Access and gateway features API

Set access rules and gateway features for apps, users and smart groups without writing policy. Each resource names who it applies to (scope) and what it sets (settings). Every write publishes one new policy revision, so these APIs need the Policy Engine on for the LLM Gateway. Try every operation in the Management API playground.

Collection	Path	What it sets	Read scope	Write scope
Access controls	`/controls/access`	`block`, `require_identity`, `require_conversation_id` (each only `true`) and `allowed_source_ips`.	`read`	`config:write`
Token saving	`/controls/token-saving`	Which token saving methods run on request bodies.	`read`	`config:write`
Response cache	`/controls/response-cache`	`enabled`: exact-match cache for non-streaming chat, Messages and embeddings requests.	`read`	`config:write`
Cache warm	`/controls/cache-warm`	`extend_cache_lifetime`, `refresh_requests`, `min_prompt_tokens`, `stop_after_idle_minutes`.	`read`	`config:write`
Model visibility	`/controls/model-visibility`	What model lists show: `show_only`, `hide`, `hide_all`, `hide_aliases`, `reveal_hidden`. Never what can be called.	`read`	`config:write`
Error messages	`/controls/error-messages`	Friendly messages and help links for matching gateway or provider errors. Status, type and code never change.	`read`	`config:write`
Conversation headers	`/controls/conversation-headers`	`id_headers`: extra request headers that carry a conversation ID.	`read`	`config:write`
Prompt enforcement	`/controls/prompt-enforcement`	`require_system_from_store` and a `universal_system_prompt` from the Prompt Store.	`read`	`config:write`

Scope

scope takes any of apps, app_tags, smart_groups and users. A resource applies to a request that matches every key it sets (within a key, any listed value matches).

Access controls with an empty scope apply to every request of every app. That is allowed only with all_apps: true; without it the write is 422 access_scope_required, and all_apps: true with a non-empty scope is 400. The response still carries the warning access_applies_to_everyone.
Feature settings with an empty scope apply to every app.

How they combine

Kind	Rule
Access controls	Only tighten. Every matching control applies and the strictest wins: any `block` blocks, any `require_*` requires, and `allowed_source_ips` lists from every matching control intersect. They also combine with access rules written in the console. A control that sets nothing restrictive, or sets a value to `false`, is `422 access_not_restrictive`.
Feature settings	Win over console rules of the same kind where they match. Between two feature resources that match a request, the higher `rank` (0 to 49) wins. The list settings `show_only`, `hide`, `mappings` and `id_headers` combine across every matching resource and console rule. Two resources of one collection with the same rank, scopes that can overlap and different values are `422 feature_conflict`.

Writes and versions

These collections follow the same rules as routing and limit controls: PUT /controls/{collection}/{id} creates (201) or replaces (200), an unchanged PUT publishes nothing (changed: false), changing or deleting needs the resource ETag in If-Match, PATCH is a JSON merge patch, and ?dry_run=true previews without publishing. Batch writes across collections go through POST /controls/_batch. See Writes, versions and idempotency.

Lists also show console rules of the same kind as read-only rows (source: "console"); writing one is 409 rule_not_api_managed.

Examples

API=https://guardrails-usa-1.quilr.ai/llmgateway/management/v1
auth=(-H "Authorization: Bearer $QUILR_MANAGEMENT_KEY" -H "Content-Type: application/json")

# Contractors: office network only, signed-in users only
curl -X PUT "$API/controls/access/contractors-office" "${auth[@]}" \
  -d '{"scope": {"smart_groups": ["contractors"]},
       "settings": {"require_identity": true, "allowed_source_ips": ["203.0.113.0/24"]},
       "description": "Contractors: office network only"}'

# Every app: require a conversation ID (an empty scope needs all_apps)
curl -X PUT "$API/controls/access/conversation-id-everywhere" "${auth[@]}" \
  -d '{"all_apps": true, "settings": {"require_conversation_id": true}}'

# Support bot: minify JSON and clean up tool output
curl -X PUT "$API/controls/token-saving/support-bot" "${auth[@]}" \
  -d '{"scope": {"apps": ["support-bot"]}, "rank": 10,
       "settings": {"json_minification": true, "tool_output_cleanup": true}}'

Endpoints

Access controls

GET/controls/access

List access controls

Every managed access control with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/access?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/access/{resource_id}

Delete an access control

Removes the access control; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Resource ETag "r<revision>-<id>-<hash8>" from the latest read, or the collection ETag "r<revision>". Required to change or delete an existing resource (428 when missing, 412 when stale); an unrelated publish does not invalidate it.

