Guardrails

Pick it in the Guardrail select on /dashboard/keys, or send guardrailId (null to clear) on POST /keys or PATCH /keys/:id.

PATCH https://api.minirouter.sh/keys/42
{ "guardrailId": "9b1c2d3e-4f50-4a6b-8c7d-0e1f2a3b4c5d" }

Only a signed-in browser session may assign one. An inference key sending guardrailId is refused with 403, because swapping a guardrail could widen a model list or drop a filter. Key views return guardrailId and guardrailName. Deleting a guardrail unassigns every key that used it.

limitNano (nano-USD, decimal string) and resetInterval (daily, weekly, monthly) are set together or both null.

The budget is counted per key: one guardrail on three keys gives each key its own budget, never a pooled one. Windows are UTC: daily resets at 00:00, weekly on Monday 00:00, monthly on the 1st. In-progress requests count against the budget.

A request that would cross the budget is refused before the first byte with 403 spend_limit_exceeded. The message names the limit, the scope guardrail, the instant it resets (resetsAt) and where to change it. There is no Retry-After; retrying before the reset repeats the same error.

A budget crossed mid-stream ends the stream with the existing usage_limit_exceeded event, because bytes have already been sent.

Allowlists intersect: the account list, the key’s allowedModelsand the guardrail’s allowedModels all apply, and a model must be in every non-empty one. Ignored lists subtract. An empty list on the guardrail adds no restriction. The same holds for providers.

A model that exists but falls outside the result returns 403 model_not_allowed, naming the model and the nearest allowed one when there is a close match. minirouter/autoskips the guardrail’s ignored models when it picks.

A model left with no provider after the provider lists are applied is refused the way an over-narrow key provider allowlist is refused today.

Each built-in detector has an action: flag records the hit, redact replaces each match with its placeholder before the request is measured, held or sent, and block refuses the request. A detector you do not list is off. Presets scan every message role regardless of the injection scan scope.

phone matches any run of ten digits with or without separators, so order numbers of that shape are redacted too. ip-address is IPv4 only. credit-card keeps only digit strings that pass the Luhn check.

The secrets preset is one regex per format. A hit names the format id in events and in the placeholder.

The regex-prompt-injection preset carries the 33 patterns below, ported from OpenRouter’s published set so the names in your events match the names in their documentation. Actions are flag, redact (placeholder [PROMPT_INJECTION]) and block.

injectionScanScope decides which text the injection patterns read. user_only (the default) reads user turns. all_messages also reads system prompts, assistant turns and tool arguments, including instructions a preset injected, because the scan runs after presets shape the body.

Spaced letters are collapsed first: three or more single letters in a row (i g n o r e) are read as one word and the patterns run again on the collapsed copy. A hit there counts under the same pattern name, and redaction replaces the original spaced span.

Three patterns are bounded so no repeat is unbounded on a 32 MB body: dan_jailbreak requires “do anything now” within 500 characters of DAN, identity_hijack caps the hijacked name at 64 word characters, and system_prefix_spoofing does not include blank lines before System:.

Not detected: scrambled words (typoglycemia), misspellings beyond the few in reveal_prompt and show_prompt, and text encoded as base64 or hex.

contentFilters holds up to 20 entries of { pattern, action, label }. pattern is a JavaScript regular expression source of 1 to 2,000 characters, compiled with the g and u flags. Matching is case-sensitive: write [Aa]cme to match either case.

label is optional, up to 40 letters, digits, spaces, _ or -. The redaction placeholder is [label], or [REDACTED] without a label. Events list the label, or pattern n for an unlabeled entry.

A pattern is rejected with 400 when it uses lookahead, lookbehind or backreferences (\1, \k<name>); nests a quantifier inside a quantified group such as (a+)+; matches the empty string; or runs too slowly on plain text in the save-time probe. The message reads Pattern n: … and never repeats the pattern. Custom patterns scan every message role.

Only these strings are read and rewritten, on /chat/completions, /responses, /messages and /messages/count_tokens. Anything else at these paths, and every other field, is left alone.

The scan runs before token measurement, the balance hold, the request trace and the upstream send, so all of them see the redacted text.

Input only: model output is never scanned. Embeddings, rerank and image requests are not content-scanned; they still get the merged model and provider lists and the budget.

Block filters run first. Any hit refuses the request with 403 guardrail_blocked before anything is measured, held or sent, and nothing is charged. The message names the detector or pattern, never the text it matched, and is capped at 200 characters.

{
  "error": {
    "message": "A guardrail on this API key blocked the request: prompt injection patterns detected (ignore_previous_instructions). Nothing was sent to a provider and nothing was charged. Manage guardrails at https://minirouter.sh/dashboard/guardrails Docs: https://minirouter.sh/docs/guardrails",
    "type": "invalid_request_error",
    "code": "guardrail_blocked",
    "request_id": "req_01J8Z6Q0GUARDRAIL"
  }
}

{
  "type": "error",
  "error": {
    "type": "permission_error",
    "message": "A guardrail on this API key blocked the request: prompt injection patterns detected (ignore_previous_instructions). Nothing was sent to a provider and nothing was charged. Manage guardrails at https://minirouter.sh/dashboard/guardrails Docs: https://minirouter.sh/docs/guardrails"
  },
  "request_id": "req_01J8Z6Q0GUARDRAIL"
}

The hit appears in the hits list on /dashboard/guardrails and on GET /guardrails/events. Hits are kept for 30 days.

x-minirouter-guardrail is set when a guardrail acted without blocking. A block is a 403, never a header; a request nothing matched carries no header unless the scan failed (skipped).

Base URL https://api.minirouter.sh, the same as /keys. Reads accept an API key or a signed-in session; writes and the test endpoint need a signed-in session. Writes are limited to 30 per minute per account.

POST https://api.minirouter.sh/guardrails
{
  "name": "Support bot",
  "limitNano": "25000000000",
  "resetInterval": "weekly",
  "contentFilterBuiltins": [
    { "slug": "email", "action": "redact" },
    { "slug": "secrets", "action": "block" },
    { "slug": "regex-prompt-injection", "action": "block" }
  ],
  "contentFilters": [
    { "pattern": "PROJ-\\d{3,6}", "action": "redact", "label": "ticket" }
  ],
  "injectionScanScope": "user_only"
}

Every guardrail is returned with id, revision (send it back as expectedRevision), keyCount, createdAt and updatedAt. Unknown fields are a 400 naming the field.

POST https://api.minirouter.sh/guardrails/test
{ "config": { "contentFilterBuiltins": [ { "slug": "email", "action": "redact" } ] },
  "text": "Reach me at user@example.com" }

{ "action": "redacted",
  "redacted": "Reach me at [EMAIL]",
  "hits": [ { "detector": "email", "action": "redact", "patterns": [], "matchCount": 1 } ] }

Events carry id, guardrailId, guardrailName (null once deleted), apiKeyId, keyPrefix, requestId, route, detector (a preset slug or custom), action, patterns (pattern names, format ids or labels) and matchCount. Pages return nextCursor; pass it as cursor for the next page. null means the end.