---
title: "Update Guardrail"
method: PUT
path: "/guardrails/{guardrail_id}"
tags: ["Guardrails"]
---

# Update Guardrail

`PUT /guardrails/{guardrail_id}`

Update an existing guardrail

👉 [Guardrail docs](https://docs.litellm.ai/docs/proxy/guardrails/quick_start)

Example Request:
```bash
curl -X PUT "http://localhost:4000/guardrails/123e4567-e89b-12d3-a456-426614174000" \
    -H "Authorization: Bearer <your_api_key>" \
    -H "Content-Type: application/json" \
    -d '{
        "guardrail": {
            "guardrail_name": "updated-bedrock-guard",
            "litellm_params": {
                "guardrail": "bedrock",
                "mode": "pre_call",
                "guardrailIdentifier": "ff6ujrregl1q",
                "guardrailVersion": "1.0",
                "default_on": true
            },
            "guardrail_info": {
                "description": "Updated Bedrock content moderation guardrail"
            }
        }
    }'
```

Example Response:
```json
{
    "guardrail_id": "123e4567-e89b-12d3-a456-426614174000",
    "guardrail_name": "updated-bedrock-guard",
    "litellm_params": {
        "guardrail": "bedrock",
        "mode": "pre_call",
        "guardrailIdentifier": "ff6ujrregl1q",
        "guardrailVersion": "1.0",
        "default_on": true
    },
    "guardrail_info": {
        "description": "Updated Bedrock content moderation guardrail"
    },
    "created_at": "2023-11-09T12:34:56.789Z",
    "updated_at": "2023-11-09T13:45:12.345Z"
}
```

