---
title: "Update Guardrail"
method: PUT
path: "/guardrails/{guardrail_id}"
tags: ["Guardrails"]
---

# Update Guardrail

`PUT /guardrails/{guardrail_id}`

Update an existing guardrail

👉 [Guardrail docs](https://docs.litellm.ai/docs/proxy/guardrails/quick_start)

Example Request:
```bash
curl -X PUT "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000" \
    -H "Authorization: Bearer <your_api_key>" \
    -H "Content-Type: application/json" \
    -d '{
        "guardrail": {
            "guardrail_name": "updated-bedrock-guard",
            "litellm_params": {
                "guardrail": "bedrock",
                "mode": "pre_call",
                "guardrailIdentifier": "ff6ujrregl1q",
                "guardrailVersion": "1.0",
                "default_on": true
            },
            "guardrail_info": {
                "description": "Updated Bedrock content moderation guardrail"
            }
        }
    }'
```

Example Response:
```json
{
    "guardrail_id": "123e4567-e89b-12d3-a456-426614174000",
    "guardrail_name": "updated-bedrock-guard",
    "litellm_params": {
        "guardrail": "bedrock",
        "mode": "pre_call",
        "guardrailIdentifier": "ff6ujrregl1q",
        "guardrailVersion": "1.0",
        "default_on": true
    },
    "guardrail_info": {
        "description": "Updated Bedrock content moderation guardrail"
    },
    "created_at": "2023-11-09T12:34:56.789Z",
    "updated_at": "2023-11-09T13:45:12.345Z"
}
```

