Validate a policy without saving it
Returns line and column diagnostics and the lockout check for a candidate policy. Requires a signed-in session and the permission saving it would need.
Required permission
Checked against the guardrail.manage permission for the resource it acts on. See Permissions for the roles and API key permissions that include it.
Command line
The orl CLI wraps this endpoint:
orl authz policy validate --kind <kind> --name <name>apiKeyAuthorizationBearer <token>OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).
application/json- body
name*stringlength <= 64description?stringlength <= 256kind*string"guardrail""custom"enabled?booleanDefaults to true.
guardrail?string"key_networks""everyone_networks""model_allowlist"ipRanges?array<string>models?array<string>endpoints?array<string>cedarText?stringlength <= 10240The validation
application/json- response
valid*booleandiagnostics*array<>lockout*array<string>Permissions the saving owner would lose (policy.manage, member.manage); saving is refused while this is non-empty.
curl -X POST 'https://api.openrelay.inc/v1/authz/policies/validate' \ -H 'Content-Type: application/json' \ -d '{ "name": "string", "kind": "guardrail"}'{ "valid": true, "diagnostics": [ { "line": 0, "column": 0, "message": "string" } ], "lockout": [ "string" ]}Create a guardrail or a custom Cedar policy POST
Saves a guardrail (key networks, everyone networks or a model allowlist) or a custom Cedar policy and returns it, enabled unless you send enabled: false. Requires a signed-in session. Guardrails that apply to API keys only need guardrail.manage; the everyone_networks guardrail and every custom policy can block sessions and need policy.manage (owners). A policy that would take policy.manage or member.manage from the saving owner is refused with 409 WOULD_LOCK_OUT.
Get a guardrail or custom policy GET
Returns one guardrail or custom policy by id: its enabled state, its networks, models or endpoints, and its Cedar (the source, or what a guardrail generates).