openapi: 3.2.0 info: title: LiteLLM Guardrails API description: 'Proxy Server to call 100+ LLMs in the OpenAI format. **Customize Swagger Docs** 👉 ```LiteLLM Admin Panel on /ui```. Create, Edit Keys with SSO. Having issues? Try ```Fallback Login``` 💸 ```LiteLLM Model Cost Map```. 🔎 ```LiteLLM Model Hub```. See available models on the proxy. **Docs**' version: 1.102.1 tags: - name: Guardrails paths: /guardrails/list: get: tags: - Guardrails summary: List Guardrails description: 'List the guardrails that are available on the proxy server 👉 Guardrail docs Example Request: ```bash curl -X GET "http://localhost:4000/guardrails/list" -H "Authorization: Bearer " ``` Example Response: ```json { "guardrails": [ { "guardrail_name": "bedrock-pre-guard", "guardrail_info": { "params": [ { "name": "toxicity_score", "type": "float", "description": "Score between 0-1 indicating content toxicity level" }, { "name": "pii_detection", "type": "boolean" } ] } } ] } ```' operationId: list_guardrails_guardrails_list_get responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ListGuardrailsResponse' security: - APIKeyHeader: [] /v2/guardrails/list: get: tags: - Guardrails summary: List Guardrails V2 description: 'List the guardrails that are available in the database using GuardrailRegistry 👉 Guardrail docs Example Request: ```bash curl -X GET "http://localhost:4000/v2/guardrails/list" -H "Authorization: Bearer " ``` Example Response: ```json { "guardrails": [ { "guardrail_id": "123e4567-e89b-12d3-a456-426614174000", "guardrail_name": "my-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "DRAFT", "default_on": true }, "guardrail_info": { "description": "Bedrock content moderation guardrail" } } ] } ```' operationId: list_guardrails_v2_v2_guardrails_list_get responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ListGuardrailsResponse' security: - APIKeyHeader: [] /guardrails: post: tags: - Guardrails summary: Create Guardrail description: 'Create a new guardrail 👉 Guardrail docs Example Request: ```bash curl -X POST "http://localhost:4000/guardrails" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d ''{ "guardrail": { "guardrail_name": "my-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "DRAFT", "default_on": true }, "guardrail_info": { "description": "Bedrock content moderation guardrail" } } }'' ``` Example Response: ```json { "guardrail_id": "123e4567-e89b-12d3-a456-426614174000", "guardrail_name": "my-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "DRAFT", "default_on": true }, "guardrail_info": { "description": "Bedrock content moderation guardrail" }, "created_at": "2023-11-09T12:34:56.789Z", "updated_at": "2023-11-09T12:34:56.789Z" } ```' operationId: create_guardrail_guardrails_post requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateGuardrailRequest' required: true responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] /guardrails/{guardrail_id}: put: tags: - Guardrails summary: Update Guardrail description: 'Update an existing guardrail 👉 Guardrail docs Example Request: ```bash curl -X PUT "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d ''{ "guardrail": { "guardrail_name": "updated-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "1.0", "default_on": true }, "guardrail_info": { "description": "Updated Bedrock content moderation guardrail" } } }'' ``` Example Response: ```json { "guardrail_id": "123e4567-e89b-12d3-a456-426614174000", "guardrail_name": "updated-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "1.0", "default_on": true }, "guardrail_info": { "description": "Updated Bedrock content moderation guardrail" }, "created_at": "2023-11-09T12:34:56.789Z", "updated_at": "2023-11-09T13:45:12.345Z" } ```' operationId: update_guardrail_guardrails__guardrail_id__put security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateGuardrailRequest' responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' delete: tags: - Guardrails summary: Delete Guardrail description: 'Delete a guardrail 👉 Guardrail docs Example Request: ```bash curl -X DELETE "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000" \ -H "Authorization: Bearer " ``` Example Response: ```json { "message": "Guardrail 123e4567-e89b-12d3-a456-426614174000 deleted successfully" } ```' operationId: delete_guardrail_guardrails__guardrail_id__delete security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' patch: tags: - Guardrails summary: Patch Guardrail description: 'Partially update an existing guardrail 👉 Guardrail docs This endpoint allows updating specific fields of a guardrail without sending the entire object. Only the following fields can be updated: - guardrail_name: The name of the guardrail - default_on: Whether the guardrail is enabled by default - guardrail_info: Additional information about the guardrail Example Request: ```bash curl -X PATCH "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d ''{ "guardrail_name": "updated-name", "default_on": true, "guardrail_info": { "description": "Updated description" } }'' ``` Example Response: ```json { "guardrail_id": "123e4567-e89b-12d3-a456-426614174000", "guardrail_name": "updated-name", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "DRAFT", "default_on": true }, "guardrail_info": { "description": "Updated description" }, "created_at": "2023-11-09T12:34:56.789Z", "updated_at": "2023-11-09T14:22:33.456Z" } ```' operationId: patch_guardrail_guardrails__guardrail_id__patch security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/PatchGuardrailRequest' responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' get: tags: - Guardrails summary: Get Guardrail Info description: 'Get detailed information about a specific guardrail by ID 👉 Guardrail docs Example Request: ```bash curl -X GET "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000/info" \ -H "Authorization: Bearer " ``` Example Response: ```json { "guardrail_id": "123e4567-e89b-12d3-a456-426614174000", "guardrail_name": "my-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "DRAFT", "default_on": true }, "guardrail_info": { "description": "Bedrock content moderation guardrail" }, "created_at": "2023-11-09T12:34:56.789Z", "updated_at": "2023-11-09T12:34:56.789Z" } ```' operationId: get_guardrail_info_guardrails__guardrail_id__get security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/register: post: tags: - Guardrails summary: Register Guardrail description: 'Register a guardrail for onboarding (team submission). Accepts a guardrail config in the Generic Guardrail API format. The submission is stored with status `pending_review` until an admin approves it.' operationId: register_guardrail_guardrails_register_post requestBody: content: application/json: schema: $ref: '#/components/schemas/RegisterGuardrailRequest' required: true responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/RegisterGuardrailResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] /guardrails/submissions: get: tags: - Guardrails summary: List Guardrail Submissions description: 'List team guardrail submissions. Returns only guardrails with a team_id. Admins see all submissions. Non-admin users see submissions for teams they are a member of. Status values: pending_review (team-registered, awaiting approval), active (approved), rejected. Optional filters: - status: pending_review | active | rejected - team_id: filter by specific team (non-admins must be a member of that team) - search: name/description' operationId: list_guardrail_submissions_guardrails_submissions_get security: - APIKeyHeader: [] parameters: - name: status in: query required: false schema: anyOf: - type: string - type: 'null' title: Status - name: team_id in: query required: false schema: anyOf: - type: string - type: 'null' title: Team Id - name: search in: query required: false schema: anyOf: - type: string - type: 'null' title: Search responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ListGuardrailSubmissionsResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/submissions/{guardrail_id}: get: tags: - Guardrails summary: Get Guardrail Submission description: Get a single guardrail submission by id. Non-admins may only access submissions for teams they belong to. operationId: get_guardrail_submission_guardrails_submissions__guardrail_id__get security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/GuardrailSubmissionItem' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/submissions/{guardrail_id}/approve: post: tags: - Guardrails summary: Approve Guardrail Submission description: 'Approve a pending guardrail submission: set status to active and initialize in memory (admin only).' operationId: approve_guardrail_submission_guardrails_submissions__guardrail_id__approve_post security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/submissions/{guardrail_id}/reject: post: tags: - Guardrails summary: Reject Guardrail Submission description: Reject a guardrail submission (admin only). operationId: reject_guardrail_submission_guardrails_submissions__guardrail_id__reject_post security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/{guardrail_id}/info: get: tags: - Guardrails summary: Get Guardrail Info description: 'Get detailed information about a specific guardrail by ID 👉 Guardrail docs Example Request: ```bash curl -X GET "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000/info" \ -H "Authorization: Bearer " ``` Example Response: ```json { "guardrail_id": "123e4567-e89b-12d3-a456-426614174000", "guardrail_name": "my-bedrock-guard", "litellm_params": { "guardrail": "bedrock", "mode": "pre_call", "guardrailIdentifier": "ff6ujrregl1q", "guardrailVersion": "DRAFT", "default_on": true }, "guardrail_info": { "description": "Bedrock content moderation guardrail" }, "created_at": "2023-11-09T12:34:56.789Z", "updated_at": "2023-11-09T12:34:56.789Z" } ```' operationId: get_guardrail_info_guardrails__guardrail_id__info_get security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/ui/add_guardrail_settings: get: tags: - Guardrails summary: Get Guardrail Ui Settings description: 'Get the UI settings for the guardrails Returns: - Supported entities for guardrails - Supported modes for guardrails - PII entity categories for UI organization - Content filter settings (patterns and categories)' operationId: get_guardrail_ui_settings_guardrails_ui_add_guardrail_settings_get responses: '200': description: Successful Response content: application/json: schema: {} security: - APIKeyHeader: [] /guardrails/ui/category_yaml/{category_name}: get: tags: - Guardrails summary: Get Category Yaml description: 'Get the YAML or JSON content for a specific content filter category. Args: category_name: The name of the category (e.g., "bias_gender", "harmful_self_harm") Returns: The raw YAML or JSON content of the category file with file type indicator' operationId: get_category_yaml_guardrails_ui_category_yaml__category_name__get security: - APIKeyHeader: [] parameters: - name: category_name in: path required: true schema: type: string title: Category Name responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/ui/major_airlines: get: tags: - Guardrails summary: Get Major Airlines description: 'Get the major airlines list from IATA (competitor intent, airline type). Returns airline id, match variants (pipe-separated), and tags.' operationId: get_major_airlines_guardrails_ui_major_airlines_get responses: '200': description: Successful Response content: application/json: schema: {} security: - APIKeyHeader: [] /guardrails/validate_blocked_words_file: post: tags: - Guardrails summary: Validate Blocked Words File description: 'Validate a blocked_words YAML file content. Args: request: Dictionary with ''file_content'' key containing the YAML string Returns: Dictionary with ''valid'' boolean and either ''message''/''errors'' depending on result Example Request: ```json { "file_content": "blocked_words:\n - keyword: \"test\"\n action: \"BLOCK\"" } ``` Example Success Response: ```json { "valid": true, "message": "Valid YAML file with 2 blocked words" } ``` Example Error Response: ```json { "valid": false, "errors": ["Entry 0: missing ''action'' field"] } ```' operationId: validate_blocked_words_file_guardrails_validate_blocked_words_file_post requestBody: content: application/json: schema: additionalProperties: type: string type: object title: Request required: true responses: '200': description: Successful Response content: application/json: schema: {} '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] /guardrails/ui/provider_specific_params: get: tags: - Guardrails summary: Get Provider Specific Params description: 'Get provider-specific parameters for different guardrail types. Returns a dictionary mapping guardrail providers to their specific parameters, including parameter names, descriptions, and whether they are required. Example Response: ```json { "bedrock": { "guardrailIdentifier": { "description": "The ID of your guardrail on Bedrock", "required": true, "type": null }, "guardrailVersion": { "description": "The version of your Bedrock guardrail (e.g., DRAFT or version number)", "required": true, "type": null } }, "azure_content_safety_text_moderation": { "api_key": { "description": "API key for the Azure Content Safety Text Moderation guardrail", "required": false, "type": null }, "optional_params": { "description": "Optional parameters for the Azure Content Safety Text Moderation guardrail", "required": true, "type": "nested", "fields": { "severity_threshold": { "description": "Severity threshold for the Azure Content Safety Text Moderation guardrail across all categories", "required": false, "type": null }, "categories": { "description": "Categories to scan for the Azure Content Safety Text Moderation guardrail", "required": false, "type": "multiselect", "options": ["Hate", "SelfHarm", "Sexual", "Violence"], "default_value": None } } } } } ```' operationId: get_provider_specific_params_guardrails_ui_provider_specific_params_get responses: '200': description: Successful Response content: application/json: schema: {} security: - APIKeyHeader: [] /guardrails/test_custom_code: post: tags: - Guardrails summary: Test Custom Code Guardrail description: 'Test custom code guardrail logic without creating a guardrail. This endpoint allows admins to experiment with custom code guardrails by: 1. Compiling the provided code in a sandbox 2. Executing the apply_guardrail function with test input 3. Returning the result (allow/block/modify) 👉 Custom Code Guardrail docs Example Request: ```bash curl -X POST "http://localhost:4000/guardrails/test_custom_code" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d ''{ "custom_code": "def apply_guardrail(inputs, request_data, input_type):\n for text in inputs[\"texts\"]:\n if regex_match(text, r\"\\d{3}-\\d{2}-\\d{4}\"):\n return block(\"SSN detected\")\n return allow()", "test_input": { "texts": ["My SSN is 123-45-6789"] }, "input_type": "request" }'' ``` Example Success Response (blocked): ```json { "success": true, "result": { "action": "block", "reason": "SSN detected" }, "error": null, "error_type": null } ``` Example Success Response (allowed): ```json { "success": true, "result": { "action": "allow" }, "error": null, "error_type": null } ``` Example Success Response (modified): ```json { "success": true, "result": { "action": "modify", "texts": ["My SSN is [REDACTED]"] }, "error": null, "error_type": null } ``` Example Error Response (compilation error): ```json { "success": false, "result": null, "error": "Syntax error in custom code: invalid syntax (, line 1)", "error_type": "compilation" } ```' operationId: test_custom_code_guardrail_guardrails_test_custom_code_post requestBody: content: application/json: schema: $ref: '#/components/schemas/TestCustomCodeGuardrailRequest' required: true responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/TestCustomCodeGuardrailResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] /guardrails/apply_guardrail: post: summary: Apply Guardrail description: 'Apply a guardrail to text input and return the processed result. This endpoint allows testing guardrails by applying them to custom text inputs.' operationId: apply_guardrail_guardrails_apply_guardrail_post requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplyGuardrailRequest' required: true responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ApplyGuardrailResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' security: - APIKeyHeader: [] tags: - Guardrails /guardrails/usage/overview: get: tags: - Guardrails summary: Guardrails Usage Overview description: Return guardrail performance overview for the dashboard. operationId: guardrails_usage_overview_guardrails_usage_overview_get security: - APIKeyHeader: [] parameters: - name: start_date in: query required: false schema: anyOf: - type: string - type: 'null' description: YYYY-MM-DD title: Start Date description: YYYY-MM-DD - name: end_date in: query required: false schema: anyOf: - type: string - type: 'null' description: YYYY-MM-DD title: End Date description: YYYY-MM-DD responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/UsageOverviewResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/usage/detail/{guardrail_id}: get: tags: - Guardrails summary: Guardrails Usage Detail description: Return single guardrail usage metrics and time series. operationId: guardrails_usage_detail_guardrails_usage_detail__guardrail_id__get security: - APIKeyHeader: [] parameters: - name: guardrail_id in: path required: true schema: type: string title: Guardrail Id - name: start_date in: query required: false schema: anyOf: - type: string - type: 'null' title: Start Date - name: end_date in: query required: false schema: anyOf: - type: string - type: 'null' title: End Date responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/UsageDetailResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' /guardrails/usage/logs: get: tags: - Guardrails summary: Guardrails Usage Logs description: Return paginated run logs for a guardrail (or policy) from SpendLogs via index. operationId: guardrails_usage_logs_guardrails_usage_logs_get security: - APIKeyHeader: [] parameters: - name: guardrail_id in: query required: false schema: anyOf: - type: string - type: 'null' title: Guardrail Id - name: policy_id in: query required: false schema: anyOf: - type: string - type: 'null' title: Policy Id - name: page in: query required: false schema: type: integer minimum: 1 default: 1 title: Page - name: page_size in: query required: false schema: type: integer maximum: 100 minimum: 1 default: 50 title: Page Size - name: action in: query required: false schema: anyOf: - type: string - type: 'null' title: Action - name: start_date in: query required: false schema: anyOf: - type: string - type: 'null' title: Start Date - name: end_date in: query required: false schema: anyOf: - type: string - type: 'null' title: End Date responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/UsageLogsResponse' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: ApplyGuardrailRequest: properties: guardrail_name: type: string title: Guardrail Name text: type: string title: Text language: anyOf: - type: string - type: 'null' title: Language entities: anyOf: - items: $ref: '#/components/schemas/PiiEntityType' type: array - type: 'null' title: Entities input_type: type: string title: Input Type default: request messages: anyOf: - items: additionalProperties: true type: object type: array - type: 'null' title: Messages metadata: anyOf: - additionalProperties: true type: object - type: 'null' title: Metadata type: object required: - guardrail_name - text title: ApplyGuardrailRequest ContentFilterCategoryConfig: properties: category: type: string title: Category description: The category to detect enabled: type: boolean title: Enabled description: Whether the category is enabled default: true action: type: string enum: - BLOCK - MASK title: Action description: The action to take when the category is detected severity_threshold: type: string enum: - high - medium - low title: Severity Threshold description: The severity threshold to detect the category default: medium category_file: anyOf: - type: string - type: 'null' title: Category File description: Optional override. Use your own category file instead of the default one. additionalProperties: true type: object required: - category - action title: ContentFilterCategoryConfig description: "category: \"harmful_self_harm\"\n enabled: true\n action: \"BLOCK\"\n severity_threshold: \"medium\"\n category_file: \"/path/to/custom_file.yaml\" # optional override" PatchGuardrailRequest: properties: guardrail_name: anyOf: - type: string - type: 'null' title: Guardrail Name litellm_params: anyOf: - $ref: '#/components/schemas/BaseLitellmParams' - type: 'null' guardrail_info: anyOf: - additionalProperties: true type: object - type: 'null' title: Guardrail Info type: object title: PatchGuardrailRequest CreateGuardrailRequest: properties: guardrail: $ref: '#/components/schemas/Guardrail' type: object required: - guardrail title: CreateGuardrailRequest GUARDRAIL_DEFINITION_LOCATION: type: string enum: - db - config title: GUARDRAIL_DEFINITION_LOCATION UsageDetailResponse: properties: guardrail_id: type: string title: Guardrail Id guardrail_name: type: string title: Guardrail Name type: type: string title: Type provider: type: string title: Provider requestsEvaluated: type: integer title: Requestsevaluated failRate: type: number title: Failrate avgScore: anyOf: - type: number - type: 'null' title: Avgscore avgLatency: anyOf: - type: number - type: 'null' title: Avglatency status: type: string title: Status trend: type: string title: Trend description: anyOf: - type: string - type: 'null' title: Description time_series: items: $ref: '#/components/schemas/UsageChartPoint' type: array title: Time Series usage_units: additionalProperties: type: integer type: object title: Usage Units usage_units_daily: items: $ref: '#/components/schemas/UsageUnitsDailyPoint' type: array title: Usage Units Daily usage_units_by_team: additionalProperties: additionalProperties: type: integer type: object type: object title: Usage Units By Team usage_units_by_key: additionalProperties: additionalProperties: type: integer type: object type: object title: Usage Units By Key cost: anyOf: - type: number - type: 'null' title: Cost cost_by_unit: additionalProperties: anyOf: - type: number - type: 'null' type: object title: Cost By Unit cost_by_team: additionalProperties: anyOf: - type: number - type: 'null' type: object title: Cost By Team cost_by_key: additionalProperties: anyOf: - type: number - type: 'null' type: object title: Cost By Key untracked_usage_units: additionalProperties: type: integer type: object title: Untracked Usage Units untracked_usage_units_by_team: additionalProperties: additionalProperties: type: integer type: object type: object title: Untracked Usage Units By Team untracked_usage_units_by_key: additionalProperties: additionalProperties: type: integer type: object type: object title: Untracked Usage Units By Key type: object required: - guardrail_id - guardrail_name - type - provider - requestsEvaluated - failRate - avgScore - avgLatency - status - trend - description - time_series - usage_units - usage_units_daily - usage_units_by_team - usage_units_by_key - cost - cost_by_unit - cost_by_team - cost_by_key - untracked_usage_units - untracked_usage_units_by_team - untracked_usage_units_by_key title: UsageDetailResponse ToolPermissionRule: properties: id: type: string title: Id description: Unique identifier for the rule tool_name: anyOf: - type: string - type: 'null' title: Tool Name description: Regex pattern applied to the tool's function name tool_type: anyOf: - type: string - type: 'null' title: Tool Type description: Regex pattern applied to the tool type (e.g., function) decision: type: string enum: - allow - deny title: Decision description: Whether to allow or deny this tool usage allowed_param_patterns: anyOf: - additionalProperties: type: string type: object - type: 'null' title: Allowed Param Patterns description: Optional regex map enforcing nested parameter values using dot/[] paths type: object required: - id - decision title: ToolPermissionRule description: A rule defining permission for a specific tool or tool pattern ListGuardrailsResponse: properties: guardrails: items: $ref: '#/components/schemas/GuardrailInfoResponse' type: array title: Guardrails type: object required: - guardrails title: ListGuardrailsResponse PiiAction: type: string enum: - BLOCK - MASK title: PiiAction ContentFilterAction: type: string enum: - BLOCK - MASK title: ContentFilterAction description: Action to take when content filter detects a match ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError ListGuardrailSubmissionsResponse: properties: submissions: items: $ref: '#/components/schemas/GuardrailSubmissionItem' type: array title: Submissions summary: $ref: '#/components/schemas/GuardrailSubmissionSummary' type: object required: - submissions - summary title: ListGuardrailSubmissionsResponse HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError CiscoAIDefenseGuardrailConfigModelOptionalParams: properties: inspection_type: type: string enum: - chat - mcp title: Inspection Type description: Which Cisco AI Defense inspection surface to use. 'chat' scans LLM model conversations via /api/v1/inspect/chat. 'mcp' scans MCP tool calls via /api/v1/inspect/mcp. Each guardrail instance targets exactly one surface; configure two guardrails to scan both chat and MCP traffic. default: chat inspect_path: anyOf: - type: string - type: 'null' title: Inspect Path description: Override for the inspection endpoint path. Defaults to /api/v1/inspect/chat when inspection_type='chat' and /api/v1/inspect/mcp when inspection_type='mcp'. enabled_rules: anyOf: - items: $ref: '#/components/schemas/CiscoAIDefenseRule' type: array - type: 'null' title: Enabled Rules description: Explicit list of Cisco AI Defense rules to evaluate. If omitted, the policies configured for the API key in the Cisco AI Defense UI are used. integration_profile_id: anyOf: - type: string - type: 'null' title: Integration Profile Id description: Integration profile id to apply (advanced). integration_profile_version: anyOf: - type: string - type: 'null' title: Integration Profile Version description: Integration profile version to apply (advanced). integration_tenant_id: anyOf: - type: string - type: 'null' title: Integration Tenant Id description: Integration tenant id to apply (advanced). integration_type: anyOf: - type: string - type: 'null' title: Integration Type description: Integration type to apply (advanced). on_flagged_action: anyOf: - type: string - type: 'null' title: On Flagged Action description: Action to take when Cisco AI Defense flags content. 'block' raises an HTTPException; 'monitor' logs the detection and lets the request continue. default: block fallback_on_error: anyOf: - type: string enum: - allow - block - type: 'null' title: Fallback On Error description: 'Behaviour when the Cisco AI Defense API is unavailable: ''allow'' proceeds without scanning (high availability), ''block'' rejects the request (maximum security).' default: block timeout: anyOf: - type: number maximum: 60.0 minimum: 1.0 - type: 'null' title: Timeout description: Timeout (seconds) for Cisco AI Defense API calls (1-60). default: 10.0 additionalProperties: true type: object title: CiscoAIDefenseGuardrailConfigModelOptionalParams description: Optional parameters for the Cisco AI Defense guardrail. RegisterGuardrailRequest: properties: guardrail_name: type: string title: Guardrail Name litellm_params: additionalProperties: true type: object title: Litellm Params guardrail_info: anyOf: - additionalProperties: true type: object - type: 'null' title: Guardrail Info team_id: anyOf: - type: string - type: 'null' title: Team Id type: object required: - guardrail_name - litellm_params title: RegisterGuardrailRequest description: Request body for POST /guardrails/register. Follows Generic Guardrail API config. TestCustomCodeGuardrailRequest: properties: custom_code: type: string title: Custom Code test_input: additionalProperties: true type: object title: Test Input input_type: type: string title: Input Type default: request request_data: anyOf: - additionalProperties: true type: object - type: 'null' title: Request Data type: object required: - custom_code - test_input title: TestCustomCodeGuardrailRequest description: Request model for testing custom code guardrails. RegisterGuardrailResponse: properties: guardrail_id: type: string title: Guardrail Id guardrail_name: type: string title: Guardrail Name status: type: string title: Status submitted_at: anyOf: - type: string format: date-time - type: 'null' title: Submitted At type: object required: - guardrail_id - guardrail_name - status title: RegisterGuardrailResponse LakeraCategoryThresholds: properties: prompt_injection: type: number title: Prompt Injection jailbreak: type: number title: Jailbreak additionalProperties: true type: object title: LakeraCategoryThresholds ContentFilterPattern: properties: pattern_type: type: string enum: - prebuilt - regex title: Pattern Type description: 'Type of pattern: ''prebuilt'' for predefined patterns or ''regex'' for custom' pattern_name: anyOf: - type: string - type: 'null' title: Pattern Name description: Name of prebuilt pattern (e.g., 'us_ssn', 'credit_card'). Required if pattern_type is 'prebuilt' pattern: anyOf: - type: string - type: 'null' title: Pattern description: Custom regex pattern. Required if pattern_type is 'regex' name: anyOf: - type: string - type: 'null' title: Name description: Name for this pattern (used in logging and error messages) action: $ref: '#/components/schemas/ContentFilterAction' description: Action to take when pattern matches (BLOCK or MASK) type: object required: - pattern_type - action title: ContentFilterPattern description: Represents a content filter pattern (prebuilt or custom regex) PiiEntityType: type: string enum: - CREDIT_CARD - CRYPTO - DATE_TIME - EMAIL_ADDRESS - IBAN_CODE - IP_ADDRESS - NRP - LOCATION - PERSON - PHONE_NUMBER - MEDICAL_LICENSE - URL - US_BANK_NUMBER - US_DRIVER_LICENSE - US_ITIN - US_PASSPORT - US_SSN - UK_NHS - UK_NINO - UK_PASSPORT - UK_POSTCODE - UK_VEHICLE_REGISTRATION - ES_NIF - ES_NIE - IT_FISCAL_CODE - IT_DRIVER_LICENSE - IT_VAT_CODE - IT_PASSPORT - IT_IDENTITY_CARD - PL_PESEL - SG_NRIC_FIN - SG_UEN - AU_ABN - AU_ACN - AU_TFN - AU_MEDICARE - IN_PAN - IN_AADHAAR - IN_VEHICLE_REGISTRATION - IN_VOTER - IN_PASSPORT - FI_PERSONAL_IDENTITY_CODE title: PiiEntityType UsageChartPoint: properties: date: type: string title: Date passed: type: integer title: Passed blocked: type: integer title: Blocked score: anyOf: - type: number - type: 'null' title: Score type: object required: - date - passed - blocked title: UsageChartPoint GuardrailInfoResponse: properties: guardrail_id: anyOf: - type: string - type: 'null' title: Guardrail Id guardrail_name: type: string title: Guardrail Name litellm_params: anyOf: - $ref: '#/components/schemas/BaseLitellmParams' - type: 'null' guardrail_info: anyOf: - additionalProperties: true type: object - type: 'null' title: Guardrail Info created_at: anyOf: - type: string format: date-time - type: 'null' title: Created At updated_at: anyOf: - type: string format: date-time - type: 'null' title: Updated At guardrail_definition_location: $ref: '#/components/schemas/GUARDRAIL_DEFINITION_LOCATION' default: config type: object required: - guardrail_name title: GuardrailInfoResponse BedrockChecksPromptAttackModel: properties: categories: items: $ref: '#/components/schemas/BedrockChecksPromptAttackCategoryItem' type: array title: Categories type: object required: - categories title: BedrockChecksPromptAttackModel Mode: properties: tags: additionalProperties: anyOf: - type: string - items: type: string type: array type: object title: Tags description: Tags for the guardrail mode default: anyOf: - type: string - items: type: string type: array - type: 'null' title: Default description: Default mode when no tags match type: object required: - tags title: Mode BedrockChecksContentFilterModel: properties: categories: items: $ref: '#/components/schemas/BedrockChecksContentFilterCategoryItem' type: array title: Categories type: object required: - categories title: BedrockChecksContentFilterModel LitellmParams: properties: optional_params: anyOf: - $ref: '#/components/schemas/CiscoAIDefenseGuardrailConfigModelOptionalParams' - type: 'null' description: Optional parameters for the guardrail singulr_api_key: anyOf: - type: string - type: 'null' title: Singulr Api Key description: The Singulr API key. Generate API key from Singulr Platform. singulr_api_base: anyOf: - type: string - type: 'null' title: Singulr Api Base description: The Singulr API base URL. Get base URL from Singulr Platform. singulr_application_id: anyOf: - type: string - type: 'null' title: Singulr Application Id description: The Singulr application ID. Get application ID from Singulr Platform. singulr_guardrail_id: anyOf: - type: string - type: 'null' title: Singulr Guardrail Id description: The Singulr Guardrail ID. Get guardrail ID from Singulr Platform. block_on_error: anyOf: - type: boolean - type: 'null' title: Block On Error description: Whether to block the request when the PromptGuard API is unreachable. Defaults to true (fail-closed). Set to false for fail-open behaviour. api_base: anyOf: - type: string - type: 'null' title: Api Base description: 'Regional base URL for the Cisco AI Defense Inspection API. Defaults to https://us.api.inspect.aidefense.security.cisco.com. Supported regions: us (us-west-2), ap (ap-ne-1), eu (eu-central-1). The environment variable `CISCO_AI_DEFENSE_API_BASE` is consulted as a fallback. The endpoint path is derived from inspection_type (/api/v1/inspect/chat for ''chat'', /api/v1/inspect/mcp for ''mcp'').' api_key: anyOf: - type: string - type: 'null' title: Api Key description: API key for the Cisco AI Defense inspection endpoint. If not provided, the `CISCO_AI_DEFENSE_API_KEY` environment variable is used. Sent in the `X-Cisco-AI-Defense-API-Key` header. Both the chat and MCP endpoints use this key. api_id: anyOf: - type: string - type: 'null' title: Api Id description: The Hiddenlayer API Id for the Hiddenlayer API. If not provided, the `HIDDENLAYER_CLIENT_ID` environment variable is checked or https://api.hiddenlayer.ai is used. version: anyOf: - type: integer - type: 'null' title: Version description: Hiddenlayer guardrail version to use. default: 2 blocked_languages: anyOf: - items: type: string type: array - type: 'null' title: Blocked Languages description: Language tags to block (e.g. python, javascript, bash). Empty or None = block all fenced code blocks. options: - python - javascript - typescript - bash - ruby - go - java - csharp - php - c - cpp - rust - sql ui_type: multiselect action: type: string enum: - block - mask title: Action description: '''block'' raises an error; ''mask'' replaces the code block with a placeholder.' default: block confidence_threshold: type: number maximum: 1.0 minimum: 0.0 title: Confidence Threshold description: Only block or mask when detection confidence >= this value; below threshold, allow or log_only. default: 0.5 default_value: 0.5 max: 1.0 min: 0.0 step: 0.1 ui_type: percentage detect_execution_intent: type: boolean title: Detect Execution Intent description: When True, block only when user intent is to run/execute; allow when intent is explain/refactor/don't run. Also block text-only execution requests (e.g. 'run `ls`', 'read /etc/passwd'). default: true evaluation_id: anyOf: - type: string - type: 'null' title: Evaluation Id description: Pre-configured evaluation ID from Qualifire dashboard. When provided, uses invoke_evaluation() instead of evaluate(). prompt_injections: anyOf: - type: boolean - type: 'null' title: Prompt Injections description: Enable prompt injection detection. Default check if no evaluation_id and no other checks are specified. hallucinations_check: anyOf: - type: boolean - type: 'null' title: Hallucinations Check description: Enable hallucination detection to detect factual inaccuracies. grounding_check: anyOf: - type: boolean - type: 'null' title: Grounding Check description: Enable grounding verification to ensure output is grounded in provided context. pii_check: anyOf: - type: boolean - type: 'null' title: Pii Check description: Enable PII (Personally Identifiable Information) detection. content_moderation_check: anyOf: - type: boolean - type: 'null' title: Content Moderation Check description: Enable content moderation to check for harmful content (harassment, hate speech, etc.). tool_selection_quality_check: anyOf: - type: boolean - type: 'null' title: Tool Selection Quality Check description: Enable tool selection quality check to evaluate quality of tool/function calls. assertions: anyOf: - items: type: string type: array - type: 'null' title: Assertions description: Custom assertions to validate against the output. Each assertion is a string describing a condition. on_flagged: anyOf: - type: string enum: - block - monitor - inject_system_message - type: 'null' title: On Flagged description: 'Action to take when content is flagged: ''block'' (raise exception), ''monitor'' (log only), or ''inject_system_message'' (append an advisory system message and let the LLM decide)' default: block tracker_api_base: anyOf: - type: string - type: 'null' title: Tracker Api Base description: Base URL for the Ovalix Tracker service. tracker_api_key: anyOf: - type: string - type: 'null' title: Tracker Api Key description: API key for the Ovalix Tracker service. application_id: anyOf: - type: string - type: 'null' title: Application Id description: Application ID for Noma Security. Defaults to 'litellm' if not provided pre_checkpoint_id: anyOf: - type: string - type: 'null' title: Pre Checkpoint Id description: Pre-checkpoint ID for the Ovalix Tracker service. post_checkpoint_id: anyOf: - type: string - type: 'null' title: Post Checkpoint Id description: Post-checkpoint ID for the Ovalix Tracker service. auth_token: anyOf: - type: string - type: 'null' title: Auth Token description: Authorization bearer token for IBM Guardrails API. Reads from IBM_GUARDRAILS_AUTH_TOKEN env var if None. base_url: anyOf: - type: string - type: 'null' title: Base Url description: Base URL for the IBM Guardrails server detector_id: anyOf: - type: string - type: 'null' title: Detector Id description: Name of the detector inside the server (e.g., 'jailbreak-detector') is_detector_server: anyOf: - type: boolean - type: 'null' title: Is Detector Server description: Boolean flag to determine if calling a detector server (True) or the FMS Orchestrator (False). Defaults to True. default: true verify_ssl: anyOf: - type: boolean - type: 'null' title: Verify Ssl description: Whether to verify SSL certificates. Defaults to True. default: true policy_name: anyOf: - type: string - type: 'null' title: Policy Name description: The EnkryptAI policy name to use. Sent via x-enkrypt-policy header. deployment_name: anyOf: - type: string - type: 'null' title: Deployment Name description: The EnkryptAI deployment name to use. Sent via X-Enkrypt-Deployment header. detectors: anyOf: - additionalProperties: true type: object - type: 'null' title: Detectors description: 'Dictionary of detector configurations (e.g., {''nsfw'': {''enabled'': True}, ''toxicity'': {''enabled'': True}}).' block_on_violation: anyOf: - type: boolean - type: 'null' title: Block On Violation description: Whether to block requests when violations are detected. Defaults to True. default: true patterns: anyOf: - items: $ref: '#/components/schemas/ContentFilterPattern' type: array - type: 'null' title: Patterns description: List of patterns (prebuilt or custom regex) to detect blocked_words: anyOf: - items: $ref: '#/components/schemas/BlockedWord' type: array - type: 'null' title: Blocked Words description: List of blocked words with individual actions blocked_words_file: anyOf: - type: string - type: 'null' title: Blocked Words File description: Path to YAML file containing blocked_words list categories: anyOf: - items: $ref: '#/components/schemas/ContentFilterCategoryConfig' type: array - type: 'null' title: Categories description: List of prebuilt categories to enable (harmful_*, bias_*) severity_threshold: anyOf: - type: string - type: 'null' title: Severity Threshold description: Minimum severity to block (high, medium, low) pattern_redaction_format: anyOf: - type: string - type: 'null' title: Pattern Redaction Format description: Format string for pattern redaction (use {pattern_name} placeholder) keyword_redaction_tag: anyOf: - type: string - type: 'null' title: Keyword Redaction Tag description: Tag to use for keyword redaction experimental_use_latest_role_message_only: anyOf: - type: boolean - type: 'null' title: Experimental Use Latest Role Message Only description: When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call) default: false only_scan_new_messages: anyOf: - type: boolean - type: 'null' title: Only Scan New Messages description: When True, the guardrail only scans messages that have not already been scanned earlier in the same session (identified by litellm_session_id / session_id). Message content is hashed per session and cached; only the diff (new or edited messages) is sent to the guardrail provider on follow-up calls. Falls back to a full scan when the request has no session id or the cache is unavailable. Intended for blocking/detection guardrails; not applied when mask_request_content is set. default: false skip_system_message_in_guardrail: anyOf: - type: boolean - type: 'null' title: Skip System Message In Guardrail description: When True, unified guardrails skip system-role messages when building evaluation inputs (texts and structured_messages). When False, system messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_system_message_in_guardrail setting. For Anthropic /v1/messages, the flag