---
title: "Update your API Guardian Endpoint configuration"
method: PATCH
path: "/shield/shield-zone/{shieldZoneId}/api-guardian/endpoint/{endpointId}"
tags: ["API Guardian"]
---

# Update your API Guardian Endpoint configuration

`PATCH /shield/shield-zone/{shieldZoneId}/api-guardian/endpoint/{endpointId}`

## Path parameters

- `shieldZoneId` integer, required
- `endpointId` integer, required

## Request body

- UpdateApiGuardianEndpointRequest — Patch request for updating an individual API Guardian endpoint. All fields are optional — only provided fields are applied.
  - `isEnabled` boolean, nullable — Enable or disable this endpoint. Disabled endpoints are not enforced.
  - `validateRequestBodySchema` boolean, nullable — Enable or disable request body schema validation. Only effective if the endpoint's OAS operation defines a request body schema.
  - `validateResponseBodySchema` boolean, nullable — Enable or disable response body schema validation. Only effective if the endpoint's OAS operation defines response schemas.
  - `validateAuthorization` boolean, nullable — Enable or disable enforcement of authentication requirements as defined in the OAS security schemes.
  - `injectionDetectionParameters` object, nullable — Parameters to run injection detection on, grouped by location (path, query, header, cookie). Must be a subset of the endpoint's available parameters.
    - `Path` string[]
    - `Query` string[]
    - `Header` string[]
    - `Cookie` string[]
  - `detectParameterXss` boolean, nullable — Enable XSS detection on the selected injection detection parameters.
  - `detectParameterSqli` boolean, nullable — Enable SQL injection detection on the selected injection detection parameters.
  - `rateLimitingEnabled` boolean, nullable — Enable or disable per-endpoint rate limiting.
  - `rateLimitingType` 'Global' | 'IP'
  - `rateLimitingRequestCount` integer, nullable — Maximum number of requests allowed within the timeframe before blocking. Must be greater than zero.
  - `rateLimitingTimeframe` 1 | 10 | 60 | 300 | 900 | 3600 — 1 = PerSecond 10 = PerTenSeconds 60 = PerOneMinute 300 = PerFiveMinutes 900 = PerFifteenMinutes 3600 = PerOneHour

