organization-guardrails

Create Organization Guardrail

Changed on

Mandate a guardrail across the organization. Organization owners and admins only.

The guardrail runs on every request from the workspaces it is scoped to, in addition to whatever the caller asked for, with the stricter of the two settings applying to a profile both name. Set applies_to_all_workspaces for it to cover workspaces created later; otherwise a new workspace inherits nothing and the entry runs only in the workspaces workspace_ids lists.

post/api/v1/organizations/me/guardrails

Request

  • The document declares no server URL.
  • Auth: one of:
    • API key in header Otari-Key
    • API key in header x-api-key

Request body

applies_to_all_workspacesboolean

True runs this in every workspace of the organization, including one created later; false runs it only in the workspaces named by workspace_ids

credentialstring nullable

Bearer credential for this entry's endpoint. Requires url to be set, and https: an entry with no endpoint of its own falls back to the deployment's guardrails_url, which is commonly a same-host http sidecar. Encrypted at rest, never returned

definition_idstring uuid nullable

A guardrail definition of this organization for Otari to build and run itself, instead of calling a profile on a guardrails service. Mutually exclusive with url and credential, which name a service

enabledboolean

False stops the guardrail everywhere without discarding it

mode'block' | 'monitor'

block rejects a flagged request with 403; monitor annotates the response and forwards it

on_unavailable'block' | 'monitor'

What a block-mode entry does when the guardrails service cannot be reached at all

profilestring required

Profile name configured on the guardrails service, unique within the organization

urlstring nullable

Guardrails endpoint for this entry; null uses the deployment's guardrails_url

validate_kwargsobject nullable

Extra kwargs for the check itself, sent to the guardrails service or handed to the guardrail this entry's definition builds

workspace_idsstring[]

Workspaces this guardrail runs in. Must be empty when applies_to_all_workspaces is true

Example request

{
  "applies_to_all_workspaces": true,
  "credential": "sk-guardrails-...",
  "mode": "block",
  "profile": "prompt-injection",
  "url": "https://guardrails.internal.example/validate"
}

Response

Successful Response

applies_to_all_workspacesboolean required
created_atstring required
definition_idstring uuid nullable required
enabledboolean required
has_credentialboolean required
idstring uuid required
modestring required
on_unavailablestring required
organization_idstring uuid required
profilestring required
updated_atstring required
urlstring nullable required
validate_kwargsobject nullable required

Extra kwargs for the check itself, sent to the guardrails service or handed to the guardrail this entry's definition builds. A parameter whose name looks credential-shaped comes back as *** rather than its stored value; sending that *** back keeps what is stored

workspace_idsstring[] required

Changes

  • fbee488d4d9fRevision changes
    • info

      added the optional property to the response with the status

  • e681d6a41c26Revision changes
    • info

      added the new optional request property

    • info

      added the required property to the response with the status