{ "info": { "_postman_id": "agentrouter-api-0.5.0-g200748c", "description": "AgentRouter API requests, generated from the combined OpenAPI spec by scripts/sdk-package.sh. Set the baseUrl and apiKey collection variables before sending.", "name": "AgentRouter API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "item": [ { "name": "ListAuditCheckpoints", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"afterSeq\": 0,\n \"limit\": 0,\n \"rebuild\": false\n}" }, "description": "List signed Merkle checkpoints (fraser#4599) for chain verification: each\n checkpoint's prev_root chains to the previous and its signature covers the\n root. Ordered by seq ascending, starting strictly after after_seq.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "checkpoints:list" ], "raw": "{{baseUrl}}/admin/v1/audit/checkpoints:list" } } }, { "name": "GetAuditInclusionProof", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"auditLogId\": \"string\"\n}" }, "description": "Return the Merkle inclusion proof for an audit_logs row: its leaf hash and\n audit path recomputed from current content, plus the signed checkpoint it\n belongs to, so a verifier can confirm the row is committed to a signed root.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "inclusion-proof" ], "raw": "{{baseUrl}}/admin/v1/audit/inclusion-proof" } } }, { "name": "GetAuditLog", "request": { "description": "Get a single audit_logs entry by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "logs", "{{log_id}}" ], "raw": "{{baseUrl}}/admin/v1/audit/logs/{{log_id}}" } } }, { "name": "QueryAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderBy\": \"timestamp\",\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"search\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"subjectUserId\": \"string\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "Query stored audit_logs entries with filtering and pagination. The read\n complement to the SIEM forwarder (which only exports) and the checkpoint\n verification RPCs (which only prove tamper-evidence): list and inspect\n entries over the API instead of standing up a SIEM.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/audit/logs:query" } } }, { "name": "ListCatalogModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "models" ], "raw": "{{baseUrl}}/admin/v1/catalog/models" } } }, { "name": "UpsertCatalogModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"additionalPricePerMillion\": {\n \"key\": 0\n },\n \"backendUrls\": [\n \"https://example.com\"\n ],\n \"cacheReadPerMillion\": \"string\",\n \"cachingPerMillion\": \"string\",\n \"capabilities\": [\n \"string\"\n ],\n \"clearFields\": [\n \"string\"\n ],\n \"inputModalities\": [\n \"string\"\n ],\n \"inputPerMillion\": \"string\",\n \"isEnabled\": false,\n \"limits\": {\n \"key\": 0\n },\n \"maxContextTokens\": 0,\n \"maxCostPerRequest\": \"string\",\n \"metadata\": {\n \"key\": 0\n },\n \"mode\": \"string\",\n \"name\": \"example-name\",\n \"outputModalities\": [\n \"string\"\n ],\n \"outputPerMillion\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"removeMetadataKeys\": [\n \"example-value\"\n ],\n \"suppressRouteRegen\": false,\n \"upstreamModel\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "models" ], "raw": "{{baseUrl}}/admin/v1/catalog/models" } } }, { "name": "ListCatalogProviders", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/admin/v1/catalog/providers" } } }, { "name": "UpsertCatalogProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"baseUrl\": \"https://example.com\",\n \"displayName\": \"example-name\",\n \"id\": \"string\",\n \"isEnabled\": false,\n \"metadata\": {\n \"key\": 0\n },\n \"removeMetadataKeys\": [\n \"example-value\"\n ],\n \"supportedAuthSchemes\": [\n \"string\"\n ],\n \"suppressRouteRegen\": false\n}" }, "description": "Admin-key catalog WRITES (fraser#8451).\n\n The identity-authenticated CatalogService.UpsertProvider/UpsertModel are\n mounted on the IA mux, which accepts only a session token or an\n `
.` public.api_keys key -- so a platform admin_api_keys key\n can never reach them. That is the same wall #6025 hit for READS, solved\n the same way: expose the operation behind the admin auth path.\n\n These delegate to catalog.Server, so validation, metadata handling,\n suppress_route_regen semantics and the per-gateway fan-out are the SAME\n code as the identity surface rather than a parallel implementation.\n\n The motivating caller is the catalog-sync CronJob, whose only credential\n on a provisioned management plane is that plane's admin key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/admin/v1/catalog/providers/{{provider_id}}" } } }, { "name": "GetCatalogSyncState", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync-state" } } }, { "name": "RecordCatalogSync", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"run\": {\n \"applied\": false,\n \"applyMode\": false,\n \"catalogVersion\": \"string\",\n \"modelsWritten\": 0,\n \"providersWritten\": 0,\n \"sources\": [\n {\n \"display\": \"string\",\n \"pinned\": false,\n \"sha256\": \"string\"\n }\n ]\n }\n}" }, "description": "Catalog sync freshness (fraser#7951), admin-key half.\n\n Same wall, same shape as the writes above: the catalog-sync CronJob's only\n credential on a provisioned management plane is that plane's admin key,\n which cannot reach agentrouter.catalog.v1.CatalogService at all. Both routes\n delegate to the same catalog.Server, so there is one record and one set of\n merge rules whichever surface wrote it -- a hand-run with a session token\n and a nightly job with an admin key update the same row. Two records would\n be worse than none: each would look stale whenever the other ran.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync-state" } } }, { "name": "GetCatalogSyncRun", "request": { "description": "GetCatalogSyncRun returns the most recent apply run, running or finished.\n An unset run means no apply has ever been started on this plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync", "run" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync/run" } } }, { "name": "ApplyCatalogSync", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"expectedCatalogVersion\": \"string\",\n \"expectedSources\": [\n {\n \"display\": \"string\",\n \"pinned\": false,\n \"sha256\": \"string\"\n }\n ]\n}" }, "description": "ApplyCatalogSync starts one background sync run and returns it RUNNING;\n poll GetCatalogSyncRun for progress. At most one run exists at a time --\n a second apply while one is in flight fails with ALREADY_EXISTS.\n\n The request MUST carry the sources (with sha256 digests) the preview\n reported. The apply re-fetches pinned to those digests, so what gets\n applied is byte-for-byte what the human reviewed; a published catalogue\n that changed in between fails the run with an instruction to re-preview\n rather than silently applying something nobody looked at.\n\n Error-code contract, which a dashboard branches on (never on message\n text):\n\n - ABORTED: the preview went stale -- the source configuration changed\n under the reviewed pin set. Re-run PlanCatalogSync and apply again.\n The same verdict reached asynchronously (the published catalogue\n changed between preview and apply) surfaces as a FAILED run with\n failure_reason = STALE_CATALOG.\n - FAILED_PRECONDITION: the plane cannot sync until an operator fixes\n something (sources unconfigured, published catalogue malformed).\n Retrying as-is will not help.\n - ALREADY_EXISTS: a run is in flight; poll it.\n - INVALID_ARGUMENT: the request is missing the preview's sources.\n\n All-or-nothing by design: no per-entry selection, and no disable-absent.\n The published catalogue is a curated SUBSET of what a plane may\n legitimately hold (vertex and vertexanthropic models are seeded but not\n published), so a one-click disable-absent would silently turn off models\n customers are routing to. The plan lists absent models read-only instead.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync:apply" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync:apply" } } }, { "name": "PlanCatalogSync", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "PlanCatalogSync fetches the published catalogue and returns what a sync\n would do, writing nothing to the catalogue itself.\n\n It DOES advance the sync-state record's checked_* fields, exactly as a\n CLI dry run does -- that record is what a dashboard's \"new models\n available\" indicator reads, and a preview is precisely \"this plane\n checked the published catalogue\". Hence models:EDIT rather than READ:\n the RPC writes the same record RecordCatalogSync writes, so it carries\n the same atom.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync:plan" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync:plan" } } }, { "name": "GetModelLifecycles", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelIds\": [\n \"string\"\n ]\n}" }, "description": "Lifecycle verdicts (retired / deprecated / new / preview) for a batch of\n catalogue models, keyed by model id (fraser#10228).\n\n The verdict is computed by catalogsync.LifecycleOfModel -- the function\n the catalog sync itself acts on -- so a consumer badges a model with the\n same answer the sync reached, rather than re-deriving it from metadata and\n drifting. Batch-by-id rather than a field on Model because the Admin\n Console lists models from its own ai_models query, not from this service:\n it already holds the ids and needs only the verdicts.\n\n An id that matches no catalogue row is ABSENT from the response map, never\n present with a zero verdict: a zero verdict means \"no lifecycle signal\"\n and would render as a normal live model. Disabled models are included --\n a retired model is usually disabled, and that is exactly the one to badge.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog:model-lifecycles" ], "raw": "{{baseUrl}}/admin/v1/catalog:model-lifecycles" } } }, { "name": "RegenerateCatalogRoutes", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Publish the catalogue to the data plane: one GLOBAL_ROUTES regeneration.\n\n The counterpart to suppress_route_regen on the two upserts above. A batch\n caller suppresses per-write regeneration and calls this ONCE at the end,\n so ~700 entries cost one fan-out rather than ~700.\n\n Deliberately takes NO caller-supplied scope. The underlying trigger must\n carry the \"system\" sentinel or the configurator narrows delivery to the\n caller's own customer, stranding every other workspace on the previous\n catalogue -- and the catalogue is global (ai_providers is keyed by name,\n ai_models is not customer-scoped). Server-side only, so a caller cannot\n get that wrong.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog:regenerate-routes" ], "raw": "{{baseUrl}}/admin/v1/catalog:regenerate-routes" } } }, { "name": "ListCustomers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers" ], "raw": "{{baseUrl}}/admin/v1/customers" } } }, { "name": "CreateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers" ], "raw": "{{baseUrl}}/admin/v1/customers" } } }, { "name": "DeleteCustomer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "UpdateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomerAuditLog", "request": { "description": "Get one audit entry only when its trusted ownership matches the supplied\n customer and optional project boundary. A foreign UUID is returned as\n NotFound, the same as an unknown UUID.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "audit", "logs", "{{log_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/audit/logs/{{log_id}}" } } }, { "name": "QueryCustomerAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"filters\": {\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderBy\": \"timestamp\",\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"search\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"subjectUserId\": \"string\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Query audit entries owned by one customer. This read is confined to the\n caller's API-key customer/project boundary; it does not provide fleet\n visibility. Rows without a trusted ownership stamp remain platform-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/audit/logs:query" } } }, { "name": "AcknowledgeConfigDifference", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Acknowledge one configuration difference, which takes it off the default\n view of the data plane or the project it reads on. The entry itself stays:\n nothing here deletes the record that the fleet was once split.\n\n Acknowledging an entry a second time changes nothing and reports\n `acknowledged: false`, so the ledger keeps naming whoever actually looked.\n\n A project owner answers the entries ListProjectConfigDifferences shows\n them by naming their project in project_id, which is what binds the gate\n to it. An administrator answers either list and leaves project_id empty.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "config-differences", "{{config_difference_id}}:acknowledge" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/config-differences/{{config_difference_id}}:acknowledge" } } }, { "name": "ListDataplaneProjects", "request": { "description": "List the labels a customer holds, which are the (data plane, project)\n pairs recording which projects each data plane serves (fraser#8587).\n\n A label is the project itself selected on a data plane, so it has no\n lifecycle of its own and there is nothing here to create or name. Filter\n by dataplane_id for one data plane's own record, by project_id for the\n data planes serving one project, or by neither for the whole customer,\n which answers both directions in one request.\n\n The answer comes from dataplane_projects rather than from the project\n gateway join, so a data plane that has never converged still reads as\n serving what it is labelled with: the question is which projects the\n management plane distributes to it, not which ones it has already pulled.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "dataplane-projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/dataplane-projects" } } }, { "name": "AddDataplaneProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Label a data plane with a project, so it serves that project's\n configuration from its next config update (fraser#8591).\n\n Idempotent: labelling a data plane that already serves the project leaves\n the label alone and reports the same success. The project's keys admit on\n this data plane once its pull lands, not when this call returns, and\n neither the project nor any other data plane serving it is modified. No\n hostname, DNS record or certificate takes part. Labelling a data plane with\n a SECOND project needs that data plane to host more than one project\n gateway, and this refuses with FAILED_PRECONDITION naming the reason while\n it hosts a single one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "dataplanes", "{{dataplane_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/dataplanes/{{dataplane_id}}/projects" } } }, { "name": "RemoveDataplaneProject", "request": { "description": "Remove a project's label from a data plane, which clears that project's\n configuration there on its next update (fraser#8591).\n\n Removing a label another data plane also carries costs the project\n nothing. Removing the last one takes the project's last endpoint away, so\n this RPC refuses that case with FAILED_PRECONDITION naming the project\n (fraser#9425): label another data plane with it first, or remove the label\n deliberately through the path that tells its owners. Removing a label the\n data plane does not carry is an idempotent no-op reporting removed=false.\n\n Until the data plane's next pull lands it still holds the old\n configuration and the project's keys still admit there.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "dataplanes", "{{dataplane_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/dataplanes/{{dataplane_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectsServedFrom", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"dataplaneIds\": [\n \"string\"\n ]\n}" }, "description": "ListProjectsServedFrom resolves a set of data planes to the projects\n served from them, which is what a region-bound rule attaches to.\n\n The rule attaches to the projects rather than to the data planes on\n purpose. A project is deliberately labelled on data planes in several\n regions, because that is the HA mechanism, so a control anchored to\n infrastructure would reach every region the project is served from. Each\n project here therefore reports the selected data planes serving it AND the\n ones outside the selection, so an operator sees which projects the\n selection does not contain.\n\n Nothing verifies where a data plane runs. A region lives in the name an\n operator gave the data plane and in the address it reports, both of which\n are the operator's own strings, mirrored read-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "dataplanes:projectsServedFrom" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/dataplanes:projectsServedFrom" } } }, { "name": "ListDataplaneRollout", "request": { "description": "ListDataplaneRollout reads the rollout watermark per data plane and rolls\n it up to a fleet figure, which is the reading a platform admin watches a\n change land by.\n\n It counts against the per-project revision #8587 mints and introduces no\n counter of its own. A data plane is current when every project labelled on\n it holds that project's current revision, so the fleet figure is a count\n of data planes rather than of projects.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "dataplanes:rollout" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/dataplanes:rollout" } } }, { "name": "ResolvePendingProjectMemberships", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "ResolvePendingProjectMemberships materializes every pending email-keyed grant\n for (customer_id, email) into real project_members rows for user_id, then\n clears the resolved pending rows (#6119). Idempotent and cheap to call on\n every login: with no pending rows it is a no-op.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "pending-members:resolve" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/pending-members:resolve" } } }, { "name": "ListProjects", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects" } } }, { "name": "CreateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects" } } }, { "name": "EnsureDefaultProjectMembership", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userId\": \"{{user_id}}\"\n}" }, "description": "EnsureDefaultProjectMembership adds user_id to the customer's `default`\n project as a `member` when the user has no membership there (#6526). It\n creates the `default` project first when it is missing. It never changes\n the role of an existing member, and it skips a user whom SCIM blocks from\n signing in. Idempotent: a repeat call leaves the same state and returns\n joined=false.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "default", "members:ensure" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/default/members:ensure" } } }, { "name": "EnsureDefaultProject", "request": { "description": "EnsureDefaultProject creates the customer's reserved `default` project\n when it does not exist, seeded with the enabled providers, MCP servers and\n models, and returns it. An existing default project is returned unchanged,\n so an allow-list an operator emptied stays empty (fraser#7281). The Admin\n Console calls it in place of its own seed (fraser#10810). Idempotent and\n safe to call concurrently.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "default:ensure" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/default:ensure" } } }, { "name": "DeleteProject", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "GetProject", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"publicEndpointUrl\": \"https://example.com\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectConfigDifferences", "request": { "description": "List the fields the data planes serving one project disagree on.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "config-differences" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/config-differences" } } }, { "name": "ListProjectDataplanes", "request": { "description": "List the data planes serving a project, which is the project's serving\n view (fraser#9573).\n\n The answer comes from the project labels a data plane carries\n (dataplane_projects, fraser#8587): a data plane serves the configuration\n of every project labeled on it, so the label set IS the set of data planes\n serving the project. The gateway a data plane hosts does not enter the\n question, which is why this read answers where ListProjectGatewayMembers\n does not.\n\n Available on EVERY deployment shape. A data plane carries project labels\n on SaaS exactly as it does on Enterprise, so nothing here is gated on the\n deployment product — the Enterprise-only surface is several gateways\n serving one project, and this RPC names no gateway.\n\n A project that no data plane serves answers an EMPTY list rather than an\n error. That state is normal: a project is created without infrastructure\n and stays unlabeled until a platform admin labels a data plane with it.\n\n Responses carry identity and state only, never credential material.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/dataplanes" } } }, { "name": "GetProjectDeletionImpact", "request": { "description": "Report what deleting a project takes off the fleet, and how far that has\n got (fraser#9424). One call answers both halves of the operation: before\n the delete it names every data plane carrying the project's label, which\n is the blast radius an operator confirms; after it, the same data planes\n say whether each has cleared the project's configuration or is still\n serving what it last pulled.