---
title: "List Guardrails V2"
method: GET
path: "/v2/guardrails/list"
tags: ["Guardrails"]
---

# List Guardrails V2

`GET /v2/guardrails/list`

List the guardrails that are available in the database using GuardrailRegistry

👉 [Guardrail docs](https://docs.litellm.ai/docs/proxy/guardrails/quick_start)

Example Request:
```bash
curl -X GET "http://localhost:4000/v2/guardrails/list" -H "Authorization: Bearer <your_api_key>"
```

Example Response:
```json
{
    "guardrails": [
        {
            "guardrail_id": "123e4567-e89b-12d3-a456-426614174000",
            "guardrail_name": "my-bedrock-guard",
            "litellm_params": {
                "guardrail": "bedrock",
                "mode": "pre_call",
                "guardrailIdentifier": "ff6ujrregl1q",
                "guardrailVersion": "DRAFT",
                "default_on": true
            },
            "guardrail_info": {
                "description": "Bedrock content moderation guardrail"
            }
        }
    ]
}
```

## Response `200`

Successful Response

- ListGuardrailsResponse
  - `guardrails` GuardrailInfoResponse[], required
    - `guardrail_id` string, nullable
    - `guardrail_name` string, required
    - `litellm_params` BaseLitellmParamsOutput
      - `patterns` ContentFilterPattern[], nullable — List of patterns (prebuilt or custom regex) to detect
        - `pattern_type` 'prebuilt' | 'regex', required — Type of pattern: 'prebuilt' for predefined patterns or 'regex' for custom
        - `pattern_name` string, nullable — Name of prebuilt pattern (e.g., 'us_ssn', 'credit_card'). Required if pattern_type is 'prebuilt'
        - `pattern` string, nullable — Custom regex pattern. Required if pattern_type is 'regex'
        - `name` string, nullable — Name for this pattern (used in logging and error messages)
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
      - `blocked_words` BlockedWord[], nullable — List of blocked words with individual actions
        - `keyword` string, required — The keyword to block or mask
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
        - `description` string, nullable — Optional description explaining why this keyword is sensitive
      - `blocked_words_file` string, nullable — Path to YAML file containing blocked_words list
      - `categories` ContentFilterCategoryConfig[], nullable — List of prebuilt categories to enable (harmful_*, bias_*)
        - `category` string, required — The category to detect
        - `enabled` boolean — Whether the category is enabled
        - `action` 'BLOCK' | 'MASK', required — The action to take when the category is detected
        - `severity_threshold` 'high' | 'medium' | 'low' — The severity threshold to detect the category
        - `category_file` string, nullable — Optional override. Use your own category file instead of the default one.
      - `severity_threshold` string, nullable — Minimum severity to block (high, medium, low)
      - `pattern_redaction_format` string, nullable — Format string for pattern redaction (use {pattern_name} placeholder)
      - `keyword_redaction_tag` string, nullable — Tag to use for keyword redaction
      - `api_key` string, nullable — API key for the guardrail service
      - `api_base` string, nullable — Base URL for the guardrail service API
      - `experimental_use_latest_role_message_only` boolean, nullable — When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call)
      - `skip_system_message_in_guardrail` boolean, nullable — When True, unified guardrails skip system-role messages when building evaluation inputs (texts and structured_messages). When False, system messages are included even if litellm_settings sets a global skip. When None, use the global litellm.skip_system_message_in_guardrail setting.
      - `category_thresholds` LakeraCategoryThresholds
        - `prompt_injection` number
        - `jailbreak` number
      - `detect_secrets_config` object, nullable — Configuration for detect-secrets guardrail
      - `guard_name` string, nullable — Name of the guardrail in guardrails.ai
      - `default_on` boolean, nullable — Whether the guardrail is enabled by default
      - `mask_request_content` boolean, nullable — Will mask request content if guardrail makes any changes
      - `mask_response_content` boolean, nullable — Will mask response content if guardrail makes any changes
      - `pangea_input_recipe` string, nullable — Recipe for input (LLM request)
      - `pangea_output_recipe` string, nullable — Recipe for output (LLM response)
      - `model` string, nullable — Optional field if guardrail requires a 'model' parameter
      - `violation_message_template` string, nullable — Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}.
      - `end_session_after_n_fails` integer, nullable — For /v1/realtime sessions: automatically close the session after this many guardrail violations.
      - `on_violation` 'warn' | 'end_session', nullable — For /v1/realtime sessions: 'warn' speaks the violation message and continues; 'end_session' speaks the message and closes the connection.
      - `realtime_violation_message` string, nullable — The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set.
      - `template_id` string, nullable — The ID of your Model Armor template
      - `location` string, nullable — Google Cloud location/region (e.g., us-central1)
      - `credentials` string, nullable — Path to Google Cloud credentials JSON file or JSON string
      - `api_endpoint` string, nullable — Optional custom API endpoint for Model Armor
      - `fail_on_error` boolean, nullable — Whether to fail the request if Model Armor encounters an error
      - `additional_provider_specific_params` object, nullable — Additional provider-specific parameters for generic guardrail APIs
      - `unreachable_fallback` 'fail_closed' | 'fail_open' — Behavior when a guardrail endpoint is unreachable due to network errors. NOTE: This is currently only implemented by guardrail='generic_guardrail_api'. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and allows the request to proceed.
      - `extra_headers` string[], nullable — Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers).
      - `custom_code` string, nullable — Python-like code containing the apply_guardrail function for custom guardrail logic
    - `guardrail_info` object, nullable
    - `created_at` string, date-time, nullable
    - `updated_at` string, date-time, nullable
    - `guardrail_definition_location` 'db' | 'config'

---

[API](https://skmtc.net/flock/apis/litellm-api.md) · [All operations](https://skmtc.net/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/flock/litellm-api/revisions/8fbaab4fc7c5/schema)