Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceAccount and accessAccess

List the org's guardrails and custom policies

Returns every guardrail and custom Cedar policy in the organization, enabled or disabled, with its networks, models, endpoints and Cedar text.

Required permission

Requires the policy.read permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

orl authz policy list
GET
/v1/authz/policies

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Response Body

Policies

application/json
  1. response
[index: integer]?
Example Request
curl -X GET 'https://api.openrelay.inc/v1/authz/policies'
Example Response
[  {    "id": "string",    "name": "string",    "description": "string",    "kind": "guardrail",    "enabled": true,    "guardrail": "key_networks",    "ipRanges": [      "string"    ],    "models": [      "string"    ],    "endpoints": [      "string"    ],    "cedarText": "string",    "cedar": "string",    "stale": "string",    "createdBy": "string",    "createdAt": "string",    "updatedBy": "string",    "updatedAt": "string"  }]

Check whether a principal may perform an action POST

Evaluates one action for a member, service account or key of the organization and returns the decision, the layer that decided it and the deciding policies.

Create a guardrail or a custom Cedar policy POST

Saves a guardrail (key networks, everyone networks or a model allowlist) or a custom Cedar policy and returns it, enabled unless you send enabled: false. Requires a signed-in session. Guardrails that apply to API keys only need guardrail.manage; the everyone_networks guardrail and every custom policy can block sessions and need policy.manage (owners). A policy that would take policy.manage or member.manage from the saving owner is refused with 409 WOULD_LOCK_OUT.