AI Scanner configuration examples by AI endpoint provider

Views:

Use these YAML configuration examples as templates for scanning your AI application with AI Scanner. Choose the provider type that matches how your application is hosted.

AI Scanner supports five target provider types. Choose the one that matches how your application is hosted, or use the generic custom type for any other HTTP application programming interface (API). Find the configuration pattern that matches your setup and adapt it to start scanning:

Configuration file structure: Required fields shared by every provider
OpenAI and OpenAI-compatible endpoints: Models served through an OpenAI-shaped chat completions API
Amazon Bedrock: Foundation models hosted on AWS Bedrock
Azure OpenAI: Azure OpenAI Service and Azure AI Foundry deployments
Google Vertex AI: Gemini models hosted on Google Cloud
Custom HTTP endpoint: Any other API, described with request and response templates
Trend Vision One–hosted judge model: Use Trend's hosted judge instead of bringing your own

Configuration file structure

Every configuration file needs the following:

version: the configuration schema version, for example 2.9.0. AI Scanner automatically migrates older 1.x and 2.x files.
target: the AI application under test
judge: the model that scores whether an attack succeeded
One of attack_preset, attack_objectives, custom_prompts, or agentic: what to attack the target with. You can combine these.

Each target and judge block selects its provider by including exactly one of these sub-blocks: openai, bedrock, azure, vertex, custom, or trendai. You do not need to set a type field; AI Scanner infers the provider from whichever sub-block is present. Not every sub-block is valid for every role, as shown in the following table.

Provider block	Used for	Target	Judge	Agentic attacker
`openai`	OpenAI and OpenAI-compatible endpoints	Yes	Yes	Yes
`bedrock`	AWS Bedrock	Yes	No	Yes
`azure`	Azure OpenAI Service or Azure AI Foundry	Yes	No	Yes
`vertex`	Google Cloud Vertex AI	Yes	No	Yes
`custom`	Any other HTTP API with request and response templates	Yes	No	No
`trendai`	Trend Vision One–hosted model	No	Yes	Yes

Currently, the judge endpoint does not support all providers.

How AI Scanner uses the API key from api_key_env to authenticate depends on the provider:

openai and trendai: sent in an Authorization header using the Bearer scheme
azure with auth_type: api_key: sent in a fixed api-key header that is not configurable
custom: sent in an Authorization header using the Bearer scheme by default. To change the header name or prefix, use the auth_header or auth_prefix field, for example auth_prefix: "Token ".
bedrock and vertex: api_key_env does not apply. These providers authenticate through the AWS or Google Cloud credential chain, as described in their sections.

For the custom provider only, two placeholders control where AI Scanner inserts and extracts data:

{{prompt}}: AI Scanner replaces this placeholder with attack prompts at runtime.
{{response}}: AI Scanner extracts the model response from this location.

Important

Store API keys in environment variables. Do not include API keys directly in configuration files. Set the environment variable named by api_key_env before running a scan.

OpenAI and OpenAI-compatible endpoints

Use this configuration when your AI application is OpenAI itself, an OpenAI-compatible gateway, or a self-hosted model that exposes the OpenAI chat completions API.

version: 2.9.0
name: OpenAI Compatible Scan
description: Security scan for an OpenAI-compatible chat endpoint
target:
  name: my-openai-app
  endpoint: https://api.openai.com/v1/
  api_key_env: TARGET_API_KEY
  openai:
    model: gpt-4o
    system_prompt: You are a helpful customer support assistant.
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
settings:
  concurrency: 10
attack_preset: OWASP

Point endpoint at any OpenAI-compatible base URL; it does not need to be api.openai.com.

Amazon Bedrock

Use this configuration when your AI application is a foundation model hosted on AWS Bedrock.

version: 2.9.0
name: Bedrock Target Scan
description: Security scan for a Bedrock-hosted model
target:
  name: my-bedrock-app
  bedrock:
    region: us-east-1
    model: anthropic.claude-3-5-sonnet-20241022-v2:0
    temperature: 0.6
    system_prompt: You are a helpful AI assistant.
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
attack_preset: OWASP

The bedrock block does not use api_key_env. AI Scanner resolves AWS credentials through the standard AWS SDK credential chain, such as an IAM role, environment variables, a shared credentials file, or SSO. You can omit region if AWS_DEFAULT_REGION or AWS_REGION is set.

Azure OpenAI

Use this configuration for Azure OpenAI Service or Azure AI Foundry deployments. Choose one of two authentication modes with azure.auth_type.

For API key authentication, use the following configuration:

version: 2.9.0
name: Azure OpenAI Target Scan
description: Security scan for an Azure OpenAI deployment
target:
  name: my-azure-app
  endpoint: https://my-resource.openai.azure.com
  api_key_env: TARGET_API_KEY
  azure:
    deployment_name: gpt-4o
    auth_type: api_key
    temperature: 0.6
    system_prompt: You are a helpful AI assistant.
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
attack_preset: OWASP

For Microsoft Entra ID authentication, which is available for Azure OpenAI Service but not Azure AI Foundry, set auth_type: entraid and remove api_key_env. Then export AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET for a service principal that has the Cognitive Services OpenAI User role on the resource.

The endpoint accepts both *.openai.azure.com hosts for Azure OpenAI Service and *.services.ai.azure.com hosts for Azure AI Foundry.