applies only to the trusted top-level system prompt. In-sequence system entries are untrusted client input and remain in texts and structured_messages. skip_tool_message_in_guardrail: anyOf: - type: boolean - type: 'null' title: Skip Tool Message In Guardrail description: When True, unified guardrails skip tool-role messages when building evaluation inputs (texts and structured_messages). When False, tool messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_tool_message_in_guardrail setting. scan_only_tool_results: anyOf: - type: boolean - type: 'null' title: Scan Only Tool Results description: When True, unified guardrails only evaluate tool results, the untrusted data an agent feeds back into the model, and skip system, user, and assistant content. Intended for agent harnesses whose own prompt scaffolding is trusted but often trips prompt-attack detectors. inspect_embeddings: anyOf: - type: boolean - type: 'null' title: Inspect Embeddings description: When True, the Aim and Cato Networks guardrails send /embeddings `input` to the vendor as user messages. Off by default because embedding input is documents being indexed, not a conversation. category_thresholds: anyOf: - $ref: '#/components/schemas/LakeraCategoryThresholds' - type: 'null' description: Threshold configuration for Lakera guardrail categories detect_secrets_config: anyOf: - additionalProperties: true type: object - type: 'null' title: Detect Secrets Config description: Configuration for detect-secrets guardrail guard_name: anyOf: - type: string - type: 'null' title: Guard Name description: Name of the Javelin guard to use default_on: anyOf: - type: boolean - type: 'null' title: Default On description: Whether the guardrail is enabled by default mask_request_content: anyOf: - type: boolean - type: 'null' title: Mask Request Content description: Will mask request content if guardrail makes any changes mask_response_content: anyOf: - type: boolean - type: 'null' title: Mask Response Content description: Will mask response content if guardrail makes any changes pangea_input_recipe: anyOf: - type: string - type: 'null' title: Pangea Input Recipe description: Recipe for input (LLM request) pangea_output_recipe: anyOf: - type: string - type: 'null' title: Pangea Output Recipe description: Recipe for output (LLM response) model: anyOf: - type: string - type: 'null' title: Model description: Model name forwarded to the headroom /v1/compress endpoint. violation_message_template: anyOf: - type: string - type: 'null' title: Violation Message Template description: Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}. end_session_after_n_fails: anyOf: - type: integer - type: 'null' title: End Session After N Fails description: 'For /v1/realtime sessions: automatically close the session after this many guardrail violations.' on_violation: anyOf: - type: string enum: - warn - end_session - block - alert - type: 'null' title: On Violation description: 'For /v1/realtime sessions: ''warn'' speaks the violation message and continues; ''end_session'' speaks the message and closes the connection. For guardrail=''mcp_security'': ''block'' rejects the request; ''alert'' only logs a warning.' realtime_violation_message: anyOf: - type: string - type: 'null' title: Realtime Violation Message description: The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set. template_id: anyOf: - type: string - type: 'null' title: Template Id description: The ID of your Model Armor template location: anyOf: - type: string - type: 'null' title: Location description: Google Cloud location/region (e.g., us-central1) credentials: anyOf: - type: string - type: 'null' title: Credentials description: Path to Google Cloud credentials JSON file or JSON string api_endpoint: anyOf: - type: string - type: 'null' title: Api Endpoint description: Optional custom API endpoint for Model Armor fail_on_error: anyOf: - type: boolean - type: 'null' title: Fail On Error description: Whether to fail the request if the guardrail encounters an error. Implemented by guardrail='model_armor', 'generic_guardrail_api' and 'crowdstrike_aidr'. True (default) raises the error. False logs a critical error and lets the request proceed, so only a valid guardrail response can block or modify it. default: true skip_unscannable_attachments: anyOf: - type: boolean - type: 'null' title: Skip Unscannable Attachments description: Implemented by guardrail='model_armor'. When True, attachment references that carry no inline bytes (file_id, gs://, or http(s) URLs) pass through unscanned instead of blocking, while fail_on_error still governs real Model Armor API errors. Default False blocks them. default: false sanitize_error_detail: anyOf: - type: boolean - type: 'null' title: Sanitize Error Detail description: 'For guardrail=''model_armor'': omit the raw Model Armor response from caller-facing errors and logs by default. Set False to restore verbose output.' default: true additional_provider_specific_params: anyOf: - additionalProperties: true type: object - type: 'null' title: Additional Provider Specific Params description: Additional provider-specific parameters for generic guardrail APIs unreachable_fallback: type: string enum: - fail_closed - fail_open title: Unreachable Fallback description: Behavior when the headroom compression service is unreachable or errors. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and forwards the request uncompressed instead of blocking it. default: fail_closed extra_headers: anyOf: - items: type: string type: array - type: 'null' title: Extra Headers description: Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers). custom_code: anyOf: - type: string - type: 'null' title: Custom Code description: Python-like code containing the apply_guardrail function for custom guardrail logic timeout: anyOf: - type: number - type: 'null' title: Timeout description: Per-request timeout for the guardrail provider API call (seconds). Accepts int, float, or numeric string; coerced to float on load. Each guardrail handler chooses its own default when unset. on_sensitive_data: anyOf: - type: string enum: - block - route - type: 'null' title: On Sensitive Data description: Action to take when sensitive data is detected. 'block' raises an exception (default behavior). 'route' reroutes the request to the model specified in sensitive_data_route_to_model. sensitive_data_route_to_model: anyOf: - type: string - type: 'null' title: Sensitive Data Route To Model description: Model to route requests to when sensitive data is detected and on_sensitive_data='route'. This is typically an on-premise model for data privacy. The routing decision persists for the entire session. sticky_session_routing: anyOf: - type: boolean - type: 'null' title: Sticky Session Routing description: When True (default), after sensitive data is detected and routed, all subsequent requests in the same session will continue routing to the same model. default: true run_in_parallel: anyOf: - type: boolean - type: 'null' title: Run In Parallel description: When True, this pre_call or post_call guardrail runs concurrently with other opted-in guardrails of the same hook, after the sequential guardrails have run. Use only for block-only guardrails that inspect and reject; do not enable it for guardrails that modify the request or response (e.g. PII masking or sensitive-data routing), since parallel runs share one snapshot and their mutations would race. scan_raw_request: anyOf: - type: boolean - type: 'null' title: Scan Raw Request description: 'When True, this pre_call guardrail always evaluates the request as it was before any guardrail in this hook ran, regardless of its position in the guardrails list -- so the YAML order of guardrails can never change whether this one blocks. Use only for block-only guardrails: any data this guardrail returns is discarded, same contract as run_in_parallel, since an earlier guardrail''s masking must not be undone by this one.' api_version: anyOf: - type: string - type: 'null' title: Api Version description: API version for Javelin service default: v1 metadata: anyOf: - additionalProperties: true type: object - type: 'null' title: Metadata description: Additional metadata to include in the request application: anyOf: - type: string - type: 'null' title: Application description: Application name for Javelin service config: anyOf: - additionalProperties: true type: object - type: 'null' title: Config description: Additional configuration for the guardrail akto_base_url: anyOf: - type: string - type: 'null' title: Akto Base Url description: 'Akto Guardrail API Base URL. Env: AKTO_GUARDRAIL_API_BASE.' examples: - http://localhost:9090 - https://akto-ingestion.example.com akto_api_key: anyOf: - type: string - type: 'null' title: Akto Api Key description: 'API key for Akto. Env: AKTO_API_KEY.' akto_account_id: anyOf: - type: string - type: 'null' title: Akto Account Id description: 'Akto account ID for multi-tenant deployments. Env: AKTO_ACCOUNT_ID. Default: ''1000000''.' akto_vxlan_id: anyOf: - type: string - type: 'null' title: Akto Vxlan Id description: 'Akto VXLAN ID. Env: AKTO_VXLAN_ID. Default: ''0''.' guardrail_timeout: anyOf: - type: integer - type: 'null' title: Guardrail Timeout description: 'HTTP timeout in seconds. Default: 5.' policy_id: anyOf: - type: integer - type: 'null' title: Policy Id description: Policy ID for Zscaler AI Guard. Can also be set via ZSCALER_AI_GUARD_POLICY_ID environment variable send_user_api_key_alias: anyOf: - type: boolean - type: 'null' title: Send User Api Key Alias description: Whether to send user_API_key_alias in headers default: false send_user_api_key_user_id: anyOf: - type: boolean - type: 'null' title: Send User Api Key User Id description: Whether to send user_API_key_user_id in headers default: false send_user_api_key_team_id: anyOf: - type: boolean - type: 'null' title: Send User Api Key Team Id description: Whether to send user_API_key_team_id in headers default: false rules: anyOf: - items: $ref: '#/components/schemas/ToolPermissionRule' type: array - type: 'null' title: Rules description: Ordered allow/deny rules. Patterns use regex for tool names/types and optional regex constraints on tool arguments. default_action: type: string enum: - allow - deny title: Default Action description: Fallback decision when no rule matches default: deny on_disallowed_action: type: string enum: - block - rewrite title: On Disallowed Action description: Choose whether disallowed tools block the request or get rewritten out of the payload default: block xecguard_model: anyOf: - type: string - type: 'null' title: Xecguard Model description: XecGuard scanning model identifier. Defaults to 'xecguard_v2'. policy_names: anyOf: - items: type: string type: array - type: 'null' title: Policy Names description: XecGuard policies to apply on each scan. Select one or more of the built-in default policies; if none are selected, the guardrail defaults to System Prompt Enforcement + Harmful Content Protection. options: - Default_Policy_SystemPromptEnforcement - Default_Policy_GeneralPromptAttackProtection - Default_Policy_ContentBiasProtection - Default_Policy_HarmfulContentProtection - Default_Policy_SkillsProtection - Default_Policy_PIISensitiveDataProtection ui_type: multiselect grounding_strictness: anyOf: - type: string enum: - BALANCED - STRICT - type: 'null' title: Grounding Strictness description: Strictness level for XecGuard context-grounding validation. 