---
title: "List Guardrails"
method: GET
path: "/guardrails/list"
tags: ["guardrails"]
---

# List Guardrails

`GET /guardrails/list`

List the guardrails that are available on the proxy server

👉 [Guardrail docs](https://docs.litellm.ai/docs/proxy/guardrails/quick_start)

Example Request:
```bash
curl -X GET "http://localhost:4000/guardrails/list" -H "Authorization: Bearer <your_api_key>"
```

Example Response:
```json
{
    "guardrails": [
        {
        "guardrail_name": "bedrock-pre-guard",
        "guardrail_info": {
            "params": [
            {
                "name": "toxicity_score",
                "type": "float",
                "description": "Score between 0-1 indicating content toxicity level"
            },
            {
                "name": "pii_detection",
                "type": "boolean"
            }
            ]
        }
        }
    ]
}
```

## Response `200`

Successful Response

- ListGuardrailsResponse
  - `guardrails` GuardrailInfoResponse[], required
    - `created_at` string, date-time, nullable
    - `guardrail_definition_location` 'db' | 'config'
    - `guardrail_id` string, nullable
    - `guardrail_info` object, nullable
    - `guardrail_name` string, required
    - `litellm_params` BaseLitellmParams
      - `additional_provider_specific_params` object, nullable — Additional provider-specific parameters for generic guardrail APIs
      - `api_base` string, nullable — Base URL for the guardrail service API
      - `api_endpoint` string, nullable — Optional custom API endpoint for Model Armor
      - `api_key` string, nullable — API key for the guardrail service
      - `blocked_words` BlockedWord[], nullable — List of blocked words with individual actions
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
        - `description` string, nullable — Optional description explaining why this keyword is sensitive
        - `keyword` string, required — The keyword to block or mask
      - `blocked_words_file` string, nullable — Path to YAML file containing blocked_words list
      - `categories` ContentFilterCategoryConfig[], nullable — List of prebuilt categories to enable (harmful_*, bias_*)
        - `action` 'BLOCK' | 'MASK', required — The action to take when the category is detected
        - `category` string, required — The category to detect
        - `category_file` string, nullable — Optional override. Use your own category file instead of the default one.
        - `enabled` boolean — Whether the category is enabled
        - `severity_threshold` 'high' | 'medium' | 'low' — The severity threshold to detect the category
      - `category_thresholds` LakeraCategoryThresholds
        - `jailbreak` number
        - `prompt_injection` number
      - `credentials` string, nullable — Path to Google Cloud credentials JSON file or JSON string
      - `custom_code` string, nullable — Python-like code containing the apply_guardrail function for custom guardrail logic
      - `default_on` boolean, nullable — Whether the guardrail is enabled by default
      - `detect_secrets_config` object, nullable — Configuration for detect-secrets guardrail
      - `end_session_after_n_fails` integer, nullable — For /v1/realtime sessions: automatically close the session after this many guardrail violations.
      - `experimental_use_latest_role_message_only` boolean, nullable — When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call)
      - `extra_headers` string[], nullable — Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers).
      - `fail_on_error` boolean, nullable — Whether to fail the request if the guardrail encounters an error. Implemented by guardrail='model_armor', 'generic_guardrail_api' and 'crowdstrike_aidr'. True (default) raises the error. False logs a critical error and lets the request proceed, so only a valid guardrail response can block or modify it.
      - `guard_name` string, nullable — Name of the guardrail in guardrails.ai
      - `keyword_redaction_tag` string, nullable — Tag to use for keyword redaction
      - `location` string, nullable — Google Cloud location/region (e.g., us-central1)
      - `mask_request_content` boolean, nullable — Will mask request content if guardrail makes any changes
      - `mask_response_content` boolean, nullable — Will mask response content if guardrail makes any changes
      - `model` string, nullable — Optional field if guardrail requires a 'model' parameter
      - `on_sensitive_data` 'block' | 'route', nullable — Action to take when sensitive data is detected. 'block' raises an exception (default behavior). 'route' reroutes the request to the model specified in sensitive_data_route_to_model.
      - `on_violation` 'warn' | 'end_session', nullable — For /v1/realtime sessions: 'warn' speaks the violation message and continues; 'end_session' speaks the message and closes the connection.
      - `only_scan_new_messages` boolean, nullable — When True, the guardrail only scans messages that have not already been scanned earlier in the same session (identified by litellm_session_id / session_id). Message content is hashed per session and cached; only the diff (new or edited messages) is sent to the guardrail provider on follow-up calls. Falls back to a full scan when the request has no session id or the cache is unavailable. Intended for blocking/detection guardrails; not applied when mask_request_content is set.
      - `pangea_input_recipe` string, nullable — Recipe for input (LLM request)
      - `pangea_output_recipe` string, nullable — Recipe for output (LLM response)
      - `pattern_redaction_format` string, nullable — Format string for pattern redaction (use {pattern_name} placeholder)