\n\n The reading is per data plane rather than per gateway (fraser#8587). A\n data plane hosting several of the project's gateways is one line, and it\n reads CLEARED only once every one of them has acknowledged the zeroized\n revision.\n\n What puts a data plane in the receipt is a membership this delete unwound,\n or a gateway still joined to the project. A gateway joined with no\n membership behind it is a stranded re-attach and holds its data plane at\n CLEARING, because it serves the project and has acknowledged nothing for\n it.\n\n What this RPC cannot see after the delete is a data plane that carried the\n label with neither of those left on it. Nothing sent it a zeroized\n revision, so there is no acknowledgement to wait for, and it leaves the\n receipt with the project. The membership ledger is what records the\n unwind, and a label is not a substitute for one.\n\n The receipt covers THIS delete and no earlier one. A gateway that left the\n project before it was deleted took the project off its data plane then,\n and the delete found nothing there to remove, so that data plane is\n absent from the receipt exactly as it was absent from the confirmation.\n\n A data plane is named by where its gateway sits when the receipt is read,\n not by where the membership was when it detached, because the ledger\n records the gateway and the gateway records the data plane (fraser#8587\n re-keys that). Moving a gateway between data planes after the delete\n therefore moves its line with it. Moving a gateway also tears down its\n configuration on the data plane it leaves, so the one that ends up named\n is never a data plane still serving the project; what is lost is which\n data plane acknowledged.\n\n A slug deleted and then recreated reports the NEW project: this reads the\n live incarnation whenever one exists, so a receipt has to be read before\n the slug is reused. Compare project_uuid with the id read before the\n delete to detect this.\n\n While the project is live the response also previews what the delete\n removes (fraser#6371): the project's id and five counts, read in one\n snapshot. In JSON a zero count is left out, so a missing count is 0.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "deletion-impact" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/deletion-impact" } } }, { "name": "ListProjectGatewayMembers", "request": { "description": "List a project's member gateways with their membership state (D1\n multi-gateway projects, fraser#5987 / ADR 052).\n\n This is the fleet-consistency primitive (epic tetrate-ai-platform#2865,\n gate amendment 6): for every member it reports the membership state\n machine position (syncing / ready / detached_zeroized /\n detached_unreachable), the member's last-acked config version vs. the\n project's head config version for that member, health (tri-state:\n unknown is a valid answer), last-seen, and the state timestamps. The\n shape is deliberately reusable by future consumers (D3 T1 steering,\n fleet-upgrade tooling): \"is this fleet converged on config head?\" is\n answerable per member from status + config_version + head_config_version\n alone.\n\n A member is advertised as `ready` ONLY under confirmed convergence: every\n per-gateway config slot acked by the data plane at its current version,\n PLUS the member workspace's shared PROXY (authz-map) slot when one exists\n (an absent workspace slot passes vacuously — the slot is minted on first\n authz-map generation). Because that PROXY slot is shared by every gateway\n in the workspace, a bump to it flips ALL of the workspace's members back\n to `syncing` until the new map version is acked — cross-member flap on\n workspace-slot bumps is expected behavior, not a defect. A\n previously-ready member whose project config moved ahead reports\n `syncing` again until the new head is acked. The `config_version` /\n `head_config_version` columns stay scoped to the member's own per-gateway\n slots (gateway family only): the workspace PROXY slot participates in the\n READY predicate but never in the version columns.\n\n Although marked NO_SIDE_EFFECTS, this read performs idempotent ledger\n reconciliation: attachments that predate the membership ledger are\n backfilled insert-only (a detached record is never reset by a list; only\n the Attach RPC does that). A legacy attachment backfilled this way gets a\n fabricated `attached_at` equal to the first list's server time — its true\n attach time was never recorded.\n\n A project with ZERO member gateways is fully valid: the response carries\n an empty members list (and whatever detached history exists), never an\n error.\n\n Responses carry NO credential material (gate amendment 5): identity,\n state, versions, and timestamps only.\n\n Enterprise only: on SaaS deployments (DEPLOYMENT_PRODUCT=saas) this RPC\n fails with UNIMPLEMENTED — the multi-gateway surface does not exist\n there (the existing attach/detach RPCs remain, capped at one gateway per\n project).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "gateway-members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/gateway-members" } } }, { "name": "ListProjectMcpServerCandidates", "request": { "description": "ListProjectMcpServerCandidates returns enabled catalog servers not yet\n assigned to the project, ordered by name, for the add-server picker.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-server-candidates" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-server-candidates" } } }, { "name": "ListProjectMcpServers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers" } } }, { "name": "AddProjectMcpServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"serverId\": \"{{server_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers" } } }, { "name": "RemoveProjectMcpServer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers", "{{server_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers/{{server_id}}" } } }, { "name": "TriggerProjectMcp", "request": { "description": "TriggerProjectMcp (re)materializes the per-Project-Gateway MCP config for\n every gateway the (customer_id, project_id) is attached to. The dashboard\n MCP profile mutation path calls this after a profile create/update/delete so\n a freshly-created profile enters its project gateways' MCP_PROFILE config;\n without it the per-gateway config-gen never re-runs and /mcp/ 404s\n on a strict-isolation gateway DP. Best-effort + dormant when the project has\n no gateways.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp:trigger" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp:trigger" } } }, { "name": "ListProjectMembers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "AddProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"admin\",\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "RemoveProjectMember", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{user_id}}" } } }, { "name": "UpdateProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"admin\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{user_id}}" } } }, { "name": "ListProjectModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "AddProjectModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelId\": \"{{model_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "RemoveProjectModel", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models/{{model_id}}" } } }, { "name": "DeleteProjectOIDCConfig", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "oidc" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/oidc" } } }, { "name": "GetProjectOIDCConfig", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "oidc" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/oidc" } } }, { "name": "UpsertProjectOIDCConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"audience\": \"string\",\n \"enabled\": false,\n \"identityClaim\": \"string\",\n \"issuer\": \"https://example.com\",\n \"principalCap\": 1,\n \"requiredEntitlement\": \"string\",\n \"requiredScope\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "oidc" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/oidc" } } }, { "name": "EnsureAdminProjectMembership", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"role\": \"admin\"\n}" }, "description": "EnsureAdminProjectMembership records the intent to grant an email a role on\n a project (#6119). At onboarding/provisioning time the target identity row\n usually does not exist yet (SSO users are created lazily at first login), so\n the grant is parked by email and materialized at first login via\n ResolvePendingProjectMemberships. If the identity already exists the grant is\n written straight to project_members instead. Idempotent.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "pending-members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/pending-members" } } }, { "name": "ListProjectProviders", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers" } } }, { "name": "AddProjectProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"providerName\": \"example-name\"\n}" }, "description": "AddProjectProvider adds a provider to the project's allow-list. A project\n admin may call it for their own project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers" } } }, { "name": "RemoveProjectProvider", "request": { "description": "RemoveProjectProvider removes a provider from the project's allow-list.\n Fails FAILED_PRECONDITION while the project still has models from that\n provider: unassign them first. A project admin may call it for their own\n project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers", "{{provider_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers/{{provider_name}}" } } }, { "name": "GetProjectSettings", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings" } } }, { "name": "DeleteProjectSetting", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings", "{{setting_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings/{{setting_name}}" } } }, { "name": "UpsertProjectSetting", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"settingValue\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings", "{{setting_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings/{{setting_name}}" } } }, { "name": "ListDataplanes", "request": { "description": "List data planes.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/dataplanes" } } }, { "name": "CreateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"dataplaneId\": \"{{dataplane_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Register a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/dataplanes" } } }, { "name": "DeleteDataplane", "request": { "description": "Delete a data plane (soft delete).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "GetDataplane", "request": { "description": "Get a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "UpdateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"autoRepair\": false,\n \"autoUpgrade\": false,\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "description": "Update a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "ListDataplaneConfigDifferences", "request": { "description": "List the configuration differences one data plane reports.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "config-differences" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/config-differences" } } }, { "name": "ListDataplaneConfigOverrides", "request": { "description": "List the whitelisted overrides one data plane carries, for one project or\n for every project.\n\n A key override reports only that a credential is set: no read path on this\n service returns key material.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "config-overrides" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/config-overrides" } } }, { "name": "SetDataplaneConfigOverride", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fieldPath\": \"string\",\n \"key\": \"example-value\",\n \"projectId\": \"{{project_id}}\",\n \"value\": \"string\"\n}" }, "description": "Override one whitelisted field on one data plane.\n\n Exactly one of `value` and `key` carries the override, and which one is\n decided by the field path: `providers..endpoint` takes `value`,\n and `providers..key` takes `key`. A field path outside the\n whitelist is rejected with INVALID_ARGUMENT naming the two paths a\n provider offers.\n\n A repeat write replaces the value the field held. Every write lands in the\n audit log with the field path, the data plane and the actor, and the data\n plane it names regenerates its configuration, so it carries the override on\n its next pull.\n\n A credential is stored write-only: it goes to the secret service and the\n override keeps a reference the data plane resolves, which resolves for that\n data plane alone.\n\n A write needs the project labelled on the data plane, and answers\n FAILED_PRECONDITION naming both when it is not: label the project onto the\n data plane first. A project that does not exist answers NOT_FOUND. A write\n to an external provider is refused for both fields, and a credential\n override for a provider whose auth type is `none` is refused, because a\n data plane never reads a credential for that provider. A data plane below\n the version that renders per-project provider objects is refused for both\n fields.\n\n An override reaches the project's requests on every route family the\n data plane serves it through: the shared catalog routes, the fallback\n chains and the routes of the project's own keys. A request authenticated\n with a key the caller brought themselves (BYOK) keeps dialling the bundle\n endpoint with the caller's key. On a deployment that registers an\n external `autofallback-` catalog entry, the primary leg routed\n through that service is not covered.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "config-overrides" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/config-overrides" } } }, { "name": "ClearDataplaneConfigOverride", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fieldPath\": \"string\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Clear one project's override of one field, which returns the field to the\n value the bundle carries for that project. Clearing a field that carries\n no override reports `cleared: false` rather than failing.\n\n Clearing a credential override also destroys the stored credential, so the\n reference stops resolving for anyone. The project's requests fall back to\n the deployment-wide credential once the data plane applies its next pull,\n which an administrator containing a leaked key has to check is not the\n leaked one: a clear revokes nothing at the provider.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "config-overrides:clear" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/config-overrides:clear" } } }, { "name": "SetDataplaneProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Assign a data plane to a project (omit project_id to clear to default).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "project" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/project" } } }, { "name": "SetDataplaneURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing advertised URL for a data plane.\n\n Deprecated (fraser#8586): a data plane reports its own address from global.gateway.hostnames in its serve-helm values, and the management plane mirrors it read-only. This stays working in 0.6; removal is proposed for 0.8.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/url" } } }, { "name": "ListMcpCatalogServers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/admin/v1/mcp/catalog/servers" } } }, { "name": "ListModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models" ], "raw": "{{baseUrl}}/admin/v1/models" } } }, { "name": "GetModel", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/admin/v1/models/{{model_id}}" } } }, { "name": "GetModelUsage", "request": { "description": "GetModelUsage lists the projects and API keys in the caller's\n organization that called a catalogue model inside a bounded window, and\n when each was last seen (fraser#10229). Organization-scoped, never\n platform-wide: a caller with no organization binding is denied, and a\n project-tier key sees only its own project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models", "{{model_id}}", "usage" ], "raw": "{{baseUrl}}/admin/v1/models/{{model_id}}/usage" } } }, { "name": "Ping", "request": { "description": "Ping endpoint for health checks and authentication testing", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "ping" ], "raw": "{{baseUrl}}/admin/v1/ping" } } }, { "name": "QueryPlatformAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderBy\": \"timestamp\",\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"search\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"subjectUserId\": \"string\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "QueryPlatformAuditLogs is the fleet-wide audit query. It requires an\n explicit platform_audit_logs.read grant, such as platform_admin;\n organization admin scope alone does not grant fleet access. An\n organization admin without that grant reads only its own organization's\n records, which is deprecated; use QueryCustomerAuditLogs.\n Same request/response as QueryAuditLogs.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "platform", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/platform/audit/logs:query" } } }, { "name": "ListProjectGateways", "request": { "description": "List project gateways (optionally filtered by customer, workspace, and/or\n attached project). Each returned gateway carries its attached project slugs\n in `attached_project_ids`, so reading gateway<->project attachments in bulk\n is ONE paginated request, not one ListProjectGatewayProjects call per\n gateway (#5591).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways" ], "raw": "{{baseUrl}}/admin/v1/project-gateways" } } }, { "name": "CreateProjectGateway", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectGatewayId\": \"{{project_gateway_id}}\",\n \"url\": \"https://example.com\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways" ], "raw": "{{baseUrl}}/admin/v1/project-gateways" } } }, { "name": "DeleteProjectGateway", "request": { "description": "Delete project gateway (soft delete)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "GetProjectGateway", "request": { "description": "Get project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "UpdateProjectGateway", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"environment\": \"string\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"url\": \"https://example.com\"\n}" }, "description": "Update project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "ListProjectGatewayProjects", "request": { "description": "List the project slugs attached to a project gateway.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects" } } }, { "name": "AttachProjectGatewayProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Attach a project to a project gateway (idempotent). Establishes a\n gateway<->project binding in the many-to-many project_gateway_projects\n relationship.\n\n A project gateway holds every project attached to it, so one hostname\n serves several projects and each request resolves to its own project by\n its own credential (fraser#9422). Re-attaching the same project is a\n no-op. Two concurrent attaches of the same binding leave one of them with\n ABORTED, which the caller retries.\n\n Ensure the attached project has assigned models BEFORE setting the\n gateway's URL: under strict isolation a gateway with no assigned models\n serves an EMPTY route map and will return 404 for every request. The\n response carries any such warnings in the `warnings` field.\n\n Multi-gateway projects (fraser#5987): a project may be attached to\n multiple gateways, capped per project (PROJECT_GATEWAY_CAP, default 10 on\n Enterprise; 1 on SaaS) — attaching beyond the cap is rejected with\n RESOURCE_EXHAUSTED (the cap is a quota, not a name collision;\n ALREADY_EXISTS stays reserved for hostname/slug uniqueness conflicts).\n The cap is a SOFT limit: the check is not atomic with the insert, so two\n concurrent attaches can both pass it and overshoot the cap by one.\n Attaching a gateway whose slug is shared with another live gateway is\n rejected with FAILED_PRECONDITION (rename or delete the sibling first).\n A successful attach starts the membership in the `syncing` state; see\n ListProjectGatewayMembers for the state machine.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects" } } }, { "name": "DetachProjectGatewayProject", "request": { "description": "Detach a project from a project gateway.\n\n Detach pushes a final zeroized config revision to the member (best-effort,\n DP-initiated polling) and revokes MP-side access as the authoritative\n backstop, so the membership lands in `detached_unreachable` until the data\n plane acknowledges the zero revision (then `detached_zeroized`). Detaching\n a project that is not attached is an idempotent no-op (success=false, no\n error). See ListProjectGatewayMembers for the state machine.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProjectGatewayProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"acceptedCredentials\": \"ACCEPTED_CREDENTIALS_API_KEY\"\n}" }, "description": "Update a project's membership of a project gateway. The one mutable field\n is accepted_credentials, which says whether an Agent Router API key, a\n verified IdP token, or either one authenticates a caller of this project on\n this gateway (ADR 050, fraser#9834). A new attachment starts at\n ACCEPTED_CREDENTIALS_API_KEY, which is what every project did before the\n field existed.\n\n TOKEN and BOTH declare that the project accepts a credential verified at\n this gateway, so both are refused with FAILED_PRECONDITION while the\n project holds no enabled jwt gateway auth policy for this gateway, and\n disabling or deleting the project's last such policy is refused while the\n membership declares either one. Both are Enterprise-only, refused with\n FAILED_PRECONDITION on SaaS the way a jwt gateway auth policy is.