## Path parameters

- `guardrail_id` string, required

## Request body

- UpdateGuardrailRequest
  - `guardrail` Guardrail, required
    - `guardrail_id` string, nullable
    - `guardrail_name` string, required
    - `litellm_params` LitellmParams, required
      - `optional_params` CiscoAIDefenseGuardrailConfigModelOptionalParams — Optional parameters for the Cisco AI Defense guardrail.
        - `inspection_type` 'chat' | 'mcp' — Which Cisco AI Defense inspection surface to use. 'chat' scans LLM model conversations via /api/v1/inspect/chat. 'mcp' scans MCP tool calls via /api/v1/inspect/mcp. Each guardrail instance targets exactly one surface; configure two guardrails to scan both chat and MCP traffic.
        - `inspect_path` string, nullable — Override for the inspection endpoint path. Defaults to /api/v1/inspect/chat when inspection_type='chat' and /api/v1/inspect/mcp when inspection_type='mcp'.
        - `enabled_rules` CiscoAIDefenseRule[], nullable — Explicit list of Cisco AI Defense rules to evaluate. If omitted, the policies configured for the API key in the Cisco AI Defense UI are used.
          - `rule_name` 'Code Detection' | 'Harassment' | 'Hate Speech' | 'PCI' | 'PHI' | 'PII' | 'Prompt Injection' | 'Profanity' | 'Sexual Content & Exploitation' | 'Social Division & Polarization' | 'Violence & Public Safety Threats', required — The canonical Cisco AI Defense rule name to evaluate.
          - `entity_types` string[], nullable — Optional list of entity types for the rule (e.g. 'Email Address', 'Phone Number'). Applies to rules such as PII, PCI, and PHI.
        - `integration_profile_id` string, nullable — Integration profile id to apply (advanced).
        - `integration_profile_version` string, nullable — Integration profile version to apply (advanced).
        - `integration_tenant_id` string, nullable — Integration tenant id to apply (advanced).
        - `integration_type` string, nullable — Integration type to apply (advanced).
        - `on_flagged_action` string, nullable — Action to take when Cisco AI Defense flags content. 'block' raises an HTTPException; 'monitor' logs the detection and lets the request continue.
        - `fallback_on_error` 'allow' | 'block', nullable — Behaviour when the Cisco AI Defense API is unavailable: 'allow' proceeds without scanning (high availability), 'block' rejects the request (maximum security).
        - `timeout` number, nullable — Timeout (seconds) for Cisco AI Defense API calls (1-60).
      - `singulr_api_key` string, nullable — The Singulr API key. Generate API key from Singulr Platform.
      - `singulr_api_base` string, nullable — The Singulr API base URL. Get base URL from Singulr Platform.
      - `singulr_application_id` string, nullable — The Singulr application ID. Get application ID from Singulr Platform.
      - `singulr_guardrail_id` string, nullable — The Singulr Guardrail ID. Get guardrail ID from Singulr Platform.
      - `block_on_error` boolean, nullable — Whether to block the request when the PromptGuard API is unreachable. Defaults to true (fail-closed). Set to false for fail-open behaviour.
      - `api_base` string, nullable — Regional base URL for the Cisco AI Defense Inspection API. Defaults to https://us.api.inspect.aidefense.security.cisco.com. Supported regions: us (us-west-2), ap (ap-ne-1), eu (eu-central-1). The environment variable `CISCO_AI_DEFENSE_API_BASE` is consulted as a fallback. The endpoint path is derived from inspection_type (/api/v1/inspect/chat for 'chat', /api/v1/inspect/mcp for 'mcp').
      - `api_key` string, nullable — API key for the Cisco AI Defense inspection endpoint. If not provided, the `CISCO_AI_DEFENSE_API_KEY` environment variable is used. Sent in the `X-Cisco-AI-Defense-API-Key` header. Both the chat and MCP endpoints use this key.
      - `api_id` string, nullable — The Hiddenlayer API Id for the Hiddenlayer API. If not provided, the `HIDDENLAYER_CLIENT_ID` environment variable is checked or https://api.hiddenlayer.ai is used.
      - `version` integer, nullable — Hiddenlayer guardrail version to use.
      - `blocked_languages` string[], nullable — Language tags to block (e.g. python, javascript, bash). Empty or None = block all fenced code blocks.
      - `action` 'block' | 'mask' — 'block' raises an error; 'mask' replaces the code block with a placeholder.
      - `confidence_threshold` number — Only block or mask when detection confidence >= this value; below threshold, allow or log_only.
      - `detect_execution_intent` boolean — When True, block only when user intent is to run/execute; allow when intent is explain/refactor/don't run. Also block text-only execution requests (e.g. 'run `ls`', 'read /etc/passwd').
      - `evaluation_id` string, nullable — Pre-configured evaluation ID from Qualifire dashboard. When provided, uses invoke_evaluation() instead of evaluate().
      - `prompt_injections` boolean, nullable — Enable prompt injection detection. Default check if no evaluation_id and no other checks are specified.
