> ## Documentation Index
> Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy Responses

> Proxy OpenAI's Responses API through the policy engine.

Same handler as the other two routes, because the scanning path is shaped
by the *body*, not the URL: `normalize_request` reads `instructions` and
`input` alongside `system` and `messages`, `_text_segments` reads `output`
alongside `choices`, and the SSE accumulator already recognises the
`response.*` frame family.

That ordering is the point. This route did not exist for as long as those
three did not — a passthrough that forwarded a Responses body would have
found no `messages`, no `choices` and no known frames, and returned `allow`
on every request without scanning a single byte. Adding the route before
teaching the parsers its shape would have shipped a hole, not a feature.



## OpenAPI

````yaml /api-reference/openapi-developer.json post /api/v1/responses
openapi: 3.1.0
info:
  title: PromptGuard Developer API
  description: >-
    Public API for developers to integrate PromptGuard security into their
    applications
  version: 1.0.0
servers:
  - url: https://api.promptguard.co
    description: Production
security:
  - ApiKeyAuth: []
paths:
  /api/v1/responses:
    post:
      summary: Proxy Responses
      description: >-
        Proxy OpenAI's Responses API through the policy engine.


        Same handler as the other two routes, because the scanning path is
        shaped

        by the *body*, not the URL: `normalize_request` reads `instructions` and

        `input` alongside `system` and `messages`, `_text_segments` reads
        `output`

        alongside `choices`, and the SSE accumulator already recognises the

        `response.*` frame family.


        That ordering is the point. This route did not exist for as long as
        those

        three did not — a passthrough that forwarded a Responses body would have

        found no `messages`, no `choices` and no known frames, and returned
        `allow`

        on every request without scanning a single byte. Adding the route before

        teaching the parsers its shape would have shipped a hole, not a feature.
      operationId: proxy_responses_api_v1_responses_post
      parameters:
        - name: x-api-key
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: X-Api-Key
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: >-
        PromptGuard API key for developer endpoints. Keys start with pg_live_
        and are created in the dashboard.

````