\n\n The data plane enforces the declaration from release 0.7.0: it refuses an\n IdP token on a project declaring API_KEY, and an API key on a project\n declaring TOKEN. A data plane older than 0.7.0 authenticates API keys alone,\n whatever the declaration says.\n\n Returns NOT_FOUND when the project is not attached to this gateway.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects/{{project_id}}" } } }, { "name": "SetProjectGatewayURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing URL/hostname for a project gateway.\n\n The hostname (host part of the URL) must be globally UNIQUE across all\n project gateways in the platform; setting a hostname already bound to a\n different gateway is rejected with ALREADY_EXISTS.\n\n Behavior change (strict isolation): once any gateway in a data plane's\n workspace has its URL set, that data plane serves ONLY per-gateway\n host-scoped routes -- the default all-models route is suppressed, so\n clients must call the gateway hostname rather than the workspace's shared\n URL.\n\n Best practice: attach a project and assign its models BEFORE setting the\n URL. Setting a URL on a gateway with no attached project (or whose project\n has no assigned models) makes the gateway reachable but it will return 404\n for every request until a project with assigned models is attached. The\n response surfaces any such condition in the `warnings` field.\n\n Deprecated (fraser#8586): a data plane reports its own address from global.gateway.hostnames in its serve-helm values, and the management plane mirrors it read-only. This stays working in 0.6; removal is proposed for 0.8.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/url" } } }, { "name": "SetProjectGatewayWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Reassign a project gateway to a different dataplane (workspace).\n\n A data plane serves ONLY the hostnames of project gateways whose\n workspace_id matches its own (via per-gateway host-scoped routes plus the\n P10 authz map). Moving a gateway is therefore NOT a bare DB flip: this RPC\n tears down the gateway's per-gateway routes + authz binding on the OLD data\n plane and materializes them on the NEW one, refreshing both workspaces'\n authz maps and default-route suppression.\n\n The gateway's hostname is unchanged, so DNS is NOT moved automatically: the\n hostname still resolves to the OLD data plane's ingress until an operator\n repoints it. Until that cutover, requests to the hostname hit the old data\n plane (now torn down) and 404. The response ALWAYS includes a `warnings`\n entry reminding the operator to repoint DNS (and provision the new data\n plane's TLS cert). Recommended order: provision the new data plane's\n DNS/cert, call this RPC, then cut DNS over.\n\n Reassigning to the gateway's current workspace is a no-op. The new\n workspace must exist for the gateway's customer, and the gateway's slug\n must be free in the new workspace (a collision is rejected with\n ALREADY_EXISTS).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "workspace" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/workspace" } } }, { "name": "ListRetiringModels", "request": { "description": "ListRetiringModels lists the catalogue models the caller's organization\n is actually using (called in the last 30 days) whose retirement_date is\n inside the requested window (fraser#10229). Computed server-side from the\n catalogue lifecycle verdict and the usage rollups. Organization-scoped,\n never platform-wide.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "retiring-models" ], "raw": "{{baseUrl}}/admin/v1/retiring-models" } } }, { "name": "ListServiceAccounts", "request": { "description": "List service accounts", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts" ], "raw": "{{baseUrl}}/admin/v1/service-accounts" } } }, { "name": "CreateServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiUri\": \"https://example.com\",\n \"audience\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"internalApiKey\": \"example-value\",\n \"issuer\": \"https://example.com\",\n \"jwksUri\": \"https://example.com\",\n \"roles\": [\n \"string\"\n ],\n \"routerKey\": \"example-value\",\n \"routerUrl\": \"https://example.com\",\n \"scopes\": [\n \"string\"\n ],\n \"serveUrl\": \"https://example.com\",\n \"telemetryEndpoint\": \"https://example.com\",\n \"telemetryHeaders\": {\n \"key\": \"string\"\n },\n \"telemetryInsecure\": false,\n \"telemetryLocalVars\": {\n \"key\": \"string\"\n },\n \"telemetryProtocol\": \"\",\n \"telemetryTimeout\": \"30s\",\n \"validityDays\": 1,\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts" ], "raw": "{{baseUrl}}/admin/v1/service-accounts" } } }, { "name": "GetServiceAccount", "request": { "description": "Get service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}" } } }, { "name": "RestoreServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Restore service account\n Restores a revoked service account to active status.\n Only one active service account per customer_id + workspace_id is allowed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}:restore" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}:restore" } } }, { "name": "RevokeServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Revoke service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}:revoke" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}:revoke" } } }, { "name": "ClearSystemSetting", "request": { "description": "ClearSystemSetting stores an empty value under a URL key, which then reads\n back as not-found (tetrateio/fraser#7281). UpsertSystemSetting rejects an\n empty value, so this is the API write that unsets a URL. Only the\n \"proxy-url\" key and the \"dataplane-url:\" keys are accepted;\n any other key returns InvalidArgument.\n\n A clear of a \"dataplane-url:\" key is refused with FailedPrecondition when\n another organization uses the same data plane ID, like SetDataplaneURL. It\n leaves the data plane's default Project Gateway unchanged and sends the\n data plane its new URL configuration.\n\n Deprecated: a data plane declares its own hostnames from 0.7, and this goes\n with the stored data plane URL in a later release.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "GetSystemSetting", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "UpsertSystemSetting", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"ifAbsent\": false,\n \"value\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "ListTelemetryConfigs", "request": { "description": "List telemetry configs", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs" } } }, { "name": "CreateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"none\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"forwardIntervalSeconds\": 0,\n \"protocol\": \"grpc\",\n \"sinkUrl\": \"https://example.com\",\n \"telemetryType\": \"traces\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "Create telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs" } } }, { "name": "TestAuditForward", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"owner\": \"string\",\n \"protocol\": \"string\",\n \"sinkUrl\": \"https://example.com\"\n}" }, "description": "Test an audit-log SIEM sink by sending a synthetic OTLP-Logs record via the\n same path the forwarder uses (POST /v1/logs with the resolved auth). Proves\n the actual log endpoint + auth, unlike the trace-based bellhop tester.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "test-forward" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/test-forward" } } }, { "name": "TriggerAuditForward", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"owner\": \"string\"\n}" }, "description": "Trigger an immediate audit-log forward run (real-time push). The management\n plane kicks the in-process forwarder; the cron ticker is the backstop.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "trigger-forward" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/trigger-forward" } } }, { "name": "DeleteTelemetryConfig", "request": { "description": "Delete telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "GetTelemetryConfig", "request": { "description": "Get telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "UpdateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"none\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"forwardIntervalSeconds\": 0,\n \"protocol\": \"grpc\",\n \"sinkUrl\": \"https://example.com\",\n \"status\": \"connected\"\n}" }, "description": "Update telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "ListUserTokens", "request": { "description": "List user tokens", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens" ], "raw": "{{baseUrl}}/admin/v1/user-tokens" } } }, { "name": "CreateUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"expiresInDays\": 1,\n \"impersonate\": false,\n \"impersonationMetadata\": {\n \"context\": {\n \"key\": \"string\"\n },\n \"impersonatorKey\": \"example-value\",\n \"reason\": \"string\"\n },\n \"name\": \"example-name\",\n \"organizationUnit\": \"string\",\n \"projectId\": \"{{project_id}}\",\n \"role\": \"string\",\n \"scopes\": [\n \"string\"\n ],\n \"userId\": \"{{user_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create user token\n Generates a JWT token for user authentication with gatekeeper.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens" ], "raw": "{{baseUrl}}/admin/v1/user-tokens" } } }, { "name": "GetUserToken", "request": { "description": "Get user token", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens", "{{user_token_jti}}" ], "raw": "{{baseUrl}}/admin/v1/user-tokens/{{user_token_jti}}" } } }, { "name": "RevokeUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"reason\": \"string\"\n}" }, "description": "Revoke user token\n Revokes a user token by its JTI (JWT ID).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens", "{{user_token_jti}}:revoke" ], "raw": "{{baseUrl}}/admin/v1/user-tokens/{{user_token_jti}}:revoke" } } }, { "name": "ListWorkspaces", "request": { "description": "List workspaces", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces" ], "raw": "{{baseUrl}}/admin/v1/workspaces" } } }, { "name": "CreateWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces" ], "raw": "{{baseUrl}}/admin/v1/workspaces" } } }, { "name": "DeleteWorkspace", "request": { "description": "Delete workspace (soft delete)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "GetWorkspace", "request": { "description": "Get workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "UpdateWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"autoRepair\": false,\n \"autoUpgrade\": false,\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "description": "Update workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "SetWorkspaceProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Assign workspace to a project (or clear back to default project by omitting project_id)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}", "project" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}/project" } } }, { "name": "SetWorkspaceURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing gateway URL for a workspace data plane.\n Writes system_settings.dataplane-url: and optionally fires a PROXY_URL config event.\n\n Deprecated (fraser#8586): SetDataplaneURL, which superseded this call, is\n deprecated too. A data plane reports its own address from\n global.gateway.hostnames in its serve-helm values, and the management plane\n mirrors it read-only. This stays working in 0.6; removal is proposed for 0.8.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}/url" } } } ], "name": "agentrouter.admin.v1.AdminService" }, { "item": [ { "name": "DeleteClaimProjectBinding", "request": { "description": "Delete a claim-to-project binding.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "claim-project-bindings", "{{claim_project_binding_id}}" ], "raw": "{{baseUrl}}/admin/v1/claim-project-bindings/{{claim_project_binding_id}}" } } }, { "name": "GetPrivateAddressSettings", "request": { "description": "Read one organization's private-address settings: whether the management plane accepts a gateway auth policy's jwks_uri, and a project OIDC contract's issuer and discovered jwks_uri, on a non-public address for that organization. INHERIT means the organization follows the deployment's own setting.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "private-address-settings" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/private-address-settings" } } }, { "name": "SetPrivateAddressSettings", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"gatewayAuthJwks\": \"PRIVATE_ADDRESS_SETTING_INHERIT\",\n \"oidcDiscovery\": \"PRIVATE_ADDRESS_SETTING_INHERIT\"\n}" }, "description": "Change one organization's private-address settings. ALLOW lets the management plane accept a non-public address for that organization, DENY refuses one even while the deployment allows it, and INHERIT follows the deployment's own setting. A field left UNSPECIFIED keeps its stored value. The settings change what the management plane accepts only, so a data plane that fetches keys from a private address still needs its own environment variable. Refused with FAILED_PRECONDITION on SaaS.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "private-address-settings" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/private-address-settings" } } }, { "name": "ListGatewayAuthPolicies", "request": { "description": "List gateway auth policies for a (customer, project, gateway) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies" } } }, { "name": "CreateGatewayAuthPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"audiences\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"environmentClaim\": \"string\",\n \"extractionHeader\": \"string\",\n \"issuer\": \"string\",\n \"jwksInline\": {\n \"key\": 0\n },\n \"jwksUri\": \"https://example.com\",\n \"mechanism\": \"string\",\n \"name\": \"example-name\",\n \"projectGatewayId\": \"{{project_gateway_id}}\",\n \"projectId\": \"{{project_id}}\",\n \"requiredScopes\": [\n \"string\"\n ]\n}" }, "description": "Create a gateway auth policy (one authentication mechanism on a gateway).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies" } } }, { "name": "DeleteGatewayAuthPolicy", "request": { "description": "Delete (soft) a gateway auth policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{gateway_auth_policy_id}}" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{gateway_auth_policy_id}}" } } }, { "name": "GetGatewayAuthPolicy", "request": { "description": "Get a gateway auth policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{gateway_auth_policy_id}}" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{gateway_auth_policy_id}}" } } }, { "name": "UpdateGatewayAuthPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"audiences\": [\n \"string\"\n ],\n \"enabled\": false,\n \"environmentClaim\": \"string\",\n \"extractionHeader\": \"string\",\n \"issuer\": \"string\",\n \"jwksInline\": {\n \"key\": 0\n },\n \"jwksUri\": \"https://example.com\",\n \"mechanism\": \"string\",\n \"requiredScopes\": [\n \"string\"\n ]\n}" }, "description": "Update a gateway auth policy's provider config + enabled flag.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{gateway_auth_policy_id}}" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{gateway_auth_policy_id}}" } } }, { "name": "ListClaimProjectBindings", "request": { "description": "List the claim-to-project bindings of a policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{policy_id}}", "project-bindings" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{policy_id}}/project-bindings" } } }, { "name": "CreateClaimProjectBinding", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"boundProjectId\": \"string\",\n \"claimName\": \"example-name\",\n \"claimValue\": \"string\"\n}" }, "description": "Bind a claim value to a project under a policy. A token call that sends no x-tars-project acts in that project when the token the policy verified carries the value in the claim.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{policy_id}}", "project-bindings" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{policy_id}}/project-bindings" } } }, { "name": "ListIdentityMappingRules", "request": { "description": "List identity mapping rules for a policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{policy_id}}", "rules" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{policy_id}}/rules" } } }, { "name": "CreateIdentityMappingRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"claimName\": \"example-name\",\n \"claimValueTemplate\": \"string\",\n \"jitPrincipalCap\": 0,\n \"jitProjectId\": \"string\",\n \"matchEveryClaimValue\": false,\n \"principalType\": \"string\",\n \"target\": \"string\"\n}" }, "description": "Create an identity mapping rule under a policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "gateway-auth-policies", "{{policy_id}}", "rules" ], "raw": "{{baseUrl}}/admin/v1/gateway-auth-policies/{{policy_id}}/rules" } } }, { "name": "DeleteIdentityMappingRule", "request": { "description": "Delete an identity mapping rule.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "identity-mapping-rules", "{{identity_mapping_rule_id}}" ], "raw": "{{baseUrl}}/admin/v1/identity-mapping-rules/{{identity_mapping_rule_id}}" } } } ], "name": "agentrouter.admin.v1.GatewayAuthPolicyService" }, { "item": [ { "name": "List", "request": { "description": "List lists BYOK keys registered under a project. Returns metadata\n only -- id, provider, name, display_suffix, creation timestamp, and\n revocation timestamp if revoked. The result includes the project's\n shared keys plus the caller's own user-scoped keys (other users'\n user-scoped keys are not returned). Each key also carries its\n traffic_preference. With include_legacy, it also includes the caller's\n own active legacy keys, marked legacy, with an empty customer_id and\n project_id.\n\n Scope: account-tier; membership is enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys" } } }, { "name": "Register", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\",\n \"preference\": \"string\",\n \"provider\": \"PROVIDER_OPENAI\",\n \"secret\": \"example-value\",\n \"userScope\": false\n}" }, "description": "Register encrypts and stores a provider API key under a project.\n After this call, inference requests routed to the matching provider\n for this project will use this key.\n\n Scope: account-tier so any project member can register their OWN\n user-scoped key (user_scope=true). Registering a PROJECT-level key\n (user_scope=false) additionally requires the caller to be the\n project's owner -- enforced in-handler against project_members.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys" } } }, { "name": "Revoke", "request": { "description": "Revoke marks the key revoked; subsequent Fetches return\n permission_denied. Inflight cached keys on dataplanes invalidate\n within sub-second via the revocation channel (milestone C).\n\n Scope: account-tier so a member can revoke their OWN user-scoped key.\n Revoking a PROJECT-level key additionally requires project ownership\n (enforced in-handler); a member may never revoke another user's\n user-scoped key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys", "{{aikey_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys/{{aikey_id}}" } } }, { "name": "Get", "request": { "description": "Get returns the metadata record for a single BYOK key. Never returns\n the plaintext.\n\n Scope: account-tier. Any project member may read keys in the project\n (project-level and the caller's own user-scoped keys); membership is\n enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys", "{{aikey_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys/{{aikey_id}}" } } }, { "name": "GetTrafficSettings", "request": { "description": "GetTrafficSettings returns the BYOK traffic pool for one provider in a\n project: every key the caller's own inference traffic can be served by,\n with its stored traffic_weight / traffic_order / traffic_preference.\n\n The pool is the UNION the route generator actually builds for the caller\n (materializedBYOKKeys): the caller's legacy per-user keys plus the\n project's effective keys for the provider (the caller's own user-scoped\n keys when they have any, otherwise the project-level keys). Revoked rows\n are excluded -- they have no dataplane backend, so they must neither\n absorb a share of a split nor appear in a failover ladder.\n\n Scope: account-tier; membership is enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys:traffic" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys:traffic" } } }, { "name": "UpdateTrafficSettings", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"preference\": \"string\",\n \"provider\": \"PROVIDER_OPENAI\",\n \"settings\": [\n {\n \"keyId\": \"{{key_id}}\",\n \"order\": 0,\n \"weight\": 0\n }\n ]\n}" }, "description": "UpdateTrafficSettings rewrites the placement of keys in one provider's\n BYOK pool -- the load-balance weights, the failover order, and the\n pool-wide usage preference.\n\n Only rows the caller OWNS are writable: a shared project key another\n member registered is returned by GetTrafficSettings (it serves the\n caller's traffic) but naming it here is rejected rather than silently\n dropped. Rows the request does not name keep their current placement.\n\n Scope: account-tier; membership is enforced in-handler, and rewriting a\n PROJECT-level (shared) key additionally requires project ownership --\n the same split Register and Revoke apply.