From 61b9e483006ea8ecc4c2f933ead698263fdde5c1 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 28 Jul 2026 15:56:31 +0000 Subject: [PATCH 1/4] docs: document workspace exclusions for org-level guardrails Add product guidance and Admin API reference pages for excluding workspaces from organization default input/output guardrails. Co-authored-by: Chandra Kiran G --- .../list-input-guardrail-exclusions.mdx | 66 +++++++++++++ .../list-output-guardrail-exclusions.mdx | 66 +++++++++++++ .../update-input-guardrail-exclusions.mdx | 69 +++++++++++++ .../update-output-guardrail-exclusions.mdx | 67 +++++++++++++ docs.json | 18 ++++ .../enforce-orgnization-level-guardrails.mdx | 96 ++++++++++++++++--- .../enforce-workspace-level-guardials.mdx | 10 ++ 7 files changed, 381 insertions(+), 11 deletions(-) create mode 100644 api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx create mode 100644 api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx create mode 100644 api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx create mode 100644 api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx new file mode 100644 index 00000000..93dea612 --- /dev/null +++ b/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx @@ -0,0 +1,66 @@ +--- +title: "List Input Guardrail Exclusions" +description: "List workspaces excluded from organization-level input guardrails" +--- + +List active workspace exclusions for **organization-level input guardrails**. Optionally filter by a single workspace. + + + Requires an Admin API key. Organization Owners and Admins can list workspace exclusions. + + +## HTTP Request + +`GET https://api.portkey.ai/v1/workspace-exclusions/input-guardrails` + +## Query Parameters + + + Organization UUID. + + + + Optional workspace UUID or workspace slug. When provided, returns exclusions for that workspace only. + + +## Example Request + +```bash +curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/input-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6" \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" +``` + +### Filter by workspace + +```bash +curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/input-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6&workspace_id=ws-sandbox" \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" +``` + +## Example Response + +```json +{ + "success": true, + "data": { + "exclusions": [ + { + "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", + "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", + "workspace_id": "11111111-2222-3333-4444-555555555555", + "entity_type": "input_guardrails", + "status": "active", + "created_by": "user_or_key_id", + "created_at": "2026-07-28T12:00:00.000Z", + "last_updated_at": "2026-07-28T12:00:00.000Z" + } + ] + } +} +``` + +## Related + +- [Update Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions) +- [List Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions) +- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx new file mode 100644 index 00000000..e3b74a43 --- /dev/null +++ b/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx @@ -0,0 +1,66 @@ +--- +title: "List Output Guardrail Exclusions" +description: "List workspaces excluded from organization-level output guardrails" +--- + +List active workspace exclusions for **organization-level output guardrails**. Optionally filter by a single workspace. + + + Requires an Admin API key. Organization Owners and Admins can list workspace exclusions. + + +## HTTP Request + +`GET https://api.portkey.ai/v1/workspace-exclusions/output-guardrails` + +## Query Parameters + + + Organization UUID. + + + + Optional workspace UUID or workspace slug. When provided, returns exclusions for that workspace only. + + +## Example Request + +```bash +curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6" \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" +``` + +### Filter by workspace + +```bash +curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6&workspace_id=ws-sandbox" \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" +``` + +## Example Response + +```json +{ + "success": true, + "data": { + "exclusions": [ + { + "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", + "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", + "workspace_id": "11111111-2222-3333-4444-555555555555", + "entity_type": "output_guardrails", + "status": "active", + "created_by": "user_or_key_id", + "created_at": "2026-07-28T12:00:00.000Z", + "last_updated_at": "2026-07-28T12:00:00.000Z" + } + ] + } +} +``` + +## Related + +- [Update Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions) +- [List Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions) +- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx new file mode 100644 index 00000000..9b16d526 --- /dev/null +++ b/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx @@ -0,0 +1,69 @@ +--- +title: "Update Input Guardrail Exclusions" +description: "Bulk update which workspaces are excluded from organization-level input guardrails" +--- + +Exclude or re-include workspaces from **organization-level input guardrails**. When a workspace is excluded, org default input guardrails are not applied to requests in that workspace. + + + Requires an Admin API key. Only Organization Owners and Admins can update workspace