      - `hallucinations_check` boolean, nullable — Enable hallucination detection to detect factual inaccuracies.
      - `grounding_check` boolean, nullable — Enable grounding verification to ensure output is grounded in provided context.
      - `pii_check` boolean, nullable — Enable PII (Personally Identifiable Information) detection.
      - `content_moderation_check` boolean, nullable — Enable content moderation to check for harmful content (harassment, hate speech, etc.).
      - `tool_selection_quality_check` boolean, nullable — Enable tool selection quality check to evaluate quality of tool/function calls.
      - `assertions` string[], nullable — Custom assertions to validate against the output. Each assertion is a string describing a condition.
      - `on_flagged` 'block' | 'monitor' | 'inject_system_message', nullable — Action to take when content is flagged: 'block' (raise exception), 'monitor' (log only), or 'inject_system_message' (append an advisory system message and let the LLM decide)
      - `tracker_api_base` string, nullable — Base URL for the Ovalix Tracker service.
      - `tracker_api_key` string, nullable — API key for the Ovalix Tracker service.
      - `application_id` string, nullable — Application ID for Noma Security. Defaults to 'litellm' if not provided
      - `pre_checkpoint_id` string, nullable — Pre-checkpoint ID for the Ovalix Tracker service.
      - `post_checkpoint_id` string, nullable — Post-checkpoint ID for the Ovalix Tracker service.
      - `auth_token` string, nullable — Authorization bearer token for IBM Guardrails API. Reads from IBM_GUARDRAILS_AUTH_TOKEN env var if None.
      - `base_url` string, nullable — Base URL for the IBM Guardrails server
      - `detector_id` string, nullable — Name of the detector inside the server (e.g., 'jailbreak-detector')
      - `is_detector_server` boolean, nullable — Boolean flag to determine if calling a detector server (True) or the FMS Orchestrator (False). Defaults to True.
      - `verify_ssl` boolean, nullable — Whether to verify SSL certificates. Defaults to True.
      - `policy_name` string, nullable — The EnkryptAI policy name to use. Sent via x-enkrypt-policy header.
      - `deployment_name` string, nullable — The EnkryptAI deployment name to use. Sent via X-Enkrypt-Deployment header.
      - `detectors` object, nullable — Dictionary of detector configurations (e.g., {'nsfw': {'enabled': True}, 'toxicity': {'enabled': True}}).
      - `block_on_violation` boolean, nullable — Whether to block requests when violations are detected. Defaults to True.
      - `patterns` ContentFilterPattern[], nullable — List of patterns (prebuilt or custom regex) to detect
        - `pattern_type` 'prebuilt' | 'regex', required — Type of pattern: 'prebuilt' for predefined patterns or 'regex' for custom
        - `pattern_name` string, nullable — Name of prebuilt pattern (e.g., 'us_ssn', 'credit_card'). Required if pattern_type is 'prebuilt'
        - `pattern` string, nullable — Custom regex pattern. Required if pattern_type is 'regex'
        - `name` string, nullable — Name for this pattern (used in logging and error messages)
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
      - `blocked_words` BlockedWord[], nullable — List of blocked words with individual actions
        - `keyword` string, required — The keyword to block or mask
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
        - `description` string, nullable — Optional description explaining why this keyword is sensitive
      - `blocked_words_file` string, nullable — Path to YAML file containing blocked_words list
      - `categories` ContentFilterCategoryConfig[], nullable — List of prebuilt categories to enable (harmful_*, bias_*)
        - `category` string, required — The category to detect
        - `enabled` boolean — Whether the category is enabled
        - `action` 'BLOCK' | 'MASK', required — The action to take when the category is detected
        - `severity_threshold` 'high' | 'medium' | 'low' — The severity threshold to detect the category
        - `category_file` string, nullable — Optional override. Use your own category file instead of the default one.
      - `severity_threshold` string, nullable — Minimum severity to block (high, medium, low)
      - `pattern_redaction_format` string, nullable — Format string for pattern redaction (use {pattern_name} placeholder)
      - `keyword_redaction_tag` string, nullable — Tag to use for keyword redaction
      - `experimental_use_latest_role_message_only` boolean, nullable — When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call)
