uip guardrails

Syntax and options for `uip guardrails byo-configurations`, which manages bring-your-own (BYOG) guardrail configurations for UiPath AI Trust Layer.

uip guardrails manages bring-your-own guardrail (BYOG) configurations for UiPath AI Trust Layer — wiring a tenant's own content-safety/validation connector (for example, Azure AI Content Safety) into a named guardrail a coded agent can reference by alias. There is one command group, byo-configurations. This corresponds to Admin → AI Trust Layer → Guardrails Configurations in the UI.

See uip llm-gateway for the LLM model discovery API some guardrail validators (e.g. LLM-as-judge) route through.

Konzepte

• Configuration vs. validator. A validator (--validator-type, e.g. pii_detection) is a capability a connector exposes — discover them with list-validators. A configuration wraps one validator with a connection and a tenant-unique alias (--validator-name) that a coded agent's ByoValidator(...) call references; ValidatorName/ValidatorType are locked at creation, so change either by deleting and re-creating.
• Probe-before-save. create always probes the connection/validator pair first and aborts if the probe fails — there is no skip flag, because the backend persists whatever connection ID it's given without validating it itself. update only re-probes when --connection-id changes; changing just --fallback-on-ui-path or enabled/disabled state does not re-probe, so a configuration whose vendor is currently down can still be disabled.
• --fallback-on-ui-path (default false) — if set, a failed BYO call falls back to UiPath's own built-in guardrail instead of failing the request.
• Feature gating. If BYOG isn't enabled for the tenant, every verb fails with Code: "ByoGuardrailsUnavailable" and points you at UiPath support.

Zusammenfassung

uip guardrails byo-configurations list
uip guardrails byo-configurations create --connection-id <guid> --validator-name <name> --validator-type <type> [--fallback-on-ui-path] [--disabled]
uip guardrails byo-configurations update <configuration-id> [--connection-id <guid>] [--fallback-on-ui-path | --no-fallback-on-ui-path] [--enabled | --disabled]
uip guardrails byo-configurations delete <configuration-id> --force
uip guardrails byo-configurations probe --connection-id <guid> --validator-type <type>
uip guardrails byo-configurations list-validators --connection-id <guid>

All verbs also accept --login-validity <minutes> (override the interactive-login token lifetime).

uip guardrails byo-configurations list

List BYOG configurations for the authenticated tenant, including connection/connector details.

Beispiel

uip guardrails byo-configurations list

Datenform (--output json)

{
  "Code": "ByoGuardrailConfigurationsList",
  "Data": [
    {
      "Id": "e5723bb8-fbc2-4317-c7d7-08de803bc010",
      "ConnectionId": "18fb337c-29b7-4162-a9e8-0c05b01cf4df",
      "ValidatorName": "my-pii-guardrail",
      "ValidatorType": "pii_detection",
      "FallbackOnUiPath": true,
      "Enabled": true,
      "CreatedAt": "2026-07-01T10:00:00Z",
      "UpdatedAt": null,
      "ConnectorKey": "uipath-azure-contentsafety",
      "ConnectorName": "Azure AI Content Safety",
      "ConnectionName": "My Content Safety Connection",
      "ValidConnection": true
    }
  ]
}

ValidatorName is the tenant-chosen alias; ValidatorType is the raw validator ID. ValidConnection reflects whether the underlying Integration Service connection currently resolves.

uip guardrails byo-configurations create

Create a BYOG configuration. Always probes the connection/validator pair first (see Concepts) — the create is aborted with the probe's own failure if it doesn't pass.

Argumente

None — everything is passed via options.

Optionen

Long	Wert	Erforderlich	Beschreibung
--connection-id <guid>	GUID	ja	Integration Service connection the guardrail calls through.
--validator-name <name>	string	ja	Tenant-unique alias — what a coded agent passes to ByoValidator(...).
--validator-type <type>	string	ja	Raw validator ID, e.g. pii_detection. Discover valid values with list-validators.
--fallback-on-ui-path	Markieren	nein	Fall back to the UiPath built-in guardrail if the BYO call fails. Default false.
--disabled	Markieren	nein	Save the configuration disabled. Default is enabled.
--login-validity <minutes>	Integer	nein	Override the interactive-login token lifetime.

Beispiel

uip guardrails byo-configurations create \
  --connection-id 18fb337c-29b7-4162-a9e8-0c05b01cf4df \
  --validator-name my-pii-guardrail --validator-type pii_detection

Datenform (--output json)

{
  "Code": "ByoGuardrailConfigurationCreated",
  "Data": {
    "Id": "e5723bb8-fbc2-4317-c7d7-08de803bc010",
    "ConnectionId": "18fb337c-29b7-4162-a9e8-0c05b01cf4df",
    "ValidatorName": "my-pii-guardrail",
    "ValidatorType": "pii_detection",
    "FallbackOnUiPath": false,
    "Enabled": true,
    "CreatedAt": "2026-07-01T10:00:00Z",
    "UpdatedAt": null,
    "ConnectorKey": null,
    "ConnectorName": null,
    "ConnectionName": null,
    "ValidConnection": null
  }
}

The connector/connection detail fields (ConnectorKey, ConnectorName, ConnectionName, ValidConnection) are null on create — they're populated on list, which joins against the connection at read time.

uip guardrails byo-configurations update

Update the connection, fallback behavior, or enabled state of an existing configuration. ValidatorName/ValidatorType cannot be changed — delete and re-create instead.