exclusions. + + +## HTTP Request + +`PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails` + +## Body Parameters + + + Organization UUID. + + + + List of workspace exclusion updates. Must contain at least one entry. Duplicate `workspace_id` values are rejected. + + + + Workspace UUID or workspace slug (for example, `ws-engineering`). + + + + Set to `true` to exclude the workspace from org-level input guardrails. Set to `false` to remove the exclusion and re-apply org defaults. + + + + When `true`, archives all existing active input-guardrail exclusions for the organization, then applies the provided `workspaces` list. When `false` (default), only the listed workspaces are upserted. + + +## Example Request + +```bash +curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{ + "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", + "workspaces": [ + { "workspace_id": "ws-sandbox", "excluded": true }, + { "workspace_id": "ws-staging", "excluded": false } + ], + "override_existing": false + }' +``` + +## Example Response + +```json +{ + "success": true, + "data": { + "message": "Workspace exclusions for input guardrails updated successfully" + } +} +``` + +## Related + +- [List Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions) +- [Update Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions) +- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx new file mode 100644 index 00000000..e434d3b1 --- /dev/null +++ b/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx @@ -0,0 +1,67 @@ +--- +title: "Update Output Guardrail Exclusions" +description: "Bulk update which workspaces are excluded from organization-level output guardrails" +--- + +Exclude or re-include workspaces from **organization-level output guardrails**. When a workspace is excluded, org default output guardrails are not applied to requests in that workspace. + + + Requires an Admin API key. Only Organization Owners and Admins can update workspace exclusions. + + +## HTTP Request + +`PUT https://api.portkey.ai/v1/workspace-exclusions/output-guardrails` + +## Body Parameters + + + Organization UUID. + + + + List of workspace exclusion updates. Must contain at least one entry. Duplicate `workspace_id` values are rejected. + + + + Workspace UUID or workspace slug (for example, `ws-engineering`). + + + + Set to `true` to exclude the workspace from org-level output guardrails. Set to `false` to remove the exclusion and re-apply org defaults. + + + + When `true`, archives all existing active output-guardrail exclusions for the organization, then applies the provided `workspaces` list. When `false` (default), only the listed workspaces are upserted. + + +## Example Request + +```bash +curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/output-guardrails \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{ + "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", + "workspaces": [ + { "workspace_id": "ws-sandbox", "excluded": true } + ] + }' +``` + +## Example Response + +```json +{ + "success": true, + "data": { + "message": "Workspace exclusions for output guardrails updated successfully" + } +} +``` + +## Related + +- [List Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions) +- [Update Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions) +- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/docs.json b/docs.json index 160e46f9..90e9e61c 100644 --- a/docs.json +++ b/docs.json @@ -1205,6 +1205,15 @@ "api-reference/admin-api/control-plane/guardrails/delete-guardrail" ] }, + { + "group": "Workspace Exclusions", + "pages": [ + "api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions" + ] + }, { "group": "Secret References", "pages": [ @@ -2254,6 +2263,15 @@ "api-reference/admin-api/control-plane/guardrails/delete-guardrail" ] }, + { + "group": "Workspace Exclusions", + "pages": [ + "api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions" + ] + }, { "group": "OpenAPI", "pages": [ diff --git a/product/administration/enforce-orgnization-level-guardrails.mdx b/product/administration/enforce-orgnization-level-guardrails.mdx index 79289fc8..ba17560f 100644 --- a/product/administration/enforce-orgnization-level-guardrails.mdx +++ b/product/administration/enforce-orgnization-level-guardrails.mdx @@ -1,38 +1,112 @@ --- title: "Enforcing Org Level Guardrails" +description: "Enforce organization-wide input and output guardrails, and exclude specific workspaces when needed" --- + ## Overview -Portkey enables organization owners to enforce request guardrails at the organization level. This feature ensures that all API requests made within the organization comply with predefined policies, enhancing security, compliance, and governance. + +Portkey enables organization owners and admins to enforce request guardrails at the organization level. This feature ensures that API requests made within the organization comply with predefined policies, enhancing security, compliance, and governance. ## How It Works -Organization owners can define input and output guardrails in the Organization Guardrails section. These guardrails are enforced on all API requests made within the organization, ensuring uniform policy enforcement across all users and applications. + +Organization owners can define input and output guardrails in the **Organisation Guardrails** section. By