What a jailbreak preset actually does (and what it never does).

Preset in one paragraph

Not a fine-tune, not a client system prompt. You send OpenAI-compatible JSON to one endpoint; the relay attaches a named, versioned preset for that request only (for example X-Relay-Preset: redteam-fiction-v1), then forwards to the model you pinned. Same key, same bill, every lab. The preset name travels with the model list from GET /v1/models, so any refusal rate you publish is reproducible: dataset in, metrics out.

POST /v1/chat/completions  base https://app.rawline.dev/v1
Header: X-Relay-Preset: redteam-fiction-v1  (per request, versioned)
Body: {"model": "", "messages": [...]}

What changes — and what stays refused

What changes: lawful creative that stock chats moralize about — long personas that stay in role, horror, dark humor, protest art you have rights to test — plus edge-case prompts researchers use to probe refusal boundaries. What never changes: illegal content, CSAM, non-consensual intimacy, weapons, cyberattacks on unauthorized targets, fraud and other criminal facilitation stay refused in both runs. That split is the finding: the delta between baseline (no preset) and preset run isolates false refusals from correct ones.

Use it in evals without fooling yourself

Pin the model. Run 30-50 lawful edge-cases twice (baseline vs preset). Score refuse/comply plus quality, report raw rates — not only the delta — with preset name, model pins and dataset hash. Keep logs free of illegal content. Then harden your own guardrails and re-run. If you only need a persona to chat with, buy the chat app — the API is for scripts that loop and score.