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/access/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/access/{resource_id}

Read an access control

One access control and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/access/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/access/{resource_id}

Update an access control

JSON merge patch of the access control (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsAccess: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsAccess.

all_appsboolean | nulloptional

Variant 1 boolean

boolean

Required (true) to leave scope empty.

Also accepts null.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

allowed_source_ipsarray<string> | nulloptional

Variant 1 array<string>

array<string>

IP addresses or CIDR ranges; intersected with every other matching list.

min items: 1max items: 100

Also accepts null.

blocktrue | nulloptional

Variant 1 true

true

Deny every matching request.

Also accepts null.

require_conversation_idtrue | nulloptional

Variant 1 true

true

Require a conversation ID.

Also accepts null.

require_identitytrue | nulloptional

Variant 1 true

true

Require a user identity.

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/access/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/access/{resource_id}

Create or replace an access control

Creates (201) or replaces (200) the access control. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Access controls tighten access for the scoped requests and never loosen it: block denies the request, require_identity and require_conversation_id require a user identity or conversation ID, and allowed_source_ips limits the source IP ranges. They apply above every console policy rule wherever they match; console denies and requirements still apply everywhere they match, and source IP lists from every matching control and console rule are intersected (lists with nothing in common deny every source). Overlapping access controls combine to the strictest result.

all_appsbooleanoptional

Required (true) to leave scope empty.

descriptionstringoptional

min length: 1max length: 500

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict (the control then applies to every request). Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

At least one restriction. Omitted settings are not set by this control.

min fields: 1

Object fields

allowed_source_ipsarray<string>optional

IP addresses or CIDR ranges; intersected with every other matching list.

min items: 1max items: 100

Array item specification

string

min length: 1

blocktrueoptional

Deny every matching request.

require_conversation_idtrueoptional

Require a conversation ID.

require_identitytrueoptional

Require a user identity.

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/access/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "description": "Contractors: office network only",
  "scope": {
    "smart_groups": [
      "contractors"
    ]
  },
  "settings": {
    "allowed_source_ips": [
      "203.0.113.0/24"
    ],
    "require_identity": true
  }
}'

Authentication, errors & retry rules Try it in the playground

Gateway features

GET/controls/cache-warm

List cache warm settings

Every managed cache warm setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/cache-warm?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/cache-warm/{resource_id}

Delete a cache warm setting

Removes the cache warm setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/cache-warm/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/cache-warm/{resource_id}

Read a cache warm setting

One cache warm setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/cache-warm/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/cache-warm/{resource_id}

Update a cache warm setting

JSON merge patch of the cache warm setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsCacheWarm: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsCacheWarm.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

extend_cache_lifetimeboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

min_prompt_tokensinteger | nulloptional

Variant 1 integer

integer

min: 0max: 2000000default: 4000

Also accepts null.

refresh_requestsboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

stop_after_idle_minutesinteger | nulloptional

Variant 1 integer

integer

min: 1max: 60default: 30

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/cache-warm/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/cache-warm/{resource_id}

Create or replace a cache warm setting

Creates (201) or replaces (200) the cache warm setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Provider prompt-cache keep-warm: extend_cache_lifetime (1-hour cache lifetime where the provider supports it, no extra requests) and refresh_requests (paid 1-token refresh requests before the provider cache lapses). Both are off unless set to true. A control replaces the whole setting where it wins: omitted keys are stored and read back at their defaults. Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

extend_cache_lifetimebooleanoptional

min_prompt_tokensintegeroptional

min: 0max: 2000000default: 4000

refresh_requestsbooleanoptional

stop_after_idle_minutesintegeroptional

min: 1max: 60default: 30

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/cache-warm/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": {
    "app_tags": [
      "coding-agents"
    ]
  },
  "settings": {
    "extend_cache_lifetime": true,
    "stop_after_idle_minutes": 20
  }
}'

Authentication, errors & retry rules Try it in the playground

GET/controls/conversation-headers

List conversation header settings

Every managed conversation header setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/conversation-headers?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/conversation-headers/{resource_id}

Delete a conversation header setting

Removes the conversation header setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/conversation-headers/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/conversation-headers/{resource_id}

Read a conversation header setting

One conversation header setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/conversation-headers/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/conversation-headers/{resource_id}

Update a conversation header setting

JSON merge patch of the conversation header setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsConversationHeaders: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsConversationHeaders.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 0unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 0unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 0unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

id_headersarray<string> | nulloptional

Variant 1 array<string>

array<string>

min items: 1

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/conversation-headers/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/conversation-headers/{resource_id}

Create or replace a conversation header setting

Creates (201) or replaces (200) the conversation header setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Extra header names that carry the conversation ID. Read before the caller is identified, so scope may name apps only. Lists add up. Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present. Only apps may be non-empty.