      - `only_scan_new_messages` boolean, nullable — When True, the guardrail only scans messages that have not already been scanned earlier in the same session (identified by litellm_session_id / session_id). Message content is hashed per session and cached; only the diff (new or edited messages) is sent to the guardrail provider on follow-up calls. Falls back to a full scan when the request has no session id or the cache is unavailable. Intended for blocking/detection guardrails; not applied when mask_request_content is set.
      - `skip_system_message_in_guardrail` boolean, nullable — When True, unified guardrails skip system-role messages when building evaluation inputs (texts and structured_messages). When False, system messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_system_message_in_guardrail setting. For Anthropic /v1/messages, the flag applies only to the trusted top-level system prompt. In-sequence system entries are untrusted client input and remain in texts and structured_messages.
      - `skip_tool_message_in_guardrail` boolean, nullable — When True, unified guardrails skip tool-role messages when building evaluation inputs (texts and structured_messages). When False, tool messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_tool_message_in_guardrail setting.
      - `scan_only_tool_results` boolean, nullable — When True, unified guardrails only evaluate tool results, the untrusted data an agent feeds back into the model, and skip system, user, and assistant content. Intended for agent harnesses whose own prompt scaffolding is trusted but often trips prompt-attack detectors.
      - `category_thresholds` LakeraCategoryThresholds
        - `prompt_injection` number
        - `jailbreak` number
      - `detect_secrets_config` object, nullable — Configuration for detect-secrets guardrail
      - `guard_name` string, nullable — Name of the Javelin guard to use
      - `default_on` boolean, nullable — Whether the guardrail is enabled by default
      - `mask_request_content` boolean, nullable — Will mask request content if guardrail makes any changes
      - `mask_response_content` boolean, nullable — Will mask response content if guardrail makes any changes
      - `pangea_input_recipe` string, nullable — Recipe for input (LLM request)
      - `pangea_output_recipe` string, nullable — Recipe for output (LLM response)
      - `model` string, nullable — Model name forwarded to the headroom /v1/compress endpoint.
      - `violation_message_template` string, nullable — Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}.
      - `end_session_after_n_fails` integer, nullable — For /v1/realtime sessions: automatically close the session after this many guardrail violations.
      - `on_violation` 'warn' | 'end_session', nullable — For /v1/realtime sessions: 'warn' speaks the violation message and continues; 'end_session' speaks the message and closes the connection.
      - `realtime_violation_message` string, nullable — The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set.
      - `template_id` string, nullable — The ID of your Model Armor template
      - `location` string, nullable — Google Cloud location/region (e.g., us-central1)
      - `credentials` string, nullable — Path to Google Cloud credentials JSON file or JSON string
      - `api_endpoint` string, nullable — Optional custom API endpoint for Model Armor
      - `fail_on_error` boolean, nullable — Whether to fail the request if the guardrail encounters an error. Implemented by guardrail='model_armor', 'generic_guardrail_api' and 'crowdstrike_aidr'. True (default) raises the error. False logs a critical error and lets the request proceed, so only a valid guardrail response can block or modify it.
      - `skip_unscannable_attachments` boolean, nullable — Implemented by guardrail='model_armor'. When True, attachment references that carry no inline bytes (file_id, gs://, or http(s) URLs) pass through unscanned instead of blocking, while fail_on_error still governs real Model Armor API errors. Default False blocks them.
      - `sanitize_error_detail` boolean, nullable — For guardrail='model_armor': omit the raw Model Armor response from caller-facing errors and logs by default. Set False to restore verbose output.
      - `additional_provider_specific_params` object, nullable — Additional provider-specific parameters for generic guardrail APIs
      - `unreachable_fallback` 'fail_closed' | 'fail_open' — Behavior when the headroom compression service is unreachable or errors. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and forwards the request uncompressed instead of blocking it.
      - `extra_headers` string[], nullable — Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers).
      - `custom_code` string, nullable — Python-like code containing the apply_guardrail function for custom guardrail logic
      - `timeout` number, nullable — Per-request timeout for the guardrail provider API call (seconds). Accepts int, float, or numeric string; coerced to float on load. Each guardrail handler chooses its own default when unset.
