Guardrails
Create Guardrail Policy
Author a new guardrail policy.
POST
/
api
/
v1
/
guardrail-policies
Create Guardrail Policy
curl --request POST \
--url https://api.example.com/api/v1/guardrail-policies \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"description": "<string>",
"rules": [
{}
],
"scope": "<string>",
"is_default": true
}
'import requests
url = "https://api.example.com/api/v1/guardrail-policies"
payload = {
"name": "<string>",
"description": "<string>",
"rules": [{}],
"scope": "<string>",
"is_default": True
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
description: '<string>',
rules: [{}],
scope: '<string>',
is_default: true
})
};
fetch('https://api.example.com/api/v1/guardrail-policies', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/guardrail-policies",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'description' => '<string>',
'rules' => [
[
]
],
'scope' => '<string>',
'is_default' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/guardrail-policies"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"rules\": [\n {}\n ],\n \"scope\": \"<string>\",\n \"is_default\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/guardrail-policies")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"rules\": [\n {}\n ],\n \"scope\": \"<string>\",\n \"is_default\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/guardrail-policies")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"rules\": [\n {}\n ],\n \"scope\": \"<string>\",\n \"is_default\": true\n}"
response = http.request(request)
puts response.read_bodyCreate a new guardrail policy. Idempotent — the same
Idempotency-Key header replays the same response.
Creating a policy does not auto-bind it to a key. Use PUT /api/v1/keys//guardrails to opt a key in.
Authentication
Requires a Bearer token with thebilling API key scope.
Body
string
required
Policy name. 1–128 chars. May not reference upstream provider names.
string
Free-text description. Up to 512 chars.
object[]
Up to 32 rule objects. Each rule has
guardrail_id, phase, verdict, and an optional config bag.string
"personal" (default) or "team". Team scope requires an active org and the manageWebhooks permission.boolean
Mark this policy as the default for its scope. At most one default per scope.
Request Examples
curl -X POST https://www.hitheo.ai/api/v1/guardrail-policies \
-H "Authorization: Bearer $THEO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "Compliance-strict",
"description": "PII redaction + jailbreak deny.",
"rules": [
{ "guardrail_id": "pii_redactor", "phase": "input", "verdict": "redact" },
{ "guardrail_id": "prompt_injection", "phase": "input", "verdict": "deny" }
]
}'
const policy = await theo.guardrails.policies.create({
name: "Compliance-strict",
description: "PII redaction + jailbreak deny.",
rules: [
{ guardrail_id: "pii_redactor", phase: "input", verdict: "redact" },
{ guardrail_id: "prompt_injection", phase: "input", verdict: "deny" },
],
});
Errors
400 guardrail_policy_invalid— Unknown guardrail id, disallowed verdict for the builtin, vendor-named label, or rule cap exceeded.403 missing_scope— API key lacks thebillingscope.409 conflict—is_default: truealready set for this scope.
Was this page helpful?
Create Guardrail Policy
curl --request POST \
--url https://api.example.com/api/v1/guardrail-policies \
--header 'Content-Type: application/json' \
--data '
{
"name": "<string>",
"description": "<string>",
"rules": [
{}
],
"scope": "<string>",
"is_default": true
}
'import requests
url = "https://api.example.com/api/v1/guardrail-policies"
payload = {
"name": "<string>",
"description": "<string>",
"rules": [{}],
"scope": "<string>",
"is_default": True
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
name: '<string>',
description: '<string>',
rules: [{}],
scope: '<string>',
is_default: true
})
};
fetch('https://api.example.com/api/v1/guardrail-policies', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/api/v1/guardrail-policies",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => '<string>',
'description' => '<string>',
'rules' => [
[
]
],
'scope' => '<string>',
'is_default' => true
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/api/v1/guardrail-policies"
payload := strings.NewReader("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"rules\": [\n {}\n ],\n \"scope\": \"<string>\",\n \"is_default\": true\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/api/v1/guardrail-policies")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"rules\": [\n {}\n ],\n \"scope\": \"<string>\",\n \"is_default\": true\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/api/v1/guardrail-policies")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"<string>\",\n \"description\": \"<string>\",\n \"rules\": [\n {}\n ],\n \"scope\": \"<string>\",\n \"is_default\": true\n}"
response = http.request(request)
puts response.read_body