You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|`portkey_workspace`| ✅ | ✅ | ✅ | ⚠️ | ✅ | Delete requires name in body | ⚠️ 10 tests, delete blocked by backend |
23
+
|`portkey_workspace_defaults`| ✅ | ✅ | ✅ | ⚠️ | ✅ | Default input/output guardrails live on the workspace; written via PUT `/admin/workspaces/{id}``defaults`. Create omits unset fields (preserves existing guardrails); Update treats a removed field as a clear. No reset endpoint — Delete clears both lists | ✅ Unit + acc tests |
23
24
|`portkey_workspace_member`| ✅ | ⚠️ | ✅ | ✅ | ✅ | getMember API has issues | Skipped |
24
25
|`portkey_workspace_security_settings`| ✅ | ✅ | ✅ | ⚠️ | ✅ | API requires full 35-field object on PUT (sparse rejected as 400 AB01); Delete removes state only, no API reset endpoint exists | ✅ 2 acc tests (basic + partial-preserves-others) |
To clear limits, simply remove the `usage_limits` or `rate_limits` blocks from your config and re-apply.
63
63
64
+
To attach default input/output guardrails to a workspace, use the [`portkey_workspace_defaults`](workspace_defaults.md) resource. Guardrails are exposed as a separate resource because the Portkey Admin API requires guardrails to live in the target workspace, which creates an unresolvable Terraform DAG cycle if they were an attribute on `portkey_workspace`.
Manages default input/output guardrails for a Portkey workspace.
6
+
---
7
+
8
+
# portkey_workspace_defaults (Resource)
9
+
10
+
Manages default input/output guardrails for a Portkey workspace. Every request routed through the workspace's API keys will pass through the configured guardrails in order.
11
+
12
+
This resource is separate from `portkey_workspace` because the Portkey Admin API requires guardrails to live in the target workspace they are attached to. Modeling guardrails as an attribute on `portkey_workspace` would create an unresolvable Terraform DAG cycle when the workspace, guardrails, and attachment are all managed in a single config. Exactly one `portkey_workspace_defaults` may exist per workspace.
13
+
14
+
## Example Usage
15
+
16
+
```terraform
17
+
resource "portkey_workspace" "prod" {
18
+
name = "Production"
19
+
description = "Prod workspace"
20
+
}
21
+
22
+
resource "portkey_guardrail" "pii" {
23
+
name = "pii-check"
24
+
workspace_id = portkey_workspace.prod.id
25
+
checks = jsonencode([{
26
+
id = "default.wordCount"
27
+
parameters = {
28
+
minWords = 1
29
+
maxWords = 4000
30
+
}
31
+
}])
32
+
actions = jsonencode({
33
+
onFail = "log"
34
+
message = "guardrail triggered"
35
+
})
36
+
}
37
+
38
+
resource "portkey_workspace_defaults" "prod" {
39
+
workspace_id = portkey_workspace.prod.id
40
+
input_guardrails = [portkey_guardrail.pii.slug]
41
+
output_guardrails = [portkey_guardrail.pii.slug]
42
+
}
43
+
```
44
+
45
+
~> **Note:** Reference guardrails by `slug` for stable plans. The Admin API accepts either guardrail IDs or slugs on write but returns slugs on read (under admin-API-key auth), so state will always contain slugs. Storing `portkey_guardrail.foo.slug` keeps state and HCL in sync; using `portkey_guardrail.foo.id` (a UUID) produces a permanent plan diff.
46
+
47
+
~> **Note:** Setting either list to `[]`**always** clears all attached guardrails of that kind. Omitting the attribute, however, behaves differently on create versus update (see below).
48
+
49
+
-**On create** (including the first `apply` when adopting this resource against a workspace that already has guardrails — for example, ones attached through the Portkey UI), an omitted attribute is **not** sent to the API, so any existing guardrails of that kind are **preserved**, not cleared. To clear on create, set the attribute explicitly to `[]`.
50
+
-**On update**, removing an attribute you previously managed **clears** that kind (it is treated as an explicit removal). If the attribute was never set, omitting it stays a no-op.
51
+
52
+
Destroying the resource clears both lists via the workspace update endpoint; there is no separate delete endpoint for workspace defaults.
53
+
54
+
## Schema
55
+
56
+
### Required
57
+
58
+
-`workspace_id` (String) ID or slug of the workspace to configure defaults for.
59
+
60
+
### Optional
61
+
62
+
-`input_guardrails` (List of String) Guardrails applied to inbound requests, as a list of guardrail slugs (or IDs — the API accepts both). The API returns slugs on read under admin-API-key auth, so prefer `portkey_guardrail.foo.slug` in HCL to avoid a permanent plan diff. Setting to `[]` clears all input guardrails.
63
+
-`output_guardrails` (List of String) Guardrails applied to model responses, as a list of guardrail slugs (or IDs — the API accepts both). The API returns slugs on read under admin-API-key auth, so prefer `portkey_guardrail.foo.slug` in HCL to avoid a permanent plan diff. Setting to `[]` clears all output guardrails.
64
+
65
+
### Read-Only
66
+
67
+
-`id` (String) Resource identifier. Equal to `workspace_id`.
0 commit comments