---
title: "Update the API Guardian configuration (enabled, execution mode, body limit action)"
method: PATCH
path: "/shield/shield-zone/{shieldZoneId}/api-guardian"
tags: ["API Guardian"]
---

# Update the API Guardian configuration (enabled, execution mode, body limit action)

`PATCH /shield/shield-zone/{shieldZoneId}/api-guardian`

## Request

- Base URL: `https://api.bunny.net`
- URL: `https://api.bunny.net/shield/shield-zone/{shieldZoneId}/api-guardian`
- Auth: none declared
- TypeScript: <https://skmtc.dev/bunny/apis/bunny-shield-api/docs/shield/shield-zone/:shieldZoneId/api-guardian/patch.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `shieldZoneId` integer, required

## Request body

- UpdateApiGuardianConfigurationRequest: Patch request for updating the global API Guardian configuration. All fields are optional — only provided fields are applied.
  - `isEnabled` boolean, nullable: Enable or disable API Guardian entirely for this shield zone.
  - `executionMode` 0 | 1: 0 = Log 1 = Block
  - `bodyLimitAction` 0 | 1 | 2: 0 = Block 1 = Log 2 = Ignore
  - `unmatchedPathAction` 0 | 1 | 2: 0 = Block 1 = Log 2 = Ignore

## Response `200`

OK

- UpdateApiGuardianConfigurationResponse: Response for the PATCH /configuration endpoint.
  - `error` GenericRequestResponse: Generic response object containing status information for API operations.
    - `statusCode` 100 | 101 | 102 | 103 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 421 | 422 | 423 | 424 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511: 100 = Continue 101 = SwitchingProtocols 102 = Processing 103 = EarlyHints 200 = OK 201 = Created 202 = Accepted 203 = NonAuthoritativeInformation 204 = NoContent 205 = ResetContent 206 = PartialContent 207 = MultiStatus 208 = AlreadyReported 226 = IMUsed 300 = MultipleChoices 300 = Ambiguous 301 = MovedPermanently 301 = Moved 302 = Found 302 = Redirect 303 = SeeOther 303 = RedirectMethod 304 = NotModified 305 = UseProxy 306 = Unused 307 = TemporaryRedirect 307 = RedirectKeepVerb 308 = PermanentRedirect 400 = BadRequest 401 = Unauthorized 402 = PaymentRequired 403 = Forbidden 404 = NotFound 405 = MethodNotAllowed 406 = NotAcceptable 407 = ProxyAuthenticationRequired 408 = RequestTimeout 409 = Conflict 410 = Gone 411 = LengthRequired 412 = PreconditionFailed 413 = RequestEntityTooLarge 414 = RequestUriTooLong 415 = UnsupportedMediaType 416 = RequestedRangeNotSatisfiable 417 = ExpectationFailed 421 = MisdirectedRequest 422 = UnprocessableEntity 422 = UnprocessableContent 423 = Locked 424 = FailedDependency 426 = UpgradeRequired 428 = PreconditionRequired 429 = TooManyRequests 431 = RequestHeaderFieldsTooLarge 451 = UnavailableForLegalReasons 500 = InternalServerError 501 = NotImplemented 502 = BadGateway 503 = ServiceUnavailable 504 = GatewayTimeout 505 = HttpVersionNotSupported 506 = VariantAlsoNegotiates 507 = InsufficientStorage 508 = LoopDetected 510 = NotExtended 511 = NetworkAuthenticationRequired
    - `success` boolean: Indicates whether the operation was successful.
    - `message` string, nullable: Human-readable message describing the result of the operation.
    - `errorKey` string, nullable: Unique error key for programmatic error handling, if applicable.
  - `data` ApiGuardianConfigurationDetails: Global API Guardian configuration for a shield zone.
    - `shieldZoneId` integer
    - `isEnabled` boolean: Whether API Guardian is enabled for this shield zone. When disabled, no requests are inspected.
    - `executionMode` 0 | 1: 0 = Log 1 = Block
    - `bodyLimitAction` 0 | 1 | 2: 0 = Block 1 = Log 2 = Ignore
    - `unmatchedPathAction` 0 | 1 | 2: 0 = Block 1 = Log 2 = Ignore
    - `title` string, nullable: The `info.title` field from the uploaded OpenAPI specification.
    - `version` string, nullable: The `info.version` field from the uploaded OpenAPI specification.
    - `maxEndpoints` integer: Plan limit: maximum number of endpoints that can be defined in the specification.
    - `maxFieldsPerType` integer: Plan limit: maximum number of properties a single schema object may declare.
    - `maxNestingDepth` integer: Plan limit: maximum depth of nested `$ref`, `items`, and `properties` chains.
    - `maxTotalSchemaNodes` integer: Plan limit: combined node count across all `components/schemas` entries.
    - `maxTotalRegexLength` integer: Plan limit: combined character length of all `pattern` regex strings in the specification.
    - `createdAt` string, date-time
    - `updatedAt` string, date-time, nullable

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `500`: Internal Server Error

## Changes

- **2026-04-23** `30ba69f85a97`: 15 warning, 139 info
  - removed the request property `content` (media type: application/json)
  - removed the request property `content` (media type: text/json)
  - removed the request property `content` (media type: application/*+json)
  - removed the request property `enforceAuthorisationValidation` (media type: application/json)
  - …150 more
- **2026-04-18** `18994bc5533c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bunny/apis/bunny-shield-api/changes/shield/shield-zone/:shieldZoneId/api-guardian/patch.md)

---

[API](https://skmtc.dev/bunny/apis/bunny-shield-api.md) - [All operations](https://skmtc.dev/bunny/apis/bunny-shield-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bunny/apis/bunny-shield-api/revisions/6a424e866a61?raw)