# openshield

> Two APIs from one account. AI moderation for images and text: one HTTP call answers accept, review or reject, with the categories, scores and thresholds behind the decision. Fraud prevention for sign-ups, logins and payments: one call answers allow, step up, hold or block, with the rules that fired. Built on openmod and openfraud, the open-source engines.

## Documentation Sets

- [openshield documentation](https://openshield.dev/llms-full.txt): The text of every page of the documentation in one file.

## Product

What openshield is for, one page for each.

- [For your SaaS](https://openshield.dev/for/saas): Moderate posts, comments, avatars and uploads before they go live.
- [For your AI agents](https://openshield.dev/for/agents): Moderate what an agent reads and what it writes.
- [Image moderation API](https://openshield.dev/image-moderation-api): Nudity, gore, weapons and more, with a score per category.
- [Text moderation API](https://openshield.dev/text-moderation-api): Unsafe text, personal data, spam and scams, with the reasons.
- [Fraud prevention API](https://openshield.dev/fraud-prevention-api): Sign-up farms, card testing and account takeover, with your own openfraud instance.
- [SightEngine alternative](https://openshield.dev/sightengine-alternative): The same workflow routes: a new base URL and a new key.
- [Alternatives compared](https://openshield.dev/alternatives): How openshield compares with Hive, Amazon Rekognition, Google Cloud Vision, Azure and OpenAI.
- [Hive Moderation alternative](https://openshield.dev/hive-moderation-alternative): Visual and text moderation priced per 1,000 requests, and what openshield does differently.
- [Amazon Rekognition alternative](https://openshield.dev/aws-rekognition-alternative): Image and video moderation billed per image, and what openshield does differently.
- [Google Cloud Vision SafeSearch alternative](https://openshield.dev/google-cloud-vision-alternative): SafeSearch explicit-content detection billed per unit, and what openshield does differently.
- [Azure AI Content Safety alternative](https://openshield.dev/azure-content-safety-alternative): Text and image analysis billed per 1,000 records, and what openshield does differently.
- [OpenAI moderation API alternative](https://openshield.dev/openai-moderation-alternative): A free moderation endpoint for text and images, and what openshield does differently.

## Site

- [Pricing](https://openshield.dev/pricing): Free use each month, then a prepaid balance, priced by what each check uses.
- [Status of the openshield API](https://openshield.dev/status): Uptime and incidents for the openshield API and dashboard.
- [Contact us](https://openshield.dev/contact): Write to the openshield team about sales, support, billing, privacy or security. We answer by email, usually within two working days.
- [Changelog of the openshield API](https://openshield.dev/changelog): What changed in the openshield API and dashboard, newest first.
- [openmod on GitHub](https://github.com/regisandre/openmod-rs): The open-source moderation engine under the Apache-2.0 licence.
- [openfraud on GitHub](https://github.com/regisandre/openfraud-rs): The open-source fraud prevention engine under the Apache-2.0 licence.

## Docs

Every page below is available as raw markdown.