default, these guardrails are enforced on API requests across workspaces in the organization. - **Input Guardrails**: Define checks and constraints for incoming LLM requests. - **Output Guardrails**: Ensure LLM responses align with organizational policies. -The guardrails available here are the same as those found in the Guardrails section of the Portkey platform. Multiple providers are supported for setting up guardrails. For a detailed list of supported providers and configurations +The guardrails available here are the same as those found in the Guardrails section of the Portkey platform. Multiple providers are supported for setting up guardrails. - - Learn about the different Guardrails you can set up in Portkey + + Learn about the different Guardrails you can set up in Portkey - ## Configuration + ### Setting Up Guardrails Requirements + 1. Head to `Admin Settings` on the Portkey dashboard 2. Navigate to the `Organisation Guardrails` section 3. Add your `Input` and/or `Output` Guardrails 4. Save your changes -Once configured, these guardrails will be enforced on all API requests across the organization. +Once configured, these guardrails are enforced on API requests across the organization, unless a workspace is explicitly excluded (see below). + +## Workspace Exclusions + +Organization owners and admins can **exclude specific workspaces** from organization-level input and/or output guardrails. Exclusions are managed separately for input and output guardrails, so a workspace can opt out of one without opting out of the other. + +When a workspace is excluded from org-level input or output guardrails: + +- The corresponding organization default guardrails are **not applied** to requests in that workspace +- Workspace-level guardrails (if configured) continue to apply independently + +This is useful when a workspace needs a different compliance posture—for example, an internal sandbox that should not inherit production org defaults. + +### Managing Exclusions via API + +Use the Admin API to list and update workspace exclusions: + +| Action | Endpoint | +|--------|----------| +| Update input guardrail exclusions | `PUT /v1/workspace-exclusions/input-guardrails` | +| List input guardrail exclusions | `GET /v1/workspace-exclusions/input-guardrails` | +| Update output guardrail exclusions | `PUT /v1/workspace-exclusions/output-guardrails` | +| List output guardrail exclusions | `GET /v1/workspace-exclusions/output-guardrails` | + + + Exclude or include workspaces from org-level input guardrails + + + Exclude or include workspaces from org-level output guardrails + + +### Permissions + +| Action | Roles | +|--------|-------| +| Update workspace exclusions | Organization Owner, Organization Admin | +| List workspace exclusions | Organization Owner, Organization Admin | + +### Example: Exclude a workspace from org input guardrails + +```bash +curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{ + "organisation_id": "ORG_UUID", + "workspaces": [ + { "workspace_id": "ws-sandbox", "excluded": true } + ] + }' +``` + +To remove an exclusion (re-apply org defaults to the workspace), call the same endpoint with `"excluded": false`. -Best Practices -- Clearly communicate guardrail requirements to all developers in your organization. -- Maintain internal documentation on your guardrail policies to ensure consistency. +**How exclusions interact with workspace guardrails** + +Workspace exclusions only clear **organization-level** defaults for that workspace. They do not remove or disable [workspace-level guardrails](/product/administration/enforce-workspace-level-guardials). Configure those separately in workspace settings if needed. +## Related Features + + + Set default input and output guardrails for a specific workspace + + + + Control who can view and manage guardrails within workspaces + + +## Best Practices + +- Clearly communicate org-level guardrail requirements to developers in your organization. +- Use workspace exclusions sparingly, and document why a workspace is opted out. +- Prefer workspace-level guardrails when a team needs additional checks on top of org defaults, rather than excluding the workspace entirely. + ## Support -For questions about configuring metadata schemas or troubleshooting issues, contact [Portkey support](mailto:support@portkey.ai) or reach out on [Discord](https://portkey.sh/reddit-discord). + +For questions about configuring organization-level guardrails or troubleshooting issues, contact [Portkey support](mailto:support@portkey.ai) or reach out on [Discord](https://portkey.sh/reddit-discord). diff --git a/product/administration/enforce-workspace-level-guardials.mdx b/product/administration/enforce-workspace-level-guardials.mdx index e5a8cf5d..1f27e17a 100644 --- a/product/administration/enforce-workspace-level-guardials.mdx +++ b/product/administration/enforce-workspace-level-guardials.mdx @@ -5,6 +5,10 @@ title: "Enforcing Workspace Level Guardrails" ## Overview Portkey allows workspace owners to enforce request guardrails at the workspace level. This feature ensures that all API requests made within a workspace comply with predefined policies, enhancing security, compliance, and governance at a more granular level. + + Organization-level guardrails may also apply to your workspace. Org defaults