> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # Policy Scan PDF (Legacy) > Scan a PDF for security threats using a specific policy > [!WARNING] > > **Archived**: This endpoint is legacy. Use the new [Guardrail Scan PDF](/api-reference/guardrails-api-reference/endpoint/guardrail-scan-pdf) endpoint instead, which supports separate input/output detectors via `X-Enkrypt-Mode`. ## OpenAPI ````yaml POST /guardrails/policy/scan-pdf openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. - name: Compliance description: >- Compliance APIs: connect a ChatGPT Enterprise workspace, then keep reading its compliance logs and scanning every message through one of your saved guardrails. Every endpoint here — reads as well as writes — requires the **governance officer** role on the project your API key belongs to. The organization owner is **not** exempt: an owner who has not been granted the role gets `403` like anyone else. An individual (non-organization) account cannot hold the role at all, so compliance is an organization-only feature today. A scan is addressed by name in the `X-Enkrypt-Scan` header, within the project its API key belongs to. Message text is never stored: Get Compliance Message fetches it live from the provider, and only while the provider still holds it. paths: /guardrails/policy/scan-pdf: post: tags: - Archived summary: Scan a PDF for security threats using a specific policy. description: >- Scans a PDF file for security threats using a specific policy. Returns details about any detected threats on a per-page basis, according to the selected policy. operationId: policyScanPdf parameters: - name: X-Enkrypt-Policy in: header required: true schema: type: string description: Name of the policy to apply requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PolicyScanPdfRequestBody' responses: '200': description: Scan results for the provided PDF using the specified policy. content: application/json: schema: $ref: '#/components/schemas/ScanPdfResponseBody' examples: success: value: summary: policy_violation: 0 injection_attack: 0 details: total_pages: 1 pages_with_detections: 0 detections: [] deprecated: true components: schemas: PolicyScanPdfRequestBody: title: PolicyScanPdfRequestBody type: object properties: file: type: string description: Base64-encoded PDF file content. user_metadata: $ref: '#/components/schemas/UserMetadata' required: - file ScanPdfResponseBody: title: ScanPdfResponseBody type: object required: - summary - details properties: summary: type: object description: Summary counts of detections by detector type. additionalProperties: type: integer details: type: object description: Detailed scan results including page-level information. properties: total_pages: type: integer description: Total number of pages in the PDF. pages_with_detections: type: integer description: Number of pages that had detections. detections: type: array description: List of detections found in the PDF. items: additionalProperties: true type: object user_metadata: $ref: '#/components/schemas/UserMetadata' UserMetadata: type: object description: >- Optional arbitrary metadata object echoed back in the response. Limits: at most 16 top-level keys, key names up to 64 characters, nesting depth up to 3, total serialized size up to 4 KB. When provided and valid, this object is also echoed as a top-level `user_metadata` key on error responses (4xx/5xx) of endpoints that accept it; invalid or oversized metadata is never echoed, including on the 422 response it causes. additionalProperties: true maxProperties: 16 example: request_id: abc-123 source: mobile-app securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.