---
title: "Update your OpenAPI specification"
method: PATCH
path: "/shield/shield-zone/{shieldZoneId}/api-guardian/spec"
tags: ["API Guardian"]
---

# Update your OpenAPI specification

`PATCH /shield/shield-zone/{shieldZoneId}/api-guardian/spec`

## Path parameters

- `shieldZoneId` integer, required

## Request body

- UpsertOpenApiSpecificationRequest — Represents the request for uploading or updating an OpenAPI specification in API Guardian.
  - `content` string, nullable — The file contents of the OpenAPI specification.
  - `enforceAuthorizationValidation` boolean, nullable — Whether to enforce authentication requirements for endpoints. On upload, defaults to true if not specified. On update, existing endpoint auth settings are preserved if not specified.

## Response `200`

OK

- UpsertOpenApiSpecificationResponse — Represents the response for uploading or updating an OpenAPI specification in API Guardian.
  - `error` GenericRequestResponse — Generic response object containing status information for API operations.
    - `statusCode` 100 | 101 | 102 | 103 | 200 | 201 | 202 | 203 | 204 | 205 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 304 | 305 | 306 | 307 | 308 | 400 | 401 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 421 | 422 | 423 | 424 | 426 | 428 | 429 | 431 | 451 | 500 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 — 100 = Continue 101 = SwitchingProtocols 102 = Processing 103 = EarlyHints 200 = OK 201 = Created 202 = Accepted 203 = NonAuthoritativeInformation 204 = NoContent 205 = ResetContent 206 = PartialContent 207 = MultiStatus 208 = AlreadyReported 226 = IMUsed 300 = MultipleChoices 300 = Ambiguous 301 = MovedPermanently 301 = Moved 302 = Found 302 = Redirect 303 = SeeOther 303 = RedirectMethod 304 = NotModified 305 = UseProxy 306 = Unused 307 = TemporaryRedirect 307 = RedirectKeepVerb 308 = PermanentRedirect 400 = BadRequest 401 = Unauthorized 402 = PaymentRequired 403 = Forbidden 404 = NotFound 405 = MethodNotAllowed 406 = NotAcceptable 407 = ProxyAuthenticationRequired 408 = RequestTimeout 409 = Conflict 410 = Gone 411 = LengthRequired 412 = PreconditionFailed 413 = RequestEntityTooLarge 414 = RequestUriTooLong 415 = UnsupportedMediaType 416 = RequestedRangeNotSatisfiable 417 = ExpectationFailed 421 = MisdirectedRequest 422 = UnprocessableEntity 422 = UnprocessableContent 423 = Locked 424 = FailedDependency 426 = UpgradeRequired 428 = PreconditionRequired 429 = TooManyRequests 431 = RequestHeaderFieldsTooLarge 451 = UnavailableForLegalReasons 500 = InternalServerError 501 = NotImplemented 502 = BadGateway 503 = ServiceUnavailable 504 = GatewayTimeout 505 = HttpVersionNotSupported 506 = VariantAlsoNegotiates 507 = InsufficientStorage 508 = LoopDetected 510 = NotExtended 511 = NetworkAuthenticationRequired
    - `success` boolean — Indicates whether the operation was successful.
    - `message` string, nullable — Human-readable message describing the result of the operation.
    - `errorKey` string, nullable — Unique error key for programmatic error handling, if applicable.
  - `data` ApiGuardianConfigurationResponse — The full API Guardian state for a shield zone: global configuration and all endpoints.
    - `configuration` ApiGuardianConfigurationDetails, required — Global API Guardian configuration for a shield zone.
      - `shieldZoneId` integer
      - `isEnabled` boolean — Whether API Guardian is enabled for this shield zone. When disabled, no requests are inspected.
      - `executionMode` 0 | 1 — 0 = Log 1 = Block
      - `bodyLimitAction` 0 | 1 | 2 — 0 = Block 1 = Log 2 = Ignore
      - `unmatchedPathAction` 0 | 1 | 2 — 0 = Block 1 = Log 2 = Ignore
      - `title` string, nullable — The `info.title` field from the uploaded OpenAPI specification.
      - `version` string, nullable — The `info.version` field from the uploaded OpenAPI specification.
      - `maxEndpoints` integer — Plan limit: maximum number of endpoints that can be defined in the specification.
      - `maxFieldsPerType` integer — Plan limit: maximum number of properties a single schema object may declare.