are enforced unless the workspace is [explicitly excluded](/product/administration/enforce-orgnization-level-guardrails#workspace-exclusions) by an organization owner or admin. Workspace-level guardrails configured here still apply independently. + + ## How It Works Workspace owners can define input and output guardrails in the workspace settings. These guardrails are enforced on all API requests made within the workspace, ensuring uniform policy enforcement across all users and applications in that workspace. @@ -34,5 +38,11 @@ Once configured, these guardrails will be enforced on all API requests within th - Maintain internal documentation on your workspace guardrail policies to ensure consistency. +## Related Features + + + Apply organization-wide defaults, and exclude specific workspaces when needed + + ## Support For questions about configuring workspace-level guardrails or troubleshooting issues, contact [Portkey support](mailto:support@portkey.ai) or reach out on [Discord](https://portkey.sh/reddit-discord). From 897adbf09c26fbe607a0614a9c76210f29509db9 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 28 Jul 2026 16:03:25 +0000 Subject: [PATCH 2/4] docs: consolidate workspace exclusions API into update + list pages Merge the input/output-specific Admin API pages into a single update and list reference that documents both entity-type endpoints. Co-authored-by: Chandra Kiran G --- .../list-output-guardrail-exclusions.mdx | 66 ------------------ ...ions.mdx => list-workspace-exclusions.mdx} | 30 ++++++--- .../update-output-guardrail-exclusions.mdx | 67 ------------------- ...ns.mdx => update-workspace-exclusions.mdx} | 44 +++++++++--- docs.json | 12 ++-- .../enforce-orgnization-level-guardrails.mdx | 16 ++--- 6 files changed, 63 insertions(+), 172 deletions(-) delete mode 100644 api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx rename api-reference/admin-api/control-plane/workspace-exclusions/{list-input-guardrail-exclusions.mdx => list-workspace-exclusions.mdx} (61%) delete mode 100644 api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx rename api-reference/admin-api/control-plane/workspace-exclusions/{update-input-guardrail-exclusions.mdx => update-workspace-exclusions.mdx} (50%) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx deleted file mode 100644 index e3b74a43..00000000 --- a/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions.mdx +++ /dev/null @@ -1,66 +0,0 @@ ---- -title: "List Output Guardrail Exclusions" -description: "List workspaces excluded from organization-level output guardrails" ---- - -List active workspace exclusions for **organization-level output guardrails**. Optionally filter by a single workspace. - - - Requires an Admin API key. Organization Owners and Admins can list workspace exclusions. - - -## HTTP Request - -`GET https://api.portkey.ai/v1/workspace-exclusions/output-guardrails` - -## Query Parameters - - - Organization UUID. - - - - Optional workspace UUID or workspace slug. When provided, returns exclusions for that workspace only. - - -## Example Request - -```bash -curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6" \ - -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" -``` - -### Filter by workspace - -```bash -curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6&workspace_id=ws-sandbox" \ - -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" -``` - -## Example Response - -```json -{ - "success": true, - "data": { - "exclusions": [ - { - "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", - "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", - "workspace_id": "11111111-2222-3333-4444-555555555555", - "entity_type": "output_guardrails", - "status": "active", - "created_by": "user_or_key_id", - "created_at": "2026-07-28T12:00:00.000Z", - "last_updated_at": "2026-07-28T12:00:00.000Z" - } - ] - } -} -``` - -## Related - -- [Update Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions) -- [List Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions) -- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx similarity index 61% rename from api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx rename to api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx index 93dea612..afb8a557 100644 --- a/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions.mdx +++ b/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx @@ -1,18 +1,23 @@ --- -title: "List Input Guardrail Exclusions" -description: "List workspaces excluded from organization-level input guardrails" +title: "List Workspace Exclusions" +description: "List workspaces excluded from organization-level input or output guardrails" --- -List active workspace exclusions for **organization-level input guardrails**. Optionally filter by a single workspace. +List active workspace exclusions for **organization-level input or output guardrails**. Optionally filter by a single workspace. + +Choose the path based on which exclusions you want to list: + +| Entity | Endpoint | +|--------|----------| +| Input guardrails | `GET /v1/workspace-exclusions/input-guardrails` | +| Output guardrails | `GET /v1/workspace-exclusions/output-guardrails` | + +Query parameters and response shape are the same for both. Requires an Admin API key. Organization Owners and Admins can list workspace