## Path parameters

- `guardrail_id` string, required

## Request body

- UpdateGuardrailRequest
  - `guardrail` Guardrail, required
    - `guardrail_id` string, nullable
    - `guardrail_name` string, required
    - `litellm_params` LitellmParams, required
      - `optional_params` GraySwanGuardrailConfigModelOptionalParams — Optional parameters for the Gray Swan guardrail.
        - `on_flagged_action` string, nullable — Action when a violation is detected: 'block' rejects the call (400 error), 'monitor' logs only, 'passthrough' replaces response content with violation message (200 status).
        - `violation_threshold` number, nullable — Threshold between 0 and 1 at which Gray Swan violations trigger the configured action.
        - `reasoning_mode` string, nullable — Gray Swan reasoning mode override. Accepted values: 'off', 'hybrid', 'thinking'.
        - `policy_id` string, nullable — Gray Swan policy identifier to apply during monitoring.
        - `categories` object, nullable — Default Gray Swan category definitions to send with each request.
        - `fail_open` boolean, nullable — If true (default), errors contacting Gray Swan are logged and the request proceeds. If false, errors propagate and block the request.
        - `guardrail_timeout` number, nullable — Timeout in seconds for calling the Gray Swan guardrail service.
      - `blocked_languages` string[], nullable — Language tags to block (e.g. python, javascript, bash). Empty or None = block all fenced code blocks.
      - `action` 'block' | 'mask' — 'block' raises an error; 'mask' replaces the code block with a placeholder.
      - `confidence_threshold` number — Only block or mask when detection confidence >= this value; below threshold, allow or log_only.
      - `detect_execution_intent` boolean — When True, block only when user intent is to run/execute; allow when intent is explain/refactor/don't run. Also block text-only execution requests (e.g. 'run `ls`', 'read /etc/passwd').
      - `api_key` string, nullable — API key for the Lakera AI service
      - `api_base` string, nullable — Base URL for the Lakera AI API
      - `evaluation_id` string, nullable — Pre-configured evaluation ID from Qualifire dashboard. When provided, uses invoke_evaluation() instead of evaluate().
      - `prompt_injections` boolean, nullable — Enable prompt injection detection. Default check if no evaluation_id and no other checks are specified.
      - `hallucinations_check` boolean, nullable — Enable hallucination detection to detect factual inaccuracies.
      - `grounding_check` boolean, nullable — Enable grounding verification to ensure output is grounded in provided context.
      - `pii_check` boolean, nullable — Enable PII (Personally Identifiable Information) detection.
      - `content_moderation_check` boolean, nullable — Enable content moderation to check for harmful content (harassment, hate speech, etc.).
      - `tool_selection_quality_check` boolean, nullable — Enable tool selection quality check to evaluate quality of tool/function calls.
      - `assertions` string[], nullable — Custom assertions to validate against the output. Each assertion is a string describing a condition.
      - `on_flagged` 'block' | 'monitor', nullable — Action to take when content is flagged: 'block' (raise exception) or 'monitor' (log only)
      - `auth_token` string, nullable — Authorization bearer token for IBM Guardrails API. Reads from IBM_GUARDRAILS_AUTH_TOKEN env var if None.
      - `base_url` string, nullable — Base URL for the IBM Guardrails server
      - `detector_id` string, nullable — Name of the detector inside the server (e.g., 'jailbreak-detector')
      - `is_detector_server` boolean, nullable — Boolean flag to determine if calling a detector server (True) or the FMS Orchestrator (False). Defaults to True.
      - `verify_ssl` boolean, nullable — Whether to verify SSL certificates. Defaults to True.
      - `policy_name` string, nullable — The EnkryptAI policy name to use. Sent via x-enkrypt-policy header.
      - `deployment_name` string, nullable — The EnkryptAI deployment name to use. Sent via X-Enkrypt-Deployment header.
      - `detectors` object, nullable — Dictionary of detector configurations (e.g., {'nsfw': {'enabled': True}, 'toxicity': {'enabled': True}}).
      - `block_on_violation` boolean, nullable — Whether to block requests when violations are detected. Defaults to True.
      - `patterns` ContentFilterPattern[], nullable — List of patterns (prebuilt or custom regex) to detect
        - `pattern_type` 'prebuilt' | 'regex', required — Type of pattern: 'prebuilt' for predefined patterns or 'regex' for custom
        - `pattern_name` string, nullable — Name of prebuilt pattern (e.g., 'us_ssn', 'credit_card'). Required if pattern_type is 'prebuilt'
        - `pattern` string, nullable — Custom regex pattern. Required if pattern_type is 'regex'
        - `name` string, nullable — Name for this pattern (used in logging and error messages)
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
      - `blocked_words` BlockedWord[], nullable — List of blocked words with individual actions
        - `keyword` string, required — The keyword to block or mask
        - `action` 'BLOCK' | 'MASK', required — Action to take when content filter detects a match
        - `description` string, nullable — Optional description explaining why this keyword is sensitive
      - `blocked_words_file` string, nullable — Path to YAML file containing blocked_words list
      - `categories` ContentFilterCategoryConfig[], nullable — List of prebuilt categories to enable (harmful_*, bias_*)
        - `category` string, required — The category to detect
        - `enabled` boolean — Whether the category is enabled