      - `maxNestingDepth` integer — Plan limit: maximum depth of nested `$ref`, `items`, and `properties` chains.
      - `maxTotalSchemaNodes` integer — Plan limit: combined node count across all `components/schemas` entries.
      - `maxTotalRegexLength` integer — Plan limit: combined character length of all `pattern` regex strings in the specification.
      - `createdAt` string, date-time
      - `updatedAt` string, date-time, nullable
    - `endpoints` ApiGuardianEndpointDetails[], nullable, required — All endpoints discovered from the uploaded OpenAPI specification.
      - `apiGuardianEndpointId` integer
      - `shieldZoneId` integer
      - `requestMethod` string, nullable — The HTTP method (e.g. "GET", "POST").
      - `requestPath` string, nullable — The OAS path template (e.g. "/pets/{petId}").
      - `validateRequestBodySchema` boolean — Whether inbound request bodies are validated against the OAS request body schema.
      - `validateResponseBodySchema` boolean — Whether outbound response bodies are validated against the OAS response schema.
      - `validateAuthorization` boolean — Whether authentication credentials are enforced.
      - `isEnabled` boolean — Whether this endpoint is active. Disabled endpoints are not enforced.
      - `authSchemes` AuthSchemeDetails[], nullable — Authentication schemes required by this endpoint, derived from the OAS security requirements. Null when the endpoint has no security requirements.
        - `schemeName` string, nullable — The OpenAPI security scheme reference name (e.g. "bearerAuth", "apiKey").
        - `schemeType` 'ApiKey' | 'Http' | 'OAuth2' | 'OpenIdConnect' — The type of security scheme as defined in the OpenAPI specification.
        - `location` 'Header' | 'Query' | 'Cookie' — Where an authentication credential is transmitted in the HTTP request.
        - `credentialName` string, nullable — The name of the header, query parameter, or cookie that carries the credential (e.g. "Authorization", "X-API-Key").
        - `httpScheme` string, nullable — For HTTP auth schemes, the scheme name (e.g. "bearer", "basic"). Null for non-HTTP schemes.
      - `requestBodySchemaYaml` string, nullable — The request body schema rendered as YAML for display purposes. Null if no request body is defined.
      - `responseBodySchemasYaml` object, nullable — Response body schemas keyed by HTTP status code, rendered as YAML. Null if no response schemas are defined.
      - `availableParameters` object, nullable — All parameters defined in the OAS operation, grouped by location (path, query, header, cookie).
        - `Path` string[]
        - `Query` string[]
        - `Header` string[]
        - `Cookie` string[]
      - `injectionDetectionParameters` object, nullable — Parameters selected for XSS/SQLi injection detection, grouped by location. Null if not configured. Subset of BunnyNet.Shield.Api.Services.Shield.ApiGuardian.Models.ApiGuardianEndpointDetails.AvailableParameters.
        - `Path` string[]
        - `Query` string[]
        - `Header` string[]
        - `Cookie` string[]
      - `detectParameterXss` boolean — Whether XSS detection is enabled for the selected parameters.
      - `detectParameterSqli` boolean — Whether SQL injection detection is enabled for the selected parameters.
      - `rateLimitingEnabled` boolean — Whether per-endpoint rate limiting is active.
      - `rateLimitingType` 'Global' | 'IP'
      - `rateLimitingRequestCount` integer — Maximum number of requests allowed within the rate limiting timeframe before blocking.
      - `rateLimitingTimeframe` 1 | 10 | 60 | 300 | 900 | 3600 — 1 = PerSecond 10 = PerTenSeconds 60 = PerOneMinute 300 = PerFiveMinutes 900 = PerFifteenMinutes 3600 = PerOneHour
      - `createdAt` string, date-time
      - `updatedAt` string, date-time, nullable

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

---

[API](https://skmtc.net/bunny/apis/bunny-net-cdn-logging.md) · [All operations](https://skmtc.net/bunny/apis/bunny-net-cdn-logging/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bunny/bunny-net-cdn-logging/versions/9e622620664b/schema)