exclusions. -## HTTP Request - -`GET https://api.portkey.ai/v1/workspace-exclusions/input-guardrails` - ## Query Parameters @@ -25,15 +30,17 @@ List active workspace exclusions for **organization-level input guardrails**. Op ## Example Request +### List input guardrail exclusions + ```bash curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/input-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6" \ -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" ``` -### Filter by workspace +### List output guardrail exclusions for one workspace ```bash -curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/input-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6&workspace_id=ws-sandbox" \ +curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6&workspace_id=ws-sandbox" \ -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" ``` @@ -59,8 +66,9 @@ curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/input-guardrails?org } ``` +`entity_type` is `input_guardrails` or `output_guardrails`, matching the endpoint you called. + ## Related -- [Update Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions) -- [List Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions) +- [Update Workspace Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions) - [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx deleted file mode 100644 index e434d3b1..00000000 --- a/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions.mdx +++ /dev/null @@ -1,67 +0,0 @@ ---- -title: "Update Output Guardrail Exclusions" -description: "Bulk update which workspaces are excluded from organization-level output guardrails" ---- - -Exclude or re-include workspaces from **organization-level output guardrails**. When a workspace is excluded, org default output guardrails are not applied to requests in that workspace. - - - Requires an Admin API key. Only Organization Owners and Admins can update workspace exclusions. - - -## HTTP Request - -`PUT https://api.portkey.ai/v1/workspace-exclusions/output-guardrails` - -## Body Parameters - - - Organization UUID. - - - - List of workspace exclusion updates. Must contain at least one entry. Duplicate `workspace_id` values are rejected. - - - - Workspace UUID or workspace slug (for example, `ws-engineering`). - - - - Set to `true` to exclude the workspace from org-level output guardrails. Set to `false` to remove the exclusion and re-apply org defaults. - - - - When `true`, archives all existing active output-guardrail exclusions for the organization, then applies the provided `workspaces` list. When `false` (default), only the listed workspaces are upserted. - - -## Example Request - -```bash -curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/output-guardrails \ - -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \ - -H "Content-Type: application/json" \ - -d '{ - "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", - "workspaces": [ - { "workspace_id": "ws-sandbox", "excluded": true } - ] - }' -``` - -## Example Response - -```json -{ - "success": true, - "data": { - "message": "Workspace exclusions for output guardrails updated successfully" - } -} -``` - -## Related - -- [List Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions) -- [Update Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions) -- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx similarity index 50% rename from api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx rename to api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx index 9b16d526..ca11b688 100644 --- a/api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions.mdx +++ b/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx @@ -1,18 +1,23 @@ --- -title: "Update Input Guardrail Exclusions" -description: "Bulk update which workspaces are excluded from organization-level input guardrails" +title: "Update Workspace Exclusions" +description: "Bulk update which workspaces are excluded from organization-level input or output guardrails" --- -Exclude or re-include workspaces from **organization-level input guardrails**. When a workspace is excluded, org default input guardrails are not applied to requests in that workspace. +Exclude or re-include workspaces from **organization-level input or output guardrails**. When a workspace is excluded, the corresponding org default guardrails are not applied to requests in that workspace. + +Choose the path based on which org-level defaults you want to change: + +| Entity | Endpoint | +|--------|----------| +| Input guardrails | `PUT /v1/workspace-exclusions/input-guardrails` | +| Output guardrails | `PUT /v1/workspace-exclusions/output-guardrails` | + +Request body, validation, and response shape are the same for both. Requires an Admin API key. Only Organization Owners and Admins can update workspace exclusions. -## HTTP Request - -`PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails` - ## Body Parameters @@ -28,15 +33,17 @@ Exclude or re-include workspaces from **organization-level input guardrails**. W - Set to `true` to exclude the workspace from org-level input guardrails. Set to `false` to remove the exclusion and re-apply org defaults. + Set to `true` to exclude the workspace from the selected org-level guardrails. Set to `false` to remove the exclusion and re-apply org defaults. - When `true`, archives