        - `action` 'BLOCK' | 'MASK', required — The action to take when the category is detected
        - `severity_threshold` 'high' | 'medium' | 'low' — The severity threshold to detect the category
        - `category_file` string, nullable — Optional override. Use your own category file instead of the default one.
      - `severity_threshold` string, nullable — Minimum severity to block (high, medium, low)
      - `pattern_redaction_format` string, nullable — Format string for pattern redaction (use {pattern_name} placeholder)
      - `keyword_redaction_tag` string, nullable — Tag to use for keyword redaction
      - `experimental_use_latest_role_message_only` boolean, nullable — When True, guardrails only receive the latest message for the relevant role (e.g., newest user input pre-call, newest assistant output post-call)
      - `category_thresholds` LakeraCategoryThresholds
        - `prompt_injection` number
        - `jailbreak` number
      - `detect_secrets_config` object, nullable — Configuration for detect-secrets guardrail
      - `guard_name` string, nullable — Name of the Javelin guard to use
      - `default_on` boolean, nullable — Whether the guardrail is enabled by default
      - `mask_request_content` boolean, nullable — Will mask request content if guardrail makes any changes
      - `mask_response_content` boolean, nullable — Will mask response content if guardrail makes any changes
      - `pangea_input_recipe` string, nullable — Recipe for input (LLM request)
      - `pangea_output_recipe` string, nullable — Recipe for output (LLM response)
      - `model` string, nullable — Optional field if guardrail requires a 'model' parameter
      - `violation_message_template` string, nullable — Custom message when a guardrail blocks an action. Supports placeholders like {tool_name}, {rule_id}, and {default_message}.
      - `end_session_after_n_fails` integer, nullable — For /v1/realtime sessions: automatically close the session after this many guardrail violations.
      - `on_violation` 'warn' | 'end_session', nullable — For /v1/realtime sessions: 'warn' speaks the violation message and continues; 'end_session' speaks the message and closes the connection.
      - `realtime_violation_message` string, nullable — The message the bot speaks aloud when a /v1/realtime guardrail fires. Falls back to violation_message_template if not set.
      - `template_id` string, nullable — The ID of your Model Armor template
      - `location` string, nullable — Google Cloud location/region (e.g., us-central1)
      - `credentials` string, nullable — Path to Google Cloud credentials JSON file or JSON string
      - `api_endpoint` string, nullable — Optional custom API endpoint for Model Armor
      - `fail_on_error` boolean, nullable — Whether to fail the request if Model Armor encounters an error
      - `additional_provider_specific_params` object, nullable — Additional provider-specific parameters for generic guardrail APIs
      - `unreachable_fallback` 'fail_closed' | 'fail_open' — Behavior when a guardrail endpoint is unreachable due to network errors. NOTE: This is currently only implemented by guardrail='generic_guardrail_api'. 'fail_closed' raises an error (default). 'fail_open' logs a critical error and allows the request to proceed.
      - `extra_headers` string[], nullable — Header names to forward from the client request to the guardrail (e.g. x-request-id). Only these headers' values are sent; others may be omitted or sent as [present]. Used by generic_guardrail_api (similar to MCP extra_headers).
      - `custom_code` string, nullable — Python-like code containing the apply_guardrail function for custom guardrail logic
      - `api_version` string, nullable — API version for Javelin service
      - `metadata` object, nullable — Additional metadata to include in the request
      - `application` string, nullable — Application name for Javelin service
      - `config` object, nullable — Additional configuration for the guardrail
      - `policy_id` integer, nullable — Policy ID for Zscaler AI Guard. Can also be set via ZSCALER_AI_GUARD_POLICY_ID environment variable
      - `send_user_api_key_alias` boolean, nullable — Whether to send user_API_key_alias in headers
      - `send_user_api_key_user_id` boolean, nullable — Whether to send user_API_key_user_id in headers
      - `send_user_api_key_team_id` boolean, nullable — Whether to send user_API_key_team_id in headers
      - `rules` ToolPermissionRule[], nullable — Ordered allow/deny rules. Patterns use regex for tool names/types and optional regex constraints on tool arguments.
        - `id` string, required — Unique identifier for the rule
        - `tool_name` string, nullable — Regex pattern applied to the tool's function name
        - `tool_type` string, nullable — Regex pattern applied to the tool type (e.g., function)
        - `decision` 'allow' | 'deny', required — Whether to allow or deny this tool usage
        - `allowed_param_patterns` object, nullable — Optional regex map enforcing nested parameter values using dot/[] paths
      - `default_action` 'allow' | 'deny' — Fallback decision when no rule matches
      - `on_disallowed_action` 'block' | 'rewrite' — Choose whether disallowed tools block the request or get rewritten out of the payload
      - `use_v2` boolean, nullable — If True and guardrail='noma', route to the new Noma v2 implementation instead of the legacy implementation.
      - `application_id` string, nullable — Application ID for Noma Security. Defaults to 'litellm' if not provided
      - `monitor_mode` boolean, nullable — If True, logs violations without blocking. Defaults to False if not provided
