From d13f42142687a1462f4759af8e8a463942332737 Mon Sep 17 00:00:00 2001 From: OpenRouter SDK Bot Date: Wed, 16 Sep 2026 19:53:42 +0000 Subject: [PATCH] chore: update OpenAPI spec [sdk-bot] --- .speakeasy/in.openapi.yaml | 1598 ++++++++++++++++++++++++++++++++++++ 1 file changed, 1598 insertions(+) diff --git a/.speakeasy/in.openapi.yaml b/.speakeasy/in.openapi.yaml index b7e92d81..be213fad 100644 --- a/.speakeasy/in.openapi.yaml +++ b/.speakeasy/in.openapi.yaml @@ -27082,6 +27082,152 @@ components: output_tokens_details: reasoning_tokens: 0 total_tokens: 35 + VaultSecret: + additionalProperties: false + description: 'Metadata for one stored secret. The secret value is never returned. `fingerprint` is a keyed SHA-256 digest of the value: equal fingerprints within one scope mean equal values, but a workspace secret and its intern copy carry different fingerprints. `hosts` and `fingerprint` are `null` only for legacy rows written before host binding was required; storing the secret again assigns hosts.' + example: + created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + properties: + created_at: + format: 'date-time' + type: 'string' + fingerprint: + pattern: '^sha256:[a-f0-9]{64}$' + type: + - 'string' + - 'null' + hosts: + items: + maxLength: 254 + type: 'string' + maxItems: 100 + minItems: 1 + type: + - 'array' + - 'null' + name: + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + required: + - 'name' + - 'hosts' + - 'fingerprint' + - 'created_at' + type: 'object' + VaultSecretCopyRequest: + additionalProperties: false + description: 'Workspace secrets to copy into the intern scope.' + example: + names: + - 'github_token' + properties: + names: + description: 'Names of workspace secrets to copy, 1 to 100 unique entries. Every name must exist in the workspace scope.' + items: + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + maxItems: 100 + minItems: 1 + type: 'array' + required: + - 'names' + type: 'object' + VaultSecretCopyResponse: + additionalProperties: false + description: 'Metadata for the copies now stored in the intern scope, one entry per requested name.' + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + properties: + data: + items: + $ref: '#/components/schemas/VaultSecret' + maxItems: 100 + type: 'array' + required: + - 'data' + type: 'object' + VaultSecretListResponse: + additionalProperties: false + description: 'One page of secret metadata for the selected scope.' + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + - created_at: '2026-08-01T09:30:00.000Z' + fingerprint: null + hosts: null + name: 'legacy_token' + has_more: false + properties: + data: + items: + $ref: '#/components/schemas/VaultSecret' + maxItems: 100 + type: 'array' + has_more: + description: 'True when more secrets exist beyond this page. Request the next page with `offset` increased by the number of returned entries.' + type: 'boolean' + required: + - 'data' + - 'has_more' + type: 'object' + VaultSecretResponse: + additionalProperties: false + description: 'Metadata for the stored secret.' + example: + data: + created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + properties: + data: + $ref: '#/components/schemas/VaultSecret' + required: + - 'data' + type: 'object' + VaultSecretWriteRequest: + additionalProperties: false + description: 'Secret value and the exact hostnames it may be released to.' + example: + hosts: + - 'api.github.com' + value: 'ghp_exampleTokenValue' + properties: + hosts: + description: 'Exact DNS hostnames the secret may be sent to, 1 to 100 entries. Each entry is lowercased and a trailing dot is removed, so `API.Example.com.` is stored as `api.example.com`. Schemes, ports, paths, wildcards and empty values are rejected. Duplicates after normalization are collapsed. Matching is exact: a secret bound to `api.example.com` is never released to `example.com` or any other hostname.' + items: + maxLength: 254 + type: 'string' + maxItems: 100 + minItems: 1 + type: 'array' + value: + description: 'Secret value, 1 to 65536 characters. It is encrypted at rest and never returned.' + maxLength: 65536 + minLength: 1 + type: 'string' + required: + - 'value' + - 'hosts' + type: 'object' VideoGenerationRequest: example: aspect_ratio: '16:9' @@ -40247,6 +40393,1456 @@ paths: tags: - 'SCIM' x-speakeasy-name-override: 'getSyncJob' + /vault/interns/{internId}/secrets: + get: + description: 'Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'listInternVaultSecrets' + parameters: + - description: 'UUID of an intern in the workspace selected by the API key.' + in: 'path' + name: 'internId' + required: