Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccess

Get a guardrail or custom policy

Returns one guardrail or custom policy by id: its enabled state, its networks, models or endpoints, and its Cedar (the source, or what a guardrail generates).

Required permission

Requires the policy.read permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl authz policy get <policy-id>
GET
/v1/authz/policies/{policyId}

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

policyId*string

Response Body

The policy

application/json
  1. response
id*string
name*string
description?string
kind*string
Value in"guardrail""custom"
enabled*boolean
guardrail?string

key_networks limits API keys to ipRanges; everyone_networks limits sessions and keys (owners only); model_allowlist limits inference to models and endpoints.

Value in"key_networks""everyone_networks""model_allowlist"
ipRanges?array<string>
models?array<string>
endpoints?array<string>
cedarText?string

A custom policy's Cedar source.

cedar?string

The Cedar a guardrail generates.

stale?string

Set when an enabled policy names something this version of OpenRelay does not know, or can no longer be read: what it does now and what to change.

createdBy?string
createdAt?string
updatedBy?string
updatedAt?string
Example Request
curl -X GET 'https://api.openrelay.inc/v1/authz/policies/string'
Example Response
{  "id": "string",  "name": "string",  "description": "string",  "kind": "guardrail",  "enabled": true,  "guardrail": "key_networks",  "ipRanges": [    "string"  ],  "models": [    "string"  ],  "endpoints": [    "string"  ],  "cedarText": "string",  "cedar": "string",  "stale": "string",  "createdBy": "string",  "createdAt": "string",  "updatedBy": "string",  "updatedAt": "string"}

Validate a policy without saving it POST

Returns line and column diagnostics and the lockout check for a candidate policy. Requires a signed-in session and the permission saving it would need.

Update, enable or disable a policy PATCH

Changes a policy's name, description, networks, models, endpoints, Cedar text or enabled state, and returns it. Fields left out keep their values. Requires a signed-in session and the permission creating the policy needs.