Skip to documentation

Guardrails

Guardrails

Apply an HTTP policy before a model call or after its response, with explicit bindings and failure behavior.

Self-hostedHosted

Last updated September 17, 2026

View as Markdown

Guardrails call a policy service and apply your configured verdict: allow, block, or a supported response replacement. They do not include a built-in moderation model. A binding attaches a guardrail to a Group, Provider, or Model.

Pre-dispatch checks can stop a request before provider usage. Post-response checks run after the provider has completed, so its usage and cost still count. Effective guardrails require non-streaming generation; they do not apply to embeddings.

Dashboard

  1. Open Guardrails, add a guardrail, and choose a preset or custom HTTP service.
  2. Configure its URL, protected credential, stage, request template, and response rules.
  3. Choose what happens on service failure: allow, block, or return an error.
  4. Test with representative input, inspect the verdict, add bindings, then enable it.

Testing can call the configured external policy service. Review its data handling before sending content.

API

Use a key with the relevant permissions; see API authentication. Replace placeholders with IDs from the corresponding list or create response.

Reads require relay:settings:view; mutations and tests require relay:settings:manage.

List guardrails

curl 'https://api.anchorshell.com/api/relay/guardrails' \
  -H 'Authorization: Bearer <API_KEY>'

Response — 200 OK

Selected response fields shown; IDs and values are illustrative.

[
  {
    "id": "<GUARDRAIL_ID>",
    "name": "Content policy",
    "preset_slug": "custom-http",
    "enabled": false,
    "has_credential": false,
    "binding_count": 0
  }
]

Get one guardrail

curl 'https://api.anchorshell.com/api/relay/guardrails/<GUARDRAIL_ID>' \
  -H 'Authorization: Bearer <API_KEY>'

Response — 200 OK

Selected response fields shown; IDs and values are illustrative.

{
  "guardrail": {
    "id": "<GUARDRAIL_ID>",
    "name": "Content policy",
    "preset_slug": "custom-http",
    "enabled": false,
    "has_credential": false,
    "binding_count": 0
  },
  "bindings": []
}

Create a disabled draft

curl -X POST 'https://api.anchorshell.com/api/relay/guardrails' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "Content policy",
  "preset_slug": "custom-http",
  "base_url": "https://policy.example.com/check",
  "http_method": "POST",
  "auth_mode": "none",
  "pre_dispatch_enabled": true
}'

Response — 201 Created

Selected response fields shown; IDs and values are illustrative.

{
  "id": "<GUARDRAIL_ID>",
  "name": "Content policy",
  "preset_slug": "custom-http",
  "enabled": false,
  "has_credential": false,
  "binding_count": 0
}

Replace the illustrative URL with your service. New guardrails are always disabled until their full configuration is validated. Configure templates and rules in the editor before enabling.

Update a guardrail

curl -X PUT 'https://api.anchorshell.com/api/relay/guardrails/<GUARDRAIL_ID>' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "name": "Production content policy",
  "enabled": false
}'

Response — 200 OK

Selected response fields shown; IDs and values are illustrative.

{
  "id": "<GUARDRAIL_ID>",
  "name": "Production content policy",
  "preset_slug": "custom-http",
  "enabled": false,
  "has_credential": false,
  "binding_count": 0
}

Replace bindings

curl -X PUT 'https://api.anchorshell.com/api/relay/guardrails/<GUARDRAIL_ID>/bindings' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "bindings": [
    {
      "provider_id": "<PROVIDER_ID>",
      "enabled": true
    }
  ]
}'

Response — 200 OK

Selected response fields shown; IDs and values are illustrative.

[
  {
    "id": "<BINDING_ID>",
    "guardrail_id": "<GUARDRAIL_ID>",
    "provider_id": "<PROVIDER_ID>",
    "enabled": true
  }
]

This replaces the whole binding list. Each binding targets exactly one resource.

Test a configured guardrail

curl -X POST 'https://api.anchorshell.com/api/relay/guardrails/<GUARDRAIL_ID>/test' \
  -H 'Authorization: Bearer <API_KEY>' \
  -H 'Content-Type: application/json' \
  -d '{
  "stage": "pre_dispatch",
  "request_text": "A harmless sample request."
}'

Response — 200 OK

Example configured policy allowing the test input. This calls the policy service, not an LLM.

{
  "response_status": 200,
  "latency_ms": 42,
  "result": {
    "decision": "allow",
    "guardrail_uuid": "<GUARDRAIL_ID>",
    "stage": "pre_dispatch"
  }
}

The saved guardrail must have valid templates and response rules before this test can run.

Delete a guardrail

curl -X DELETE 'https://api.anchorshell.com/api/relay/guardrails/<GUARDRAIL_ID>' \
  -H 'Authorization: Bearer <API_KEY>'

Response — 204 No Content

No response body.

Next

Limits.