chore: update OpenAPI spec from monorepo

.speakeasy/in.openapi.yaml

@@ -14968,6 +14968,82 @@ components:
         - 'code'
         - 'message'
       type: 'object'
+    OAuthErrorResponse:
+      description: 'RFC 6749 §5.2 error response.'
+      example:
+        error: 'invalid_grant'
+        error_description: 'The subject token was not accepted.'
+      properties:
+        error:
+          enum:
+            - 'invalid_request'
+            - 'invalid_grant'
+            - 'unsupported_grant_type'
+            - 'invalid_scope'
+            - 'server_error'
+            - 'temporarily_unavailable'
+          type: 'string'
+        error_description:
+          type: 'string'
+      required:
+        - 'error'
+        - 'error_description'
+      type: 'object'
+    OAuthJwks:
+      description: 'RFC 7517 JWK Set of the keys OpenRouter signs access tokens with.'
+      example:
+        keys:
+          - alg: 'ES256'
+            crv: 'P-256'
+            kid: 'or-2026-09'
+            kty: 'EC'
+            use: 'sig'
+            x: 'f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU'
+            'y': 'x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0'
+      properties:
+        keys:
+          items:
+            additionalProperties: false
+            properties:
+              alg:
+                enum:
+                  - 'ES256'
+                type: 'string'
+              crv:
+                enum:
+                  - 'P-256'
+                type: 'string'
+              kid:
+                minLength: 1
+                type: 'string'
+              kty:
+                enum:
+                  - 'EC'
+                type: 'string'
+              use:
+                enum:
+                  - 'sig'
+                type: 'string'
+              x:
+                pattern: '^[A-Za-z0-9_-]+$'
+                type: 'string'
+              'y':
+                pattern: '^[A-Za-z0-9_-]+$'
+                type: 'string'
+            required:
+              - 'kty'
+              - 'crv'
+              - 'kid'
+              - 'x'
+              - 'y'
+              - 'alg'
+              - 'use'
+            type: 'object'
+          minItems: 1
+          type: 'array'
+      required:
+        - 'keys'
+      type: 'object'
     ObservabilityArizeDestination:
       example:
         api_key_hashes: null
@@ -24945,6 +25021,92 @@ components:
       example:
         format:
           type: 'text'
+    TokenExchangeRequest:
+      description: 'RFC 8693 token exchange request body (application/x-www-form-urlencoded).'
+      example:
+        federation_policy_id: '4b2f7d1e-8c3a-4e5f-9a6b-1c2d3e4f5a6b'
+        grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange'
+        subject_token: '<jwt from your identity provider>'
+        subject_token_type: 'urn:ietf:params:oauth:token-type:jwt'
+      properties:
+        federation_policy_id:
+          description: 'The federation policy to evaluate, from Settings → Workload identity. Binds the exchange to one organization.'
+          example: '4b2f7d1e-8c3a-4e5f-9a6b-1c2d3e4f5a6b'
+          format: 'uuid'
+          type: 'string'
+        grant_type:
+          description: 'Must be `urn:ietf:params:oauth:grant-type:token-exchange`.'
+          enum:
+            - 'urn:ietf:params:oauth:grant-type:token-exchange'
+          example: 'urn:ietf:params:oauth:grant-type:token-exchange'
+          type: 'string'
+        requested_token_type:
+          description: 'Optional; when present must be `urn:ietf:params:oauth:token-type:access_token`.'
+          enum:
+            - 'urn:ietf:params:oauth:token-type:access_token'
+          example: 'urn:ietf:params:oauth:token-type:access_token'
+          type: 'string'
+        scope:
+          description: 'Optional; only `inference` is available.'
+          enum:
+            - 'inference'
+          example: 'inference'
+          type: 'string'
+        subject_token:
+          description: 'The JWT issued by your identity provider.'
+          example: '<jwt from your identity provider>'
+          maxLength: 16384
+          minLength: 1
+          type: 'string'
+        subject_token_type:
+          description: 'Must be `urn:ietf:params:oauth:token-type:jwt`.'
+          enum:
+            - 'urn:ietf:params:oauth:token-type:jwt'
+          example: 'urn:ietf:params:oauth:token-type:jwt'
+          type: 'string'
+      required:
+        - 'grant_type'
+        - 'subject_token'
+        - 'federation_policy_id'
+        - 'subject_token_type'
+      type: 'object'
+    TokenExchangeResponse:
+      description: 'RFC 8693 token exchange response.'
+      example:
+        access_token: '<short-lived openrouter access token jwt>'
+        expires_in: 900
+        issued_token_type: 'urn:ietf:params:oauth:token-type:access_token'
+        scope: 'inference'
+        token_type: 'Bearer'
+      properties:
+        access_token:
+          description: 'A short-lived JWT to send as `Authorization: Bearer` to the inference API.'
+          example: '<short-lived openrouter access token jwt>'
+          type: 'string'
+        expires_in:
+          description: 'Seconds until the access token expires: at most 15 minutes, and never later than the subject token expires.'
+          example: 900
+          type: 'integer'
+        issued_token_type:
+          enum:
+            - 'urn:ietf:params:oauth:token-type:access_token'
+          example: 'urn:ietf:params:oauth:token-type:access_token'
+          type: 'string'
+        scope:
+          example: 'inference'
+          type: 'string'
+        token_type:
+          enum:
+            - 'Bearer'
+          example: 'Bearer'
+          type: 'string'
+      required:
+        - 'access_token'
+        - 'issued_token_type'
+        - 'token_type'
+        - 'expires_in'
+        - 'scope'
+      type: 'object'
     ToolCallStatus:
       enum:
         - 'in_progress'
@@ -36197,6 +36359,70 @@ paths:
         outputs:
           results: '$.data'
         type: 'offsetLimit'
+  /oauth/jwks:
+    get:
+      description: 'RFC 7517 JWK Set containing the public keys OpenRouter signs access tokens with.'
+      operationId: 'listOauthJwks'
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthJwks'
+          description: 'JWK Set'
+        '500':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/InternalServerResponse'
+          description: 'Signing keys are not configured'
+      summary: 'OpenRouter access token signing keys'
+      tags:
+        - 'OAuth'
+  /oauth/token:
+    post:
+      description: 'RFC 8693 token exchange. Presents a JWT from an issuer your organization trusts (Settings → Workload identity) and receives a short-lived OpenRouter access token that acts as the API key the matching federation policy targets.'
+      operationId: 'createOauthToken'
+      requestBody:
+        content:
+          application/x-www-form-urlencoded:
+            schema:
+              $ref: '#/components/schemas/TokenExchangeRequest'
+        required: true
+      responses:
+        '200':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/TokenExchangeResponse'
+          description: 'Access token issued'
+        '400':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'Malformed request, unsupported grant, or the subject token was not accepted'
+        '429':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'Rate limited'
+        '500':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'The token could not be issued'
+        '503':
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/OAuthErrorResponse'
+          description: 'The issuer’s discovery document or JWKS could not be fetched'
+      summary: 'Exchange a workload identity token'
+      tags:
+        - 'OAuth'
   /observability/destinations:
     get:
       description: 'List the observability destinations configured for the authenticated entity''s default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace. Only destinations with stable release status are surfaced — destinations of other types are excluded. [Management key](/docs/guides/overview/auth/management-api-keys) required.'