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys:traffic" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys:traffic" } } } ], "name": "agentrouter.aikeys.v1.AiKeysService" }, { "item": [ { "name": "ListAlertDestinations", "request": { "description": "ListAlertDestinations returns every destination for the workspace,\n newest first.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "dataplanes", "{{workspace_id}}", "alert-destinations" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/dataplanes/{{workspace_id}}/alert-destinations" } } }, { "name": "CreateAlertDestination", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"classes\": [\n \"ALERT_SEVERITY_CLASS_PAGE\"\n ],\n \"enabled\": false,\n \"secret\": \"example-value\",\n \"type\": \"ALERT_DESTINATION_TYPE_SLACK\"\n}" }, "description": "CreateAlertDestination stores the credential through the secret service\n and then inserts the destination row referencing it.\n\n Returns INVALID_ARGUMENT when the type is unspecified, when the secret is\n empty or (for a webhook) not the {url, signing_key} object, or when the\n resulting URL names a non-public host.\n\n Every destination type is accepted here, PagerDuty included. The\n dashboard's own create form offers only Slack and webhook, so a PagerDuty\n destination is created through this API rather than through that form.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "dataplanes", "{{workspace_id}}", "alert-destinations" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/dataplanes/{{workspace_id}}/alert-destinations" } } }, { "name": "TestSendAlert", "request": { "description": "TestSendAlert appends one synthetic, already-closed alert event for the\n workspace, which the dispatcher then fans out to every enabled\n destination whose classes include \"notify\".\n\n It exercises the workspace's whole delivery pipeline rather than one\n destination: alert_events carries no destination_id by design, because\n alert_deliveries is the per-destination fan-out.\n\n Gated on alert_destinations.EDIT rather than an atom of its own. It\n writes no destination state, but it makes every destination in the\n workspace emit a real delivery, so the right bar is \"may change this\n workspace's alert routing\" -- which .edit already means. There is\n deliberately no fifth atom.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "dataplanes", "{{workspace_id}}", "alert-destinations", "test-send" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/dataplanes/{{workspace_id}}/alert-destinations/test-send" } } }, { "name": "DeleteAlertDestination", "request": { "description": "DeleteAlertDestination removes the destination and then purges its\n credential. Returns NOT_FOUND when no such destination exists in this\n workspace.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "dataplanes", "{{workspace_id}}", "alert-destinations", "{{alert_destination_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/dataplanes/{{workspace_id}}/alert-destinations/{{alert_destination_id}}" } } }, { "name": "UpdateAlertDestination", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"classes\": {\n \"classes\": [\n \"ALERT_SEVERITY_CLASS_PAGE\"\n ]\n },\n \"enabled\": false\n}" }, "description": "UpdateAlertDestination applies a partial update to the two mutable\n fields, `classes` and `enabled`. The type and the credential are set once\n at creation and are not reachable from here.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "dataplanes", "{{workspace_id}}", "alert-destinations", "{{alert_destination_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/dataplanes/{{workspace_id}}/alert-destinations/{{alert_destination_id}}" } } } ], "name": "agentrouter.alerting.v1.AlertDestinationService" }, { "item": [ { "name": "ListApiKeys", "request": { "description": "ListApiKeys returns API-key metadata.\n\n A request that names no customer_id reads the platform-wide directory,\n which includes soft-deleted keys for historical spend attribution. It\n needs the platform admin scope or api_key_directory.read on a platform\n binding.\n\n A request that names customer_id (and optionally project_id) reads only\n the keys of that tenant. api_key_directory.read on that customer or\n project authorizes it, so an org admin or a project owner can list the\n keys in their scope. api_keys.read does not: the read and write\n management keys and the Viewer hold it for the lookup RPCs. The organization-admin lift that the acting user of the\n Admin Console receives is never applied to this RPC.\n\n Filter by project_id and application_keys_only to find the key that serves\n one application; disabling that key with UpdateApiKey stops the application.\n\n A request that sets only page, name, project_id and application_keys_only\n keeps the legacy behaviour: UUID keyset pages, every status, no summary.\n Any other field switches to offset pages with filters, sorting and an\n optional summary.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys" ], "raw": "{{baseUrl}}/v1/api-keys" } } }, { "name": "CreateApiKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"name\": \"example-name\",\n \"userId\": \"{{user_id}}\",\n \"userKeyAddress\": \"example-value\"\n}" }, "description": "CreateApiKey creates a new JWT user-token API key for a user and returns the plaintext token exactly once.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys" ], "raw": "{{baseUrl}}/v1/api-keys" } } }, { "name": "DeleteApiKey", "request": { "description": "DeleteApiKey soft-deletes an API key (sets deleted_at).\n\n customer_id and project_id authorize the call as on UpdateApiKey, with\n api_keys.delete. The delete and its DELETE_API_KEY audit record commit\n together.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/api-keys/{{key_id}}" } } }, { "name": "UpdateApiKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"failIfRevoked\": false,\n \"isActive\": false,\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"recordDisabledBy\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "UpdateApiKey updates mutable fields of an API key (name and/or active state).\n\n When the request names customer_id (and optionally project_id), that\n tenant is the authorization target: api_keys.edit on it authorizes the\n call, and a key outside it returns NOT_FOUND. A caller whose admin scope\n comes only from the Admin Console's organization lift also needs\n api_keys.edit on the key's own customer or project, or the call returns\n NOT_FOUND. The change and its UPDATE_API_KEY audit record commit together.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/api-keys/{{key_id}}" } } }, { "name": "ListApiKeys", "request": { "description": "ListApiKeys returns API-key metadata.\n\n A request that names no customer_id reads the platform-wide directory,\n which includes soft-deleted keys for historical spend attribution. It\n needs the platform admin scope or api_key_directory.read on a platform\n binding.\n\n A request that names customer_id (and optionally project_id) reads only\n the keys of that tenant. api_key_directory.read on that customer or\n project authorizes it, so an org admin or a project owner can list the\n keys in their scope. api_keys.read does not: the read and write\n management keys and the Viewer hold it for the lookup RPCs. The organization-admin lift that the acting user of the\n Admin Console receives is never applied to this RPC.\n\n Filter by project_id and application_keys_only to find the key that serves\n one application; disabling that key with UpdateApiKey stops the application.\n\n A request that sets only page, name, project_id and application_keys_only\n keeps the legacy behaviour: UUID keyset pages, every status, no summary.\n Any other field switches to offset pages with filters, sorting and an\n optional summary.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys" } } }, { "name": "ListApiKeys", "request": { "description": "ListApiKeys returns API-key metadata.\n\n A request that names no customer_id reads the platform-wide directory,\n which includes soft-deleted keys for historical spend attribution. It\n needs the platform admin scope or api_key_directory.read on a platform\n binding.\n\n A request that names customer_id (and optionally project_id) reads only\n the keys of that tenant. api_key_directory.read on that customer or\n project authorizes it, so an org admin or a project owner can list the\n keys in their scope. api_keys.read does not: the read and write\n management keys and the Viewer hold it for the lookup RPCs. The organization-admin lift that the acting user of the\n Admin Console receives is never applied to this RPC.\n\n Filter by project_id and application_keys_only to find the key that serves\n one application; disabling that key with UpdateApiKey stops the application.\n\n A request that sets only page, name, project_id and application_keys_only\n keeps the legacy behaviour: UUID keyset pages, every status, no summary.\n Any other field switches to offset pages with filters, sorting and an\n optional summary.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "api-keys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/api-keys" } } } ], "name": "agentrouter.api_keys.v1.ApiKeysService" }, { "item": [ { "name": "GetJWKS", "request": { "description": "JWKS endpoint.\n Public endpoint - no authentication required.\n Returns JSON Web Key Set for verifying JWT tokens.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ ".well-known", "jwks.json" ], "raw": "{{baseUrl}}/.well-known/jwks.json" } } } ], "name": "agentrouter.auth.v1.AuthService" }, { "item": [ { "name": "ListEmailDomainPolicies", "request": { "description": "ListEmailDomainPolicies returns one page of policies, the number of\n matches, and the counts of every policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies" } } }, { "name": "CreateEmailDomainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"category\": \"EMAIL_DOMAIN_CATEGORY_PUBLIC_FREE\",\n \"customerId\": \"{{customer_id}}\",\n \"domain\": \"string\",\n \"isActive\": false,\n \"reason\": \"string\"\n}" }, "description": "CreateEmailDomainPolicy adds a policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies" } } }, { "name": "GetEmailDomainPolicy", "request": { "description": "GetEmailDomainPolicy returns one policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies", "{{email_domain_policy_id}}" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies/{{email_domain_policy_id}}" } } }, { "name": "UpdateEmailDomainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"category\": \"EMAIL_DOMAIN_CATEGORY_PUBLIC_FREE\",\n \"customerId\": \"{{customer_id}}\",\n \"domain\": \"string\",\n \"isActive\": false,\n \"lastReviewedAt\": \"2023-01-15T01:30:15.01Z\",\n \"reason\": \"string\"\n}" }, "description": "UpdateEmailDomainPolicy changes the fields the request sets.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies", "{{email_domain_policy_id}}" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies/{{email_domain_policy_id}}" } } }, { "name": "DeactivateEmailDomainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\"\n}" }, "description": "DeactivateEmailDomainPolicy stops a policy from applying. The policy is\n kept; UpdateEmailDomainPolicy with is_active=true turns it back on.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies", "{{email_domain_policy_id}}:deactivate" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies/{{email_domain_policy_id}}:deactivate" } } }, { "name": "ExportEmailDomainPolicies", "request": { "description": "ExportEmailDomainPolicies returns every policy that matches the filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies:export" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies:export" } } }, { "name": "ImportEmailDomainPolicies", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"previewSampleLimit\": 0,\n \"rows\": [\n {\n \"category\": \"EMAIL_DOMAIN_CATEGORY_PUBLIC_FREE\",\n \"domain\": \"string\",\n \"isActive\": false,\n \"reason\": \"string\"\n }\n ],\n \"validateOnly\": false\n}" }, "description": "ImportEmailDomainPolicies creates and updates policies from a file. Each\n valid row is written; each row that fails is reported, and the others\n still commit. validate_only previews the import and writes nothing.\n Requests up to 64 MiB are accepted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "billing", "email-domain-policies:import" ], "raw": "{{baseUrl}}/v1/billing/email-domain-policies:import" } } } ], "name": "agentrouter.billing.v1.EmailDomainPolicyAdminService" }, { "item": [ { "name": "ListModels", "request": { "description": "ListModels returns catalog models in one response, optionally filtered\n to a single provider via the provider_id query parameter. The list is\n not paginated: every page field is ignored, and next_page_token is\n always empty.\n\n Naming customer_id makes this a tenant-path read: the caller is\n authorized at that customer and the response is redacted (see\n ListModelsRequest.customer_id). The rows are the same global catalog\n either way.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models" ], "raw": "{{baseUrl}}/v1/catalog/models" } } }, { "name": "UpsertModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"additionalPricePerMillion\": {\n \"key\": 0\n },\n \"backendUrls\": [\n \"https://example.com\"\n ],\n \"cacheReadPerMillion\": \"string\",\n \"cachingPerMillion\": \"string\",\n \"capabilities\": [\n \"string\"\n ],\n \"clearFields\": [\n \"string\"\n ],\n \"inputModalities\": [\n \"string\"\n ],\n \"inputPerMillion\": \"string\",\n \"isEnabled\": false,\n \"limits\": {\n \"key\": 0\n },\n \"maxContextTokens\": 0,\n \"maxCostPerRequest\": \"string\",\n \"metadata\": {\n \"key\": 0\n },\n \"mode\": \"string\",\n \"name\": \"example-name\",\n \"outputModalities\": [\n \"string\"\n ],\n \"outputPerMillion\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"removeMetadataKeys\": [\n \"example-value\"\n ],\n \"suppressRouteRegen\": false,\n \"upstreamModel\": \"string\"\n}" }, "description": "UpsertModel creates or fully replaces a model record.\n\n The provider must already exist (FAILED_PRECONDITION otherwise), and\n must be enabled if this model is going to be enabled -- an enabled\n model under a disabled provider could never become routable, yet\n would read as available. Writing an explicitly DISABLED model under a\n disabled provider is allowed: neither appears in any route map, so\n nothing is misrepresented, and it is how a catalog sync stages a\n provider's models before an operator turns the provider on.\n\n A successful write propagates to the gateway automatically\n (no separate publish step): the model appears in the data plane's\n /v1/models and becomes promptable once the refreshed configuration\n lands. Poll /v1/models to confirm. The exception is\n `suppress_route_regen`, which defers that propagation to the\n caller's own configurator.TriggerUpdate.\n\n `is_enabled` is tri-state: omit it and the stored value is left\n alone, so a model an operator disabled is not silently re-enabled by\n a later write. A new model defaults to enabled.\n\n On update, a field left empty keeps its stored value. To clear a\n stored value, name the field in clear_fields; to remove a metadata\n key, name it in remove_metadata_keys. A request that sets neither\n writes exactly as before.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models" ], "raw": "{{baseUrl}}/v1/catalog/models" } } }, { "name": "DeleteModel", "request": { "description": "DeleteModel removes a model entry, along with its project assignments,\n in one transaction.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/catalog/models/{{model_id}}" } } }, { "name": "GetModel", "request": { "description": "GetModel returns a single model by id (UUID) or by unique model name,\n including its pricing, context window, capabilities, modalities, and limits.\n\n Naming customer_id makes this a tenant-path read, with the same\n authorization and redaction as ListModels.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/catalog/models/{{model_id}}" } } }, { "name": "CreateModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"additionalPricePerMillion\": {\n \"key\": 0\n },\n \"backendUrls\": [\n \"https://example.com\"\n ],\n \"cacheReadPerMillion\": \"string\",\n \"cachingPerMillion\": \"string\",\n \"capabilities\": [\n \"string\"\n ],\n \"inputModalities\": [\n \"string\"\n ],\n \"inputPerMillion\": \"string\",\n \"isEnabled\": false,\n \"limits\": {\n \"key\": 0\n },\n \"maxContextTokens\": 0,\n \"maxCostPerRequest\": \"string\",\n \"metadata\": {\n \"key\": 0\n },\n \"mode\": \"string\",\n \"name\": \"example-name\",\n \"outputModalities\": [\n \"string\"\n ],\n \"outputPerMillion\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"upstreamModel\": \"string\"\n}" }, "description": "CreateModel adds a new model. It never changes an existing one: when a\n model with this (provider_id, name) already exists it returns\n ALREADY_EXISTS and writes nothing. Use UpsertModel to edit a model.\n\n It is not idempotent. A client that retries after a lost response and\n gets ALREADY_EXISTS cannot tell its own first write from someone\n else's; it should read the model with GetModel and compare.\n\n The provider rules, the enabled default and the route regeneration are\n the same as for UpsertModel. The provider rules are checked first, so a\n create under a disabled provider that leaves is_enabled unset returns\n FAILED_PRECONDITION even when the model already exists.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models:create" ], "raw": "{{baseUrl}}/v1/catalog/models:create" } } }, { "name": "ListProviders", "request": { "description": "ListProviders returns the registered AI providers in one response:\n the list is not paginated. Every page field (page_size, page_token,\n filter, order_by) is ignored, and next_page_token is always empty.\n\n Naming customer_id makes this a tenant-path read: the caller is\n authorized at that customer and the response is redacted (see\n Provider.credential_suffix and Provider.metadata). The rows are the\n same global catalog either way.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/catalog/providers" } } }, { "name": "UpsertProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"baseUrl\": \"https://example.com\",\n \"displayName\": \"example-name\",\n \"id\": \"string\",\n \"isEnabled\": false,\n \"metadata\": {\n \"key\": 0\n },\n \"removeMetadataKeys\": [\n \"example-value\"\n ],\n \"supportedAuthSchemes\": [\n \"string\"\n ],\n \"suppressRouteRegen\": false\n}" }, "description": "UpsertProvider creates a provider or updates an existing one.\n\n On update, a field left empty keeps its stored value, so\n `{id, is_enabled}` alone toggles availability. The slug rule,\n display_name and base_url are enforced only when this call creates the\n provider. `metadata` merges key by key, and remove_metadata_keys\n removes keys: see UpsertProviderRequest.\n\n `is_enabled` is tri-state: omit it and the stored value is left\n alone (a provider an operator disabled stays disabled). A new\n provider defaults to disabled -- the data plane does not reconcile\n an AIServiceBackend or fetch credentials for it until it is both\n enabled and credentialed via SetProviderCredential.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/catalog/providers" } } }, { "name": "DeleteProvider", "request": { "description": "DeleteProvider removes a provider, along with the project assignments that\n granted access to it. Refuses while any model still references it, while any\n BYOK API key is registered against it (revoke those keys first), or when it\n is the only provider assigned to a project that still has models assigned.\n On success, any revoked BYOK keys for this provider and their stored secrets\n are permanently removed, and the provider's own stored credential is retired.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}" } } }, { "name": "GetProvider", "request": { "description": "GetProvider returns a single provider by id.\n\n Naming customer_id makes this a tenant-path read, with the same\n authorization and redaction as ListProviders.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}" } } }, { "name": "DeleteProviderCredential", "request": { "description": "DeleteProviderCredential removes the provider's stored platform\n credential. Afterwards has_credential is false, credential_suffix is\n empty, and the data plane stops sending the key. Idempotent: calling it\n for a provider with no credential succeeds and changes nothing.\n\n Refuses with FAILED_PRECONDITION while the provider is enabled and its\n auth type needs a key; disable the provider first. `aws` (the data\n plane falls back to its IAM role) and `none` are exempt.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}", "credential" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}/credential" } } }, { "name": "SetProviderCredential", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"credential\": \"string\"\n}" }, "description": "SetProviderCredential stores or rotates the credential used to\n authenticate requests to this provider. The plaintext is never\n returned; the provider's credential_suffix reflects the last 4\n characters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}", "credential" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}/credential" } } }, { "name": "CreateProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"baseUrl\": \"https://example.com\",\n \"displayName\": \"example-name\",\n \"id\": \"string\",\n \"isEnabled\": false,\n \"metadata\": {\n \"key\": 0\n },\n \"supportedAuthSchemes\": [\n \"string\"\n ]\n}" }, "description": "CreateProvider adds a new provider. It never changes an existing one:\n when a provider with this id already exists it returns ALREADY_EXISTS\n and writes nothing. Use UpsertProvider to edit a provider.\n\n It is not idempotent. A client that retries after a lost response and\n gets ALREADY_EXISTS cannot tell its own first write from someone\n else's; it should read the provider with GetProvider and compare.