List Guardrails

GET /environments/{env_id}/guardrails

List Guardrails

Return every guardrail definition in the environment. Scope attachments are listed separately through the attachments endpoint.

Parameters

• env_id (path, string, required): Environment ID that scopes the request.

Responses

• 200: OK

• data (array, required): Guardrails in the environment.

• data[].id (string, required): Guardrail ID within the environment.

• data[].env_id (string, required): Environment that owns the guardrail.

• data[].name (string, required): Human-readable guardrail name, unique within the environment.

• data[].enabled (boolean, required): Whether connected gateways evaluate this guardrail.

• data[].hook_point (string, optional): Where in the request lifecycle the guardrail executes. This is the runtime control; direction is only metadata.

• data[].kind (string, required): Guardrail provider kind. Fixed at creation.

• data[].fail_open (boolean, optional): When the remote guardrail provider cannot complete its check, allow (true) or block (false) the request. Defaults to false — an unchecked request is not released. No-op for kind=keyword.

• data[].config (object, optional): Kind-specific configuration. Shape is validated server-side against the guardrail catalog; secrets are redacted here.

Kinds that store a secret replace it with a server-computed summary of what is held: api_key_set, access_key_secret_set, aws_credentials.secret_set or secret_names. These are read-only projections. You may send them straight back on create or update — the value is accepted when it matches what the server holds, so a read-modify-write round-trip works unchanged — but they never write anything: a value that disagrees is rejected with 400 rather than silently ignored. To change the underlying secret, send the secret field itself (api_key, access_key_secret, aws_credentials.secret_access_key, or secrets).

• data[].family (string, optional): Dashboard grouping metadata (not sent to the data plane).

• data[].provider (string, optional): Provider metadata used to select the guardrail configuration form.

• data[].check_type (string, optional): Check-category metadata used to select the guardrail configuration form.

• data[].enforcement_mode (string, optional): Whether matching content is only observed or actively enforced.

• data[].direction (string, optional): Input/output classification hint stored with the guardrail. Guardrail execution still follows hook_point; changing this value does not move evaluation to a different lifecycle hook.

• data[].created_at (string, optional): RFC3339 time when the guardrail was created.

• data[].updated_at (string, optional): RFC3339 time when the guardrail was last updated.

• 400: Request body or parameters failed validation.

• error (object, required): Error details.

• error.code (string, required): Machine-readable identifier. Examples: UNAUTHENTICATED, INVALID_REQUEST, MASTER_KEY_UNSET, INTERNAL.

• error.message (string, required): Human-readable explanation; safe to surface to operators.

• 401: Missing or invalid bearer. Response fields (application/json): identical to GET /environments/{env_id}/guardrails, response 400 above.

• 404: Resource not found. Response fields (application/json): identical to GET /environments/{env_id}/guardrails, response 400 above.

cURL

curl -X GET '$AISIX_CP/environments/{env_id}/guardrails' -H 'Authorization: Bearer $AISIX_TOKEN'