true + schema: + description: 'UUID of an intern in the workspace selected by the API key.' + example: '7c9e6679-7425-40de-944b-e07fc1f90ae7' + format: 'uuid' + type: 'string' + - description: 'Page size, 1 to 100. Defaults to 100.' + in: 'query' + name: 'limit' + required: false + schema: + default: 100 + description: 'Page size, 1 to 100. Defaults to 100.' + example: 50 + maximum: 100 + minimum: 1 + type: 'integer' + - description: 'Number of secrets to skip, 0 to 10000. Defaults to 0.' + in: 'query' + name: 'offset' + required: false + schema: + default: 0 + description: 'Number of secrets to skip, 0 to 10000. Defaults to 0.' + example: 0 + maximum: 10000 + minimum: 0 + type: 'integer' + responses: + '200': + content: + application/json: + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + - created_at: '2026-08-01T09:30:00.000Z' + fingerprint: null + hosts: null + name: 'legacy_token' + has_more: false + schema: + $ref: '#/components/schemas/VaultSecretListResponse' + description: 'One page of secret metadata.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'List intern secrets' + tags: + - 'Vault' + /vault/interns/{internId}/secrets/{name}: + delete: + description: 'Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'deleteInternVaultSecret' + parameters: + - description: 'UUID of an intern in the workspace selected by the API key.' + in: 'path' + name: 'internId' + required: true + schema: + description: 'UUID of an intern in the workspace selected by the API key.' + example: '7c9e6679-7425-40de-944b-e07fc1f90ae7' + format: 'uuid' + type: 'string' + - description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + in: 'path' + name: 'name' + required: true + schema: + description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + example: 'github_token' + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + responses: + '204': + description: 'Secret deleted. The response has no body.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'Delete an intern secret' + tags: + - 'Vault' + put: + description: 'Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'storeInternVaultSecret' + parameters: + - description: 'UUID of an intern in the workspace selected by the API key.' + in: 'path' + name: 'internId' + required: true + schema: + description: 'UUID of an intern in the workspace selected by the API key.' + example: '7c9e6679-7425-40de-944b-e07fc1f90ae7' + format: 'uuid' + type: 'string' + - description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + in: 'path' + name: 'name' + required: true + schema: + description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + example: 'github_token' + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + requestBody: + content: + application/json: + example: + hosts: + - 'api.github.com' + value: 'ghp_exampleTokenValue' + schema: + $ref: '#/components/schemas/VaultSecretWriteRequest' + required: true + responses: + '200': + content: + application/json: + example: + data: + created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + schema: + $ref: '#/components/schemas/VaultSecretResponse' + description: 'Metadata for the stored secret.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '409': + content: + application/json: + examples: + transfer-in-progress: + summary: 'Transfer in progress' + value: + error: + code: 409 + message: 'Vault request conflicts with existing secrets' + schema: + $ref: '#/components/schemas/ConflictResponse' + description: 'Conflict - The intern is being transferred to another workspace and its vault has not moved yet. Retry once the transfer finishes.' + '413': + content: + application/json: + examples: + body-too-large: + summary: 'Body too large' + value: + error: + code: 413 + message: 'Request body too large' + schema: + $ref: '#/components/schemas/PayloadTooLargeResponse' + description: 'Payload Too Large - The JSON body exceeds 425000 bytes.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'Store an intern secret' + tags: + - 'Vault' + /vault/interns/{internId}/secrets/copy: + post: + description: 'Copies the named workspace secrets into one intern''s scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose `hosts` is `null` cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'copyVaultSecretsToIntern' + parameters: + - description: 'UUID of an intern in the workspace selected by the API key.' + in: 'path' + name: 'internId' + required: true + schema: + description: 'UUID of an intern in the workspace selected by the API key.' + example: '7c9e6679-7425-40de-944b-e07fc1f90ae7' + format: 'uuid' + type: 'string' + requestBody: + content: + application/json: + example: + names: + - 'github_token' + schema: + $ref: '#/components/schemas/VaultSecretCopyRequest' + required: true + responses: + '200': + content: + application/json: + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + schema: + $ref: '#/components/schemas/VaultSecretCopyResponse' + description: 'Metadata for the copied secrets.