\n\n The provider is created disabled unless is_enabled is true. Enable a\n provider whose auth scheme needs a key only after SetProviderCredential:\n the data plane fetches the credential of every enabled provider. A\n successful create regenerates routes, as UpsertProvider does.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers:create" ], "raw": "{{baseUrl}}/v1/catalog/providers:create" } } }, { "name": "GetCatalogSyncState", "request": { "description": "GetCatalogSyncState returns this plane's catalog sync record.\n\n Never NotFound: a plane that has never recorded a sync returns a state\n with both timestamps unset, which is itself the answer -- \"no sync has\n ever run here\" is a different and more actionable report than an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/v1/catalog/sync-state" } } }, { "name": "RecordCatalogSync", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"applied\": false,\n \"applyMode\": false,\n \"catalogVersion\": \"string\",\n \"modelsWritten\": 0,\n \"providersWritten\": 0,\n \"sources\": [\n {\n \"display\": \"string\",\n \"pinned\": false,\n \"sha256\": \"string\"\n }\n ]\n}" }, "description": "RecordCatalogSync persists what the last catalog sync saw and did.\n\n A sync runs in the client: it fetches a published catalog, compares it\n with this management plane and writes the difference. The catalog version\n that drove a run is only known to that client, and a report-only run\n changes nothing the server could observe, so a run reports itself here.\n\n How the record advances:\n\n - checked_at / checked_version advance on every recorded run, including\n report-only ones. They say when this plane last looked at a published\n catalog, and which one.\n - applied_at / applied_version advance only when `applied` is set, which\n means the run wrote the catalog and left nothing unwritten. They say\n which published catalog this plane is actually on.\n\n The two together are the drift an operator acts on: the published catalog\n is at version X, this plane is on version Y, applied N days ago.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/v1/catalog/sync-state" } } }, { "name": "ListModels", "request": { "description": "ListModels returns catalog models in one response, optionally filtered\n to a single provider via the provider_id query parameter. The list is\n not paginated: every page field is ignored, and next_page_token is\n always empty.\n\n Naming customer_id makes this a tenant-path read: the caller is\n authorized at that customer and the response is redacted (see\n ListModelsRequest.customer_id). The rows are the same global catalog\n either way.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "catalog", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/catalog/models" } } }, { "name": "GetModel", "request": { "description": "GetModel returns a single model by id (UUID) or by unique model name,\n including its pricing, context window, capabilities, modalities, and limits.\n\n Naming customer_id makes this a tenant-path read, with the same\n authorization and redaction as ListModels.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/catalog/models/{{model_id}}" } } }, { "name": "ListProviders", "request": { "description": "ListProviders returns the registered AI providers in one response:\n the list is not paginated. Every page field (page_size, page_token,\n filter, order_by) is ignored, and next_page_token is always empty.\n\n Naming customer_id makes this a tenant-path read: the caller is\n authorized at that customer and the response is redacted (see\n Provider.credential_suffix and Provider.metadata). The rows are the\n same global catalog either way.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/catalog/providers" } } }, { "name": "GetProvider", "request": { "description": "GetProvider returns a single provider by id.\n\n Naming customer_id makes this a tenant-path read, with the same\n authorization and redaction as ListProviders.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/catalog/providers/{{provider_id}}" } } }, { "name": "ListProjectModels", "request": { "description": "ListProjectModels returns every catalog model assigned to a project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "AssignModelToProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelId\": \"{{model_id}}\"\n}" }, "description": "AssignModelToProject grants a project access to a catalog model.\n Idempotent: re-assigning a model is a no-op.\n\n The model's provider must be enabled (FAILED_PRECONDITION otherwise) --\n a model under a disabled provider is absent from the route map and could\n not be served.\n\n Propagates automatically to any Project Gateway attached to the\n project (per-gateway route maps serve only assigned models); no\n separate publish step is needed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "UnassignModelFromProject", "request": { "description": "UnassignModelFromProject removes a project's access to a catalog model.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models/{{model_id}}" } } } ], "name": "agentrouter.catalog.v1.CatalogService" }, { "item": [ { "name": "GetApiKeySettings", "request": { "description": "GetApiKeySettings returns the per-key settings of an API key the caller\n owns: the global fallback and the token rate limit. The settings belong to\n the key's client, so every key of the client shares them.\n\n A key that does not exist, or that belongs to another user, returns\n NOT_FOUND.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "api-keys", "{{api_key_id}}", "settings" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/api-keys/{{api_key_id}}/settings" } } }, { "name": "UpdateApiKeySettings", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"globalFallbackEnabled\": false,\n \"rateLimit\": {\n \"enabled\": false,\n \"inputTokensPerHour\": 1,\n \"outputTokensPerHour\": 1,\n \"totalTokensPerHour\": 1\n }\n}" }, "description": "UpdateApiKeySettings changes the per-key settings of an API key the caller\n owns, for every key of its client. Only the fields that are set change.\n The new settings reach the data plane of every active key of the client.\n\n An API_KEY-scoped rate-limit policy writes the same rate limit when it\n changes, and deletes it when it is deactivated or deleted. The last write\n wins.\n\n A key that does not exist, or that belongs to another user, returns\n NOT_FOUND. A request that sets no field, or a rate limit out of range,\n returns INVALID_ARGUMENT.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "api-keys", "{{api_key_id}}", "settings" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/api-keys/{{api_key_id}}/settings" } } }, { "name": "ListClients", "request": { "description": "ListClients returns every client owned by the caller within the\n given (customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients" } } }, { "name": "CreateClientWithKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"keyName\": \"example-name\",\n \"title\": \"string\"\n}" }, "description": "CreateClientWithKey creates a new client and a new API key attached\n 1:1 (client_id == key_id at bootstrap).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients" } } }, { "name": "DeleteClient", "request": { "description": "DeleteClient soft-deletes a client the caller owns. It returns\n FAILED_PRECONDITION while a key version of the client is still live\n (neither destroyed nor deleted): destroy the versions first. The delete\n and its DELETE_CLIENT audit record commit together.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "GetClient", "request": { "description": "GetClient returns a single client by id within the scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "UpdateClientTitle", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"title\": \"string\"\n}" }, "description": "UpdateClientTitle updates the editable client title.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "AddKeyToClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"keyId\": \"{{key_id}}\"\n}" }, "description": "AddKeyToClient attaches an existing key to a client. A key still in the\n default project is moved into the client's project.\n\n Fails with FAILED_PRECONDITION when the key would leave a client that\n other keys stay in and whose per-key budget is active: that budget\n sums the client's current keys, so the move would carry the key's\n accrued spend out of it. Deactivate the budget first, then attach.\n\n Fails with ALREADY_EXISTS when the key carries its own per-key budget\n and the client already holds an active one at the same intent: a\n standalone key's budget moves with it, and two cannot govern one\n client. The attachment is rolled back with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys" } } }, { "name": "RotateKeyInClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"destroyAfter\": \"string\",\n \"disableAfter\": \"string\",\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"keyName\": \"example-name\",\n \"oldKeyDestroyAt\": \"2023-01-15T01:30:15.01Z\",\n \"oldKeyDisableAt\": \"2023-01-15T01:30:15.01Z\",\n \"oldKeyId\": \"example-value\",\n \"userKeyAddress\": \"example-value\"\n}" }, "description": "RotateKeyInClient creates a new key attached to client_id and may\n schedule the prior key's disable/destroy lifecycle.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "rotate" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/rotate" } } }, { "name": "DestroyKeyVersionInClient", "request": { "description": "DestroyKeyVersionInClient permanently destroys a key version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}" } } }, { "name": "DisableKeyVersionInClient", "request": { "description": "DisableKeyVersionInClient disables a key version immediately (reversible).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "disable" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/disable" } } }, { "name": "EmergencyRevokeKeyVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"generateReplacement\": false,\n \"replacementEnterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"replacementKeyName\": \"example-name\",\n \"replacementUserKeyAddress\": \"example-value\"\n}" }, "description": "EmergencyRevokeKeyVersion disables a key immediately and optionally\n creates a replacement.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "emergency-revoke" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/emergency-revoke" } } }, { "name": "EnableKeyVersionInClient", "request": { "description": "EnableKeyVersionInClient re-enables a disabled key version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "enable" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/enable" } } } ], "name": "agentrouter.clients.v1.ClientsService" }, { "item": [ { "name": "GetPublishedContent", "request": { "description": "GetPublishedContent returns the published version of a kind, or one file\n of the published sign-in content. It needs no credential: the sign-in\n page shows it before anyone signs in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "published" ], "raw": "{{baseUrl}}/v1/content/published" } } }, { "name": "ListContentVersions", "request": { "description": "ListContentVersions returns the versions of a kind, newest first.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions" ], "raw": "{{baseUrl}}/v1/content/versions" } } }, { "name": "CreateContentVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"version\": {\n \"kind\": \"CONTENT_KIND_ANNOUNCEMENT\",\n \"announcement\": {\n \"backgroundColor\": \"string\",\n \"endDate\": \"2023-01-15T01:30:15.01Z\",\n \"link\": \"string\",\n \"linkText\": \"string\",\n \"showLinkOnAuthPages\": false,\n \"startDate\": \"2023-01-15T01:30:15.01Z\",\n \"textColor\": \"string\",\n \"title\": \"string\"\n }\n }\n}" }, "description": "CreateContentVersion adds a version that is not published.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions" ], "raw": "{{baseUrl}}/v1/content/versions" } } }, { "name": "DeleteContentVersion", "request": { "description": "DeleteContentVersion deletes a version that is not published. A\n published version returns FAILED_PRECONDITION.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions", "{{version_id}}" ], "raw": "{{baseUrl}}/v1/content/versions/{{version_id}}" } } }, { "name": "GetContentVersion", "request": { "description": "GetContentVersion returns one version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions", "{{version_id}}" ], "raw": "{{baseUrl}}/v1/content/versions/{{version_id}}" } } }, { "name": "UpdateContentVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"version\": {\n \"kind\": \"CONTENT_KIND_ANNOUNCEMENT\",\n \"announcement\": {\n \"backgroundColor\": \"string\",\n \"endDate\": \"2023-01-15T01:30:15.01Z\",\n \"link\": \"string\",\n \"linkText\": \"string\",\n \"showLinkOnAuthPages\": false,\n \"startDate\": \"2023-01-15T01:30:15.01Z\",\n \"textColor\": \"string\",\n \"title\": \"string\"\n }\n }\n}" }, "description": "UpdateContentVersion replaces the body of a version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions", "{{version_id}}" ], "raw": "{{baseUrl}}/v1/content/versions/{{version_id}}" } } }, { "name": "PublishContentVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"kind\": \"CONTENT_KIND_ANNOUNCEMENT\"\n}" }, "description": "PublishContentVersion publishes a version, and unpublishes the version\n of the same kind that was published, in one step.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions", "{{version_id}}:publish" ], "raw": "{{baseUrl}}/v1/content/versions/{{version_id}}:publish" } } }, { "name": "UnpublishContentVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"kind\": \"CONTENT_KIND_ANNOUNCEMENT\"\n}" }, "description": "UnpublishContentVersion unpublishes a version. Then no content of its\n kind shows.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "content", "versions", "{{version_id}}:unpublish" ], "raw": "{{baseUrl}}/v1/content/versions/{{version_id}}:unpublish" } } } ], "name": "agentrouter.content.v1.ContentService" }, { "item": [ { "name": "ListGuardrailProviders", "request": { "description": "ListGuardrailProviders returns the providers visible in the requested\n scope: the project's own instances plus the global rows. Catalog\n templates are omitted unless include_templates is set.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/providers" } } }, { "name": "CreateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreateGuardrailProvider registers a new provider instance in the\n requested scope. Any accepted `kind` may be created, including the kinds\n the catalog templates use. Returns ALREADY_EXISTS when the name is taken\n in that scope, and INVALID_ARGUMENT for an unaccepted kind, a\n configuration the kind cannot be built from, or a credential in `config`.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/providers" } } }, { "name": "DeleteGuardrailProvider", "request": { "description": "DeleteGuardrailProvider soft-deletes a user-defined provider (sets\n deleted_at; the row disappears from List/Get). Historical trigger records\n referencing this provider REMAIN queryable.\n Returns PERMISSION_DENIED for a global row or a catalog template (both\n are read-only), and NOT_FOUND when no such provider is visible in the\n requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "GetGuardrailProvider", "request": { "description": "GetGuardrailProvider returns a single provider by id, from the project's\n own instances or the global rows. Returns NOT_FOUND when no such provider\n is visible in the requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "SetGuardrailProviderSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "null" }, "description": "SetGuardrailProviderSecret stores the credential a provider authenticates\n to its backing service with. This is the ONLY way a credential enters the\n system: it is never accepted in GuardrailProvider.config.\n\n A request carries exactly one credential: `aws_credentials` for a\n \"bedrockguardrails\" provider, `api_key` for every other kind that takes a\n credential. A request carrying neither, both, or the one the provider's\n kind does not take is rejected with INVALID_ARGUMENT.\n\n Write-only. The value is encrypted at rest, the provider row keeps only a\n reference to it, and no read path -- List, Get, or the data-plane\n configuration -- ever returns it. GuardrailProvider.has_api_key is all a\n reader learns.\n\n Calling it again ROTATES: the stored credential is replaced in place and\n the provider keeps its id, its configuration and every rule bound to it.\n There is no un-set; deleting the provider's project destroys the stored\n credential.\n\n The operation is audit-logged. The audit entry records who set a\n credential on which provider, never the value.\n\n Returns NOT_FOUND when no such provider is visible in the requested scope,\n and PERMISSION_DENIED for a global row or a catalog template (both are\n read-only; a template is copied into an instance before it is used).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "providers", "{{provider_id}}", "secret" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/providers/{{provider_id}}/secret" } } }, { "name": "UpdateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdateGuardrailProvider updates mutable fields of a user-defined provider.\n Omitted/empty scalar string fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. Absent\n message fields (config) leave the existing value untouched; a present\n config Struct REPLACES the stored configuration wholesale (no deep merge).\n Returns PERMISSION_DENIED for a global row or a catalog template (both\n are read-only), and NOT_FOUND when no such provider is visible in the\n requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "ListGuardrailProviders", "request": { "description": "ListGuardrailProviders returns the providers visible in the requested\n scope: the project's own instances plus the global rows. Catalog\n templates are omitted unless include_templates is set.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers" } } }, { "name": "CreateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreateGuardrailProvider registers a new provider instance in the\n requested scope. Any accepted `kind` may be created, including the kinds\n the catalog templates use. Returns ALREADY_EXISTS when the name is taken\n in that scope, and INVALID_ARGUMENT for an unaccepted kind, a\n configuration the kind cannot be built from, or a credential in `config`.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers" } } }, { "name": "DeleteGuardrailProvider", "request": { "description": "DeleteGuardrailProvider soft-deletes a user-defined provider (sets\n deleted_at; the row disappears from List/Get). Historical trigger records\n referencing this provider REMAIN queryable.\n Returns PERMISSION_DENIED for a global row or a catalog template (both\n are read-only), and NOT_FOUND when no such provider is visible in the\n requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "GetGuardrailProvider", "request": { "description": "GetGuardrailProvider returns a single provider by id, from the project's\n own instances or the global rows. Returns NOT_FOUND when no such provider\n is visible in the requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "SetGuardrailProviderSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "null" }, "description": "SetGuardrailProviderSecret stores the credential a provider authenticates\n to its backing service with. This is the ONLY way a credential enters the\n system: it is never accepted in GuardrailProvider.config.\n\n A request carries exactly one credential: `aws_credentials` for a\n \"bedrockguardrails\" provider, `api_key` for every other kind that takes a\n credential. A request carrying neither, both, or the one the provider's\n kind does not take is rejected with INVALID_ARGUMENT.\n\n Write-only. The value is encrypted at rest, the provider row keeps only a\n reference to it, and no read path -- List, Get, or the data-plane\n configuration -- ever returns it. GuardrailProvider.has_api_key is all a\n reader learns.\n\n Calling it again ROTATES: the stored credential is replaced in place and\n the provider keeps its id, its configuration and every rule bound to it.\n There is no un-set; deleting the provider's project destroys the stored\n credential.\n\n The operation is audit-logged. The audit entry records who set a\n credential on which provider, never the value.\n\n Returns NOT_FOUND when no such provider is visible in the requested scope,\n and PERMISSION_DENIED for a global row or a catalog template (both are\n read-only; a template is copied into an instance before it is used).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}", "secret" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}/secret" } } }, { "name": "UpdateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdateGuardrailProvider updates mutable fields of a user-defined provider.\n Omitted/empty scalar string fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. Absent\n message fields (config) leave the existing value untouched; a present\n config Struct REPLACES the stored configuration wholesale (no deep merge).\n Returns PERMISSION_DENIED for a global row or a catalog template (both\n are read-only), and NOT_FOUND when no such provider is visible in the\n requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } } ], "name": "agentrouter.guardrails.v1.GuardrailProvidersService" }, { "item": [ { "name": "GetDashboard", "request": { "description": "GetDashboard returns a combined summary of guardrail posture and recent\n trigger activity for the dashboard view.