all existing active input-guardrail exclusions for the organization, then applies the provided `workspaces` list. When `false` (default), only the listed workspaces are upserted. + When `true`, archives all existing active exclusions for that entity type in the organization, then applies the provided `workspaces` list. When `false` (default), only the listed workspaces are upserted. ## Example Request +### Exclude a workspace from org input guardrails + ```bash curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \ -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \ @@ -51,6 +58,20 @@ curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \ }' ``` +### Exclude a workspace from org output guardrails + +```bash +curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/output-guardrails \ + -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{ + "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6", + "workspaces": [ + { "workspace_id": "ws-sandbox", "excluded": true } + ] + }' +``` + ## Example Response ```json @@ -62,8 +83,9 @@ curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \ } ``` +The `message` text reflects the entity type you updated (`input guardrails` or `output guardrails`). + ## Related -- [List Input Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions) -- [Update Output Guardrail Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions) +- [List Workspace Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions) - [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) diff --git a/docs.json b/docs.json index 90e9e61c..0476e35c 100644 --- a/docs.json +++ b/docs.json @@ -1208,10 +1208,8 @@ { "group": "Workspace Exclusions", "pages": [ - "api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions", - "api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions", - "api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions", - "api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions" + "api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions" ] }, { @@ -2266,10 +2264,8 @@ { "group": "Workspace Exclusions", "pages": [ - "api-reference/admin-api/control-plane/workspace-exclusions/update-input-guardrail-exclusions", - "api-reference/admin-api/control-plane/workspace-exclusions/list-input-guardrail-exclusions", - "api-reference/admin-api/control-plane/workspace-exclusions/update-output-guardrail-exclusions", - "api-reference/admin-api/control-plane/workspace-exclusions/list-output-guardrail-exclusions" + "api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions", + "api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions" ] }, { diff --git a/product/administration/enforce-orgnization-level-guardrails.mdx b/product/administration/enforce-orgnization-level-guardrails.mdx index ba17560f..3bbbe9ee 100644 --- a/product/administration/enforce-orgnization-level-guardrails.mdx +++ b/product/administration/enforce-orgnization-level-guardrails.mdx @@ -44,21 +44,19 @@ This is useful when a workspace needs a different compliance posture—for examp ### Managing Exclusions via API -Use the Admin API to list and update workspace exclusions: +Use the Admin API to list and update workspace exclusions. Paths differ by entity type (`input-guardrails` or `output-guardrails`): | Action | Endpoint | |--------|----------| -| Update input guardrail exclusions | `PUT /v1/workspace-exclusions/input-guardrails` | -| List input guardrail exclusions | `GET /v1/workspace-exclusions/input-guardrails` | -| Update output guardrail exclusions | `PUT /v1/workspace-exclusions/output-guardrails` | -| List output guardrail exclusions | `GET /v1/workspace-exclusions/output-guardrails` | +| Update exclusions | `PUT /v1/workspace-exclusions/input-guardrails` or `.../output-guardrails` | +| List exclusions | `GET /v1/workspace-exclusions/input-guardrails` or `.../output-guardrails` | - - Exclude or include workspaces from org-level input guardrails + + Exclude or include workspaces from org-level input or output guardrails - - Exclude or include workspaces from org-level output guardrails + + List workspaces excluded from org-level input or output guardrails From 4f807d892feee840ab0ce7d284aa579128a6623d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 28 Jul 2026 16:09:20 +0000 Subject: [PATCH 3/4] docs: add GET/PUT method badges for workspace exclusions API Use Mintlify api frontmatter so the Admin API sidebar shows method tags for the update and list workspace exclusions pages. Co-authored-by: Chandra Kiran G --- .../workspace-exclusions/list-workspace-exclusions.mdx | 2 ++ .../workspace-exclusions/update-workspace-exclusions.mdx | 2 ++ 2 files changed, 4 insertions(+) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx index afb8a557..b57c3447 100644 --- a/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx +++ b/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx @@ -1,6 +1,8 @@ --- title: "List Workspace Exclusions" description: "List workspaces excluded from organization-level input or output guardrails" +api: "GET https://api.portkey.ai/v1/workspace-exclusions/input-guardrails" +playground: none --- List active workspace exclusions for **organization-level input or output guardrails**. Optionally filter by a single workspace. diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx index ca11b688..589fb1bd 