Google Vertex AI

Use this configuration when your AI application is a Gemini model hosted on Google Cloud Vertex AI.

version: 2.9.0
name: Vertex AI Target Scan
description: Security scan for a Vertex AI-hosted Gemini model
target:
  name: my-gemini-app
  vertex:
    project: my-gcp-project
    location: us-central1
    model: gemini-2.5-flash
    temperature: 0.6
    system_prompt: You are a helpful AI assistant.
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
attack_preset: OWASP

The vertex block does not use api_key_env. Vertex AI uses Application Default Credentials (ADC). Before running a scan, authenticate with gcloud auth application-default login for local development, or configure a service account or Workload Identity Federation for automated pipelines.

Custom HTTP endpoint

Use the custom provider for any AI application that is not OpenAI-compatible, Bedrock, Azure OpenAI, or Vertex AI. The custom block describes the request and response shape of your API as YAML templates.

You must specify the following:

Endpoint URL
HTTP method
Header fields, such as content-type declarations
The JSON structure of the request body, including the location of the text prompt, marked with {{prompt}}
The JSON structure of the response body, including the location of the model output, marked with {{response}}

Simple REST API

Use this configuration when your AI application exposes a straightforward REST endpoint that accepts a prompt in a single field and returns the model response in a single field. Adapt the field names in the request and response sections to match your API schema.

version: 2.9.0
name: Simple REST API Scan
description: Security scan for a basic text generation endpoint
target:
  name: my-text-api
  endpoint: https://api.example.com/v1/generate
  api_key_env: TARGET_API_KEY
  custom:
    method: POST
    headers:
      Content-Type: application/json
    request:
      input: "{{prompt}}"
      temperature: 0.2
    response:
      answer: "{{response}}"
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
settings:
  concurrency: 10
attack_objectives:
  - name: System Prompt Leakage
    techniques:
      - None
    modifiers:
      - None
  - name: Sensitive Data Disclosure
    techniques:
      - None
    modifiers:
      - None

Chat completions API with message array

Use this configuration when your AI application follows the chat completions API convention, where prompts are sent as a messages array with role and content fields. This pattern is common for custom-hosted endpoints that follow the same request structure as OpenAI.

To include a system prompt, add it as the first entry in the messages array with role: system. AI Scanner sends each attack prompt as a role: user message.

version: 2.9.0
name: Chat Completions API Scan
description: Security scan for a chat-style AI endpoint
target:
  name: my-chat-api
  endpoint: https://api.example.com/v1/chat/completions
  api_key_env: TARGET_API_KEY
  custom:
    method: POST
    headers:
      Content-Type: application/json
    request:
      model: my-model-v1
      messages:
        - role: system
          content: You are a helpful assistant.
        - role: user
          content: "{{prompt}}"
      stream: false
    response:
      choices:
        - finish_reason: stop
          index: 0
          message:
            content: "{{response}}"
            role: assistant
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
settings:
  concurrency: 10
attack_objectives:
  - name: System Prompt Leakage
    techniques:
      - DAN (Do anything now)
    modifiers:
      - None
  - name: Malicious Code Generation
    techniques:
      - Ignore all previous instructions
    modifiers:
      - Base64 Encoding

Where the response template contains an array, such as choices here, AI Scanner extracts from index 0.

Nested request and response structure

Use this configuration when your AI application wraps the prompt and response in deeply nested JSON objects, such as APIs that include metadata or configuration parameters alongside the prompt.

version: 2.9.0
name: Nested Structure API Scan
description: Security scan for an endpoint with nested JSON payloads
target:
  name: my-nested-api
  endpoint: https://nlp.example.net/run
  api_key_env: TARGET_API_KEY
  custom:
    method: POST
    headers:
      Content-Type: application/json
    auth_prefix: "Token "
    request:
      payload:
        prompt: "{{prompt}}"
      config:
        temperature: 0.1
        max_tokens: 1000
    response:
      data:
        result:
          message: "{{response}}"
judge:
  name: judge
  endpoint: https://api.openai.com/v1/
  api_key_env: JUDGE_API_KEY
  openai:
    model: gpt-4o
settings:
  concurrency: 5
attack_objectives:
  - name: Sensitive Data Disclosure
    techniques:
      - Payload splitting
    modifiers:
      - Best-of-N Scrambling
  - name: Agent Tool Definition Leakage
    techniques:
      - None
    modifiers:
      - None

Custom endpoint limitations

JSON responses only. AI Scanner does not support non-JSON response bodies.
No streaming. AI Scanner reads the full response body before parsing, so it does not support server-sent events or chunked streams.
First array element only. Where the response template contains an array, AI Scanner always extracts from index 0.

Tip

If your application sits behind a guardrail that blocks off-topic prompts, including the connectivity check that AI Scanner sends before a scan starts, you can override the check prompt or disable it with the optional target.health_check block:

target:
  health_check:
    enabled: true      # set to false to skip the check entirely
    message: How can I do DC profiling?

Trend Vision One–hosted judge model

If you do not want to bring your own OpenAI-compatible key to score attack results, use the Trend Vision One–hosted judge model instead. The trendai provider block is available only for the judge role, and optionally the agentic attacker role. You cannot use it as the scan target, because the target is always the AI application that you are testing.

version: 2.9.0
name: TrendAI Judge Example
description: Scan a customer OpenAI target with a Trend Vision One-hosted judge
target:
  name: customer-app
  endpoint: https://api.openai.com/v1/
  api_key_env: TARGET_API_KEY
  openai:
    model: gpt-4o
judge:
  name: trend-saas-judge
  api_key_env: TREND_AI_KEY
  trendai:
    region: us
attack_preset: OWASP

The model, endpoint, system prompt, and tuning parameters are not user-configurable for this provider; AI Scanner derives them automatically from region and role which is optional and defaults to us. Supported regions:

us
eu
jp
sg
au
in
mea
uk
ca
za

Comments (0)