---
title: "Update your API Guardian Endpoint configuration"
method: PATCH
path: "/shield/shield-zone/{shieldZoneId}/api-guardian/endpoint/{endpointId}"
tags: ["API Guardian"]
---

# Update your API Guardian Endpoint configuration

`PATCH /shield/shield-zone/{shieldZoneId}/api-guardian/endpoint/{endpointId}`

## Request

- Base URL: `https://api.bunny.net`
- URL: `https://api.bunny.net/shield/shield-zone/{shieldZoneId}/api-guardian/endpoint/{endpointId}`
- Auth: none declared
- TypeScript: <https://skmtc.dev/bunny/apis/bunny-shield-api/docs/shield/shield-zone/:shieldZoneId/api-guardian/endpoint/:endpointId/patch.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `shieldZoneId` integer, required
- `endpointId` integer, required

## Request body

- UpdateApiGuardianEndpointRequest: Patch request for updating an individual API Guardian endpoint. All fields are optional — only provided fields are applied.
  - `isEnabled` boolean, nullable: Enable or disable this endpoint. Disabled endpoints are not enforced.
  - `validateRequestBodySchema` boolean, nullable: Enable or disable request body schema validation. Only effective if the endpoint's OAS operation defines a request body schema.
  - `validateResponseBodySchema` boolean, nullable: Enable or disable response body schema validation. Only effective if the endpoint's OAS operation defines response schemas.
  - `validateAuthorization` boolean, nullable: Enable or disable enforcement of authentication requirements as defined in the OAS security schemes.
  - `injectionDetectionParameters` object, nullable: Parameters to run injection detection on, grouped by location (path, query, header, cookie). Must be a subset of the endpoint's available parameters.
    - `Path` string[]
    - `Query` string[]
    - `Header` string[]
    - `Cookie` string[]
  - `detectParameterXss` boolean, nullable: Enable XSS detection on the selected injection detection parameters.
  - `detectParameterSqli` boolean, nullable: Enable SQL injection detection on the selected injection detection parameters.
  - `rateLimitingEnabled` boolean, nullable: Enable or disable per-endpoint rate limiting.
  - `rateLimitingType` 'Global' | 'IP'
  - `rateLimitingRequestCount` integer, nullable: Maximum number of requests allowed within the timeframe before blocking. Must be greater than zero.
  - `rateLimitingTimeframe` 1 | 10 | 60 | 300 | 900 | 3600: 1 = PerSecond 10 = PerTenSeconds 60 = PerOneMinute 300 = PerFiveMinutes 900 = PerFifteenMinutes 3600 = PerOneHour