100644 --- a/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx +++ b/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx @@ -1,6 +1,8 @@ --- title: "Update Workspace Exclusions" description: "Bulk update which workspaces are excluded from organization-level input or output guardrails" +api: "PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails" +playground: none --- Exclude or re-include workspaces from **organization-level input or output guardrails**. When a workspace is excluded, the corresponding org default guardrails are not applied to requests in that workspace. From 7dd4cfc669920e99a85d320ed50a245e231f0a48 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 28 Jul 2026 16:12:07 +0000 Subject: [PATCH 4/4] docs: document organisation_exclusions API key scopes Add organisation_exclusions.update and .list to Admin API key scopes and call them out on the workspace exclusions product and API pages. Co-authored-by: Chandra Kiran G --- .../workspace-exclusions/list-workspace-exclusions.mdx | 3 ++- .../update-workspace-exclusions.mdx | 3 ++- .../enforce-orgnization-level-guardrails.mdx | 10 ++++++---- .../org-management/api-keys-authn-and-authz.mdx | 2 ++ 4 files changed, 12 insertions(+), 6 deletions(-) diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx index b57c3447..1d4e0306 100644 --- a/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx +++ b/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx @@ -17,7 +17,7 @@ Choose the path based on which exclusions you want to list: Query parameters and response shape are the same for both. - Requires an Admin API key. Organization Owners and Admins can list workspace exclusions. + Requires an Admin API key (`organisation-service`) with the `organisation_exclusions.list` scope. Only Organization Owners and Admins can be granted this scope. ## Query Parameters @@ -74,3 +74,4 @@ curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?or - [Update Workspace Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions) - [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) +- [API Keys (AuthN and AuthZ)](/product/enterprise-offering/org-management/api-keys-authn-and-authz) — includes `organisation_exclusions.update` / `.list` diff --git a/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx b/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx index 589fb1bd..f44c2153 100644 --- a/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx +++ b/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx @@ -17,7 +17,7 @@ Choose the path based on which org-level defaults you want to change: Request body, validation, and response shape are the same for both. - Requires an Admin API key. Only Organization Owners and Admins can update workspace exclusions. + Requires an Admin API key (`organisation-service`) with the `organisation_exclusions.update` scope. Only Organization Owners and Admins can be granted this scope. ## Body Parameters @@ -91,3 +91,4 @@ The `message` text reflects the entity type you updated (`input guardrails` or ` - [List Workspace Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions) - [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails) +- [API Keys (AuthN and AuthZ)](/product/enterprise-offering/org-management/api-keys-authn-and-authz) — includes `organisation_exclusions.update` / `.list` diff --git a/product/administration/enforce-orgnization-level-guardrails.mdx b/product/administration/enforce-orgnization-level-guardrails.mdx index 3bbbe9ee..1dbae2f9 100644 --- a/product/administration/enforce-orgnization-level-guardrails.mdx +++ b/product/administration/enforce-orgnization-level-guardrails.mdx @@ -62,10 +62,12 @@ Use the Admin API to list and update workspace exclusions. Paths differ by entit ### Permissions -| Action | Roles | -|--------|-------| -| Update workspace exclusions | Organization Owner, Organization Admin | -| List workspace exclusions | Organization Owner, Organization Admin | +| Action | Roles | API scope | +|--------|-------|-----------| +| Update workspace exclusions | Organization Owner, Organization Admin | `organisation_exclusions.update` | +| List workspace exclusions | Organization Owner, Organization Admin | `organisation_exclusions.list` | + +These scopes are available on **Admin (organisation-service) API keys** only. See [API Keys (AuthN and AuthZ)](/product/enterprise-offering/org-management/api-keys-authn-and-authz) for the full scope list. ### Example: Exclude a workspace from org input guardrails diff --git a/product/enterprise-offering/org-management/api-keys-authn-and-authz.mdx b/product/enterprise-offering/org-management/api-keys-authn-and-authz.mdx index 7cd796f8..cf342676 100644 --- a/product/enterprise-offering/org-management/api-keys-authn-and-authz.mdx +++ b/product/enterprise-offering/org-management/api-keys-authn-and-authz.mdx @@ -53,6 +53,8 @@ Admin API Keys should be carefully managed and their use should be limited to ne | `secret_references.update` | Modify secret references | | `secret_references.delete` | Delete secret references | | `secret_references.list` | List secret references | + | `organisation_exclusions.update` | Update organisation workspace exclusions (for example, org-level guardrail exclusions) | + | `organisation_exclusions.list` | List organisation workspace exclusions |