> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usefini.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Overview
> Manage guardrail policies, discover check types, and inspect runs and hit counts.
Guardrail policies belong to an agent and check generated replies before delivery. See [Guardrails](/en/configuration/guardrails) for dashboard setup, rewrite behavior, and fail-open limitations.
Policies are saved directly, not versioned drafts. Creation, updates, and deletion affect live configuration. Workspace API keys require `read` scope for discovery and reports, and `write` scope for mutations.
## Endpoints
| Method | Endpoint | Scope |
| - | - | - |
| `GET` | [List guardrail check types](/en/api-reference/list-guardrail-check-types) | `read` |
| `GET` | [List guardrail policies](/en/api-reference/list-guardrail-policies) | `read` |
| `GET` | [Get guardrail policy](/en/api-reference/get-guardrail-policy) | `read` |
| `POST` | [Create guardrail policy](/en/api-reference/create-guardrail-policy) | `write` |
| `PUT` | [Update guardrail policy](/en/api-reference/update-guardrail-policy) | `write` |
| `DELETE` | [Delete guardrail policy](/en/api-reference/delete-guardrail-policy) | `write` |
| `GET` | [List guardrail runs](/en/api-reference/list-guardrail-runs) | `read` |
| `GET` | [Get guardrail hits](/en/api-reference/get-guardrail-hits) | `read` |
## Configuration schemas
The `config` object is validated against `checkType`; unknown configuration keys are rejected. Arrays are limited to 200 items, with each item at most 200 characters. Terms must have at least two characters. Regex patterns are validated for syntax and unsafe repetition.
| Check type | Configuration |
| - | - |
| `internal_reasoning_leak` | Optional `additionalTerms` and `additionalPatterns` string arrays. An empty object intentionally uses only built-in checks. |
| `banned_terms` | Optional `terms` and `patterns` string arrays; at least one term or pattern is required. |
| `confidential_attributes` | Nonempty `attributeKeys` string array. |
| `url_allowlist` | Nonempty `allowedDomains` string array of bare domains, without scheme or path. Subdomains are allowed. |
| `ai_disclosure` | An empty object is the complete configuration; no configurable fields. |
| `custom` | Required `name` (1 to 120 characters) and `instruction` (1 to 4,000 characters); optional `examples` array with up to 10 entries, each containing `text` (1 to 2,000 characters) and `verdict` (`pass` or `fail`). |
Each non-custom check type can exist once per agent, even when disabled. Up to 10 custom policies can exist per agent.
## Channel scope
`sources` accepts unique channel names: `ui`, `widget`, `standalone`, `testsuite`, `replay`, `api`, `intercom`, `zendesk`, `salesforce`, `gorgias`, `front`, `hubspot`, `livechat`, `slack`, `discord`, `freshdesk`, `freshchat`, `deskpro`, `microsoft365`, and `email`. Accepted source identifiers do not guarantee that every delivery path is enabled in your workspace.
An omitted or empty array on creation means all channels; responses represent that scope as `null`. On update, omit `sources` to preserve it or send an empty array to clear the restriction. Standalone maps to widget for matching. Dashboard, Test Suite, and replay evaluation bypass channel filtering.
## Shared response and error behavior
Policy responses include `id`, `companyId`, `botId`, `checkType`, `config`, `enabled`, `sources`, `createdAt`, and `updatedAt`. List endpoints return arrays directly. Run responses redact `originalContent` and `rewriteReason` to `null` for workspace API callers.
Invalid configuration or query values return 400. A missing agent or policy in the authenticated workspace returns 404. Creating a duplicate non-custom type returns 409. Exceeding the custom-policy limit returns 400.
## Related topics
- [Overview](/en/api-reference/tags.md)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.
Guardrails