      - `block_failures` boolean, nullable — If True, blocks requests on API failures. Defaults to True if not provided
      - `anonymize_input` boolean, nullable — If True, replaces sensitive content with anonymized version when only PII/PCI/secrets are detected. Only applies in blocking mode. Defaults to False if not provided
      - `on_flagged_action` string, nullable — Action to take when content is flagged: 'block' (raise exception) or 'monitor' (log only)
      - `async_mode` boolean, nullable — Set to True to request asynchronous analysis (sets `plr_async` header). Defaults to provider behaviour when omitted.
      - `persist_session` boolean, nullable — Controls Pillar session persistence (sets `plr_persist` header). Set to False to disable persistence.
      - `include_scanners` boolean, nullable — Include scanner category summaries in responses (sets `plr_scanners` header).
      - `include_evidence` boolean, nullable — Include detailed evidence payloads in responses (sets `plr_evidence` header).
      - `lasso_user_id` string, nullable — User ID for the Lasso guardrail
      - `lasso_conversation_id` string, nullable — Conversation ID for the Lasso guardrail
      - `mask` boolean, nullable — Enable content masking using Lasso classifix API
      - `project_id` string, nullable — Project ID for the Lakera AI project
      - `payload` boolean, nullable — Whether to include payload in the response
      - `breakdown` boolean, nullable — Whether to include breakdown in the response
      - `dev_info` boolean, nullable — Whether to include developer information in the response
      - `guardrailIdentifier` string, nullable — The ID of your guardrail on Bedrock
      - `guardrailVersion` string, nullable — The version of your Bedrock guardrail (e.g., DRAFT or version number)
      - `disable_exception_on_block` boolean, nullable — If True, will not raise an exception when the guardrail is blocked. Useful for OpenWebUI where exceptions can end the chat flow.
      - `aws_region_name` string, nullable — AWS region where your guardrail is deployed
      - `aws_access_key_id` string, nullable — AWS access key ID for authentication
      - `aws_secret_access_key` string, nullable — AWS secret access key for authentication
      - `aws_session_token` string, nullable — AWS session token for temporary credentials
      - `aws_session_name` string, nullable — Name of the AWS session
      - `aws_profile_name` string, nullable — AWS profile name for credential retrieval
      - `aws_role_name` string, nullable — AWS role name for assuming roles
      - `aws_web_identity_token` string, nullable — Web identity token for AWS role assumption
      - `aws_sts_endpoint` string, nullable — AWS STS endpoint URL
      - `aws_bedrock_runtime_endpoint` string, nullable — AWS Bedrock runtime endpoint URL
      - `presidio_analyzer_api_base` string, nullable — Base URL for the Presidio analyzer API
      - `presidio_anonymizer_api_base` string, nullable — Base URL for the Presidio anonymizer API
      - `presidio_filter_scope` 'input' | 'output' | 'both', nullable — Where to apply Presidio checks: 'input' (user -> model), 'output' (model -> user), or 'both' (default).
      - `output_parse_pii` boolean, nullable — When True, LiteLLM will replace the masked text with the original text in the response
      - `presidio_language` string, nullable — Language code for Presidio PII analysis (e.g., 'en', 'de', 'es', 'fr')
      - `presidio_run_on` 'input' | 'output' | 'both', nullable — Where to apply Presidio checks: input, output, or both (default).
      - `pii_entities_config` object, nullable — Configuration for PII entity types and actions
      - `presidio_score_thresholds` object, nullable — Optional per-entity minimum confidence scores for Presidio detections. Entities below the threshold are ignored.
      - `presidio_entities_deny_list` union[], nullable — List of entity types to exclude from Presidio detection results. Detections of these types will be silently dropped. Useful for suppressing false positives (e.g., US_DRIVER_LICENSE on coding routes).
        - union
          - 'CREDIT_CARD' | 'CRYPTO' | 'DATE_TIME' | 'EMAIL_ADDRESS' | 'IBAN_CODE' | 'IP_ADDRESS' | 'NRP' | 'LOCATION' | 'PERSON' | 'PHONE_NUMBER' | 'MEDICAL_LICENSE' | 'URL' | 'US_BANK_NUMBER' | 'US_DRIVER_LICENSE' | 'US_ITIN' | 'US_PASSPORT' | 'US_SSN' | 'UK_NHS' | 'UK_NINO' | 'ES_NIF' | 'ES_NIE' | 'IT_FISCAL_CODE' | 'IT_DRIVER_LICENSE' | 'IT_VAT_CODE' | 'IT_PASSPORT' | 'IT_IDENTITY_CARD' | 'PL_PESEL' | 'SG_NRIC_FIN' | 'SG_UEN' | 'AU_ABN' | 'AU_ACN' | 'AU_TFN' | 'AU_MEDICARE' | 'IN_PAN' | 'IN_AADHAAR' | 'IN_VEHICLE_REGISTRATION' | 'IN_VOTER' | 'IN_PASSPORT' | 'FI_PERSONAL_IDENTITY_CODE'
          - string
      - `presidio_ad_hoc_recognizers` string, nullable — Path to a JSON file containing ad-hoc recognizers for Presidio
      - `mock_redacted_text` object, nullable — Mock redacted text for testing
      - `guardrail` string, required — The type of guardrail integration to use
      - `mode` union, required — When to apply the guardrail (pre_call, post_call, during_call, logging_only)
        - string
        - string[]
        - Mode
          - `tags` object, required — Tags for the guardrail mode
          - `default` union — Default mode when no tags match
            - string
            - string[]
    - `guardrail_info` object, nullable
    - `policy_template` string, nullable
    - `created_at` string, date-time, nullable
    - `updated_at` string, date-time, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/sea-lion/apis/litellm-api.md) · [All operations](https://skmtc.net/sea-lion/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sea-lion/litellm-api/revisions/79928a3d37d3/schema)