'BALANCED' (default) treats INCOMPLETE answers as SAFE; 'STRICT' flags them as UNSAFE. Grounding only runs in post_call when `metadata.xecguard_grounding_documents` is provided. use_v2: anyOf: - type: boolean - type: 'null' title: Use V2 description: If True and guardrail='noma', route to the new Noma v2 implementation instead of the legacy implementation. default: false monitor_mode: anyOf: - type: boolean - type: 'null' title: Monitor Mode description: If True, logs violations without blocking. Defaults to False if not provided block_failures: anyOf: - type: boolean - type: 'null' title: Block Failures description: If True, blocks requests on API failures. Defaults to True if not provided anonymize_input: anyOf: - type: boolean - type: 'null' title: Anonymize Input description: If True, replaces sensitive content with anonymized version when only PII/PCI/secrets are detected. Only applies in blocking mode. Defaults to False if not provided on_flagged_action: anyOf: - type: string - type: 'null' title: On Flagged Action description: 'Action to take when content is flagged: ''block'' (raise exception) or ''monitor'' (log only)' default: monitor async_mode: anyOf: - type: boolean - type: 'null' title: Async Mode description: Set to True to request asynchronous analysis (sets `plr_async` header). Defaults to provider behaviour when omitted. persist_session: anyOf: - type: boolean - type: 'null' title: Persist Session description: Controls Pillar session persistence (sets `plr_persist` header). Set to False to disable persistence. include_scanners: anyOf: - type: boolean - type: 'null' title: Include Scanners description: Include scanner category summaries in responses (sets `plr_scanners` header). default: true include_evidence: anyOf: - type: boolean - type: 'null' title: Include Evidence description: Include detailed evidence payloads in responses (sets `plr_evidence` header). default: true deepkeep_firewall_id: anyOf: - type: string - type: 'null' title: Deepkeep Firewall Id description: The DeepKeep Firewall ID to use for guardrail evaluation. If not provided, the `DEEPKEEP_FIREWALL_ID` environment variable is checked. lasso_user_id: anyOf: - type: string - type: 'null' title: Lasso User Id description: User ID for the Lasso guardrail lasso_conversation_id: anyOf: - type: string - type: 'null' title: Lasso Conversation Id description: Conversation ID for the Lasso guardrail mask: anyOf: - type: boolean - type: 'null' title: Mask description: Enable content masking using Lasso classifix API default: false asset_id: anyOf: - type: string - type: 'null' title: Asset Id description: Repello asset ID whose dashboard policies are enforced. Required; the guardrail raises at init if it is missing. ccr_retrieval: type: boolean title: Ccr Retrieval description: Inject the Headroom retrieval tool for hashes declared by the compression service. default: true project_id: anyOf: - type: string - type: 'null' title: Project Id description: Project ID for the Lakera AI project payload: anyOf: - type: boolean - type: 'null' title: Payload description: Whether to include payload in the response default: true breakdown: anyOf: - type: boolean - type: 'null' title: Breakdown description: Whether to include breakdown in the response default: true dev_info: anyOf: - type: boolean - type: 'null' title: Dev Info description: Whether to include developer information in the response default: true advisory_system_message: anyOf: - type: string - type: 'null' title: Advisory System Message description: Custom advisory message template used when on_flagged='inject_system_message'. Must contain a {reason} placeholder. Defaults to a generic advisory message if unset. guardrailIdentifier: anyOf: - type: string - type: 'null' title: Guardrailidentifier description: The ID of your guardrail on Bedrock guardrailVersion: anyOf: - type: string - type: 'null' title: Guardrailversion description: The version of your Bedrock guardrail (e.g., DRAFT or version number) disable_exception_on_block: anyOf: - type: boolean - type: 'null' title: Disable Exception On Block description: If True, will not raise an exception when the guardrail is blocked. Useful for OpenWebUI where exceptions can end the chat flow. default: false aws_region_name: anyOf: - type: string - type: 'null' title: Aws Region Name description: AWS region where your guardrail is deployed aws_access_key_id: anyOf: - type: string - type: 'null' title: Aws Access Key Id description: AWS access key ID for authentication aws_secret_access_key: anyOf: - type: string - type: 'null' title: Aws Secret Access Key description: AWS secret access key for authentication aws_session_token: anyOf: - type: string - type: 'null' title: Aws Session Token description: AWS session token for temporary credentials aws_session_name: anyOf: - type: string - type: 'null' title: Aws Session Name description: Name of the AWS session aws_profile_name: anyOf: - type: string - type: 'null' title: Aws Profile Name description: AWS profile name for credential retrieval aws_role_name: anyOf: - type: string - type: 'null' title: Aws Role Name description: AWS role name for assuming roles aws_web_identity_token: anyOf: - type: string - type: 'null' title: Aws Web Identity Token description: Web identity token for AWS role assumption aws_sts_endpoint: anyOf: - type: string - type: 'null' title: Aws Sts Endpoint description: AWS STS endpoint URL aws_external_id: anyOf: - type: string - type: 'null' title: Aws External Id description: External ID required by the target role's trust policy on sts:AssumeRole aws_bedrock_runtime_endpoint: anyOf: - type: string - type: 'null' title: Aws Bedrock Runtime Endpoint description: AWS Bedrock runtime endpoint URL checks: anyOf: - $ref: '#/components/schemas/BedrockChecksConfigModel' - type: 'null' description: Inline safeguards for the resource-less InvokeGuardrailChecks API (contentFilter / promptAttack / sensitiveInformation). When set, the guardrail calls InvokeGuardrailChecks instead of ApplyGuardrail and no guardrailIdentifier is required. Mutually exclusive with guardrailIdentifier. content_filter_threshold: anyOf: - type: number maximum: 1.0 minimum: 0.0 - type: 'null' title: Content Filter Threshold description: 'InvokeGuardrailChecks: block when any contentFilter severityScore >= this value (scores are in [0,1]). Set to null to make the content filter detect-only (logged, never blocks).' default: 0.5 prompt_attack_threshold: anyOf: - type: number maximum: 1.0 minimum: 0.0 - type: 'null' title: Prompt Attack Threshold description: 'InvokeGuardrailChecks: block when any promptAttack severityScore >= this value (scores are in [0,1]). Set to null to make prompt-attack detection detect-only.' default: 0.5 pii_confidence_threshold: anyOf: - type: number maximum: 1.0 minimum: 0.0 - type: 'null' title: Pii Confidence Threshold description: 'InvokeGuardrailChecks: block when any sensitiveInformation confidenceScore >= this value (scores are in [0,1]). Set to null to make PII detection detect-only.' default: 0.5 chunk_budget_chars: type: integer exclusiveMinimum: 0.0 title: Chunk Budget Chars description: 'ApplyGuardrail: batch size, in characters, used to re-send content after AWS has rejected a request as too large. Requests AWS accepts are always sent in a single call, so this has no effect until a rejection happens. Defaults to 25,000; a batch AWS still rejects is bisected automatically, so this value only trades round trips against batch size and cannot fail a request on its own.' default: 25000 presidio_analyzer_api_base: anyOf: - type: string - type: 'null' title: Presidio Analyzer Api Base description: Base URL for the Presidio analyzer API presidio_anonymizer_api_base: anyOf: - type: string - type: 'null' title: Presidio Anonymizer Api Base description: Base URL for the Presidio anonymizer API presidio_filter_scope: anyOf: - type: string enum: - input - output - both - type: 'null' title: Presidio Filter Scope description: 'Where to apply Presidio checks: ''input'' (user -> model), ''output'' (model -> user), or ''both'' (default).' output_parse_pii: anyOf: - type: boolean - type: 'null' title: Output Parse Pii description: When True, LiteLLM will replace the masked text with the original text in the response ui_type: bool presidio_language: anyOf: - type: string - type: 'null' title: Presidio Language description: Language code for Presidio PII analysis (e.g., 'en', 'de', 'es', 'fr') default: en presidio_run_on: anyOf: - type: string enum: - input - output - both - type: 'null' title: Presidio Run On description: 'Where to apply Presidio checks: input, output, or both (default).' pii_entities_config: anyOf: - additionalProperties: $ref: '#/components/schemas/PiiAction' type: object - type: 'null' title: Pii Entities Config description: Configuration for PII entity types and actions presidio_score_thresholds: anyOf: - additionalProperties: type: number type: object - type: 'null' title: Presidio Score Thresholds description: Optional per-entity minimum confidence scores for Presidio detections. Entities below the threshold are ignored. presidio_entities_deny_list: anyOf: - items: anyOf: - $ref: '#/components/schemas/PiiEntityType' - type: string type: array - type: 'null' title: Presidio Entities Deny List description: List of entity types to exclude from Presidio detection results. Detections of these types will be silently dropped. Useful for suppressing false positives (e.g., US_DRIVER_LICENSE on coding routes). presidio_ad_hoc_recognizers: anyOf: - type: string - type: 'null' title: Presidio Ad Hoc Recognizers description: Path to a JSON file containing ad-hoc recognizers for Presidio presidio_analyze_chunk_size_bytes: anyOf: - type: integer - type: 'null' title: Presidio Analyze Chunk Size Bytes description: Maximum UTF-8 bytes of text sent in a single Presidio /analyze call. Longer texts are split into overlapping chunks of at most this size and the merged results are remapped onto the original text. Defaults to 500000; set it below your analyzer deployment's request body limit, leaving headroom for the rest of the analyze payload. mock_redacted_text: anyOf: - additionalProperties: true type: object - type: 'null' title: Mock Redacted Text description: Mock redacted text for testing guardrail: type: string title: Guardrail description: The type of guardrail integration to use mode: anyOf: - type: string - items: type: string type: array - $ref: '#/components/schemas/Mode' title: Mode description: When to apply the guardrail (pre_call, post_call, during_call, logging_only) additionalProperties: true type: object required: - guardrail - mode title: LitellmParams CiscoAIDefenseRule: properties: rule_name: type: string enum: - Code Detection - Harassment - Hate Speech - PCI - PHI - PII - Prompt Injection - Profanity - Sexual Content & Exploitation - Social Division & Polarization - Violence & Public Safety Threats title: Rule Name description: The canonical Cisco AI Defense rule name to evaluate. entity_types: anyOf: - items: type: string type: array - type: 'null' title: Entity Types description: Optional list of entity types for the rule (e.g. 'Email Address', 'Phone Number'). Applies to rules such as PII, PCI, and PHI. type: object required: - rule_name title: CiscoAIDefenseRule description: A single rule to enable for Cisco AI Defense inspection. UsageOverviewResponse: properties: rows: items: $ref: '#/components/schemas/UsageOverviewRow' type: array title: Rows chart: items: $ref: '#/components/schemas/UsageChartPoint' type: array title: Chart totalRequests: type: integer title: Totalrequests totalBlocked: type: integer title: Totalblocked passRate: type: number title: Passrate totalUsageUnits: additionalProperties: type: integer type: object title: Totalusageunits totalCost: anyOf: - type: number - type: 'null' title: Totalcost totalUntrackedUsageUnits: additionalProperties: type: integer type: object title: Totaluntrackedusageunits type: object required: - rows - chart - totalRequests - totalBlocked - passRate - totalUsageUnits - totalCost - totalUntrackedUsageUnits title: UsageOverviewResponse BedrockChecksPromptAttackCategoryItem: properties: category: type: string enum: - JAILBREAK - PROMPT_INJECTION - PROMPT_LEAKAGE title: Category type: object required: - category title: BedrockChecksPromptAttackCategoryItem GuardrailSubmissionItem: properties: guardrail_id: type: string title: Guardrail Id guardrail_name: type: string title: Guardrail Name status: type: string title: Status team_id: anyOf: - type: string - type: 'null' title: Team Id team_guardrail: type: boolean title: Team Guardrail default: false litellm_params: anyOf: - additionalProperties: true type: object - type: 'null' title: Litellm Params guardrail_info: anyOf: - additionalProperties: true type: object - type: 'null' title: Guardrail Info submitted_by_user_id: anyOf: - type: string - type: 'null' title: Submitted By User Id submitted_by_email: anyOf: - type: string - type: 'null' title: Submitted By Email submitted_at: anyOf: - type: string format: date-time - type: 'null' title: Submitted At reviewed_at: anyOf: - type: string format: date-time - type: 'null' title: Reviewed At created_at: anyOf: - type: string format: date-time - type: 'null' title: Created At updated_at: anyOf: - type: string format: date-time - type: 'null' title: Updated At type: object required: - guardrail_id - guardrail_name - status title: GuardrailSubmissionItem Guardrail: properties: guardrail_id: anyOf: - type: string - type: 'null' title: Guardrail Id guardrail_name: type: string title: Guardrail Name litellm_params: $ref: '#/components/schemas/LitellmParams' guardrail_info: anyOf: - additionalProperties: true type: object - type: 'null' title: Guardrail Info policy_template: anyOf: - type: string - type: 'null' title: Policy Template created_at: anyOf: - type: string format: date-time - type: 'null' title: Created At updated_at: anyOf: - type: string format: date-time - type: 'null' title: Updated At type: object required: - guardrail_name - litellm_params title: Guardrail GuardrailSubmissionSummary: properties: total: type: integer title: Total pending_review: type: integer title: Pending Review active: type: integer title: Active rejected: type: integer title: Rejected type: object required: - total - pending_review - active - rejected title: GuardrailSubmissionSummary BedrockChecksSensitiveInformationModel: properties: entities: items: $ref: '#/components/schemas/BedrockChecksSensitiveInformationEntityItem' type: array title: Entities type: object required: - entities title: BedrockChecksSensitiveInformationModel UsageUnitsDailyPoint: properties: date: type: string title: Date units: additionalProperties: type: integer type: object title: Units cost: anyOf: - type: number - type: 'null' title: Cost type: object required: - date - units - cost title: UsageUnitsDailyPoint UpdateGuardrailRequest: properties: guardrail: $ref: '#/components/schemas/Guardrail' type: object required: - guardrail title: UpdateGuardrailRequest BedrockChecksConfigModel: properties: contentFilter: anyOf: - $ref: '#/components/schemas/BedrockChecksContentFilterModel' - type: 'null' promptAttack: anyOf: - $ref: '#/components/schemas/BedrockChecksPromptAttackModel' - type: 'null' sensitiveInformation: anyOf: - $ref: '#/components/schemas/BedrockChecksSensitiveInformationModel' - type: 'null' type: object title: BedrockChecksConfigModel description: 'Inline `checks` config for the resource-less Bedrock InvokeGuardrailChecks API. Include only the checks you want to run; at least one must be set.' UsageLogEntry: properties: id: type: string title: Id timestamp: type: string title: Timestamp action: type: string title: Action score: anyOf: - type: number - type: 'null' title: Score latency_ms: anyOf: - type: number - type: 'null' title: Latency Ms model: anyOf: - type: string - type: 'null' title: Model input_snippet: anyOf: - type: string - type: 'null' title: Input Snippet output_snippet: anyOf: - type: string - type: 'null' title: Output Snippet reason: anyOf: - type: string - type: 'null' title: Reason type: object required: - id - timestamp - action - score - latency_ms - model - input_snippet - output_snippet - reason title: UsageLogEntry ApplyGuardrailResponse: properties: response_text: type: string title: Response Text type: object required: - response_text title: ApplyGuardrailResponse TestCustomCodeGuardrailResponse: properties: success: type: boolean title: Success result: anyOf: - additionalProperties: true type: object - type: 'null' title: Result error: anyOf: - type: string - type: 'null' title: Error error_type: anyOf: - type: string - type: 'null' title: Error Type type: object required: - success title: TestCustomCodeGuardrailResponse description: Response model for testing custom code guardrails. BlockedWord: properties: keyword: type: string title: Keyword description: The keyword to block or mask action: $ref: '#/components/schemas/ContentFilterAction' description: Action to take when keyword is detected (BLOCK or MASK) description: anyOf: - type: string - type: 'null' title: Description description: Optional description explaining why this keyword is sensitive type: object required: - keyword - action title: BlockedWord description: Represents a blocked word with its action and optional description BedrockChecksSensitiveInformationEntityItem: properties: type: type: string enum: - ADDRESS - AGE - AWS_ACCESS_KEY - AWS_SECRET_KEY - CA_HEALTH_NUMBER - CA_SOCIAL_INSURANCE_NUMBER - CREDIT_DEBIT_CARD_CVV - CREDIT_DEBIT_CARD_EXPIRY - CREDIT_DEBIT_CARD_NUMBER - DRIVER_ID - EMAIL - INTERNATIONAL_BANK_ACCOUNT_NUMBER - IP_ADDRESS - LICENSE_PLATE - MAC_ADDRESS - NAME - PASSWORD - PHONE - PIN - SWIFT_CODE - UK_NATIONAL_HEALTH_SERVICE_NUMBER - UK_NATIONAL_INSURANCE_NUMBER - UK_UNIQUE_TAXPAYER_REFERENCE_NUMBER - URL - USERNAME - US_BANK_ACCOUNT_NUMBER - US_BANK_ROUTING_NUMBER - US_INDIVIDUAL_TAX_IDENTIFICATION_NUMBER - US_PASSPORT_NUMBER - US_SOCIAL_SECURITY_NUMBER - VEHICLE_IDENTIFICATION_NUMBER title: Type type: object required: - type title: BedrockChecksSensitiveInformationEntityItem UsageLogsResponse: properties: logs: items: $ref: '#/components/schemas/UsageLogEntry' type: array title: Logs total: type: integer title: Total page: type: integer title: Page page_size: type: integer title: Page Size type: object required: - logs - total - page - page_size title: UsageLogsResponse UsageOverviewRow: properties: id: type: string title: Id name: type: string title: Name type: type: string title: Type provider: type: string title: Provider requestsEvaluated: type: integer title: Requestsevaluated failRate: type: number title: Failrate avgScore: anyOf: - type: number - type: 'null' title: Avgscore avgLatency: anyOf: - type: number - type: 'null' title: Avglatency status: type: string title: Status trend: type: string title: Trend usageUnits: additionalProperties: type: integer type: object title: Usageunits cost: anyOf: - type: number - type: 'null' title: Cost description: USD for the priced share of usageUnits over the window; null when no unit was priced untrackedUsageUnits: additionalProperties: type: integer type: object title: Untrackedusageunits description: 'The share of usageUnits that cost leaves out: units recorded with no known price, per counter' type: object required: - id - name - type - provider - requestsEvaluated - failRate - avgScore - avgLatency - status - trend - usageUnits - cost - untrackedUsageUnits title: UsageOverviewRow BedrockChecksContentFilterCategoryItem: properties: category: type: string enum: - VIOLENCE - HATE - SEXUAL - MISCONDUCT - INSULTS title: Category type: object required: - category title: BedrockChecksContentFilterCategoryItem BaseLitellmParams: properties: patterns: anyOf: - items: $ref: '#/components/schemas/ContentFilterPattern' type: array - type: 'null' title: Patterns description: List of patterns (prebuilt or custom regex) to detect blocked_words: anyOf: - items: $ref: '#/components/schemas/BlockedWord' type: array - type: 'null' title: Blocked Words