Object fields

app_tagsarray<string>optional

max items: 0unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 0unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 0unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

id_headersarray<string>optional

min items: 1

Array item specification

string

min length: 1

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/conversation-headers/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": {
    "apps": [
      "support-bot"
    ]
  },
  "settings": {
    "id_headers": [
      "x-thread-id"
    ]
  }
}'

Authentication, errors & retry rules Try it in the playground

GET/controls/error-messages

List error message settings

Every managed error message setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/error-messages?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/error-messages/{resource_id}

Delete an error message setting

Removes the error message setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/error-messages/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/error-messages/{resource_id}

Read an error message setting

One error message setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/error-messages/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/error-messages/{resource_id}

Update an error message setting

JSON merge patch of the error message setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsErrorMessages: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsErrorMessages.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

mappingsarray<object> | nulloptional

Variant 1 array<object>

array<object>

min items: 1max items: 64

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/error-messages/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/error-messages/{resource_id}

Create or replace an error message setting

Creates (201) or replaces (200) the error message setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Friendly error messages: each mapping matches gateway or provider errors and replaces the message (status and code never change). Lists add up and are checked highest precedence first (higher rank first); two error-message controls of the same rank must name disjoint scope.apps lists. Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

mappingsarray<object>optional

min items: 1max items: 64

Array item specification

idstringrequired

min length: 1max length: 64pattern: ^[a-z0-9][a-z0-9_.-]{0,63}$

matchobjectrequired

min fields: 1

Object fields

classarray<string>optional

min items: 1unique items

Array item specification

string

Values: "timeout""connection""rate_limit""server_error""auth""model_not_found""context_length""content_filter"

codearray<string>optional

min items: 1max items: 32unique items

Array item specification

string

min length: 1max length: 128pattern: ^[A-Za-z0-9][A-Za-z0-9_.:-]*$

message_containsarray<string>optional

min items: 1max items: 8

Array item specification

string

min length: 1max length: 200

sourcestringoptional

default: "any"

"any""gateway""provider"

statusarray<integer>optional

min items: 1max items: 16unique items

Array item specification

integer

min: 400max: 599

Unknown fields are rejected in this object.

messagestringoptional

min length: 1max length: 300

urlstringoptional

max length: 2048format: uripattern: ^https://

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/error-messages/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": {
    "apps": [
      "support-bot"
    ]
  },
  "settings": {
    "mappings": [
      {
        "id": "busy",
        "match": {
          "class": [
            "rate_limit"
          ],
          "source": "provider"
        },
        "message": "The assistant is busy; try again in a minute.",
        "url": "https://help.example.com/busy"
      }
    ]
  }
}'

Authentication, errors & retry rules Try it in the playground

GET/controls/model-visibility

List model visibility settings

Every managed model visibility setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/model-visibility?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/model-visibility/{resource_id}

Delete a model visibility setting

Removes the model visibility setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/model-visibility/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/model-visibility/{resource_id}

Read a model visibility setting

One model visibility setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/model-visibility/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/model-visibility/{resource_id}

Update a model visibility setting

JSON merge patch of the model visibility setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsModelVisibility: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsModelVisibility.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

hidearray<object> | nulloptional

Variant 1 array<object>

array<object>

min items: 1max items: 16

Also accepts null.

hide_aliasestrue | nulloptional

Variant 1 true

true

Also accepts null.

hide_alltrue | nulloptional

Variant 1 true

true

Also accepts null.

reveal_hiddenobject | nulloptional

Variant 1 object

object

Values: "always""on_request""never"

Also accepts null.

show_onlyarray<object> | nulloptional

Variant 1 array<object>

array<object>

min items: 1max items: 16

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/model-visibility/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/model-visibility/{resource_id}

Create or replace a model visibility setting

Creates (201) or replaces (200) the model visibility setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

What model lists show (never what can be called). hide_all and hide_aliases accept only true; reveal_hidden exempts a scope; show_only and hide grants add up across every matching control and console rule. Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

hidearray<object>optional

min items: 1max items: 16

Array item specification

labelsarray<string>optional

min items: 1max items: 128unique items

Array item specification

string

min length: 1max length: 256

modelsarray<string>optional

min items: 1max items: 128unique items

Array item specification

string

min length: 1max length: 256

providersarray<string>optional

min items: 1max items: 128unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

hide_aliasestrueoptional

hide_alltrueoptional

reveal_hiddenobjectoptional

"always""on_request""never"

show_onlyarray<object>optional

min items: 1max items: 16

Array item specification

labelsarray<string>optional

min items: 1max items: 128unique items

Array item specification

string

min length: 1max length: 256

modelsarray<string>optional

min items: 1max items: 128unique items

Array item specification

string

min length: 1max length: 256

providersarray<string>optional

min items: 1max items: 128unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/model-visibility/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": {
    "smart_groups": [
      "contractors"
    ]
  },
  "settings": {
    "hide_aliases": true,
    "show_only": [
      {
        "models": [
          "gpt-4.1*"
        ],
        "providers": [
          "openai"
        ]
      }
    ]
  }
}'