- [Overview](https://openshield.dev/raw/docs.md): openshield is an AI moderation API for images and text, and a fraud prevention API for sign-ups and payments. One HTTP call, a decision, the reasons.
- [AI coding agents](https://openshield.dev/raw/docs/ai-agents.md): Hand the integration to your coding agent with a ready prompt, llms.txt and the OpenAPI document.
- [API reference](https://openshield.dev/raw/docs/api-reference.md): Every endpoint of the moderation API in one table, the fraud prevention routes, and the OpenAPI document.
- [Authentication and keys](https://openshield.dev/raw/docs/authentication.md): How to call the API with a key, what a key may do and how to keep it safe.
- [Best practices](https://openshield.dev/raw/docs/best-practices.md): Server-side only, fail closed, downscale images, and show users messages you choose by category id.
- [Changelog](https://openshield.dev/raw/docs/changelog.md): New features and changes to the openshield API and dashboard, newest first.
- [Device token and challenges](https://openshield.dev/raw/docs/device-and-challenges.md): Add the device script to your pages, send its token with each sensitive event, and report the outcome of a step-up challenge.
- [Fraud prevention](https://openshield.dev/raw/docs/fraud-prevention.md): Score sign-ups, logins and payments with /fraud/v1/decide, report events with /fraud/v1/events, and get a webhook when a case opens.
- [Images](https://openshield.dev/raw/docs/images.md): Check an image with POST /v1/image, sent as bytes or as a public URL.
- [Cloudflare Workers](https://openshield.dev/raw/docs/integration-guides/cloudflare-workers.md): Moderate content from a Worker, with the key as a Worker secret.
- [Go](https://openshield.dev/raw/docs/integration-guides/go.md): A moderation package for Go with net/http and the standard library only.
- [Moderate an AI agent](https://openshield.dev/raw/docs/integration-guides/moderate-ai-agents.md): Check what an agent reads and what it writes with two calls and a fallback, so nothing unchecked reaches the model or the reader.
- [Node.js and TypeScript](https://openshield.dev/raw/docs/integration-guides/nodejs.md): A small moderation module for Node.js 18 or later, with timeouts and a decision that fails closed.
- [Nuxt and Next](https://openshield.dev/raw/docs/integration-guides/nuxt-and-next.md): Moderate content in a Nuxt server route or a Next.js route handler, so the key never leaves the server.
- [PHP](https://openshield.dev/raw/docs/integration-guides/php.md): A moderation helper for PHP 8.1 or later with cURL, and no dependency.
- [Python](https://openshield.dev/raw/docs/integration-guides/python.md): A moderation module for Python 3 with the requests library.
- [Supabase Edge Functions](https://openshield.dev/raw/docs/integration-guides/supabase-edge-functions.md): Moderate content from a Supabase Edge Function, with the key as a project secret.
- [The journal and ref](https://openshield.dev/raw/docs/journal-and-ref.md): What the decision journal keeps, how long, and how your own id (ref) lets you find a decision.
- [Limits and quotas](https://openshield.dev/raw/docs/limits-and-quotas.md): What a check costs, how the prepaid balance works, how fast you may call the API, and what happens when a limit is reached.
- [MCP server](https://openshield.dev/raw/docs/mcp-server.md): Connect Claude, Cursor, VS Code or your own agent to your openshield organization through the Model Context Protocol, with OAuth and your own role.
- [Migrating from SightEngine](https://openshield.dev/raw/docs/migrating-from-sightengine.md): Three SightEngine workflow routes work here with the same paths, request fields and answer envelope. Change the base URL and key, map the category ids.
- [Privacy and data](https://openshield.dev/raw/docs/privacy-and-data.md): What openshield stores and what it never stores, where, and for how long.
- [Quickstart](https://openshield.dev/raw/docs/quickstart.md): Your first check in five minutes, from an account to a key and one request.
- [Responses and errors](https://openshield.dev/raw/docs/responses-and-errors.md): Every field of an answer, the error envelope with its types, and the headers on every response.
- [Texts](https://openshield.dev/raw/docs/texts.md): Check a text with POST /v1/text, for comments, messages, names and bios.
- [Workflows](https://openshield.dev/raw/docs/workflows.md): A workflow decides which categories are checked and how strictly, with thresholds, custom categories and versions.

## Landing

Every page below is available as raw markdown.

- [openshield docs](https://openshield.dev/raw/index.md): AI moderation for images and text, with one HTTP call.

## Notes

- The API base URL is https://api.openshield.dev. Call it from a server with a key in the Authorization header: the API refuses calls from browsers.
- The moderation API checks images and text. It does not check video or audio, it does not detect prompt injection, and it has no human review.
- Moderation content is checked in memory and never stored. The checking server and the databases are in the European Union.
- The fraud prevention API (/fraud/v1) runs one openfraud instance per organization, on a server in Germany. Its events, decisions and cases are kept 90 days, and email addresses and IP addresses are replaced by keyed pseudonyms.
- The engines, openmod and openfraud, are open source under the Apache-2.0 licence and can be run on your own: https://github.com/regisandre/openmod-rs and https://github.com/regisandre/openfraud-rs