description: List of blocked words with individual actions blocked_words_file: anyOf: - type: string - type: 'null' title: Blocked Words File description: Path to YAML file containing blocked_words list categories: anyOf: - items: $ref: '#/components/schemas/ContentFilterCategoryConfig' type: array - type: 'null' title: Categories description: List of prebuilt categories to enable (harmful_*, bias_*) severity_threshold: anyOf: - type: string - type: 'null' title: Severity Threshold description: Minimum severity to block (high, medium, low) pattern_redaction_format: anyOf: - type: string - type: 'null' title: Pattern Redaction Format description: Format string for pattern redaction (use {pattern_name} placeholder) keyword_redaction_tag: anyOf: - type: string - type: 'null' title: Keyword Redaction Tag description: Tag to use for keyword redaction api_key: anyOf: - type: string - type: 'null' title: Api Key description: API key for the guardrail service api_base: anyOf: - type: string - type: 'null' title: Api Base description: Base URL for the guardrail service API experimental_use_latest_role_message_only: anyOf: - type: boolean - type: 'null' title: Experimental Use Latest Role Message Only description: When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call) default: false only_scan_new_messages: anyOf: - type: boolean - type: 'null' title: Only Scan New Messages description: When True, the guardrail only scans messages that have not already been scanned earlier in the same session (identified by litellm_session_id / session_id). Message content is hashed per session and cached; only the diff (new or edited messages) is sent to the guardrail provider on follow-up calls. Falls back to a full scan when the request has no session id or the cache is unavailable. Intended for blocking/detection guardrails; not applied when mask_request_content is set. default: false skip_system_message_in_guardrail: anyOf: - type: boolean - type: 'null' title: Skip System Message In Guardrail description: When True, unified guardrails skip system-role messages when building evaluation inputs (texts and structured_messages). When False, system messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_system_message_in_guardrail setting. For Anthropic /v1/messages, the flag applies only to the trusted top-level system prompt. In-sequence system entries are untrusted client input and remain in texts and structured_messages. skip_tool_message_in_guardrail: anyOf: - type: boolean - type: 'null' title: Skip Tool Message In Guardrail description: When True, unified guardrails skip tool-role messages when building evaluation inputs (texts and structured_messages). When False, tool messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_tool_message_in_guardrail setting. scan_only_tool_results: anyOf: - type: boolean - type: 'null' title: Scan Only Tool Results description: When True, unified guardrails only evaluate tool results, the untrusted data an agent feeds back into the model, and skip system, user, and assistant content. Intended for agent harnesses whose own prompt scaffolding is trusted but often trips prompt-attack detectors. inspect_embeddings: anyOf: - type: boolean - type: 'null' title: Inspect Embeddings description: When True, the Aim and Cato Networks guardrails send /embeddings `input` to the vendor as user messages. Off by default because embedding input is documents being indexed, not a conversation. category_thresholds: anyOf: - $ref: '#/components/schemas/LakeraCategoryThresholds' - type: 'null' description: Threshold configuration for Lakera guardrail categories detect_secrets_config: anyOf: - additionalProperties: true type: object - type: 'null' title: Detect Secrets Config description: Configuration for detect-secrets guardrail guard_name: anyOf: - type: string - type: 'null' title: Guard Name description: Name of the guardrail in guardrails.ai default_on: anyOf: - type: boolean - type: 'null' title: Default On description: Whether the guardrail is enabled by default mask_request_content: anyOf: - type: boolean - type: 'null' title: Mask Request Content description: Will mask request content if guardrail makes any changes mask_response_content: anyOf: - type: boolean - type: 'null' title: Mask Response Content description: Will mask response content if guardrail makes any changes pangea_input_recipe: anyOf: - type: string - type: 'null' title: Pangea Input Recipe description: Recipe for input (LLM request) pangea_output_recipe: anyOf: - type: string - type: 'null' title: Pangea Output Recipe description: Recipe for output (LLM response) model: anyOf: - type: string - type: 'null' title: Model description: Optional field if guardrail requires a 'model' parameter violation_message_template: anyOf: - type: string - type: 'null' title: Violation Message Template description: Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}. end_session_after_n_fails: anyOf: - type: integer - type: 'null' title: End Session After N Fails description: 'For /v1/realtime sessions: automatically close the session after this many guardrail violations.' on_violation: anyOf: - type: string enum: - warn - end_session - block - alert - type: 'null' title: On Violation description: 'For /v1/realtime sessions: ''warn'' speaks the violation message and continues; ''end_session'' speaks the message and closes the connection. For guardrail=''mcp_security'': ''block'' rejects the request; ''alert'' only logs a warning.' realtime_violation_message: anyOf: - type: string - type: 'null' title: Realtime Violation Message description: The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set. template_id: anyOf: - type: string - type: 'null' title: Template Id description: The ID of your Model Armor template location: anyOf: - type: string - type: 'null' title: Location description: Google Cloud location/region (e.g., us-central1) credentials: anyOf: - type: string - type: 'null' title: Credentials description: Path to Google Cloud credentials JSON file or JSON string api_endpoint: anyOf: - type: string - type: 'null' title: Api Endpoint description: Optional custom API endpoint for Model Armor fail_on_error: anyOf: - type: boolean - type: 'null' title: Fail On Error description: Whether to fail the request if the guardrail encounters an error. Implemented by guardrail='model_armor', 'generic_guardrail_api' and 'crowdstrike_aidr'. True (default) raises the error. False logs a critical error and lets the request proceed, so only a valid guardrail response can block or modify it. default: true skip_unscannable_attachments: anyOf: - type: boolean - type: 'null' title: Skip Unscannable Attachments description: Implemented by guardrail='model_armor'. When True, attachment references that carry no inline bytes (file_id, gs://, or http(s) URLs) pass through unscanned instead of blocking, while fail_on_error still governs real Model Armor API errors. Default False blocks them. default: false sanitize_error_detail: anyOf: - type: boolean - type: 'null' title: Sanitize Error Detail description: 'For guardrail=''model_armor'': omit the raw Model Armor response from caller-facing errors and logs by default. Set False to restore verbose output.' default: true additional_provider_specific_params: anyOf: - additionalProperties: true type: object - type: 'null' title: Additional Provider Specific Params description: Additional provider-specific parameters for generic guardrail APIs unreachable_fallback: type: string enum: - fail_closed - fail_open title: Unreachable Fallback description: Behavior when a guardrail endpoint is unreachable due to network errors. Implemented by guardrail='generic_guardrail_api', 'akto', 'vigil_guard', 'repelloai', 'headroom', 'compresr', and 'typesafe'. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and allows the request to proceed. default: fail_closed extra_headers: anyOf: - items: type: string type: array - type: 'null' title: Extra Headers description: Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers). custom_code: anyOf: - type: string - type: 'null' title: Custom Code description: Python-like code containing the apply_guardrail function for custom guardrail logic timeout: anyOf: - type: number - type: 'null' title: Timeout description: Per-request timeout for the guardrail provider API call (seconds). Accepts int, float, or numeric string; coerced to float on load. Each guardrail handler chooses its own default when unset. on_sensitive_data: anyOf: - type: string enum: - block - route - type: 'null' title: On Sensitive Data description: Action to take when sensitive data is detected. 'block' raises an exception (default behavior). 'route' reroutes the request to the model specified in sensitive_data_route_to_model. sensitive_data_route_to_model: anyOf: - type: string - type: 'null' title: Sensitive Data Route To Model description: Model to route requests to when sensitive data is detected and on_sensitive_data='route'. This is typically an on-premise model for data privacy. The routing decision persists for the entire session. sticky_session_routing: anyOf: - type: boolean - type: 'null' title: Sticky Session Routing description: When True (default), after sensitive data is detected and routed, all subsequent requests in the same session will continue routing to the same model. default: true run_in_parallel: anyOf: - type: boolean - type: 'null' title: Run In Parallel description: When True, this pre_call or post_call guardrail runs concurrently with other opted-in guardrails of the same hook, after the sequential guardrails have run. Use only for block-only guardrails that inspect and reject; do not enable it for guardrails that modify the request or response (e.g. PII masking or sensitive-data routing), since parallel runs share one snapshot and their mutations would race. scan_raw_request: anyOf: - type: boolean - type: 'null' title: Scan Raw Request description: 'When True, this pre_call guardrail always evaluates the request as it was before any guardrail in this hook ran, regardless of its position in the guardrails list -- so the YAML order of guardrails can never change whether this one blocks. Use only for block-only guardrails: any data this guardrail returns is discarded, same contract as run_in_parallel, since an earlier guardrail''s masking must not be undone by this one.' additionalProperties: true type: object title: BaseLitellmParams securitySchemes: APIKeyHeader: type: apiKey description: Bearer token in: header name: x-litellm-api-key