Authentication, errors & retry rules Try it in the playground

GET/controls/prompt-enforcement

List prompt enforcement settings

Every managed prompt enforcement setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/prompt-enforcement?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/prompt-enforcement/{resource_id}

Delete a prompt enforcement setting

Removes the prompt enforcement setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/prompt-enforcement/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/prompt-enforcement/{resource_id}

Read a prompt enforcement setting

One prompt enforcement setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/prompt-enforcement/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/prompt-enforcement/{resource_id}

Update a prompt enforcement setting

JSON merge patch of the prompt enforcement setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsPromptEnforcement: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsPromptEnforcement.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

require_system_from_storeboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

universal_system_promptobject | nulloptional

Variant 1 object

contentstring | nulloptional

Variant 1 string

string

min length: 1max length: 8192

Also accepts null.

enabledboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

prompt_idstring | nulloptional

Variant 1 string

string

min length: 1pattern: ^[a-zA-Z0-9_-]+$

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/prompt-enforcement/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/prompt-enforcement/{resource_id}

Create or replace a prompt enforcement setting

Creates (201) or replaces (200) the prompt enforcement setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Prompt store enforcement: require_system_from_store and the universal system prompt. Use prompt_id (a stored prompt) for prompts you edit often: editing the stored prompt needs no control change. Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

require_system_from_storebooleanoptional

universal_system_promptobjectoptional

Object fields

contentstringoptional

min length: 1max length: 8192

enabledbooleanrequired

prompt_idstringoptional

min length: 1pattern: ^[a-zA-Z0-9_-]+$

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/prompt-enforcement/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": {
    "apps": [
      "support-bot"
    ]
  },
  "settings": {
    "require_system_from_store": true,
    "universal_system_prompt": {
      "enabled": true,
      "prompt_id": "support-guidelines"
    }
  }
}'

Authentication, errors & retry rules Try it in the playground

GET/controls/response-cache

List response cache settings

Every managed response cache setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/response-cache?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/response-cache/{resource_id}

Delete a response cache setting

Removes the response cache setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/response-cache/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/response-cache/{resource_id}

Read a response cache setting

One response cache setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/response-cache/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/response-cache/{resource_id}

Update a response cache setting

JSON merge patch of the response cache setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsResponseCache: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsResponseCache.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

enabledboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/response-cache/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/response-cache/{resource_id}

Create or replace a response cache setting

Creates (201) or replaces (200) the response cache setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Turns the exact-match response cache on or off for the scoped apps. Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

enabledbooleanoptional

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/response-cache/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "scope": {
    "apps": [
      "support-bot"
    ]
  },
  "settings": {
    "enabled": true
  }
}'

Authentication, errors & retry rules Try it in the playground

GET/controls/token-saving

List token saving settings

Every managed token saving setting with its ETag, then the console policy rules of the same kind as read-only rows (source console, policy, rule_index, view). Console rows cannot be written here (409 rule_not_api_managed). Paginated (limit, cursor bound to the revision) and filtered by source, app, requested_model, mode and references.

REQUIRESread

Path, query & header parameters 7

limit (query)integeroptional

Page size.

min: 1max: 500default: 100

cursor (query)stringoptional

next_cursor of the previous page; bound to the revision (409 collection_changed when the policy changed).

source (query)objectoptional

Only managed resources or only console rows.

"managed""console"

app (query)stringoptional

Rows that can apply to this app (rows scoped only by smart group, user or tag are kept). app_name is a deprecated alias.

requested_model (query)stringoptional

Rows that can apply to this requested model. model is a deprecated alias.

mode (query)stringoptional

Rows with this mode (routes: active, observe, disabled; limits: enforce, alert, paused).

references (query)stringoptional

<provider_label> or <provider_label>/<model>: rows that name it, following destination and failover-profile refs (adds references [paths]).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/token-saving?limit=example' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

DELETE/controls/token-saving/{resource_id}

Delete a token saving setting

Removes the token saving setting; refused while other controls reference it. If-Match is required.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

Unknown fields are rejected in this object.

curl --request DELETE \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/token-saving/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

GET/controls/token-saving/{resource_id}

Read a token saving setting

One token saving setting and its ETag.