      - `patterns` ContentFilterPattern[], nullable — List of patterns (prebuilt or custom regex) to detect
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
        - `name` string, nullable — Name for this pattern (used in logging and error messages)
        - `pattern` string, nullable — Custom regex pattern. Required if pattern_type is 'regex'
        - `pattern_name` string, nullable — Name of prebuilt pattern (e.g., 'us_ssn', 'credit_card'). Required if pattern_type is 'prebuilt'
        - `pattern_type` 'prebuilt' | 'regex', required — Type of pattern: 'prebuilt' for predefined patterns or 'regex' for custom
      - `realtime_violation_message` string, nullable — The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set.
      - `run_in_parallel` boolean, nullable — When True, this pre_call or post_call guardrail runs concurrently with other opted-in guardrails of the same hook, after the sequential guardrails have run. Use only for block-only guardrails that inspect and reject; do not enable it for guardrails that modify the request or response (e.g. PII masking or sensitive-data routing), since parallel runs share one snapshot and their mutations would race.
      - `sanitize_error_detail` boolean, nullable — For guardrail='model_armor': omit the raw Model Armor response from caller-facing errors and logs by default. Set False to restore verbose output.
      - `scan_only_tool_results` boolean, nullable — When True, unified guardrails only evaluate tool results, the untrusted data an agent feeds back into the model, and skip system, user, and assistant content. Intended for agent harnesses whose own prompt scaffolding is trusted but often trips prompt-attack detectors.
      - `scan_raw_request` boolean, nullable — When True, this pre_call guardrail always evaluates the request as it was before any guardrail in this hook ran, regardless of its position in the guardrails list -- so the YAML order of guardrails can never change whether this one blocks. Use only for block-only guardrails: any data this guardrail returns is discarded, same contract as run_in_parallel, since an earlier guardrail's masking must not be undone by this one.
      - `sensitive_data_route_to_model` string, nullable — Model to route requests to when sensitive data is detected and on_sensitive_data='route'. This is typically an on-premise model for data privacy. The routing decision persists for the entire session.
      - `severity_threshold` string, nullable — Minimum severity to block (high, medium, low)
      - `skip_system_message_in_guardrail` boolean, nullable — When True, unified guardrails skip system-role messages when building evaluation inputs (texts and structured_messages). When False, system messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_system_message_in_guardrail setting. For Anthropic /v1/messages, the flag applies only to the trusted top-level system prompt. In-sequence system entries are untrusted client input and remain in texts and structured_messages.
      - `skip_tool_message_in_guardrail` boolean, nullable — When True, unified guardrails skip tool-role messages when building evaluation inputs (texts and structured_messages). When False, tool messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_tool_message_in_guardrail setting.
      - `skip_unscannable_attachments` boolean, nullable — Implemented by guardrail='model_armor'. When True, attachment references that carry no inline bytes (file_id, gs://, or http(s) URLs) pass through unscanned instead of blocking, while fail_on_error still governs real Model Armor API errors. Default False blocks them.
      - `sticky_session_routing` boolean, nullable — When True (default), after sensitive data is detected and routed, all subsequent requests in the same session will continue routing to the same model.
      - `template_id` string, nullable — The ID of your Model Armor template
      - `timeout` number, nullable — Per-request timeout for the guardrail provider API call (seconds). Accepts int, float, or numeric string; coerced to float on load. Each guardrail handler chooses its own default when unset.
      - `unreachable_fallback` 'fail_closed' | 'fail_open' — Behavior when a guardrail endpoint is unreachable due to network errors. Implemented by guardrail='generic_guardrail_api', 'akto', 'vigil_guard', 'repelloai', 'headroom', and 'compresr'. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and allows the request to proceed.
      - `violation_message_template` string, nullable — Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}.
    - `updated_at` string, date-time, nullable

## Changes

- **2026-09-19** `c357baf422ab` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed
- **2026-09-18** `082b5fabd909` — 4 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed
  - added `#/components/schemas/BaseLitellmParams` to the `guardrails/items/litellm_params` response property `anyOf` list for the response status `200`
  - removed `#/components/schemas/BaseLitellmParams-Output` from the `guardrails/items/litellm_params` response property `anyOf` list for the response status `200`
- **2026-09-17** `e2f308355e2d` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed
- **2026-09-01** `89805a9f84ad` — 2 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed
- **2026-09-01** `5c00a227eebf` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed

[Full history](https://skmtc.dev/flock/apis/litellm-api/changes/guardrails/list/get.md)

---

[API](https://skmtc.dev/flock/apis/litellm-api.md) · [All operations](https://skmtc.dev/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flock/apis/litellm-api/revisions/3b2b241e4b0b?raw)