      - `on_sensitive_data` 'block' | 'route', nullable — Action to take when sensitive data is detected. 'block' raises an exception (default behavior). 'route' reroutes the request to the model specified in sensitive_data_route_to_model.
      - `sensitive_data_route_to_model` string, nullable — Model to route requests to when sensitive data is detected and on_sensitive_data='route'. This is typically an on-premise model for data privacy. The routing decision persists for the entire session.
      - `sticky_session_routing` boolean, nullable — When True (default), after sensitive data is detected and routed, all subsequent requests in the same session will continue routing to the same model.
      - `run_in_parallel` boolean, nullable — When True, this pre_call or post_call guardrail runs concurrently with other opted-in guardrails of the same hook, after the sequential guardrails have run. Use only for block-only guardrails that inspect and reject; do not enable it for guardrails that modify the request or response (e.g. PII masking or sensitive-data routing), since parallel runs share one snapshot and their mutations would race.
      - `scan_raw_request` boolean, nullable — When True, this pre_call guardrail always evaluates the request as it was before any guardrail in this hook ran, regardless of its position in the guardrails list -- so the YAML order of guardrails can never change whether this one blocks. Use only for block-only guardrails: any data this guardrail returns is discarded, same contract as run_in_parallel, since an earlier guardrail's masking must not be undone by this one.
      - `api_version` string, nullable — API version for Javelin service
      - `metadata` object, nullable — Additional metadata to include in the request
      - `application` string, nullable — Application name for Javelin service
      - `config` object, nullable — Additional configuration for the guardrail
      - `akto_base_url` string, nullable — Akto Guardrail API Base URL. Env: AKTO_GUARDRAIL_API_BASE.
      - `akto_api_key` string, nullable — API key for Akto. Env: AKTO_API_KEY.
      - `akto_account_id` string, nullable — Akto account ID for multi-tenant deployments. Env: AKTO_ACCOUNT_ID. Default: '1000000'.
      - `akto_vxlan_id` string, nullable — Akto VXLAN ID. Env: AKTO_VXLAN_ID. Default: '0'.
      - `guardrail_timeout` integer, nullable — HTTP timeout in seconds. Default: 5.
      - `policy_id` integer, nullable — Policy ID for Zscaler AI Guard. Can also be set via ZSCALER_AI_GUARD_POLICY_ID environment variable
      - `send_user_api_key_alias` boolean, nullable — Whether to send user_API_key_alias in headers
      - `send_user_api_key_user_id` boolean, nullable — Whether to send user_API_key_user_id in headers
      - `send_user_api_key_team_id` boolean, nullable — Whether to send user_API_key_team_id in headers
      - `rules` ToolPermissionRule[], nullable — Ordered allow/deny rules. Patterns use regex for tool names/types and optional regex constraints on tool arguments.
        - `id` string, required — Unique identifier for the rule
        - `tool_name` string, nullable — Regex pattern applied to the tool's function name
        - `tool_type` string, nullable — Regex pattern applied to the tool type (e.g., function)
        - `decision` 'allow' | 'deny', required — Whether to allow or deny this tool usage
        - `allowed_param_patterns` object, nullable — Optional regex map enforcing nested parameter values using dot/[] paths
      - `default_action` 'allow' | 'deny' — Fallback decision when no rule matches
      - `on_disallowed_action` 'block' | 'rewrite' — Choose whether disallowed tools block the request or get rewritten out of the payload
      - `xecguard_model` string, nullable — XecGuard scanning model identifier. Defaults to 'xecguard_v2'.
      - `policy_names` string[], nullable — XecGuard policies to apply on each scan. Select one or more of the built-in default policies; if none are selected, the guardrail defaults to System Prompt Enforcement + Harmful Content Protection.
      - `grounding_strictness` 'BALANCED' | 'STRICT', nullable — Strictness level for XecGuard context-grounding validation. 'BALANCED' (default) treats INCOMPLETE answers as SAFE; 'STRICT' flags them as UNSAFE. Grounding only runs in post_call when `metadata.xecguard_grounding_documents` is provided.
      - `use_v2` boolean, nullable — If True and guardrail='noma', route to the new Noma v2 implementation instead of the legacy implementation.
      - `monitor_mode` boolean, nullable — If True, logs violations without blocking. Defaults to False if not provided
      - `block_failures` boolean, nullable — If True, blocks requests on API failures. Defaults to True if not provided
      - `anonymize_input` boolean, nullable — If True, replaces sensitive content with anonymized version when only PII/PCI/secrets are detected. Only applies in blocking mode. Defaults to False if not provided
      - `on_flagged_action` string, nullable — Action to take when content is flagged: 'block' (raise exception) or 'monitor' (log only)