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "dashboard" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/dashboard" } } }, { "name": "ListGuardrailTriggers", "request": { "description": "ListGuardrailTriggers lists trigger events matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers" } } }, { "name": "GetGuardrailTriggerStats", "request": { "description": "GetGuardrailTriggerStats returns aggregate statistics for trigger events\n in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers/stats" } } }, { "name": "GetGuardrailTrigger", "request": { "description": "GetGuardrailTrigger returns a single trigger event by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers", "{{trigger_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers/{{trigger_id}}" } } }, { "name": "ReportGuardrailTriggers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggers\": [\n {\n \"consumerId\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"executionDurationMs\": 0,\n \"guardrailId\": \"{{guardrail_id}}\",\n \"id\": \"string\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"projectId\": \"{{project_id}}\",\n \"resourceId\": \"string\",\n \"ruleEvaluations\": [\n {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"checkType\": \"CHECK_TYPE_PII\",\n \"executeOnContentType\": \"EXECUTE_ON_CONTENT_TYPE_ALL\",\n \"executedOn\": \"EXECUTE_ON_INPUT\",\n \"executionDurationMs\": 0,\n \"guardrailRuleId\": \"string\",\n \"inputResults\": [],\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"outputResults\": [],\n \"providerId\": \"{{provider_id}}\",\n \"score\": 0\n }\n ],\n \"triggeredAt\": \"2023-01-15T01:30:15.01Z\"\n }\n ]\n}" }, "description": "ReportGuardrailTriggers ingests a batch of trigger events from the data\n plane. Idempotent on trigger.id (duplicate ids return success=true with no\n error). Per-item failure model: a malformed or unknown-reference trigger\n yields success=false for that item only; the RPC itself fails only for auth\n errors, an empty batch, or a batch exceeding 1000 triggers\n (INVALID_ARGUMENT). Authenticated as a service account only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "guardrails", "triggers", "report" ], "raw": "{{baseUrl}}/v1/guardrails/triggers/report" } } } ], "name": "agentrouter.guardrails.v1.GuardrailTriggersService" }, { "item": [ { "name": "ListGuardrails", "request": { "description": "ListGuardrails returns guardrails matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails" } } }, { "name": "CreateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n },\n \"projectId\": \"{{project_id}}\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreateGuardrail creates a new guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails" } } }, { "name": "CreateGuardrailFromTemplate", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\",\n \"templateId\": \"string\"\n}" }, "description": "CreateGuardrailFromTemplate instantiates a new guardrail from a platform\n template row (is_template=true). The resulting guardrail is editable and\n scoped to (customer_id, project_id).\n Returns NOT_FOUND when template_id does not reference an existing template\n guardrail (non-template ids are treated as not found).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "from-template" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/from-template" } } }, { "name": "TestRuleAgainstStack", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"againstProjectId\": \"string\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"projectId\": \"{{project_id}}\",\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "TestRuleAgainstStack evaluates a candidate rule against a project's\n effective stack and returns what it would run into, without storing it and\n without sending any traffic (tetrateio/fraser#9666).\n\n What it answers is where the rule lands: which checks on the stack it\n duplicates, whether its provider is one its scope may bind and is switched\n on, whether the patterns it names resolve, and whether a data plane would\n evaluate it at all. That turns a rollout into a countdown rather than\n leaving an operator to find out from a refused request.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "rules:testAgainstStack" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/rules:testAgainstStack" } } }, { "name": "GetGuardrailStats", "request": { "description": "GetGuardrailStats returns aggregate statistics for guardrails in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/stats" } } }, { "name": "UpdateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n },\n \"projectId\": \"{{project_id}}\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdateGuardrail updates mutable guardrail fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response) leave the existing value untouched; a present\n triggered_response replaces it wholesale. The guardrail id must be set\n inside the guardrail field.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "ListGuardrailRules", "request": { "description": "ListGuardrailRules returns rules for the specified guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "CreateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreateGuardrailRule adds a new rule to a guardrail.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.\n\n A rule on a bedrockguardrails provider is refused with FAILED_PRECONDITION\n while a data plane serving the rule's scope reports a build older than\n 0.11.0, a build that cannot be read, or no build. The response's warnings\n carry non-fatal advisories, such as a binding to a guardrail's DRAFT.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "DeleteGuardrailRule", "request": { "description": "DeleteGuardrailRule soft-deletes a rule (sets deleted_at; the row\n disappears from List/Get). Historical trigger records referencing this rule\n REMAIN queryable.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "GetGuardrailRule", "request": { "description": "GetGuardrailRule returns a single rule by id.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "UpdateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdateGuardrailRule updates mutable rule fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response, configuration) leave the existing value untouched; a\n present configuration Struct REPLACES the stored configuration wholesale\n (no deep merge). The rule id must be set inside the rule field.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.\n\n An update that changes the provider or the configuration of a rule on a\n bedrockguardrails provider, or turns such a rule on, is refused with\n FAILED_PRECONDITION while a data plane serving the rule's scope reports a\n build older than 0.11.0, a build that cannot be read, or no build. The response's warnings carry\n non-fatal advisories, such as a binding to a guardrail's DRAFT.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "DeleteGuardrail", "request": { "description": "DeleteGuardrail soft-deletes a guardrail (sets deleted_at; the row\n disappears from List/Get). Child rules of the soft-deleted guardrail are\n no longer served. Historical trigger records referencing this guardrail\n REMAIN queryable.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "GetGuardrail", "request": { "description": "GetGuardrail returns a single guardrail by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "SetGuardrailStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false,\n \"projectId\": \"{{project_id}}\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\"\n}" }, "description": "SetGuardrailStatus updates the status and/or enabled flag of a guardrail.\n At least one of status/enabled must be provided; otherwise INVALID_ARGUMENT.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "{{guardrail_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/{{guardrail_id}}/status" } } }, { "name": "GetBlastRadius", "request": { "description": "GetBlastRadius counts what an apply reconverges, before the operator\n confirms it (tetrateio/fraser#9666). An organization-level apply names no\n project and reaches every one of them, so it is counted in projects and in\n data planes: every data plane labelled with any of those projects re-pulls\n at once.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails:blastRadius" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails:blastRadius" } } }, { "name": "ListGuardrails", "request": { "description": "ListGuardrails returns guardrails matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails" } } }, { "name": "CreateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreateGuardrail creates a new guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails" } } }, { "name": "CreateGuardrailFromTemplate", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\",\n \"templateId\": \"string\"\n}" }, "description": "CreateGuardrailFromTemplate instantiates a new guardrail from a platform\n template row (is_template=true). The resulting guardrail is editable and\n scoped to (customer_id, project_id).\n Returns NOT_FOUND when template_id does not reference an existing template\n guardrail (non-template ids are treated as not found).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "from-template" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/from-template" } } }, { "name": "GetGuardrailStats", "request": { "description": "GetGuardrailStats returns aggregate statistics for guardrails in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/stats" } } }, { "name": "UpdateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdateGuardrail updates mutable guardrail fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response) leave the existing value untouched; a present\n triggered_response replaces it wholesale. The guardrail id must be set\n inside the guardrail field.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "ListGuardrailRules", "request": { "description": "ListGuardrailRules returns rules for the specified guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "CreateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreateGuardrailRule adds a new rule to a guardrail.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.\n\n A rule on a bedrockguardrails provider is refused with FAILED_PRECONDITION\n while a data plane serving the rule's scope reports a build older than\n 0.11.0, a build that cannot be read, or no build. The response's warnings\n carry non-fatal advisories, such as a binding to a guardrail's DRAFT.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "DeleteGuardrailRule", "request": { "description": "DeleteGuardrailRule soft-deletes a rule (sets deleted_at; the row\n disappears from List/Get). Historical trigger records referencing this rule\n REMAIN queryable.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "GetGuardrailRule", "request": { "description": "GetGuardrailRule returns a single rule by id.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "UpdateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdateGuardrailRule updates mutable rule fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response, configuration) leave the existing value untouched; a\n present configuration Struct REPLACES the stored configuration wholesale\n (no deep merge). The rule id must be set inside the rule field.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.\n\n An update that changes the provider or the configuration of a rule on a\n bedrockguardrails provider, or turns such a rule on, is refused with\n FAILED_PRECONDITION while a data plane serving the rule's scope reports a\n build older than 0.11.0, a build that cannot be read, or no build. The response's warnings carry\n non-fatal advisories, such as a binding to a guardrail's DRAFT.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "DeleteGuardrail", "request": { "description": "DeleteGuardrail soft-deletes a guardrail (sets deleted_at; the row\n disappears from List/Get). Child rules of the soft-deleted guardrail are\n no longer served. Historical trigger records referencing this guardrail\n REMAIN queryable.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "GetGuardrail", "request": { "description": "GetGuardrail returns a single guardrail by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "SetGuardrailStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false,\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\"\n}" }, "description": "SetGuardrailStatus updates the status and/or enabled flag of a guardrail.\n At least one of status/enabled must be provided; otherwise INVALID_ARGUMENT.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/status" } } }, { "name": "GetEffectiveStack", "request": { "description": "GetEffectiveStack returns every rule a project is served under, at both\n levels, in one list (tetrateio/fraser#9666).\n\n The two levels are not merged. A rule set at the organization and a rule\n set at the project that check the same thing at the same stage are two\n rules and the data plane evaluates both, so each is marked as duplicating\n the other rather than one of them being folded away.\n\n A data plane's own network controls are absent from the answer. A data\n plane carries no guardrails, and what it does carry is mirrored read-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails:effectiveStack" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails:effectiveStack" } } } ], "name": "agentrouter.guardrails.v1.GuardrailsService" }, { "item": [ { "name": "ListPatterns", "request": { "description": "ListPatterns returns patterns visible to the requested scope, including\n built-in patterns which are globally visible.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/patterns" } } }, { "name": "CreatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n },\n \"projectId\": \"{{project_id}}\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreatePattern creates a new user-defined pattern.\n Returns PERMISSION_DENIED when attempting to create a pattern with\n is_builtin=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/patterns" } } }, { "name": "DeletePattern", "request": { "description": "DeletePattern soft-deletes a user-defined pattern (sets deleted_at; the\n row disappears from List/Get). Historical trigger records referencing this\n pattern REMAIN queryable.\n Returns PERMISSION_DENIED when attempting to delete a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "GetPattern", "request": { "description": "GetPattern returns a single pattern by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "UpdatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n },\n \"projectId\": \"{{project_id}}\",\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdatePattern updates mutable fields of a user-defined pattern. Omitted/\n empty scalar string fields leave the existing value untouched. Enum fields\n set to *_UNSPECIFIED leave the existing value untouched.\n Returns PERMISSION_DENIED when attempting to modify a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "ListPatterns", "request": { "description": "ListPatterns returns patterns visible to the requested scope, including\n built-in patterns which are globally visible.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns" } } }, { "name": "CreatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "CreatePattern creates a new user-defined pattern.\n Returns PERMISSION_DENIED when attempting to create a pattern with\n is_builtin=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns" } } }, { "name": "DeletePattern", "request": { "description": "DeletePattern soft-deletes a user-defined pattern (sets deleted_at; the\n row disappears from List/Get). Historical trigger records referencing this\n pattern REMAIN queryable.\n Returns PERMISSION_DENIED when attempting to delete a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "GetPattern", "request": { "description": "GetPattern returns a single pattern by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "UpdatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n },\n \"scope\": \"GUARDRAIL_SCOPE_ORGANIZATION\"\n}" }, "description": "UpdatePattern updates mutable fields of a user-defined pattern. Omitted/\n empty scalar string fields leave the existing value untouched. Enum fields\n set to *_UNSPECIFIED leave the existing value untouched.\n Returns PERMISSION_DENIED when attempting to modify a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } } ], "name": "agentrouter.guardrails.v1.PatternsService" }, { "item": [ { "name": "ListSSOProviders", "request": { "description": "ListSSOProviders returns every registered provider. Secrets are never\n included: client_secret is write-only on this surface.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers" ], "raw": "{{baseUrl}}/v1/sso-providers" } } }, { "name": "CreateOrUpdateSSOProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"adminEmails\": \"developer@example.com\",\n \"clearAdminEmails\": false,\n \"customerId\": \"{{customer_id}}\",\n \"domain\": \"string\",\n \"enabled\": false,\n \"liftRoleSyncBans\": false,\n \"oidc\": {\n \"attributeMapping\": {\n \"mapping\": {\n \"key\": \"string\"\n }\n },\n \"authorizationEndpoint\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"discoveryEndpoint\": \"https://example.com\",\n \"discoveryUrl\": \"https://example.com\",\n \"issuer\": \"string\",\n \"jwksEndpoint\": \"https://example.com\",\n \"scopes\": {\n \"values\": [\n \"string\"\n ]\n },\n \"tokenEndpoint\": \"https://example.com\",\n \"userinfoEndpoint\": \"https://example.com\"\n },\n \"organizationId\": \"string\",\n \"organizationName\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"providerType\": \"string\",\n \"resetOidcEndpoints\": false,\n \"roleClaimPath\": \"string\",\n \"roleMapping\": {\n \"roles\": {\n \"key\": \"string\"\n }\n },\n \"roleSyncMode\": \"string\",\n \"saml\": {\n \"audience\": \"string\",\n \"cert\": \"string\",\n \"emailAttribute\": \"developer@example.com\",\n \"entryPoint\": \"string\",\n \"idpEntityId\": \"string\",\n \"issuer\": \"string\",\n \"nameAttribute\": \"string\",\n \"nameIdFormat\": \"string\",\n \"wantAssertionsSigned\": false\n },\n \"validateConfig\": false\n}" }, "description": "CreateOrUpdateSSOProvider upserts the deployment's SSO provider row. The\n oidc_config jsonb it writes keeps better-auth's camelCase keys, because\n valet's own login parses those exact keys back out\n (identitysvc.SSOProviderOIDC): a write that renamed them would break the\n next sign-in rather than fail here.\n\n One gate, both verbs. The old auth service reached this row two ways and\n answered differently on each -- /api/sso-providers required a grant while\n /api/sso-init required nothing at all -- and that split was deliberately\n not ported: create and edit are separate verbs on one resource behind one\n annotation, so there is no second way in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers" ], "raw": "{{baseUrl}}/v1/sso-providers" } } }, { "name": "DeleteSSOProvider", "request": { "description": "DeleteSSOProvider removes a provider row. Corporate login stops working the\n moment it lands, so it admits the same callers a write does.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/sso-providers/{{provider_id}}" } } }, { "name": "GetSSOProvider", "request": { "description": "GetSSOProvider returns one provider by id. Same secret rule as the list.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/sso-providers/{{provider_id}}" } } }, { "name": "RegisterSSOProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"provider\": {\n \"adminEmails\": \"developer@example.com\",\n \"clearAdminEmails\": false,\n \"customerId\": \"{{customer_id}}\",\n \"domain\": \"string\",\n \"enabled\": false,\n \"liftRoleSyncBans\": false,\n \"oidc\": {\n \"attributeMapping\": {\n \"mapping\": {\n \"key\": \"string\"\n }\n },\n \"authorizationEndpoint\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"discoveryEndpoint\": \"https://example.com\",\n \"discoveryUrl\": \"https://example.com\",\n \"issuer\": \"string\",\n \"jwksEndpoint\": \"https://example.com\",\n \"scopes\": {\n \"values\": [\n \"string\"\n ]\n },\n \"tokenEndpoint\": \"https://example.com\",\n \"userinfoEndpoint\": \"https://example.com\"\n },\n \"organizationId\": \"string\",\n \"organizationName\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"providerType\": \"string\",\n \"resetOidcEndpoints\": false,\n \"roleClaimPath\": \"string\",\n \"roleMapping\": {\n \"roles\": {\n \"key\": \"string\"\n }\n },\n \"roleSyncMode\": \"string\",\n \"saml\": {\n \"audience\": \"string\",\n \"cert\": \"string\",\n \"emailAttribute\": \"developer@example.com\",\n \"entryPoint\": \"string\",\n \"idpEntityId\": \"string\",\n \"issuer\": \"string\",\n \"nameAttribute\": \"string\",\n \"nameIdFormat\": \"string\",\n \"wantAssertionsSigned\": false\n },\n \"validateConfig\": false\n }\n}" }, "description": "RegisterSSOProvider creates the deployment's SSO provider row. It refuses\n with ALREADY_EXISTS when the row exists, so a console that only wants to\n create cannot overwrite a live provider. It also links the organization\n whose slug is the provider id.\n\n customer_id names the authorization target (ADR 093), not the rows: the\n provider row is deployment-wide. A platform administrator passes for any\n customer. An organization administrator, or a holder of an organization\n sso_providers.create grant, passes only when RBAC_AUTH_DB_MODE is\n \"single\" and customer_id is the customer of the deployment. A call with\n an API key and a customer_id is refused.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers:register" ], "raw": "{{baseUrl}}/v1/sso-providers:register" } } }, { "name": "ListUsers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "ListUsers batch-resolves user_ids to directory entries in one call,\n so a stats/management caller can resolve a whole page of grouped\n insights rows without N round-trips. Unknown ids are silently\n omitted from the response.