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '409': + content: + application/json: + examples: + copy-conflict: + summary: 'Copy conflict' + value: + error: + code: 409 + message: 'Vault request conflicts with existing secrets' + schema: + $ref: '#/components/schemas/ConflictResponse' + description: 'Conflict - A named workspace secret has no hosts yet, or the intern is being transferred to another workspace. Nothing is copied.' + '413': + content: + application/json: + examples: + body-too-large: + summary: 'Body too large' + value: + error: + code: 413 + message: 'Request body too large' + schema: + $ref: '#/components/schemas/PayloadTooLargeResponse' + description: 'Payload Too Large - The JSON body exceeds 425000 bytes.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'Copy workspace secrets to an intern' + tags: + - 'Vault' + /vault/secrets: + get: + description: 'Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with `limit` and `offset`. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'listVaultSecrets' + parameters: + - description: 'Page size, 1 to 100. Defaults to 100.' + in: 'query' + name: 'limit' + required: false + schema: + default: 100 + description: 'Page size, 1 to 100. Defaults to 100.' + example: 50 + maximum: 100 + minimum: 1 + type: 'integer' + - description: 'Number of secrets to skip, 0 to 10000. Defaults to 0.' + in: 'query' + name: 'offset' + required: false + schema: + default: 0 + description: 'Number of secrets to skip, 0 to 10000. Defaults to 0.' + example: 0 + maximum: 10000 + minimum: 0 + type: 'integer' + responses: + '200': + content: + application/json: + example: + data: + - created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + - created_at: '2026-08-01T09:30:00.000Z' + fingerprint: null + hosts: null + name: 'legacy_token' + has_more: false + schema: + $ref: '#/components/schemas/VaultSecretListResponse' + description: 'One page of secret metadata.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'List workspace secrets' + tags: + - 'Vault' + /vault/secrets/{name}: + delete: + description: 'Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'deleteVaultSecret' + parameters: + - description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + in: 'path' + name: 'name' + required: true + schema: + description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + example: 'github_token' + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + responses: + '204': + description: 'Secret deleted. The response has no body.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'Delete a workspace secret' + tags: + - 'Vault' + put: + description: 'Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in `hosts`. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key''s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as `eu.openrouter.ai` are refused. [API key](/docs/api-reference/authentication) required.' + operationId: 'storeVaultSecret' + parameters: + - description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + in: 'path' + name: 'name' + required: true + schema: + description: 'Secret name. Lowercase letters, digits and single underscores, starting with a letter and not ending with an underscore, 1 to 255 characters.' + example: 'github_token' + maxLength: 255 + minLength: 1 + pattern: '^(?!.*__)[a-z]([a-z0-9_]*[a-z0-9])?$' + type: 'string' + requestBody: + content: + application/json: + example: + hosts: + - 'api.github.com' + value: 'ghp_exampleTokenValue' + schema: + $ref: '#/components/schemas/VaultSecretWriteRequest' + required: true + responses: + '200': + content: + application/json: + example: + data: + created_at: '2026-09-15T17:44:00.000Z' + fingerprint: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08' + hosts: + - 'api.github.com' + name: 'github_token' + schema: + $ref: '#/components/schemas/VaultSecretResponse' + description: 'Metadata for the stored secret.' + '400': + content: + application/json: + examples: + invalid-vault-request: + summary: 'Invalid vault request' + value: + error: + code: 400 + message: 'Invalid vault request' + schema: + $ref: '#/components/schemas/BadRequestResponse' + description: 'Bad Request - The secret name, path, query