## Response `200`

OK

- UpdateApiGuardianEndpointResponse — Response for the PATCH /endpoint/{endpointId} endpoint.
  - `error` GenericRequestResponse — Generic response object containing status information for API operations.
    - `statusCode` 100 | 101 | 102 | 103 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 421 | 422 | 423 | 424 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 — 100 = Continue 101 = SwitchingProtocols 102 = Processing 103 = EarlyHints 200 = OK 201 = Created 202 = Accepted 203 = NonAuthoritativeInformation 204 = NoContent 205 = ResetContent 206 = PartialContent 207 = MultiStatus 208 = AlreadyReported 226 = IMUsed 300 = MultipleChoices 300 = Ambiguous 301 = MovedPermanently 301 = Moved 302 = Found 302 = Redirect 303 = SeeOther 303 = RedirectMethod 304 = NotModified 305 = UseProxy 306 = Unused 307 = TemporaryRedirect 307 = RedirectKeepVerb 308 = PermanentRedirect 400 = BadRequest 401 = Unauthorized 402 = PaymentRequired 403 = Forbidden 404 = NotFound 405 = MethodNotAllowed 406 = NotAcceptable 407 = ProxyAuthenticationRequired 408 = RequestTimeout 409 = Conflict 410 = Gone 411 = LengthRequired 412 = PreconditionFailed 413 = RequestEntityTooLarge 414 = RequestUriTooLong 415 = UnsupportedMediaType 416 = RequestedRangeNotSatisfiable 417 = ExpectationFailed 421 = MisdirectedRequest 422 = UnprocessableEntity 422 = UnprocessableContent 423 = Locked 424 = FailedDependency 426 = UpgradeRequired 428 = PreconditionRequired 429 = TooManyRequests 431 = RequestHeaderFieldsTooLarge 451 = UnavailableForLegalReasons 500 = InternalServerError 501 = NotImplemented 502 = BadGateway 503 = ServiceUnavailable 504 = GatewayTimeout 505 = HttpVersionNotSupported 506 = VariantAlsoNegotiates 507 = InsufficientStorage 508 = LoopDetected 510 = NotExtended 511 = NetworkAuthenticationRequired
    - `success` boolean — Indicates whether the operation was successful.
    - `message` string, nullable — Human-readable message describing the result of the operation.
    - `errorKey` string, nullable — Unique error key for programmatic error handling, if applicable.
  - `data` ApiGuardianEndpointDetails — Detailed view of a single API Guardian endpoint, including its validation settings, authentication requirements, and rate limiting configuration.
    - `apiGuardianEndpointId` integer
    - `shieldZoneId` integer
    - `requestMethod` string, nullable — The HTTP method (e.g. "GET", "POST").
    - `requestPath` string, nullable — The OAS path template (e.g. "/pets/{petId}").
    - `validateRequestBodySchema` boolean — Whether inbound request bodies are validated against the OAS request body schema.
    - `validateResponseBodySchema` boolean — Whether outbound response bodies are validated against the OAS response schema.
    - `validateAuthorization` boolean — Whether authentication credentials are enforced.
    - `isEnabled` boolean — Whether this endpoint is active. Disabled endpoints are not enforced.
    - `authSchemes` AuthSchemeDetails[], nullable — Authentication schemes required by this endpoint, derived from the OAS security requirements. Null when the endpoint has no security requirements.
      - `schemeName` string, nullable — The OpenAPI security scheme reference name (e.g. "bearerAuth", "apiKey").
      - `schemeType` 'ApiKey' | 'Http' | 'OAuth2' | 'OpenIdConnect' — The type of security scheme as defined in the OpenAPI specification.
      - `location` 'Header' | 'Query' | 'Cookie' — Where an authentication credential is transmitted in the HTTP request.
      - `credentialName` string, nullable — The name of the header, query parameter, or cookie that carries the credential (e.g. "Authorization", "X-API-Key").
      - `httpScheme` string, nullable — For HTTP auth schemes, the scheme name (e.g. "bearer", "basic"). Null for non-HTTP schemes.
    - `requestBodySchemaYaml` string, nullable — The request body schema rendered as YAML for display purposes. Null if no request body is defined.
    - `responseBodySchemasYaml` object, nullable — Response body schemas keyed by HTTP status code, rendered as YAML. Null if no response schemas are defined.
    - `availableParameters` object, nullable — All parameters defined in the OAS operation, grouped by location (path, query, header, cookie).
      - `Path` string[]
      - `Query` string[]
      - `Header` string[]
      - `Cookie` string[]
    - `injectionDetectionParameters` object, nullable — Parameters selected for XSS/SQLi injection detection, grouped by location. Null if not configured. Subset of BunnyNet.Shield.Api.Services.Shield.ApiGuardian.Models.ApiGuardianEndpointDetails.AvailableParameters.
      - `Path` string[]
      - `Query` string[]
      - `Header` string[]
      - `Cookie` string[]
    - `detectParameterXss` boolean — Whether XSS detection is enabled for the selected parameters.
    - `detectParameterSqli` boolean — Whether SQL injection detection is enabled for the selected parameters.
    - `rateLimitingEnabled` boolean — Whether per-endpoint rate limiting is active.
    - `rateLimitingType` 'Global' | 'IP'
    - `rateLimitingRequestCount` integer — Maximum number of requests allowed within the rate limiting timeframe before blocking.
    - `rateLimitingTimeframe` 1 | 10 | 60 | 300 | 900 | 3600 — 1 = PerSecond 10 = PerTenSeconds 60 = PerOneMinute 300 = PerFiveMinutes 900 = PerFifteenMinutes 3600 = PerOneHour
    - `createdAt` string, date-time
    - `updatedAt` string, date-time, nullable

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.net/bunny/apis/bunny-net-cdn-logging.md) · [All operations](https://skmtc.net/bunny/apis/bunny-net-cdn-logging/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bunny/bunny-net-cdn-logging/versions/9e622620664b/schema)