Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccess

Create a guardrail or a custom Cedar policy

Saves a guardrail (key networks, everyone networks or a model allowlist) or a custom Cedar policy and returns it, enabled unless you send enabled: false. Requires a signed-in session. Guardrails that apply to API keys only need guardrail.manage; the everyone_networks guardrail and every custom policy can block sessions and need policy.manage (owners). A policy that would take policy.manage or member.manage from the saving owner is refused with 409 WOULD_LOCK_OUT.

Required permission

Checked against the guardrail.manage permission for the resource it acts on. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl authz policy create --kind <kind> --name <name>
POST
/v1/authz/policies

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Request Body

application/json
  1. body
name*string
Lengthlength <= 64
description?string
Lengthlength <= 256
kind*string
Value in"guardrail""custom"
enabled?boolean

Defaults to true.

guardrail?string
Value in"key_networks""everyone_networks""model_allowlist"
ipRanges?array<string>
models?array<string>
endpoints?array<string>
cedarText?string
Lengthlength <= 10240

Response Body

Created

application/json
  1. response
id*string
name*string
description?string
kind*string
Value in"guardrail""custom"
enabled*boolean
guardrail?string

key_networks limits API keys to ipRanges; everyone_networks limits sessions and keys (owners only); model_allowlist limits inference to models and endpoints.

Value in"key_networks""everyone_networks""model_allowlist"
ipRanges?array<string>
models?array<string>
endpoints?array<string>
cedarText?string

A custom policy's Cedar source.

cedar?string

The Cedar a guardrail generates.

stale?string

Set when an enabled policy names something this version of OpenRelay does not know, or can no longer be read: what it does now and what to change.

createdBy?string
createdAt?string
updatedBy?string
updatedAt?string
Example Request
curl -X POST 'https://api.openrelay.inc/v1/authz/policies' \  -H 'Content-Type: application/json' \  -d '{  "name": "string",  "kind": "guardrail"}'
Example Response
{  "id": "string",  "name": "string",  "description": "string",  "kind": "guardrail",  "enabled": true,  "guardrail": "key_networks",  "ipRanges": [    "string"  ],  "models": [    "string"  ],  "endpoints": [    "string"  ],  "cedarText": "string",  "cedar": "string",  "stale": "string",  "createdBy": "string",  "createdAt": "string",  "updatedBy": "string",  "updatedAt": "string"}

List the org's guardrails and custom policies GET

Returns every guardrail and custom Cedar policy in the organization, enabled or disabled, with its networks, models, endpoints and Cedar text.

Validate a policy without saving it POST

Returns line and column diagnostics and the lockout check for a candidate policy. Requires a signed-in session and the permission saving it would need.