> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a detection engine ## OpenAPI ````yaml /api-reference/openapi.yaml post /api/dlp/admin/v1/detection-engines openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/dlp/admin/v1/detection-engines: post: tags: - dlp summary: Create a detection engine operationId: create_detection_engine requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateDetectionEngineRequest' required: true responses: '201': description: The created detection engine content: application/json: schema: $ref: '#/components/schemas/DetectionEngineResponse' '400': description: Unknown provider type, detection type or connection content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '401': description: Missing or invalid bearer token content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '403': description: >- Caller lacks a tenant-admin role, or the provider type is not enabled for this organization content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '409': description: >- Another engine in this organization already uses this name for this provider type content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' components: schemas: CreateDetectionEngineRequest: type: object required: - name - provider_type properties: config: {} enabled_detection_types: type: array items: type: string name: type: string provider_connection_name: type: - string - 'null' provider_type: type: string DetectionEngineResponse: type: object required: - id - org_id - name - provider_type - enabled_detection_types - supported_detection_types - supported_actions - provider_class - capabilities - runtime_stages - config - created_at - updated_at properties: capabilities: $ref: '#/components/schemas/DetectionEngineCapabilitiesResponse' config: {} created_at: type: string format: date-time created_by: type: - string - 'null' enabled_detection_types: type: array items: type: string id: type: string name: type: string org_id: type: string provider_class: type: string provider_connection_name: type: - string - 'null' provider_type: type: string runtime_stages: type: array items: type: string supported_actions: type: array items: type: string supported_detection_types: type: array items: type: string description: >- Every `DETECTION_TYPE_*` this engine's provider can produce, code-derived from the backend capability tables (coverage compiler). The frontend reads this instead of re-encoding per-engine type Sets by hand. updated_at: type: string format: date-time updated_by: type: - string - 'null' DlpErrorResponse: type: object description: >- The error body every `/admin/v1` handler returns. Two shapes reach the wire and both are modelled here as optional fields: the shared auth/role gate in [`super`] emits `{"error": ...}`, while [`super::json_message`] — which the handlers themselves use — emits `{"message": ...}`. Exactly one is present on any given response. This is documentation of what the service already does, not a new contract; a handler is not free to send both. properties: error: type: - string - 'null' description: Set by the authentication and tenant-admin role gate (401 and 403). message: type: - string - 'null' description: Set by handler-level validation and store failures. DetectionEngineCapabilitiesResponse: type: object required: - provider_class - pii_detection - secret_detection - prompt_attack_detection - span_offsets - confidence_scores - native_masking - native_blocking - supports_tokenization_pipeline properties: confidence_scores: type: boolean native_blocking: type: boolean native_masking: type: boolean pii_detection: type: boolean prompt_attack_detection: type: boolean provider_class: type: string secret_detection: type: boolean span_offsets: type: boolean supports_tokenization_pipeline: type: boolean securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.