.
* **Build tooling** — use the signature list to power dashboards, audit reports, or policy management interfaces.

<Tip>
  After adding custom signatures, call `POST /v1/admin/reload` to hot-reload them without restarting the server, then verify with `GET /v1/signatures`.
</Tip>

For guidance on writing your own signatures, see [Custom Signatures](/guides/custom-signatures).