---
title: "List Guardrails V2"
method: GET
path: "/v2/guardrails/list"
tags: ["Guardrails"]
---

# List Guardrails V2

`GET /v2/guardrails/list`

List the guardrails that are available in the database using GuardrailRegistry

👉 [Guardrail docs](https://docs.litellm.ai/docs/proxy/guardrails/quick_start)

Example Request:
```bash
curl -X GET "http://localhost:4000/v2/guardrails/list" -H "Authorization: Bearer <your_api_key>"
```

Example Response:
```json
{
    "guardrails": [
        {
            "guardrail_id": "123e4567-e89b-12d3-a456-426614174000",
            "guardrail_name": "my-bedrock-guard",
            "litellm_params": {
                "guardrail": "bedrock",
                "mode": "pre_call",
                "guardrailIdentifier": "ff6ujrregl1q",
                "guardrailVersion": "DRAFT",
                "default_on": true
            },
            "guardrail_info": {
                "description": "Bedrock content moderation guardrail"
            }
        }
    ]
}
```

## Response `200`

Successful Response

- ListGuardrailsResponse
  - `guardrails` GuardrailInfoResponse[], required
    - `guardrail_id` string, nullable
    - `guardrail_name` string, required
    - `litellm_params` BaseLitellmParams
      - `patterns` ContentFilterPattern[], nullable — List of patterns (prebuilt or custom regex) to detect
        - `pattern_type` 'prebuilt' | 'regex', required — Type of pattern: 'prebuilt' for predefined patterns or 'regex' for custom
        - `pattern_name` string, nullable — Name of prebuilt pattern (e.g., 'us_ssn', 'credit_card'). Required if pattern_type is 'prebuilt'
        - `pattern` string, nullable — Custom regex pattern. Required if pattern_type is 'regex'
        - `name` string, nullable — Name for this pattern (used in logging and error messages)
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
      - `blocked_words` BlockedWord[], nullable — List of blocked words with individual actions
        - `keyword` string, required — The keyword to block or mask
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
        - `description` string, nullable — Optional description explaining why this keyword is sensitive
      - `blocked_words_file` string, nullable — Path to YAML file containing blocked_words list
      - `categories` ContentFilterCategoryConfig[], nullable — List of prebuilt categories to enable (harmful_*, bias_*)
        - `category` string, required — The category to detect
        - `enabled` boolean — Whether the category is enabled
        - `action` 'BLOCK' | 'MASK', required — The action to take when the category is detected
        - `severity_threshold` 'high' | 'medium' | 'low' — The severity threshold to detect the category
        - `category_file` string, nullable — Optional override. Use your own category file instead of the default one.
      - `severity_threshold` string, nullable — Minimum severity to block (high, medium, low)
      - `pattern_redaction_format` string, nullable — Format string for pattern redaction (use {pattern_name} placeholder)
      - `keyword_redaction_tag` string, nullable — Tag to use for keyword redaction
      - `api_key` string, nullable — API key for the guardrail service
      - `api_base` string, nullable — Base URL for the guardrail service API
      - `experimental_use_latest_role_message_only` boolean, nullable — When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call)
      - `only_scan_new_messages` boolean, nullable — When True, the guardrail only scans messages that have not already been scanned earlier in the same session (identified by litellm_session_id / session_id). Message content is hashed per session and cached; only the diff (new or edited messages) is sent to the guardrail provider on follow-up calls. Falls back to a full scan when the request has no session id or the cache is unavailable. Intended for blocking/detection guardrails; not applied when mask_request_content is set.
      - `skip_system_message_in_guardrail` boolean, nullable — When True, unified guardrails skip system-role messages when building evaluation inputs (texts and structured_messages). When False, system messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_system_message_in_guardrail setting. For Anthropic /v1/messages, the flag applies only to the trusted top-level system prompt. In-sequence system entries are untrusted client input and remain in texts and structured_messages.
      - `skip_tool_message_in_guardrail` boolean, nullable — When True, unified guardrails skip tool-role messages when building evaluation inputs (texts and structured_messages). When False, tool messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_tool_message_in_guardrail setting.
      - `scan_only_tool_results` boolean, nullable — When True, unified guardrails only evaluate tool results, the untrusted data an agent feeds back into the model, and skip system, user, and assistant content. Intended for agent harnesses whose own prompt scaffolding is trusted but often trips prompt-attack detectors.
      - `category_thresholds` LakeraCategoryThresholds
        - `prompt_injection` number
        - `jailbreak` number
      - `detect_secrets_config` object, nullable — Configuration for detect-secrets guardrail
      - `guard_name` string, nullable — Name of the guardrail in guardrails.ai
      - `default_on` boolean, nullable — Whether the guardrail is enabled by default
      - `mask_request_content` boolean, nullable — Will mask request content if guardrail makes any changes
      - `mask_response_content` boolean, nullable — Will mask response content if guardrail makes any changes
      - `pangea_input_recipe` string, nullable — Recipe for input (LLM request)