or JSON body failed validation. The vault returns 400 for a malformed request as well.' + '401': + content: + application/json: + examples: + invalid-or-missing-api-key: + summary: 'Invalid or missing API key' + value: + error: + code: 401 + message: 'Invalid or missing API key' + schema: + $ref: '#/components/schemas/UnauthorizedResponse' + description: 'Unauthorized - Missing or unknown API key. Provisioning keys cannot call vault routes.' + '403': + content: + application/json: + examples: + regional-hostname: + summary: 'Regional hostname' + value: + error: + code: 403 + message: 'The Intern API does not support regional data residency yet. Please use the global endpoint at openrouter.ai.' + workspace-scope-unavailable: + summary: 'Workspace scope unavailable' + value: + error: + code: 403 + message: 'Vault scope is unavailable' + schema: + $ref: '#/components/schemas/ForbiddenResponse' + description: 'Forbidden - The key has no usable workspace scope, or the request arrived on a regional hostname.' + '404': + content: + application/json: + examples: + not-found: + summary: 'Not found' + value: + error: + code: 404 + message: 'Not found' + schema: + $ref: '#/components/schemas/NotFoundResponse' + description: 'Not Found - The intern is not in the selected workspace, the secret does not exist in the selected scope, or the caller is outside the intern programme.' + '408': + content: + application/json: + examples: + body-timed-out: + summary: 'Body timed out' + value: + error: + code: 408 + message: 'Request body timed out' + route-deadline: + summary: 'Route deadline' + value: + error: + code: 408 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/RequestTimeoutResponse' + description: 'Request Timeout - The route deadline passed before the request completed, or the request body stopped arriving.' + '413': + content: + application/json: + examples: + body-too-large: + summary: 'Body too large' + value: + error: + code: 413 + message: 'Request body too large' + schema: + $ref: '#/components/schemas/PayloadTooLargeResponse' + description: 'Payload Too Large - The JSON body exceeds 425000 bytes.' + '429': + content: + application/json: + examples: + rate-limited: + summary: 'Rate limited' + value: + error: + code: 429 + message: 'Too many vault requests' + schema: + $ref: '#/components/schemas/TooManyRequestsResponse' + description: 'Too Many Requests - The vault rate limit was reached.' + '500': + content: + application/json: + examples: + internal-error: + summary: 'Internal error' + value: + error: + code: 500 + message: 'Internal Server Error' + schema: + $ref: '#/components/schemas/InternalServerResponse' + description: 'Internal Server Error - Scope lookup failed.' + '502': + content: + application/json: + examples: + invalid-vault-response: + summary: 'Invalid vault response' + value: + error: + code: 502 + message: 'Invalid vault response' + vault-request-failed: + summary: 'Vault request failed' + value: + error: + code: 502 + message: 'Vault request failed' + schema: + $ref: '#/components/schemas/BadGatewayResponse' + description: 'Bad Gateway - The vault could not be reached or returned an unexpected response.' + '503': + content: + application/json: + examples: + vault-unavailable: + summary: 'Vault unavailable' + value: + error: + code: 503 + message: 'Vault service is unavailable' + writes-disabled: + summary: 'Writes disabled' + value: + error: + code: 503 + message: 'Vault writes are not enabled' + schema: + $ref: '#/components/schemas/ServiceUnavailableResponse' + description: 'Service Unavailable - Vault writes are disabled for the caller, or the vault is not configured.' + '504': + content: + application/json: + examples: + vault-timed-out: + summary: 'Vault timed out' + value: + error: + code: 504 + message: 'Vault request timed out' + schema: + $ref: '#/components/schemas/GatewayTimeoutResponse' + description: 'Gateway Timeout - The vault did not answer in time.' + security: + - apiKey: [] + summary: 'Store a workspace secret' + tags: + - 'Vault' /videos: post: description: 'Submits a video generation request and returns a polling URL to check status' @@ -41700,6 +43296,8 @@ tags: - description: 'Text-to-speech endpoints' name: 'TTS' x-displayName: 'Speech' + - description: 'Store host-bound secrets for a workspace or for one intern. Scope is selected by the API key. Responses return metadata only, never secret values. See https://openrouter.ai/docs/guides/ori/vault.' + name: 'Vault' - description: 'Video Generation endpoints' name: 'Video Generation' - description: 'Workspaces endpoints'