Argumente

Name	Erforderlich	Zweck
<configuration-id>	ja	BYOG configuration GUID, from list.

Optionen

Long	Wert	Beschreibung
--connection-id <guid>	GUID	New connection. Re-probes the pair before saving — aborts on probe failure.
--fallback-on-ui-path / --no-fallback-on-ui-path	Markieren	Set or clear the fallback flag.
--enabled / --disabled	Markieren	Mutually exclusive — enable or disable the configuration.
--login-validity <minutes>	Integer	Override the interactive-login token lifetime.

At least one of --connection-id, --fallback-on-ui-path/--no-fallback-on-ui-path, or --enabled/--disabled is required — omitting all of them fails client-side before any lookup.

Beispiel

uip guardrails byo-configurations update e5723bb8-fbc2-4317-c7d7-08de803bc010 \
  --connection-id 24887687-1234-4abc-9def-012345678901

Datenform (--output json)

Same shape as create's response, with UpdatedAt now set.

uip guardrails byo-configurations delete

Permanently delete a BYOG configuration.

Argumente

Name	Erforderlich	Zweck
<configuration-id>	ja	BYOG configuration GUID, from list.

Optionen

Long	Wert	Erforderlich	Beschreibung
--force	Markieren	ja	Skip the confirmation guard. Omitting it fails with an explicit "Refusing to delete without --force" error — deletion is otherwise permanent.
--login-validity <minutes>	Integer	nein	Override the interactive-login token lifetime.

Beispiel

uip guardrails byo-configurations delete e5723bb8-fbc2-4317-c7d7-08de803bc010 --force

Datenform (--output json)

{ "Code": "ByoGuardrailConfigurationDeleted", "Data": { "Id": "e5723bb8-fbc2-4317-c7d7-08de803bc010" } }

uip guardrails byo-configurations probe

Test whether a connection can serve a validator, without creating or saving anything. The backend asks the connector for its validators, then evaluates a benign test input using the validator's default parameters.

Optionen

Long	Wert	Erforderlich	Beschreibung
--connection-id <guid>	GUID	ja	Integration Service connection to test.
--validator-type <type>	string	ja	Validator ID to test. Discover values with list-validators.
--login-validity <minutes>	Integer	nein	Override the interactive-login token lifetime.

Beispiel

uip guardrails byo-configurations probe \
  --connection-id 18fb337c-29b7-4162-a9e8-0c05b01cf4df --validator-type pii_detection

Datenform (--output json)

{
  "Code": "ByoGuardrailProbeSucceeded",
  "Data": {
    "ConnectionId": "18fb337c-29b7-4162-a9e8-0c05b01cf4df",
    "ValidatorType": "pii_detection",
    "ConnectorKey": "uipath-azure-contentsafety",
    "IsAvailable": true,
    "Verdict": "PASSED",
    "Details": null,
    "DurationMs": 842,
    "Error": null
  }
}

IsAvailable (not Verdict) is what gates success/failure — Verdict is the vendor's evaluation of the benign test input, so "PASSED" and "FAILED" both mean the connector answered. The command exits 1 when IsAvailable is false, with Code: "ByoGuardrailProbeFailed" and the same Data shape attached to the failure envelope.

uip guardrails byo-configurations list-validators

List the validators an Integration Service connection exposes. Every Validator value returned is a valid --validator-type for probe and create.

Optionen

Long	Wert	Erforderlich	Beschreibung
--connection-id <guid>	GUID	ja	Connection to inspect.
--login-validity <minutes>	Integer	nein	Override the interactive-login token lifetime.

Beispiel

uip guardrails byo-configurations list-validators --connection-id 18fb337c-29b7-4162-a9e8-0c05b01cf4df

Datenform (--output json)

{
  "Code": "ByoGuardrailValidatorsList",
  "Data": [
    {
      "Validator": "pii_detection",
      "DisplayName": "PII detection",
      "Description": null,
      "Status": "Available",
      "AllowedScopes": ["Agent", "Llm", "Tool"],
      "PayloadMinSizeLimit": null,
      "PayloadMaxSizeLimit": 10000
    }
  ]
}

Fehlerverhalten

• BYOG not enabled for the tenant: Code: "ByoGuardrailsUnavailable", pointing you at UiPath support.
• Unknown configuration ID: Code: "ByoGuardrailConfigurationNotFound", pointing you at list.
• A probe that runs successfully but finds the pair unusable: Code: "ByoGuardrailProbeFailed", exit 1, with the probe result still attached under Data for scripts to inspect.
• delete without --force: fails before any network call.

Siehe auch

• uip llm-gateway — LLM model discovery, used by LLM-as-judge-style validators.
• uip is connections — Integration Service connections referenced by --connection-id.
• Tools (Plugins)
• Globale Optionen
• Exitcodes