organization-guardrail-definitions

Update Organization Guardrail Definition

Changed on

Change a definition's name, guardrail, build arguments, or enabled flag.

Organization owners and admins only. Omitted fields are left as they are. create_kwargs replaces the arguments whole when sent, an argument sent as *** keeps the value stored under that name, and omitting the field entirely leaves the stored credentials untouched and unread.

The guardrail is rebuilt afterwards and the response reports the outcome in build_state, so repairing a credential shows the definition running again in the same response, and enabled: false stops it here rather than on the next refresh.

patch/api/v1/organizations/me/guardrail-definitions/{definition_id}

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header Otari-Key
    • API key in header x-api-key

Path parameters

definition_idstring uuid required

Request body

create_kwargsobject nullable

Replaces the constructor arguments whole. An argument sent as *** keeps the value stored under that name; a secret left out is cleared. Omit the field to leave the stored arguments alone, and {} to clear them

enabledboolean
guardrail_namestring
namestring

Example request

{
  "create_kwargs": {
    "api_key": "***",
    "endpoint": "https://eu.api.lakera.ai"
  },
  "enabled": false
}

Response

Successful Response

build_state'built' | 'failed' | 'pending' | 'disabled' required

Whether the worker that answered this request holds a guardrail built from this version of the definition. built means it does and the check runs; failed means that worker tried these exact arguments and could not build them, so every mandate pointing here is unevaluable; pending means it holds nothing for this version yet, which is the answer right after a write and on any worker that has not caught up within the refresh interval; disabled means the definition is switched off and nothing is built on purpose. It answers for one worker, so two reads can disagree while a write propagates. Why a build failed is never reported here: the reason is in the gateway's log

create_kwargsobject required

The constructor arguments the catalog does not mark secret, as they were stored. Returned in clear: the secrets were taken out of this map by flag, and a form has to round-trip an endpoint or a project id

create_secretsobject required

The secret constructor arguments this definition holds, each as ***. Sending one back unchanged keeps the stored value; sending a new one rotates it, and leaving one out clears it

created_atstring required
enabledboolean required
guardrail_namestring required
idstring uuid required
namestring required
organization_idstring uuid required
secrets_decryptableboolean required

False when the stored secrets cannot be read with the current OTARI_SECRET_KEY, in which case create_secrets is empty and the definition needs its credentials sent again

updated_atstring required

Changes