## Response `200`

OK

- UpdateApiGuardianEndpointResponse: Response for the PATCH /endpoint/{endpointId} endpoint.
  - `error` GenericRequestResponse: Generic response object containing status information for API operations.
    - `statusCode` 100 | 101 | 102 | 103 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 421 | 422 | 423 | 424 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511: 100 = Continue 101 = SwitchingProtocols 102 = Processing 103 = EarlyHints 200 = OK 201 = Created 202 = Accepted 203 = NonAuthoritativeInformation 204 = NoContent 205 = ResetContent 206 = PartialContent 207 = MultiStatus 208 = AlreadyReported 226 = IMUsed 300 = MultipleChoices 300 = Ambiguous 301 = MovedPermanently 301 = Moved 302 = Found 302 = Redirect 303 = SeeOther 303 = RedirectMethod 304 = NotModified 305 = UseProxy 306 = Unused 307 = TemporaryRedirect 307 = RedirectKeepVerb 308 = PermanentRedirect 400 = BadRequest 401 = Unauthorized 402 = PaymentRequired 403 = Forbidden 404 = NotFound 405 = MethodNotAllowed 406 = NotAcceptable 407 = ProxyAuthenticationRequired 408 = RequestTimeout 409 = Conflict 410 = Gone 411 = LengthRequired 412 = PreconditionFailed 413 = RequestEntityTooLarge 414 = RequestUriTooLong 415 = UnsupportedMediaType 416 = RequestedRangeNotSatisfiable 417 = ExpectationFailed 421 = MisdirectedRequest 422 = UnprocessableEntity 422 = UnprocessableContent 423 = Locked 424 = FailedDependency 426 = UpgradeRequired 428 = PreconditionRequired 429 = TooManyRequests 431 = RequestHeaderFieldsTooLarge 451 = UnavailableForLegalReasons 500 = InternalServerError 501 = NotImplemented 502 = BadGateway 503 = ServiceUnavailable 504 = GatewayTimeout 505 = HttpVersionNotSupported 506 = VariantAlsoNegotiates 507 = InsufficientStorage 508 = LoopDetected 510 = NotExtended 511 = NetworkAuthenticationRequired
    - `success` boolean: Indicates whether the operation was successful.
    - `message` string, nullable: Human-readable message describing the result of the operation.
    - `errorKey` string, nullable: Unique error key for programmatic error handling, if applicable.
  - `data` ApiGuardianEndpointDetails: Detailed view of a single API Guardian endpoint, including its validation settings, authentication requirements, and rate limiting configuration.
    - `apiGuardianEndpointId` integer
    - `shieldZoneId` integer
    - `requestMethod` string, nullable: The HTTP method (e.g. "GET", "POST").
    - `requestPath` string, nullable: The OAS path template (e.g. "/pets/{petId}").
    - `validateRequestBodySchema` boolean: Whether inbound request bodies are validated against the OAS request body schema.
    - `validateResponseBodySchema` boolean: Whether outbound response bodies are validated against the OAS response schema.
    - `validateAuthorization` boolean: Whether authentication credentials are enforced.
    - `isEnabled` boolean: Whether this endpoint is active. Disabled endpoints are not enforced.
    - `authSchemes` AuthSchemeDetails[], nullable: Authentication schemes required by this endpoint, derived from the OAS security requirements. Null when the endpoint has no security requirements.
      - `schemeName` string, nullable: The OpenAPI security scheme reference name (e.g. "bearerAuth", "apiKey").
      - `schemeType` 'ApiKey' | 'Http' | 'OAuth2' | 'OpenIdConnect': The type of security scheme as defined in the OpenAPI specification.
      - `location` 'Header' | 'Query' | 'Cookie': Where an authentication credential is transmitted in the HTTP request.
      - `credentialName` string, nullable: The name of the header, query parameter, or cookie that carries the credential (e.g. "Authorization", "X-API-Key").
      - `httpScheme` string, nullable: For HTTP auth schemes, the scheme name (e.g. "bearer", "basic"). Null for non-HTTP schemes.
    - `requestBodySchemaYaml` string, nullable: The request body schema rendered as YAML for display purposes. Null if no request body is defined.
    - `responseBodySchemasYaml` object, nullable: Response body schemas keyed by HTTP status code, rendered as YAML. Null if no response schemas are defined.
    - `availableParameters` object, nullable: All parameters defined in the OAS operation, grouped by location (path, query, header, cookie).
      - `Path` string[]
      - `Query` string[]
      - `Header` string[]
      - `Cookie` string[]
    - `injectionDetectionParameters` object, nullable: Parameters selected for XSS/SQLi injection detection, grouped by location. Null if not configured. Subset of BunnyNet.Shield.Api.Services.Shield.ApiGuardian.Models.ApiGuardianEndpointDetails.AvailableParameters.
      - `Path` string[]
      - `Query` string[]
      - `Header` string[]
      - `Cookie` string[]
    - `detectParameterXss` boolean: Whether XSS detection is enabled for the selected parameters.
    - `detectParameterSqli` boolean: Whether SQL injection detection is enabled for the selected parameters.
    - `rateLimitingEnabled` boolean: Whether per-endpoint rate limiting is active.
    - `rateLimitingType` 'Global' | 'IP'
    - `rateLimitingRequestCount` integer: Maximum number of requests allowed within the rate limiting timeframe before blocking.
    - `rateLimitingTimeframe` 1 | 10 | 60 | 300 | 900 | 3600: 1 = PerSecond 10 = PerTenSeconds 60 = PerOneMinute 300 = PerFiveMinutes 900 = PerFifteenMinutes 3600 = PerOneHour
    - `createdAt` string, date-time
    - `updatedAt` string, date-time, nullable

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `500`: Internal Server Error

## Changes

- **2026-11-12** `6a424e866a61`: 35 breaking, 81 warning, 88 info
  - removed the enum value `0.00` of the request property `rateLimitingType` (media type: application/json)
  - removed the enum value `0.00` of the request property `rateLimitingType` (media type: text/json)
  - removed the enum value `0.00` of the request property `rateLimitingType` (media type: application/*+json)
  - removed the enum value `1.00` of the request property `rateLimitingType` (media type: application/json)
  - …200 more
- **2026-04-23** `30ba69f85a97`: 54 breaking, 147 warning, 142 info
  - the response property `data/updatedAt` became nullable for the status `200` (media type: text/plain)
  - the response property `data/updatedAt` became nullable for the status `200` (media type: application/json)
  - the response property `data/updatedAt` became nullable for the status `200` (media type: text/json)
  - the response property `data/updatedAt` became nullable for the status `403` (media type: text/plain)
  - …339 more
- **2026-04-18** `18994bc5533c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bunny/apis/bunny-shield-api/changes/shield/shield-zone/:shieldZoneId/api-guardian/endpoint/:endpointId/patch.md)

---

[API](https://skmtc.dev/bunny/apis/bunny-shield-api.md) - [All operations](https://skmtc.dev/bunny/apis/bunny-shield-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bunny/apis/bunny-shield-api/revisions/6a424e866a61?raw)