# Register an guardrail POST /v1/guardrails ```sh curl --request POST \ --url https://example.com/v1/guardrails \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "id": "example", "projectId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "name": "example", "description": "example", "kind": "zero-llm", "check": "example", "config": {}, "action": { "on-violation": "halt", "retry": { "maxAttempts": 1 }, "escalateTo": "example", "compensateWith": "example" }, "severity": "info", "scope": { "when": "always", "agents": [ "example" ], "flows": [ "example" ], "tenants": [ "example" ] }, "budget": { "maxCostUsd": 1, "maxLatencyMs": 1 }, "judgeCapabilities": {} }' ``` Body is a full `Guardrail` shape. Server validates via `@kindgi/guardrails.validateGuardrailSpec`. The `check` id must reference an implementation already available to the runtime; check code is not uploaded through this route. ## Authorizations - **[bearerAuth](https://docs.kindgi.com/v0.1.10/reference/api.md#bearerauth)** ## Parameters ### Header Parameters **Idempotency-Key** string \>= 1 characters Caller-supplied idempotency key, scoped to the caller: the same key from someone else in the tenant is their own request (from 0.1.5). Retries with the same key return the original response byte-identical (per `docs/API-ROUTE-CONVENTIONS.md` §3.1). A retry sent while the first request still runs is answered `409 idempotency-key-in-flight` with `Retry-After`, on a runtime whose store holds keys (from 0.1.5); retry after it, and you get the first request’s answer. An answer that carries a secret (a new API key or public run token, a session token, a generated signing secret) isn’t kept: a retry gets `409 idempotency-key-replay-withheld`, with the first request’s status and when it succeeded (from 0.1.5). ## Request Bodyrequired application/json Guardrail spec. Validated server-side via `@kindgi/guardrails.validateGuardrailSpec`. Metadata-only registration: the `check` id must reference an implementation already available to the runtime. object **id** required string \>= 1 characters **projectId** required Project this belongs to (its content scope). Required: missing, or not a project in the caller’s tenant → `400 bad-input`. string format: uuid **name** string **description** string **kind** required How the guardrail is checked. Open string: the built-in kinds are listed in `examples`; adapters register strategies for their own kinds. string \>= 1 characters **check** required Reference to the concrete check implementation registered server-side. string \>= 1 characters **config** object **_key_** additional properties any **action** required object **on-violation** required What a failed check does to the agent turn. Open string: the built-in actions are listed in `examples`, and any other non-empty name is accepted. In 0.1 the runtime acts only on `halt`: the turn fails with `guardrail-violation` and its response is not stored. Any other value is recorded as a violation, as `log-only` is, and the turn completes: nothing runs the turn again, escalates or calls a compensating tool. string \>= 1 characters **retry** The attempts a `retry` asks for. In 0.1 nothing acts on it: there’s no second attempt. object **maxAttempts** required integer \>= 1 <= 10 **escalateTo** Where an `escalate` goes. In 0.1 nothing escalates. string **compensateWith** The tool id a `compensate` names. In 0.1 that tool isn’t called. string **severity** string Allowed values: info warn error critical **scope** object **when** string Allowed values: always ci-only runtime-only **agents** Array\ **flows** Array\ **tenants** Array\ **budget** object **maxCostUsd** number **maxLatencyMs** integer **judgeCapabilities** object **_key_** additional properties any ## Responses ### 201 Guardrail registered. application/json object **guardrailId** required string ##### Examplegenerated ```json { "guardrailId": "example" } ``` ### 400 Validation failed (see `details.issues`); or `projectId` isn’t a project id (a UUID). Or `reference-out-of-scope`: a pack check it names isn’t registered in its project, its org or the tenant (`details.issues`); a built-in check is every project’s. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 401 Missing / malformed / expired / revoked bearer token. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 404 The body’s `projectId` names no project of this tenant (`project-not-found`). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 409 Guardrail already registered at that id. Or `environment-takes-promotions`: the project is a later environment of an environment order, which takes builds only by promotion from the one before it; publish in the order’s first environment instead (`details.firstProjectId`, when you can read that project; `details.position`, the project’s place from 0). Nothing is written. Or `registry-read-only`: this registry takes no writes (under `kindgi dev`, the pack’s files are the source); the message says what to do instead. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 413 The request body is over the API’s limit (`request-too-large`; `details.maxBytes` says how much). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 422 `guardrail-config-invalid`: the guardrail’s `config` breaks the `configSchema` of the check it names (a pack check’s, or a built-in’s), which would refuse it on every call. `details.issues` lists each problem, `{ path, message }` with `path` a JSON pointer into the guardrail (`/config/maxChars`); the message names the guardrail, the check and the setting. Checked when the check’s deployment carries its schema. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 429 `rate-limit-exceeded` with `details.limit: "schema-compile-time"`, on a server with a compile budget (Kindgi Cloud): this tenant’s schemas spent `details.budgetMs` compiling in the last 60 seconds. Nothing was stored; `Retry-After` says when to send it again. application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ### 500 Server error (unmapped domain code or framework crash). application/json object **error** required object **code** required Stable machine-readable discriminant. Values match domain error codes (see `docs/API-ROUTE-CONVENTIONS.md` §4.3). string **message** required string **details** Optional, kind-specific. object **_key_** additional properties any **requestId** required Server-assigned request id; also echoed via `X-Request-Id` header. string ##### Examplegenerated ```json { "error": { "code": "example", "message": "example", "details": {}, "requestId": "example" } } ``` ## See also - [`GET /v1/guardrails`: List guardrails](https://docs.kindgi.com/v0.1.10/reference/api/operations/guardrailslist.md) - [Operate a self-hosted runtime](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/operate.md) - [Error code `environment-takes-promotions`](https://docs.kindgi.com/v0.1.10/reference/errors.md#environment-takes-promotions) - [Error code `guardrail-config-invalid`](https://docs.kindgi.com/v0.1.10/reference/errors.md#guardrail-config-invalid) - [Error code `project-not-found`](https://docs.kindgi.com/v0.1.10/reference/errors.md#project-not-found) - [Error code `rate-limit-exceeded`](https://docs.kindgi.com/v0.1.10/reference/errors.md#rate-limit-exceeded) - [Error code `reference-out-of-scope`](https://docs.kindgi.com/v0.1.10/reference/errors.md#reference-out-of-scope) - [Error code `registry-read-only`](https://docs.kindgi.com/v0.1.10/reference/errors.md#registry-read-only) - [Error code `request-too-large`](https://docs.kindgi.com/v0.1.10/reference/errors.md#request-too-large) - [Every error code](https://docs.kindgi.com/v0.1.10/reference/errors.md)