--- title: "Update your OpenAPI specification" method: PATCH path: "/shield/shield-zone/{shieldZoneId}/api-guardian/spec" tags: ["API Guardian"] --- # Update your OpenAPI specification `PATCH /shield/shield-zone/{shieldZoneId}/api-guardian/spec` ## Request - Base URL: `https://api.bunny.net` - URL: `https://api.bunny.net/shield/shield-zone/{shieldZoneId}/api-guardian/spec` - Auth: none declared - TypeScript: (a function with typed inputs; its response is checked against the schema) ## Path parameters - `shieldZoneId` integer, required ## Request body - UpsertOpenApiSpecificationRequest: Represents the request for uploading or updating an OpenAPI specification in API Guardian. - `content` string, nullable: The file contents of the OpenAPI specification. - `enforceAuthorizationValidation` boolean, nullable: Whether to enforce authentication requirements for endpoints. On upload, defaults to true if not specified. On update, existing endpoint auth settings are preserved if not specified. ## Response `200` OK - UpsertOpenApiSpecificationResponse: Represents the response for uploading or updating an OpenAPI specification in API Guardian. - `error` GenericRequestResponse: Generic response object containing status information for API operations. - `statusCode` 100 | 101 | 102 | 103 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 421 | 422 | 423 | 424 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511: 100 = Continue 101 = SwitchingProtocols 102 = Processing 103 = EarlyHints 200 = OK 201 = Created 202 = Accepted 203 = NonAuthoritativeInformation 204 = NoContent 205 = ResetContent 206 = PartialContent 207 = MultiStatus 208 = AlreadyReported 226 = IMUsed 300 = MultipleChoices 300 = Ambiguous 301 = MovedPermanently 301 = Moved 302 = Found 302 = Redirect 303 = SeeOther 303 = RedirectMethod 304 = NotModified 305 = UseProxy 306 = Unused 307 = TemporaryRedirect 307 = RedirectKeepVerb 308 = PermanentRedirect 400 = BadRequest 401 = Unauthorized 402 = PaymentRequired 403 = Forbidden 404 = NotFound 405 = MethodNotAllowed 406 = NotAcceptable 407 = ProxyAuthenticationRequired 408 = RequestTimeout 409 = Conflict 410 = Gone 411 = LengthRequired 412 = PreconditionFailed 413 = RequestEntityTooLarge 414 = RequestUriTooLong 415 = UnsupportedMediaType 416 = RequestedRangeNotSatisfiable 417 = ExpectationFailed 421 = MisdirectedRequest 422 = UnprocessableEntity 422 = UnprocessableContent 423 = Locked 424 = FailedDependency 426 = UpgradeRequired 428 = PreconditionRequired 429 = TooManyRequests 431 = RequestHeaderFieldsTooLarge 451 = UnavailableForLegalReasons 500 = InternalServerError 501 = NotImplemented 502 = BadGateway 503 = ServiceUnavailable 504 = GatewayTimeout 505 = HttpVersionNotSupported 506 = VariantAlsoNegotiates 507 = InsufficientStorage 508 = LoopDetected 510 = NotExtended 511 = NetworkAuthenticationRequired - `success` boolean: Indicates whether the operation was successful. - `message` string, nullable: Human-readable message describing the result of the operation. - `errorKey` string, nullable: Unique error key for programmatic error handling, if applicable. - `data` ApiGuardianConfigurationResponse: The full API Guardian state for a shield zone: global configuration and all endpoints. - `configuration` ApiGuardianConfigurationDetails, required: Global API Guardian configuration for a shield zone. - `shieldZoneId` integer - `isEnabled` boolean: Whether API Guardian is enabled for this shield zone. When disabled, no requests are inspected. - `executionMode` 0 | 1: 0 = Log 1 = Block - `bodyLimitAction` 0 | 1 | 2: 0 = Block 1 = Log 2 = Ignore - `unmatchedPathAction` 0 | 1 | 2: 0 = Block 1 = Log 2 = Ignore - `title` string, nullable: The `info.title` field from the uploaded OpenAPI specification. - `version` string, nullable: The `info.version` field from the uploaded OpenAPI specification. - `maxEndpoints` integer: Plan limit: maximum number of endpoints that can be defined in the specification. - `maxFieldsPerType` integer: Plan limit: maximum number of properties a single schema object may declare. - `maxNestingDepth` integer: Plan limit: maximum depth of nested `$ref`, `items`, and `properties` chains. - `maxTotalSchemaNodes` integer: Plan limit: combined node count across all `components/schemas` entries. - `maxTotalRegexLength` integer: Plan limit: combined character length of all `pattern` regex strings in the specification. - `createdAt` string, date-time - `updatedAt` string, date-time, nullable - `endpoints` ApiGuardianEndpointDetails[], nullable, required: All endpoints discovered from the uploaded OpenAPI specification. - `apiGuardianEndpointId` integer - `shieldZoneId` integer - `requestMethod` string, nullable: The HTTP method (e.g. "GET", "POST"). - `requestPath` string, nullable: The OAS path template (e.g. "/pets/{petId}"). - `validateRequestBodySchema` boolean: Whether inbound request bodies are validated against the OAS request body schema. - `validateResponseBodySchema` boolean: Whether outbound response bodies are validated against the OAS response schema. - `validateAuthorization` boolean: Whether authentication credentials are enforced. - `isEnabled` boolean: Whether this endpoint is active. Disabled endpoints are not enforced. - `authSchemes` AuthSchemeDetails[], nullable: Authentication schemes required by this endpoint, derived from the OAS security requirements. Null when the endpoint has no security requirements. - `schemeName` string, nullable: The OpenAPI security scheme reference name (e.g. "bearerAuth", "apiKey"). - `schemeType` 'ApiKey' | 'Http' | 'OAuth2' | 'OpenIdConnect': The type of security scheme as defined in the OpenAPI specification. - `location` 'Header' | 'Query' | 'Cookie': Where an authentication credential is transmitted in the HTTP request. - `credentialName` string, nullable: The name of the header, query parameter, or cookie that carries the credential (e.g. "Authorization", "X-API-Key"). - `httpScheme` string, nullable: For HTTP auth schemes, the scheme name (e.g. "bearer", "basic"). Null for non-HTTP schemes. - `requestBodySchemaYaml` string, nullable: The request body schema rendered as YAML for display purposes. Null if no request body is defined. - `responseBodySchemasYaml` object, nullable: Response body schemas keyed by HTTP status code, rendered as YAML. Null if no response schemas are defined. - `availableParameters` object, nullable: All parameters defined in the OAS operation, grouped by location (path, query, header, cookie). - `Path` string[] - `Query` string[] - `Header` string[] - `Cookie` string[] - `injectionDetectionParameters` object, nullable: Parameters selected for XSS/SQLi injection detection, grouped by location. Null if not configured. Subset of BunnyNet.Shield.Api.Services.Shield.ApiGuardian.Models.ApiGuardianEndpointDetails.AvailableParameters. - `Path` string[] - `Query` string[] - `Header` string[] - `Cookie` string[] - `detectParameterXss` boolean: Whether XSS detection is enabled for the selected parameters. - `detectParameterSqli` boolean: Whether SQL injection detection is enabled for the selected parameters. - `rateLimitingEnabled` boolean: Whether per-endpoint rate limiting is active. - `rateLimitingType` 'Global' | 'IP' - `rateLimitingRequestCount` integer: Maximum number of requests allowed within the rate limiting timeframe before blocking. - `rateLimitingTimeframe` 1 | 10 | 60 | 300 | 900 | 3600: 1 = PerSecond 10 = PerTenSeconds 60 = PerOneMinute 300 = PerFiveMinutes 900 = PerFifteenMinutes 3600 = PerOneHour - `createdAt` string, date-time - `updatedAt` string, date-time, nullable ## Other responses - `401`: Unauthorized - `403`: Forbidden - `404`: Not Found - `500`: Internal Server Error ## Changes - **2026-11-12** `6a424e866a61`: 27 breaking, 81 warning, 81 info - the `data/endpoints/items/authSchemes/items/location` response's property type changed from `integer` to `string`, and format from `int32` to no format for status `200` (media type: text/plain) - the `data/endpoints/items/authSchemes/items/location` response's property type changed from `integer` to `string`, and format from `int32` to no format for status `200` (media type: application/json) - the `data/endpoints/items/authSchemes/items/location` response's property type changed from `integer` to `string`, and format from `int32` to no format for status `200` (media type: text/json) - the `data/endpoints/items/authSchemes/items/location` response's property type changed from `integer` to `string`, and format from `int32` to no format for status `403` (media type: text/plain) - …185 more - **2026-04-23** `30ba69f85a97`: 1 info - endpoint added [Operation history](https://skmtc.dev/bunny/apis/bunny-shield-api/changes/shield/shield-zone/:shieldZoneId/api-guardian/spec/patch.md) --- [API](https://skmtc.dev/bunny/apis/bunny-shield-api.md) - [All operations](https://skmtc.dev/bunny/apis/bunny-shield-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bunny/apis/bunny-shield-api/revisions/6a424e866a61?raw)