REQUIRESread

Path, query & header parameters 1

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

No request body.

curl --request GET \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/token-saving/eu-pool' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules Try it in the playground

PATCH/controls/token-saving/{resource_id}

Update a token saving setting

JSON merge patch of the token saving setting (null removes a field); the result is validated as a whole. If-Match is required. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 4

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringrequired

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

Full request body specification application/json

JSON merge patch of ControlsTokenSaving: send only the fields to change; null removes a field (nested objects merge, lists are replaced). The merged resource must be a valid ControlsTokenSaving.

descriptionstring | nulloptional

Variant 1 string

string

min length: 1max length: 500

Also accepts null.

rankinteger | nulloptional

Variant 1 integer

integer

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

Also accepts null.

scopeobject | nulloptional

Variant 1 object

app_tagsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

appsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

smart_groupsarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

usersarray<string> | nulloptional

Variant 1 array<string>

array<string>

max items: 100unique items

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

settingsobject | nulloptional

Variant 1 object

base64_blob_elisionboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

html_to_textboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

json_minificationboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

markdown_to_textboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

smart_json_compressionboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

text_compressionboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

tool_output_cleanupboolean | nulloptional

Variant 1 boolean

boolean

Also accepts null.

Unknown fields are rejected in this object.

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/token-saving/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"'

Authentication, errors & retry rules Try it in the playground

PUT/controls/token-saving/{resource_id}

Create or replace a token saving setting

Creates (201) or replaces (200) the token saving setting. Changing an existing one needs If-Match; If-None-Match: * creates only. Writes publish one policy revision. A PUT whose content equals the stored resource returns changed false and publishes nothing.

REQUIRESconfig:write

Path, query & header parameters 5

resource_id (path)stringrequired

Client-chosen control ID, ^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$ (console rules read as console:<policy>:<rule_index>).

dry_run (query)booleanoptional

Preview: spec and policy diff, diagnostics, warnings, would_publish and impact; nothing is saved.

default: false

If-Match (header)stringoptional

Idempotency-Key (header)stringoptional

Unique per logical write. A retry with the same key and body returns the original result, including after a crash once the revision was published. Optional on PUT, PATCH and DELETE.

min length: 1max length: 200

If-None-Match (header)"*"optional

Create only: 412 when the resource exists with different content.

Full request body specification application/json

Request-body token saving methods for the scoped requests (true turns a method on, false off). Gateway-feature controls take precedence over console policy rules wherever they match, except console policies above priority 999 and console policies at 950 to 999 that predate the controls and are unchanged (both listed in overridden_by); console rules still apply elsewhere.

descriptionstringoptional

min length: 1max length: 500

rankintegeroptional

Orders overlapping controls of this collection: the higher rank wins. Two overlapping controls with the same rank and different values are 422 feature_conflict.

min: 0max: 49default: 0

scopeobjectoptional

Every non-empty list must match (AND); empty or omitted lists do not restrict. Returned with every field present.

Object fields

app_tagsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

appsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

smart_groupsarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

usersarray<string>optional

max items: 100unique items

Array item specification

string

min length: 1max length: 256

Unknown fields are rejected in this object.

settingsobjectrequired

Omitted settings are not set by this control.

min fields: 1

Object fields

base64_blob_elisionbooleanoptional

html_to_textbooleanoptional

json_minificationbooleanoptional

markdown_to_textbooleanoptional

smart_json_compressionbooleanoptional

text_compressionbooleanoptional

tool_output_cleanupbooleanoptional

Unknown fields are rejected in this object.

curl --request PUT \
  'https://guardrails-usa-1.quilr.ai/llmgateway/management/v1/controls/token-saving/eu-pool' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "r12-eu-pool-1a2b3c4d"' \
  --header 'Content-Type: application/json' \
  --data '{
  "rank": 10,
  "scope": {
    "apps": [
      "support-bot"
    ]
  },
  "settings": {
    "json_minification": true,
    "tool_output_cleanup": true
  }
}'

Authentication, errors & retry rules Try it in the playground

Routing and failover API - write rules, ETags, batch and revision restore shared by every control collection.
Rate limits API - request and token limits, request guards and limit responses.
Management API - authentication, scopes, errors and response formats.

Scope​

How they combine​

Writes and versions​

Examples​

Endpoints​

Access controls​

Gateway features​

Related​

Scope

How they combine

Writes and versions

Examples

Endpoints

Access controls

Gateway features

Related