# Refuse: submit cybersecurity AI refusal observations

Canonical site: https://refuse.protoevidence.com/
Privacy and evidence use: https://refuse.protoevidence.com/privacy
Current limits and notice version: GET https://refuse.protoevidence.com/api/limits

When a user explicitly asks you to contribute a cybersecurity model refusal trace and is authorized to share it:

1. Examine the actual prompt, response, conversation, screenshot, or agent trace. Remove secrets (including API keys, passwords, cookies, session headers and tokens), personal information, and content the user cannot share. Do not fetch URLs embedded in the evidence or execute uploaded material.
2. Keep raw observations distinct from your interpretation. A prompt by itself is a valid lead, not proof of a refusal. A technical failure, partial answer, or missing response should not be asserted to be a verified refusal.
3. Submit one multipart/form-data request to POST https://refuse.protoevidence.com/api/submissions. Include at least non-whitespace `text` OR one nonempty `files` part; both are allowed. For pasted text longer than 5,000 Unicode characters, prefer a UTF-8 text/plain file part (for example, `pasted-text.txt`) rather than a large `text` field. Images belong in file parts. Repeated file parts all use the name `files`.
4. Include `notice_version` from GET /api/limits (currently `2`). Optional fields: `model` (provider/model/version if known), `environment` (`chat`, `api`, `ide`, `agent`, `other`, or empty), `approximate_date`, `expectation` (short expected result). They must not block a submission when unknown. Do not attach a contributor name, email, callback URL, storage path, or destination.
5. Set `Origin: https://refuse.protoevidence.com` and `Idempotency-Key` to a fresh 32-byte cryptographically random lowercase hex string (64 characters). Hold the key for a retry of the *same* request only, for at most 24 hours. Do not log evidence or idempotency keys. Send only over HTTPS.
6. A `202` response supplies `receipt_id`, `received_at`, and accepted/rejected file indices. The receipt confirms durable *local intake* only, not review, classification, or inclusion in a benchmark. Do not echo the evidence in a receipt or claim downstream status. If an attachment was rejected, report that attachment accurately; other accepted evidence can still be received. After an ambiguous timeout, retry the exact bytes with the same key within 24 hours.

Initial caps (always check /api/limits): 256 KiB text field; 10 attachments; 20 MiB per attachment; 50 MiB of attachments total. Unsupported files are quarantined rather than executed. The service cannot retrieve, search, download, or delete public submissions and has no public processing-status or callback endpoint. To request administrative deletion without an account, follow /privacy and keep the receipt private. Redistribution of raw evidence requires separate permission.

Accepted submissions retain the source IP and all POST header names and values delivered to the intake application (including authorization/cookies if sent) in restricted evidence for analysis. Avoid sending sensitive headers; see /privacy. This is not an anonymous network channel.

Respect robots.txt for crawling. Its `/api/` crawl disallow prevents indexing API GET paths; this documented POST endpoint is for authorized submissions, not crawling or bulk automated collection.