AI Lakera Guard Configuration
Configuration reference for the AI Lakera Guard plugin (`ai-lakera-guard`): the parameters, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
This plugin supports referencing sensitive parameter values from environment variables using the env:// prefix, or from a secret manager, such as HashiCorp Vault’s KV secrets engine, using the secret:// prefix. For more information, see environment variables in plugin (opens in Apache APISIX docs) and secrets (opens in Apache APISIX docs).
api_key — string · required · since APISIX 3.18.0 · API7 Gateway 3.9.16
Valid values: non-empty
API key used to authenticate to the Lakera Guard API. It is sent as a Bearer token in the Authorization header. The value is encrypted before being stored.
lakera_endpoint — string · optional · default: https://api.lakera.ai/v2/guard · since APISIX 3.18.0 · API7 Gateway 3.9.16
URL of the Lakera Guard v2 endpoint. Set this to point at a self-hosted or regional Lakera Guard deployment.
project_id — string · optional · since APISIX 3.18.0 · API7 Gateway 3.9.16
Lakera project ID whose policy (detectors and thresholds) should be applied to the scan.
direction — string · optional · default: input · since APISIX 3.18.0 · API7 Gateway 3.9.16
Valid values: input, output, or both
Which traffic to scan. With input, only the request prompt is scanned. With output, only the LLM response is scanned, including streaming responses. With both, both are scanned.
action — string · optional · default: block · since APISIX 3.18.0 · API7 Gateway 3.9.16
Valid values: block or alert
How to handle a flagged verdict. With block, the request or response is denied. With alert, the traffic is passed through and the verdict is only logged, which is useful for evaluating a policy before enforcing it.
deny_code — integer · optional · default: 200 · since APISIX 3.18.0 · API7 Gateway 3.9.16
Valid values: between 200 and 599 inclusive
HTTP status code returned when blocking flagged traffic. The default 200 returns a provider-compatible completion whose content is the failure message, so SDK clients handle it gracefully. Set a 4xx value to surface the block as an HTTP error instead.
request_failure_message — string · optional · default: Request blocked by Lakera Guard · since APISIX 3.18.0 · API7 Gateway 3.9.16
Message returned in the deny response when the request prompt is flagged.
response_failure_message — string · optional · default: Response blocked by Lakera Guard · since APISIX 3.18.0 · API7 Gateway 3.9.16
Message returned in the deny response when the LLM response is flagged.
reveal_failure_categories — boolean · optional · default: false · since APISIX 3.18.0 · API7 Gateway 3.9.16
If true, append the flagged detector categories (and their confidence levels) to the failure message.
fail_open — boolean · optional · default: false · since APISIX 3.18.0 · API7 Gateway 3.9.16
Behavior when the call to the Lakera Guard API fails or times out. If false, the traffic is blocked (fail closed). If true, the traffic is allowed (fail open).
fail_mode — string · optional · default: skip · since APISIX 3.18.0 · API7 Gateway 3.9.16
Valid values: skip, warn, or error
Behavior when the request format is not recognized as AI traffic, for example when the route does not also configure ai-proxy or ai-proxy-multi. With skip, the request passes unchecked. With warn, it passes unchecked and a warning is logged. With error, the request is rejected with HTTP 500. None of these outcomes means a Lakera scan succeeded.
timeout — integer · optional · default: 5000 · since APISIX 3.18.0 · API7 Gateway 3.9.16
Valid values: greater than or equal to 1
Timeout in milliseconds for the request to the Lakera Guard API.
ssl_verify — boolean · optional · default: true · since APISIX 3.18.0 · API7 Gateway 3.9.16
If true, verify the TLS certificate of the Lakera Guard endpoint.