      - `async_mode` boolean, nullable — Set to True to request asynchronous analysis (sets `plr_async` header). Defaults to provider behaviour when omitted.
      - `persist_session` boolean, nullable — Controls Pillar session persistence (sets `plr_persist` header). Set to False to disable persistence.
      - `include_scanners` boolean, nullable — Include scanner category summaries in responses (sets `plr_scanners` header).
      - `include_evidence` boolean, nullable — Include detailed evidence payloads in responses (sets `plr_evidence` header).
      - `deepkeep_firewall_id` string, nullable — The DeepKeep Firewall ID to use for guardrail evaluation. If not provided, the `DEEPKEEP_FIREWALL_ID` environment variable is checked.
      - `lasso_user_id` string, nullable — User ID for the Lasso guardrail
      - `lasso_conversation_id` string, nullable — Conversation ID for the Lasso guardrail
      - `mask` boolean, nullable — Enable content masking using Lasso classifix API
      - `asset_id` string, nullable — Repello asset ID whose dashboard policies are enforced. Required; the guardrail raises at init if it is missing.
      - `project_id` string, nullable — Project ID for the Lakera AI project
      - `payload` boolean, nullable — Whether to include payload in the response
      - `breakdown` boolean, nullable — Whether to include breakdown in the response
      - `dev_info` boolean, nullable — Whether to include developer information in the response
      - `advisory_system_message` string, nullable — Custom advisory message template used when on_flagged='inject_system_message'. Must contain a {reason} placeholder. Defaults to a generic advisory message if unset.
      - `guardrailIdentifier` string, nullable — The ID of your guardrail on Bedrock
      - `guardrailVersion` string, nullable — The version of your Bedrock guardrail (e.g., DRAFT or version number)
      - `disable_exception_on_block` boolean, nullable — If True, will not raise an exception when the guardrail is blocked. Useful for OpenWebUI where exceptions can end the chat flow.
      - `aws_region_name` string, nullable — AWS region where your guardrail is deployed
      - `aws_access_key_id` string, nullable — AWS access key ID for authentication
      - `aws_secret_access_key` string, nullable — AWS secret access key for authentication
      - `aws_session_token` string, nullable — AWS session token for temporary credentials
      - `aws_session_name` string, nullable — Name of the AWS session
      - `aws_profile_name` string, nullable — AWS profile name for credential retrieval
      - `aws_role_name` string, nullable — AWS role name for assuming roles
      - `aws_web_identity_token` string, nullable — Web identity token for AWS role assumption
      - `aws_sts_endpoint` string, nullable — AWS STS endpoint URL
      - `aws_external_id` string, nullable — External ID required by the target role's trust policy on sts:AssumeRole
      - `aws_bedrock_runtime_endpoint` string, nullable — AWS Bedrock runtime endpoint URL
      - `checks` BedrockChecksConfigModel — Inline `checks` config for the resource-less Bedrock InvokeGuardrailChecks API. Include only the checks you want to run; at least one must be set.
        - `contentFilter` BedrockChecksContentFilterModel
          - `categories` BedrockChecksContentFilterCategoryItem[], required
            - `category` 'VIOLENCE' | 'HATE' | 'SEXUAL' | 'MISCONDUCT' | 'INSULTS', required
        - `promptAttack` BedrockChecksPromptAttackModel
          - `categories` BedrockChecksPromptAttackCategoryItem[], required
            - `category` 'JAILBREAK' | 'PROMPT_INJECTION' | 'PROMPT_LEAKAGE', required
        - `sensitiveInformation` BedrockChecksSensitiveInformationModel
          - `entities` BedrockChecksSensitiveInformationEntityItem[], required
            - `type` 'ADDRESS' | 'AGE' | 'AWS_ACCESS_KEY' | 'AWS_SECRET_KEY' | 'CA_HEALTH_NUMBER' | 'CA_SOCIAL_INSURANCE_NUMBER' | 'CREDIT_DEBIT_CARD_CVV' | 'CREDIT_DEBIT_CARD_EXPIRY' | 'CREDIT_DEBIT_CARD_NUMBER' | 'DRIVER_ID' | 'EMAIL' | 'INTERNATIONAL_BANK_ACCOUNT_NUMBER' | 'IP_ADDRESS' | 'LICENSE_PLATE' | 'MAC_ADDRESS' | 'NAME' | 'PASSWORD' | 'PHONE' | 'PIN' | 'SWIFT_CODE' | 'UK_NATIONAL_HEALTH_SERVICE_NUMBER' | 'UK_NATIONAL_INSURANCE_NUMBER' | 'UK_UNIQUE_TAXPAYER_REFERENCE_NUMBER' | 'URL' | 'USERNAME' | 'US_BANK_ACCOUNT_NUMBER' | 'US_BANK_ROUTING_NUMBER' | 'US_INDIVIDUAL_TAX_IDENTIFICATION_NUMBER' | 'US_PASSPORT_NUMBER' | 'US_SOCIAL_SECURITY_NUMBER' | 'VEHICLE_IDENTIFICATION_NUMBER', required
      - `content_filter_threshold` number, nullable — InvokeGuardrailChecks: block when any contentFilter severityScore >= this value (scores are in [0,1]). Set to null to make the content filter detect-only (logged, never blocks).
      - `prompt_attack_threshold` number, nullable — InvokeGuardrailChecks: block when any promptAttack severityScore >= this value (scores are in [0,1]). Set to null to make prompt-attack detection detect-only.
