Create guardrails and assign them to your API keys — budgets, model and provider lists, and content filters.
A guardrail is a set of rules you put on your API keys: a budget in DA, the models that may run, the providers that may serve, zero data retention per lab, and content filters. It binds only the keys it is assigned to.
Every guardrail route is free and takes a management key. The Go client has no guardrails resource, so call the routes with net/http.
body, _ := json.Marshal(map[string]any{
"name": "Souk Bot production",
"limit": 500, // budget in DA
"reset_interval": "monthly",
"allowed_models": []string{"anthropic/claude-sonnet-5"},
"content_filter_builtins": []map[string]string{{"slug": "email", "action": "redact"}},
})
req, _ := http.NewRequest("POST", "https://opendunes.com/v1/guardrails", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
// 201 — resp body: { "data": { "id": "…", "name": "Souk Bot production", "limit": 500, … } }Keys are named by their hash — the hash the API keys routes return.
body, _ := json.Marshal(map[string]any{"key_hashes": []string{keyHash}})
req, _ := http.NewRequest("POST",
"https://opendunes.com/v1/guardrails/"+guardrailID+"/assignments/keys", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("OPENDUNES_MANAGEMENT_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
// → { "assigned_count": 1 }…/assignments/keys/remove takes the same body and unassigns.
A request the guardrail blocks answers 403 before it reaches a model, and nothing is charged. A spent budget answers 402 with limit_source: "guardrail".