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "lookup" ], "raw": "{{baseUrl}}/v1/users/lookup" } } }, { "name": "SearchUsers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"excludeUserGroupId\": \"string\",\n \"excludeUserIds\": [\n \"string\"\n ],\n \"hasUserGroup\": false,\n \"limit\": 0,\n \"offset\": 0,\n \"role\": \"string\",\n \"search\": \"string\",\n \"sortBy\": \"USER_SORT_CREATED_AT\",\n \"sortDir\": \"USER_SORT_DIRECTION_ASCENDING\",\n \"status\": \"USER_STATUS_ACTIVE\",\n \"unassignedUserGroup\": false,\n \"userGroupId\": \"{{user_group_id}}\",\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "SearchUsers browses the directory the way the admin console's Users\n page needs (fraser#8695): a case-insensitive substring match on name\n or email, a status filter, and limit/offset paging with a total, so\n the console renders its numbered pages and stat cards without\n reading the auth DB directly (fraser#5521). The same users_reader\n gate and in-handler tenant boundary as GetUser/ListUsers apply.\n\n An UNSPECIFIED status hides deleted users -- deleted_at IS NULL is\n the default everywhere active lists are rendered -- so a caller sees\n the active population unless it asks for USER_STATUS_DELETED\n explicitly. ACTIVE and BANNED also exclude deleted users: a delete\n is a separate state from an operator ban, not a flavor of one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "search" ], "raw": "{{baseUrl}}/v1/users/search" } } }, { "name": "GetUserStats", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"excludeUserGroupId\": \"string\",\n \"excludeUserIds\": [\n \"string\"\n ],\n \"hasUserGroup\": false,\n \"role\": \"string\",\n \"search\": \"string\",\n \"unassignedUserGroup\": false,\n \"userGroupId\": \"{{user_group_id}}\",\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "GetUserStats returns the per-status counts the Users page's stat\n cards render, over the same boundary and the same non-status filters\n as SearchUsers -- one call instead of four filtered searches. The\n status filter is the one SearchUsers predicate this request omits:\n the counts ARE the status breakdown. total counts non-deleted users\n (active + banned), so deleted users never inflate a \"total users\"\n card.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "stats" ], "raw": "{{baseUrl}}/v1/users/stats" } } }, { "name": "DeleteUser", "request": { "description": "DeleteUser soft-deletes a user (fraser#8692). The authn.user row is\n never removed: delete sets banned = true with the USER_DELETED ban\n reason, stamps deleted_at/deleted_by, revokes every live API key the\n user owns (writing deleted_at, revoked_at and is_active), deletes the\n RBAC bindings those keys carried, and removes their authn.session\n rows -- all in one transaction, so a key-revocation failure leaves the\n user unchanged. RestoreUser reverses it.\n\n Restorable by design, and visibly distinct from an operator ban: a\n deleted account carries the USER_DELETED sentinel as its ban reason.\n\n Refuses with FAILED_PRECONDITION when the target is the last active\n administrator -- of the platform (legacy admin role or a platform-scope\n admin binding) or of any customer they hold an org-scope admin binding\n for -- so a deployment cannot delete its way out of being\n administrable. Refuses with FAILED_PRECONDITION when the user is\n already deleted; NOT_FOUND for an unknown user_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}" } } }, { "name": "GetUser", "request": { "description": "GetUser resolves a single user_id to its directory entry (email +\n name). This is the attribution/display lookup that per-user\n insights/usage views need: those views key data by the opaque\n authn.user.id, and this maps that id back to a named person. It is a\n directory lookup only -- not identity propagation or authorization,\n and callers must not read the auth DB directly.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}" } } }, { "name": "BanUser", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "BanUser bans a user (authn.user.banned = true) with a reason, and\n immediately revokes every live session and API key the user holds.\n It replaced better-auth's admin ban-user endpoint (fraser#9001): the\n flag lives on the authn.user row, the session revocation matches better-auth's\n ban-time deletion, and the key soft-delete matches the\n fraser#8689 hook (keys are marked deleted_at, never restored --\n an unbanned user issues fresh keys).\n\n Admin-gated and session-only, carrying the same caller contract as\n DeleteUser (fraser#9151): an interactive session that holds the admin\n scope, or the users.edit permission on a platform-scope RBAC binding.\n A ban revokes every session and every API key the target holds, so its\n blast radius equals a delete's and the two admit the same\n administrators. users.edit is also the atom the old ban endpoints\n authorized on (fraser#8689), so a ban still needs the same permission.\n\n The request names a bare user_id and no tenant, so users.edit is\n authorized at PLATFORM reach. The handler re-checks the session half:\n an API key is refused even when it carries users.edit.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "ban" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/ban" } } }, { "name": "SetUserPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"newPassword\": \"string\"\n}" }, "description": "SetUserPassword sets another user's password and signs them out\n everywhere. It replaced better-auth's admin set-user-password endpoint\n (fraser#11247). The new hash, the session revocation and the audit row\n commit together, or nothing commits. API keys are left alone.\n\n Only a signed-in super_admin may call it, and the handler decides, as on\n GrantSuperAdmin: the session must hold the admin scope (which needs the\n platform_admin binding as well as the role), and authn.user.role must be\n super_admin, read in the same transaction as the write. There is no\n users.edit leg, so a user_admin or an org admin is refused, and an API key\n is refused even when its owner is a super_admin.\n\n INVALID_ARGUMENT: user_id is empty, or the password is shorter than 8 or\n longer than 128 characters. FAILED_PRECONDITION: the target is the caller\n (use ChangePassword), is deleted, or has no password account (an SSO-only\n user). NOT_FOUND for an unknown user_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "password" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/password" } } }, { "name": "RestoreUser", "request": { "description": "RestoreUser reverses DeleteUser: it clears deleted_at/deleted_by, and\n lifts the USER_DELETED ban the delete wrote. It does not touch an\n operator's separate suspension (a ban whose reason is not the\n USER_DELETED sentinel survives a restore), and it does not resurrect\n the revoked API keys or deleted sessions -- those stay revoked, and the\n user mints new credentials on next login. NOT_FOUND when the user_id\n has no row or carries no deleted_at (shaped as \"not deleted\").", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "restore" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/restore" } } }, { "name": "RevokeUserSessions", "request": { "description": "RevokeUserSessions signs a user out everywhere by deleting every\n authn.session row they hold. It touches nothing else: API keys stay\n live and the account is not banned. It replaced better-auth's admin\n revoke-user-sessions endpoint, and the admin console calls it when it\n lowers a user's role so the old role's sessions do not outlive the\n change. Revoking your own sessions is allowed.\n\n Same caller contract as BanUser: an interactive session that holds the\n admin scope, or the users.edit permission on a platform-scope RBAC\n binding. users.edit is the atom the old revoke-user-sessions endpoint\n authorized on (the same gate as the ban endpoints), so the same\n administrators are admitted. The request\n names a bare user_id and no tenant, so users.edit is authorized at\n PLATFORM reach, and the handler refuses any credential that is not a\n session, even an API key carrying users.edit.\n\n NOT_FOUND for an unknown user_id. A known user with no sessions\n succeeds with revoked_count 0.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "revoke-sessions" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/revoke-sessions" } } }, { "name": "SetUserRole", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"role\": \"string\"\n}" }, "description": "SetUserRole sets a user's legacy role (authn.user.role) and, in the same\n transaction, the org binding that the role projects, the platform\n projection, and the user's binding version, so the new access applies at\n the next request. A change that is not a promotion to a higher level\n (a demotion, or a move between roles at the same level) also signs the\n user out. The change and its audit row commit together, or nothing\n commits.\n\n Session only. A platform administrator can change a role for any\n customer_id. Any other caller needs all three: RBAC_AUTH_DB_MODE is\n \"single\", customer_id is the deployment customer, and the caller\n administers that customer. Anyone else gets PERMISSION_DENIED.\n\n FAILED_PRECONDITION: the target is deleted, the target is the caller,\n the old or the new role is super_admin or admin (use GrantSuperAdmin and\n RevokeSuperAdmin), or the built-in org role is not seeded yet.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "role" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/role" } } }, { "name": "UnbanUser", "request": { "description": "UnbanUser clears a user's ban (authn.user.banned, ban_reason,\n ban_expires). It deliberately restores nothing: sessions deleted\n by the ban stay logged out and API keys soft-deleted by the ban\n stay dead, so a re-enabled user must sign in again and issue\n fresh keys (fraser#8689). Same caller gate as BanUser, declared the\n same way: lifting a ban is as consequential as writing one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "unban" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/unban" } } } ], "name": "agentrouter.identity.v1.IdentityService" }, { "item": [ { "name": "ChangePassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"currentPassword\": \"string\",\n \"newPassword\": \"string\"\n}" }, "description": "ChangePassword sets a new password for the signed-in caller, who must\n prove the current one. Every OTHER session the user holds is revoked, so a\n password change ends any session an attacker may already have.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "change-password" ], "raw": "{{baseUrl}}/v1/auth/change-password" } } }, { "name": "Login", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"codeChallenge\": \"string\",\n \"codeChallengeMethod\": \"string\",\n \"issuer\": \"string\",\n \"redirectUri\": \"https://example.com\"\n}" }, "description": "Login initiates an OIDC authorization-code + PKCE flow. Returns an\n authorization_url the caller must redirect the user's browser to.\n After the IdP authenticates and redirects to redirect_uri, the\n platform establishes a session cookie for subsequent requests.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "login" ], "raw": "{{baseUrl}}/v1/auth/login" } } }, { "name": "Logout", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "Logout invalidates the caller's current OIDC session. Subsequent\n requests using the session cookie return 401 unauthenticated. Does\n not revoke API keys the identity may have issued.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "logout" ], "raw": "{{baseUrl}}/v1/auth/logout" } } }, { "name": "RequestPasswordReset", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"redirectTo\": \"string\"\n}" }, "description": "RequestPasswordReset emails a single-use reset link. The response is the\n same whether or not the address has an account, so it cannot be used to\n discover who has one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "request-password-reset" ], "raw": "{{baseUrl}}/v1/auth/request-password-reset" } } }, { "name": "ResetPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"newPassword\": \"string\",\n \"token\": \"example-token\"\n}" }, "description": "ResetPassword consumes a reset token and sets the new password. The token\n is single-use and expires an hour after it is issued.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "reset-password" ], "raw": "{{baseUrl}}/v1/auth/reset-password" } } }, { "name": "SendVerificationEmail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"callbackUrl\": \"https://example.com\",\n \"email\": \"developer@example.com\"\n}" }, "description": "SendVerificationEmail re-sends the verification link. The response is the\n same whether or not the address has an unverified account.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "send-verification-email" ], "raw": "{{baseUrl}}/v1/auth/send-verification-email" } } }, { "name": "SignInWithPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"password\": \"string\"\n}" }, "description": "SignInWithPassword exchanges an email and password for a session. Serves\n the same credential store as the auth service (authn.account, provider\n \"credential\"), so a password set by either stack works on both.\n\n Registered only where credential sign-in is enabled: a deployment running\n corporate SSO has no password surface at all.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "sign-in", "email" ], "raw": "{{baseUrl}}/v1/auth/sign-in/email" } } }, { "name": "SignUpWithPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"callbackUrl\": \"https://example.com\",\n \"email\": \"developer@example.com\",\n \"name\": \"example-name\",\n \"password\": \"string\"\n}" }, "description": "SignUpWithPassword creates an account with an email and password and sends\n a verification link. Available only where self-serve sign-up is enabled;\n elsewhere an administrator provisions the user instead.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "sign-up", "email" ], "raw": "{{baseUrl}}/v1/auth/sign-up/email" } } }, { "name": "ListSocialProviders", "request": { "description": "ListSocialProviders names the social logins this deployment has credentials\n for, so a sign-in page renders the buttons that will actually work. Public\n and thin for the same reason GetSSOProviderStatus is: it carries no client\n id and no secret, only the names.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "social", "providers" ], "raw": "{{baseUrl}}/v1/auth/social/providers" } } }, { "name": "StartSocialLogin", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": \"string\",\n \"returnUrl\": \"https://example.com\"\n}" }, "description": "StartSocialLogin opens a Google or GitHub login, the same browser shape as\n StartSSOLogin and with the same signed state.\n\n Corporate SSO and social login differ in where the provider is configured,\n not in how the flow runs: corporate is a row an administrator registers at\n runtime, while the social apps are deployment credentials supplied as\n environment variables, because their client secrets belong to the operator\n rather than to a tenant. That is why this takes a provider NAME from a\n closed set instead of a provider id.\n\n Public of necessity: it runs before anyone is signed in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "social", "start" ], "raw": "{{baseUrl}}/v1/auth/social/start" } } }, { "name": "StartSSOLogin", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"providerId\": \"{{provider_id}}\",\n \"returnUrl\": \"https://example.com\"\n}" }, "description": "StartSSOLogin opens the browser-shaped corporate SSO flow. Login hands PKCE\n orchestration to the CLI, which owns the loopback redirect; a browser has\n nowhere to keep a verifier, so this mints the whole attempt server-side and\n signs the return URL into the state. Any replica can then complete the\n callback -- no shared store, no session affinity (the reason login state is\n stateless at all, fraser#5339).\n\n Public of necessity: it runs before anyone is signed in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "sso", "start" ], "raw": "{{baseUrl}}/v1/auth/sso/start" } } }, { "name": "VerifyEmail", "request": { "description": "VerifyEmail consumes a verification link and marks the address verified.\n The token is the same signed form the auth service issues, so a link from\n either stack works on both.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "verify-email" ], "raw": "{{baseUrl}}/v1/auth/verify-email" } } }, { "name": "GetMe", "request": { "description": "GetMe returns the full identity record for the authenticated caller.\n Use to verify which identity a credential belongs to, populate a\n \"logged in as\" UI element, or confirm role assignments before making\n permission-gated calls. A session caller also receives its session claims:\n the organization-level permission set and whether the deployment has an\n administrator.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me" ], "raw": "{{baseUrl}}/v1/me" } } }, { "name": "UpdateMe", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\"\n}" }, "description": "UpdateMe changes the signed-in caller's own display name\n (authn.user.name) and returns the updated identity. It acts only on the\n caller: there is no user id in the request, so it cannot rename anyone\n else.\n\n Name only. better-auth's update-user also accepted image,\n phone, website and address, but the console's profile dialog sends only\n name, so that is all this serves. Email and role are never\n caller-editable.\n\n Session-only, like ChangePassword: an API key is refused even though it\n belongs to the same user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me" ], "raw": "{{baseUrl}}/v1/me" } } }, { "name": "ListAssignableKeyScopes", "request": { "description": "ListAssignableKeyScopes returns the scopes a management key can carry, for\n the surfaces that render a scope picker while creating one: an\n organization-wide key, or with project_id set, a key for that project.\n Every assignable scope is listed, in a stable order, whether or not this\n caller could grant it; `grantable` marks the ones IssueMyKey would accept\n from this caller now, so a picker can disable the rest instead of offering\n a choice that is refused on submit.\n\n The gate is the one IssueMyKey applies to the same key -- type\n API_KEY_TYPE_MANAGEMENT, this customer_id, and this project_id (\"default\"\n when it is empty) -- and not role administration: a caller who could\n create the key gets the list, and one who could not gets the refusal\n IssueMyKey would return -- PERMISSION_DENIED, or FAILED_PRECONDITION for an\n API key without its own api_keys.create grant. The built-in User Admin\n role, which creates keys but cannot read roles, is answered.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "assignable-key-scopes" ], "raw": "{{baseUrl}}/v1/me/assignable-key-scopes" } } }, { "name": "ListMyKeys", "request": { "description": "ListMyKeys lists all API keys belonging to the caller. Returns\n metadata (id, name, creation timestamp, last-used timestamp) but\n never the plaintext secret.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys" ], "raw": "{{baseUrl}}/v1/me/keys" } } }, { "name": "IssueMyKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"idempotencyKey\": \"example-value\",\n \"name\": \"example-name\",\n \"platformRoles\": [\n \"string\"\n ],\n \"projectId\": \"{{project_id}}\",\n \"scopes\": [\n \"string\"\n ],\n \"tags\": {\n \"key\": \"string\"\n },\n \"type\": \"API_KEY_TYPE_PROMPT\"\n}" }, "description": "IssueMyKey issues a new long-lived API key for the caller. The\n secret field in the response is returned exactly once and cannot be\n retrieved again. Store it in a secrets manager immediately.\n\n Issuing a management key (type API_KEY_TYPE_MANAGEMENT) requires the\n api_keys.create permission for the target customer -- the built-in Super\n Admin and User Admin roles carry it -- or the request fails with\n PERMISSION_DENIED. Inference keys (the default) are open to any\n authenticated session.\n\n The key carries the caller's own access, not the organization's: a caller\n who cannot already administer the customer receives read-only management\n scopes, and asking for broader ones fails with PERMISSION_DENIED.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys" ], "raw": "{{baseUrl}}/v1/me/keys" } } }, { "name": "RevokeMyKey", "request": { "description": "RevokeMyKey permanently and irrevocably revokes an API key.\n Revocation propagates to all active data planes within sub-second;\n requests already in flight that passed authentication before\n propagation may still complete.\n\n With soft_delete the key is deleted instead: the delete and its\n DELETE_API_KEY audit record commit, then the key's routes are removed\n and its token is revoked.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/me/keys/{{key_id}}" } } }, { "name": "UpdateMyKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"clearPlatformRoles\": false,\n \"clearScopes\": false,\n \"clearTags\": false,\n \"isActive\": false,\n \"name\": \"example-name\",\n \"platformRoles\": [\n \"string\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"tags\": {\n \"key\": \"string\"\n }\n}" }, "description": "UpdateMyKey replaces the scope set of a caller-owned management key\n in place, so an existing key can be re-scoped without rotating its\n secret. The caller may only assign scopes it is authorized to delegate.\n\n It also renames, enables or disables any caller-owned key (name,\n is_active). That change and its UPDATE_API_KEY audit record commit\n together; disabling or enabling a key updates its routes.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/me/keys/{{key_id}}" } } }, { "name": "ResolveMyPermissions", "request": { "description": "ResolveMyPermissions returns every RBAC permission the calling identity\n holds at one target: the customer's org level when project_id is empty, or\n that project otherwise.