      - `pii_confidence_threshold` number, nullable — InvokeGuardrailChecks: block when any sensitiveInformation confidenceScore >= this value (scores are in [0,1]). Set to null to make PII detection detect-only.
      - `chunk_budget_chars` integer — ApplyGuardrail: batch size, in characters, used to re-send content after AWS has rejected a request as too large. Requests AWS accepts are always sent in a single call, so this has no effect until a rejection happens. Defaults to 25,000; a batch AWS still rejects is bisected automatically, so this value only trades round trips against batch size and cannot fail a request on its own.
      - `presidio_analyzer_api_base` string, nullable — Base URL for the Presidio analyzer API
      - `presidio_anonymizer_api_base` string, nullable — Base URL for the Presidio anonymizer API
      - `presidio_filter_scope` 'input' | 'output' | 'both', nullable — Where to apply Presidio checks: 'input' (user -> model), 'output' (model -> user), or 'both' (default).
      - `output_parse_pii` boolean, nullable — When True, LiteLLM will replace the masked text with the original text in the response
      - `presidio_language` string, nullable — Language code for Presidio PII analysis (e.g., 'en', 'de', 'es', 'fr')
      - `presidio_run_on` 'input' | 'output' | 'both', nullable — Where to apply Presidio checks: input, output, or both (default).
      - `pii_entities_config` object, nullable — Configuration for PII entity types and actions
      - `presidio_score_thresholds` object, nullable — Optional per-entity minimum confidence scores for Presidio detections. Entities below the threshold are ignored.
      - `presidio_entities_deny_list` union[], nullable — List of entity types to exclude from Presidio detection results. Detections of these types will be silently dropped. Useful for suppressing false positives (e.g., US_DRIVER_LICENSE on coding routes).
        - union
          - 'CREDIT_CARD' | 'CRYPTO' | 'DATE_TIME' | 'EMAIL_ADDRESS' | 'IBAN_CODE' | 'IP_ADDRESS' | 'NRP' | 'LOCATION' | 'PERSON' | 'PHONE_NUMBER' | 'MEDICAL_LICENSE' | 'URL' | 'US_BANK_NUMBER' | 'US_DRIVER_LICENSE' | 'US_ITIN' | 'US_PASSPORT' | 'US_SSN' | 'UK_NHS' | 'UK_NINO' | 'UK_PASSPORT' | 'UK_POSTCODE' | 'UK_VEHICLE_REGISTRATION' | 'ES_NIF' | 'ES_NIE' | 'IT_FISCAL_CODE' | 'IT_DRIVER_LICENSE' | 'IT_VAT_CODE' | 'IT_PASSPORT' | 'IT_IDENTITY_CARD' | 'PL_PESEL' | 'SG_NRIC_FIN' | 'SG_UEN' | 'AU_ABN' | 'AU_ACN' | 'AU_TFN' | 'AU_MEDICARE' | 'IN_PAN' | 'IN_AADHAAR' | 'IN_VEHICLE_REGISTRATION' | 'IN_VOTER' | 'IN_PASSPORT' | 'FI_PERSONAL_IDENTITY_CODE'
          - string
      - `presidio_ad_hoc_recognizers` string, nullable — Path to a JSON file containing ad-hoc recognizers for Presidio
      - `presidio_analyze_chunk_size_bytes` integer, nullable — Maximum UTF-8 bytes of text sent in a single Presidio /analyze call. Longer texts are split into overlapping chunks of at most this size and the merged results are remapped onto the original text. Defaults to 500000; set it below your analyzer deployment's request body limit, leaving headroom for the rest of the analyze payload.
      - `mock_redacted_text` object, nullable — Mock redacted text for testing
      - `guardrail` string, required — The type of guardrail integration to use
      - `mode` union, required — When to apply the guardrail (pre_call, post_call, during_call, logging_only)
        - string
        - string[]
        - Mode
          - `tags` object, required — Tags for the guardrail mode
          - `default` union — Default mode when no tags match
            - string
            - string[]
    - `guardrail_info` object, nullable
    - `policy_template` string, nullable
    - `created_at` string, date-time, nullable
    - `updated_at` string, date-time, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-21** `6246f8d427b7` — 2 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed
- **2026-09-19** `c357baf422ab` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed
- **2026-09-18** `082b5fabd909` — 1 breaking, 38 info
  - removed `#/components/schemas/GraySwanGuardrailConfigModelOptionalParams` from the `guardrail/litellm_params/optional_params` request property `anyOf` list
  - api tag `Guardrails` added
  - api tag `guardrails` removed
  - added the new optional request property `guardrail/litellm_params/advisory_system_message`
  - …35 more
- **2026-09-17** `e2f308355e2d` — 2 info
  - api tag `guardrails` added
  - api tag `Guardrails` removed
- **2026-09-01** `89805a9f84ad` — 2 info
  - api tag `Guardrails` added
  - api tag `guardrails` removed

[Full history](https://skmtc.dev/flock/apis/litellm-api/changes/guardrails/:guardrail_id/put.md)

---

[API](https://skmtc.dev/flock/apis/litellm-api.md) · [All operations](https://skmtc.dev/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flock/apis/litellm-api/revisions/7ed45f30a5f0?raw)