      - `pangea_output_recipe` string, nullable — Recipe for output (LLM response)
      - `model` string, nullable — Optional field if guardrail requires a 'model' parameter
      - `violation_message_template` string, nullable — Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}.
      - `end_session_after_n_fails` integer, nullable — For /v1/realtime sessions: automatically close the session after this many guardrail violations.
      - `on_violation` 'warn' | 'end_session', nullable — For /v1/realtime sessions: 'warn' speaks the violation message and continues; 'end_session' speaks the message and closes the connection.
      - `realtime_violation_message` string, nullable — The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set.
      - `template_id` string, nullable — The ID of your Model Armor template
      - `location` string, nullable — Google Cloud location/region (e.g., us-central1)
      - `credentials` string, nullable — Path to Google Cloud credentials JSON file or JSON string
      - `api_endpoint` string, nullable — Optional custom API endpoint for Model Armor
      - `fail_on_error` boolean, nullable — Whether to fail the request if the guardrail encounters an error. Implemented by guardrail='model_armor', 'generic_guardrail_api' and 'crowdstrike_aidr'. True (default) raises the error. False logs a critical error and lets the request proceed, so only a valid guardrail response can block or modify it.
      - `skip_unscannable_attachments` boolean, nullable — Implemented by guardrail='model_armor'. When True, attachment references that carry no inline bytes (file_id, gs://, or http(s) URLs) pass through unscanned instead of blocking, while fail_on_error still governs real Model Armor API errors. Default False blocks them.
      - `sanitize_error_detail` boolean, nullable — For guardrail='model_armor': omit the raw Model Armor response from caller-facing errors and logs by default. Set False to restore verbose output.
      - `additional_provider_specific_params` object, nullable — Additional provider-specific parameters for generic guardrail APIs
      - `unreachable_fallback` 'fail_closed' | 'fail_open' — Behavior when a guardrail endpoint is unreachable due to network errors. Implemented by guardrail='generic_guardrail_api', 'akto', 'vigil_guard', 'repelloai', 'headroom', and 'compresr'. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and allows the request to proceed.
      - `extra_headers` string[], nullable — Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers).
      - `custom_code` string, nullable — Python-like code containing the apply_guardrail function for custom guardrail logic
      - `timeout` number, nullable — Per-request timeout for the guardrail provider API call (seconds). Accepts int, float, or numeric string; coerced to float on load. Each guardrail handler chooses its own default when unset.
      - `on_sensitive_data` 'block' | 'route', nullable — Action to take when sensitive data is detected. 'block' raises an exception (default behavior). 'route' reroutes the request to the model specified in sensitive_data_route_to_model.
      - `sensitive_data_route_to_model` string, nullable — Model to route requests to when sensitive data is detected and on_sensitive_data='route'. This is typically an on-premise model for data privacy. The routing decision persists for the entire session.
      - `sticky_session_routing` boolean, nullable — When True (default), after sensitive data is detected and routed, all subsequent requests in the same session will continue routing to the same model.
      - `run_in_parallel` boolean, nullable — When True, this pre_call or post_call guardrail runs concurrently with other opted-in guardrails of the same hook, after the sequential guardrails have run. Use only for block-only guardrails that inspect and reject; do not enable it for guardrails that modify the request or response (e.g. PII masking or sensitive-data routing), since parallel runs share one snapshot and their mutations would race.
      - `scan_raw_request` boolean, nullable — When True, this pre_call guardrail always evaluates the request as it was before any guardrail in this hook ran, regardless of its position in the guardrails list -- so the YAML order of guardrails can never change whether this one blocks. Use only for block-only guardrails: any data this guardrail returns is discarded, same contract as run_in_parallel, since an earlier guardrail's masking must not be undone by this one.
    - `guardrail_info` object, nullable
    - `created_at` string, date-time, nullable
    - `updated_at` string, date-time, nullable
    - `guardrail_definition_location` 'db' | 'config'

## Changes

- **2026-09-21** `6246f8d427b7` — 2 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed
- **2026-09-19** `c357baf422ab` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed
- **2026-09-18** `082b5fabd909` — 4 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed
  - added `#/components/schemas/BaseLitellmParams` to the `guardrails/items/litellm_params` response property `anyOf` list for the response status `200`
  - removed `#/components/schemas/BaseLitellmParams-Output` from the `guardrails/items/litellm_params` response property `anyOf` list for the response status `200`
- **2026-09-17** `e2f308355e2d` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed
- **2026-09-01** `89805a9f84ad` — 2 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed

[Full history](https://skmtc.dev/flock/apis/litellm-api/changes/v2/guardrails/list/get.md)

---

[API](https://skmtc.dev/flock/apis/litellm-api.md) · [All operations](https://skmtc.dev/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flock/apis/litellm-api/revisions/731afbea6a1b?raw)