superagent_

// context guardrails

Messages

Score SMS, WhatsApp, and social messages before an agent trusts their text or follows outbound links.

Score a normalized SMS, WhatsApp, or social message before an agent reads it or follows a link inside it. The message endpoint scans text and outbound https links. It does not scan media or attachments.

Use the email endpoint instead for email. Email scans can inspect sender identity and, when you submit raw RFC 822, authentication headers, MIME structure, and attachments.

Request

Send application/json to POST /api/v1/context/message:

Field Type Required Description
text string yes Message text to scan
channel string no Provider-neutral channel label such as sms, whatsapp, or instagram
links string[] no Outbound https links associated with the message 
curl "https://superagent.sh/api/v1/context/message?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{
    "text": "Review the account notice at https://login.example.net/reset",
    "channel": "whatsapp",
    "links": ["https://login.example.net/reset"]
  }'

The response uses the standard Context Guardrails API envelope. Use mode=full when you need the completed verdict in the same request, and use details=true to include all detected threats.

The artifact identifier is the SHA-256 digest of the canonical channel, text, and link fields. Look up a completed result without starting another scan:

curl "https://superagent.sh/api/v1/context/message/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

What gets scanned

Message scans evaluate untrusted text for phishing, credential harvesting, social engineering, prompt injection, and exfiltration patterns. Outbound https links are checked as web content.

Identity is not scored for social messages. The identity sub-score is a neutral compatibility value with zero weight, and the identity tier is reported as skipped. Completed message confidence is capped at medium.

The endpoint is intentionally text only. Images, audio, video, documents, stickers, and other media are out of scope. Do not treat a safe message verdict as a verdict on omitted media or attachments.

Integrate a provider

Verify the provider's webhook signature against the raw request before parsing or normalizing the payload. Then map its text, channel name, and outbound https links into the provider-neutral request above.

For Bird Channels webhooks, see the Bird integration.

Next steps