\n\n This is the read the console renders from -- it decides which controls\n exist, not whether a call is allowed. Enforcement stays at the interceptor.\n\n This read and the interceptor's RBAC leg resolve through the SAME bindings,\n so they cannot disagree about a binding-derived grant. They can still\n disagree in one direction, and it is worth stating plainly: authorization is\n an additive OR of the RBAC leg and the static coarse-scope leg, so a caller\n the interceptor admits on a coarse scope alone -- holding no binding --\n resolves an empty set here. The `admin` scope is carved out below and\n unioned in; the other scope tokens are not, and neither is a management key\n riding delegated scopes. Such a caller sees fewer controls than it may in\n fact use. That is the safe direction (it hides, it never offers a control\n that 403s), but it is not \"identical\".\n\n `resolved` reports whether the frontier was actually computed. It is never\n a silent empty: a resolve failure answers an error rather than an empty\n permission list, because \"no permissions\" and \"could not tell\" render the\n same way and only one of them is safe to act on.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "permissions" ], "raw": "{{baseUrl}}/v1/me/permissions" } } }, { "name": "ListMyProjects", "request": { "description": "ListMyProjects lists the projects the calling identity can access within\n one customer, with the caller's role in each.\n\n Access is the union of three sources: the caller's project_members rows,\n the projects their project-scoped RBAC bindings reach, and -- when they\n hold an org-scoped grant -- every project in the customer.\n\n The customer-wide `default` project travels with EVERY customer the caller\n belongs to, not only the oldest one that fills an omitted customer_id, and\n with a caller who has no customer yet, which is the first-login state it\n exists for. An established caller naming a tenant they hold no membership\n in does NOT receive that tenant's `default` project; they get an empty list.\n\n `role` reports what the platform actually enforces for the caller on that\n project, not merely what the membership row says, so a project listed as\n \"admin\" is one the caller is genuinely admitted to as owner. A caller with\n no access receives an empty page, not an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "projects" ], "raw": "{{baseUrl}}/v1/me/projects" } } }, { "name": "ListMyReachableProjects", "request": { "description": "ListMyReachableProjects returns the bare project ids the calling identity\n can reach in one customer: every project it reads, plus every project it\n holds a project binding on with any project permission.\n\n ListMyProjects answers the read frontier with full project records and a\n role per project; this returns only the ids, because the console's project\n scoping splices them into a query and never reads the rest. `all_projects`\n reports an org-wide grant, where the caller reaches every project in the\n customer and the id list is therefore empty rather than exhaustive.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "reachable-projects" ], "raw": "{{baseUrl}}/v1/me/reachable-projects" } } }, { "name": "GetPermissionCatalog", "request": { "description": "GetPermissionCatalog returns the seeded permission vocabulary grouped by\n domain, for the surfaces that render a permission picker.\n\n The catalog grants nothing and is the same for every caller in a\n deployment, so it is authenticated but otherwise ungated -- matching the\n endpoint it replaces. It is sourced from authn.rbac_permission, which\n carries the atom, its domain and its scope set; the menu metadata and\n descriptions in the old auth service's manifest never reached the database\n and are not returned.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "permissions", "catalog" ], "raw": "{{baseUrl}}/v1/permissions/catalog" } } }, { "name": "GetSSOProviderStatus", "request": { "description": "GetSSOProviderStatus reports whether a provider is configured and enabled\n and which protocol it speaks. Public and deliberately thin: a sign-in page\n has to ask before anyone is signed in, so the response carries no issuer,\n no client id and no endpoints -- only enough to decide whether to offer the\n corporate button.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers", "{{provider_id}}", "status" ], "raw": "{{baseUrl}}/v1/sso-providers/{{provider_id}}/status" } } }, { "name": "CreateUser", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"initialPassword\": \"string\",\n \"issueSession\": false,\n \"name\": \"example-name\",\n \"sendPasswordSetupEmail\": false\n}" }, "description": "CreateUser provisions a user identity (an authn.user row). Admin-scoped\n and session-only: only platform operators (admin scope) acting through an\n interactive session may create users; API keys are rejected. Intended for\n tenant onboarding where users do not arrive via interactive SSO. When\n issue_session is true a session is also created and its token returned\n ONCE, so the caller can immediately act as the new user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users" ], "raw": "{{baseUrl}}/v1/users" } } } ], "name": "agentrouter.identity.v1.MeService" }, { "item": [ { "name": "Prompt", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"idempotencyKey\": \"example-value\",\n \"keyId\": \"{{key_id}}\",\n \"model\": \"string\",\n \"prompt\": \"string\"\n}" }, "description": "Prompt sends a prompt to an upstream LLM and returns the model's\n completion. The gateway selects an eligible data plane, retrieves\n and applies the project's BYOK key, enforces quota, records a\n request log entry, and proxies the call to the upstream provider.\n Streaming, multi-turn conversations, tools, and vision are not yet\n supported on this path.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "prompts" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/prompts" } } }, { "name": "GetDataplaneURL", "request": { "description": "GetDataplaneURL returns one dataplane (gateway) URL for a single project.\n The project is deduced from the caller's credential -- no input is required\n in the common case: a caller who belongs to one project gets that project's\n dataplane; one whose identity spans several gets their default (the oldest\n membership). Pass project_id to disambiguate or target a specific project\n (it is membership-checked). The customer is derived the same way. When the\n credential itself already pins a workspace, a gateway on that workspace is\n preferred. When several Project Gateways are eligible, the first by\n project_gateway_id is returned; use ListDataplaneURLs to retrieve the set.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "dataplane-url" ], "raw": "{{baseUrl}}/v1/dataplane-url" } } }, { "name": "ListDataplaneURLs", "request": { "description": "ListDataplaneURLs returns every dataplane URL the caller can reach. For a\n project with attached Project Gateways it returns one entry per configured\n gateway; otherwise it preserves the legacy one-entry-per-workspace shape.\n Key-deduced; no input is required. project_id narrows the list to one\n project, and include_unaddressed also lists the entries with no URL. Use\n GetDataplaneURL when one project's preferred URL is wanted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "dataplane-urls" ], "raw": "{{baseUrl}}/v1/dataplane-urls" } } } ], "name": "agentrouter.inference.v1.InferenceIngressService" }, { "item": [ { "name": "ListCustomerRequestLogs", "request": { "description": "ListCustomerRequestLogs returns the caller's own request logs,\n filtered by the supplied tenancy scope. Forced filter:\n `user_id = caller.UserID`.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs" } } }, { "name": "GetCustomerRequestLogStats", "request": { "description": "GetCustomerRequestLogStats returns aggregated statistics over the\n calling user's request logs within the supplied tenancy scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs/stats" } } }, { "name": "GetCustomerRequestLog", "request": { "description": "GetCustomerRequestLog returns a single request log row owned by the\n calling user. Cross-user NotFound: the user cannot read another\n user's log even within the same customer/project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs", "{{request_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs/{{request_id}}" } } }, { "name": "GetMyUsageStats", "request": { "description": "GetMyUsageStats returns the calling user's own usage over time, read\n from the usage rollups. Forced filter: `user_id = caller`. The tenancy\n fields and the key filters can only narrow the caller's own rows. A\n session token is required: an API key is refused with PermissionDenied.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "usage", "stats" ], "raw": "{{baseUrl}}/v1/me/usage/stats" } } } ], "name": "agentrouter.insights.v1.CustomerRequestLogsService" }, { "item": [ { "name": "ListMcpOperations", "request": { "description": "ListMcpOperations lists MCP calls, newest first: the operations that\n GetMcpOperationStats counts.\n\n Authorization is the same as GetMcpOperationStats. client_ip and\n error_message are returned only to a signed-in user that a console acts\n for, and to a key with the admin or request_logs_reader scope. Other\n callers get them empty.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-operations" ], "raw": "{{baseUrl}}/v1/mcp-operations" } } }, { "name": "GetMcpOperationStats", "request": { "description": "GetMcpOperationStats summarizes MCP calls: totals and groups by session,\n profile, backend, tool, client or method.\n\n It counts operations, one row for each MCP call, and leaves out the\n backend fan-out rows of older data planes. For a session that has both,\n the current rows win over the older root row, chosen inside the\n requested window. ListMcpOperations returns the same operations.\n\n Authorization is the same as GetUsageStats: metrics_reader and\n usage.read. A request that names customer_id is authorized against that\n customer and reads only its calls. A request that names no customer\n reads every customer, including calls recorded before the tenant was\n stored, and needs a platform usage.read grant.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-operations", "stats" ], "raw": "{{baseUrl}}/v1/mcp-operations/stats" } } }, { "name": "QueryRequestLogs", "request": { "description": "QueryRequestLogs retrieves request logs with filtering and pagination.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs" ], "raw": "{{baseUrl}}/v1/request-logs" } } }, { "name": "CountProjectRequests", "request": { "description": "CountProjectRequests counts one project's requests on each of several\n data planes, in one call and without reading a row.\n Requires request_logs_reader (admin implies it).\n\n QueryRequestLogs answers this today with page_size 1, which costs a\n COUNT(*) plus a row the caller discards, and takes the project as every\n API key id the project has ever held. This takes the project itself and\n scopes through api_keys.project_id, so the caller sends no key ids and a\n key added mid-window is counted (fraser#10363).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "count" ], "raw": "{{baseUrl}}/v1/request-logs/count" } } }, { "name": "GetRequestLogStats", "request": { "description": "GetRequestLogStats returns aggregated statistics for request logs.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "stats" ], "raw": "{{baseUrl}}/v1/request-logs/stats" } } }, { "name": "GetRequestLog", "request": { "description": "GetRequestLog retrieves a single request log by request ID.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "{{request_id}}" ], "raw": "{{baseUrl}}/v1/request-logs/{{request_id}}" } } }, { "name": "GetUsageStats", "request": { "description": "GetUsageStats returns an organization's usage over time, read from the\n usage rollups: totals, a time series, and groups by model, user, team,\n API key or usage mode.\n\n Unlike the request-log reads above, this is gated on metrics_reader and\n usage.read, the same grant as the metrics API. It returns aggregates\n only, never a request body or a client address.\n\n A request that names customer_id is authorized against that customer: an\n organization viewer of that customer, or a key of that customer, may\n call it. A request that names no customer reads every customer and needs\n a platform usage.read grant. A non-admin key is always confined to its\n own customer, and to its own project for a project-tier key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "usage", "stats" ], "raw": "{{baseUrl}}/v1/usage/stats" } } } ], "name": "agentrouter.insights.v1.RequestLogsService" }, { "item": [ { "name": "ListCustomerCatalogServers", "request": { "description": "ListCustomerCatalogServers lists the enabled catalog servers to the\n admins of one customer, for the Admin Console's MCP Servers page. It is\n the tenant read of the global catalogue: operator fields (note,\n metadata, tools_last_error) are left empty, and disabled servers are not\n listed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/mcp/catalog/servers" } } }, { "name": "GetCatalogServerOAuthClient", "request": { "description": "GetCatalogServerOAuthClient returns the OAuth client that serves a\n catalog server in one project, as sign-in picks it: the project's own\n client, else the deployment's shared one. Never another project's, and\n never the client secret. NOT_FOUND when no active client serves the\n server. The Admin Console calls it before it starts an OAuth sign-in or\n fetches a server's tools, so it needs mcp edit.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp", "catalog", "servers", "{{server_id}}", "oauth-client" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp/catalog/servers/{{server_id}}/oauth-client" } } }, { "name": "ListCatalogServers", "request": { "description": "ListCatalogServers returns every catalog entry, including disabled\n rows so operators can re-enable them. The dashboard's read-only\n view filters to is_enabled=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers" } } }, { "name": "UpsertCatalogServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authentication\": \"string\",\n \"categories\": [\n \"string\"\n ],\n \"description\": \"Example description\",\n \"iconUrl\": \"https://example.com\",\n \"id\": \"string\",\n \"name\": \"example-name\",\n \"note\": \"string\",\n \"requiresAuth\": false,\n \"requiresProfile\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "UpsertCatalogServer creates or replaces a catalog entry. Idempotent\n on `id`. Operator-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers" } } }, { "name": "DeleteCatalogServer", "request": { "description": "DeleteCatalogServer removes a catalog entry by id. Operator-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "GetCatalogServer", "request": { "description": "GetCatalogServer returns a single catalog entry by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "UpdateCatalogServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authentication\": \"string\",\n \"categories\": [\n \"string\"\n ],\n \"description\": \"Example description\",\n \"iconUrl\": \"https://example.com\",\n \"name\": \"example-name\",\n \"note\": \"string\",\n \"requiresAuth\": false,\n \"requiresProfile\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "UpdateCatalogServer replaces the content fields of an existing catalog\n server. It keeps the tools, the enabled state and the grants. A server\n that does not exist is NOT_FOUND, so an edit never brings back a server\n someone deleted. Every project that grants the server, and every owner\n of a profile that uses it, gets its routes regenerated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "SetCatalogServerEnabled", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false,\n \"typedErrors\": false\n}" }, "description": "SetCatalogServerEnabled flips the operator visibility toggle on a\n catalog entry. Split from UpsertCatalogServer so a re-upsert that\n refreshes content fields (display_name, url, ...) cannot silently\n re-enable a previously-disabled row through the proto bool zero\n value.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}", "enabled" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}/enabled" } } }, { "name": "SetCatalogServerTools", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"lastError\": \"string\",\n \"tools\": [\n {\n \"description\": \"Example description\",\n \"inputSchema\": \"string\",\n \"name\": \"example-name\",\n \"title\": \"string\"\n }\n ]\n}" }, "description": "SetCatalogServerTools saves the tools a catalog server offers, which the\n caller fetched from the server, or why that fetch failed. With tools, it\n replaces the list, stamps tools_fetched_at and clears tools_last_error.\n With only last_error, it keeps the tools and records the error. A server\n that does not exist is NOT_FOUND. Profiles pick from these tools; saving\n them changes no route, so it sends no data-plane event.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}", "tools" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}/tools" } } }, { "name": "CreateCatalogServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authentication\": \"string\",\n \"categories\": [\n \"string\"\n ],\n \"description\": \"Example description\",\n \"iconUrl\": \"https://example.com\",\n \"id\": \"string\",\n \"name\": \"example-name\",\n \"note\": \"string\",\n \"requiresAuth\": false,\n \"requiresProfile\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "CreateCatalogServer adds a server to the MCP catalog, enabled. It never\n changes an existing one: when a server with this id exists it returns\n ALREADY_EXISTS and writes nothing. Use UpdateCatalogServer to edit one.\n It is not idempotent: a client that retries after a lost response and\n gets ALREADY_EXISTS should read the server with GetCatalogServer.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers:create" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers:create" } } } ], "name": "agentrouter.mcp.v1.MCPCatalogService" }, { "item": [ { "name": "ListAvailableMCPServers", "request": { "description": "ListAvailableMCPServers lists the MCP servers a user may attach to a\n profile in the given project: enabled catalog servers granted to the\n project (project_mcp_servers), each with its tool catalog so the client\n can pick which tools to enable on attach.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "available-mcp-servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/available-mcp-servers" } } }, { "name": "ListMCPProfiles", "request": { "description": "ListMCPProfiles lists every profile owned by the given\n (user_id, customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "CreateMCPProfile", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"securityPolicyType\": \"https://example.com\",\n \"securityPolicyValue\": \"https://example.com\"\n}" }, "description": "CreateMCPProfile registers a new MCP server for a user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "DeleteMCPProfile", "request": { "description": "DeleteMCPProfile soft-deletes a profile (deleted_at set; row kept\n for FK integrity against historical request logs).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "GetMCPProfile", "request": { "description": "GetMCPProfile returns a single profile by uuid.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "UpdateMCPProfile", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"securityPolicyType\": \"https://example.com\",\n \"securityPolicyValue\": \"https://example.com\"\n}" }, "description": "UpdateMCPProfile updates mutable profile fields. Omitted scalar\n strings (\"\") leave the existing value untouched.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "AddMCPProfileServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiToken\": \"example-token\",\n \"bearerToken\": \"example-token\",\n \"serverId\": \"{{server_id}}\",\n \"tools\": [\n \"string\"\n ]\n}" }, "description": "AddMCPProfileServer attaches an MCP server to a profile with all of its\n tools enabled by default. Pass --tools in the CLI, or `tools` in the\n SDK/REST request, to enable a subset; a profile of type oauth requires it\n ([\"regex:*\"] for all tools).\n Creates a row in mcp_profile_backends with an optional\n per-server credential; the server must be enabled in the catalog and\n granted to the profile's project (project_mcp_servers), and re-adding an\n already-attached server updates its tools/credential in place.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers" } } }, { "name": "RemoveMCPProfileServer", "request": { "description": "RemoveMCPProfileServer detaches an MCP server from a profile, deleting\n the mcp_profile_backends row and any per-server credential. Idempotent:\n removing an already-detached server succeeds.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}" } } }, { "name": "GetMCPProfileServerAuthHeader", "request": { "description": "GetMCPProfileServerAuthHeader returns the header a call to an attached\n server sends with the per-server credential stored on the attachment (an\n API key or bearer token): the header named when the server was attached\n (default Authorization), with \"Bearer \" before a bearer token. An\n attachment with no stored credential returns an empty header, not an\n error. OAuth servers send the caller's OAuth token instead, through\n McpOAuthTokensService. Only a signed-in session acting for itself may call\n it, for its own profile. Internal: the Developer Console's Playground tool\n calls.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}", "auth-header" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}/auth-header" } } }, { "name": "SetMCPProfileServerTools", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tools\": [\n \"string\"\n ]\n}" }, "description": "SetMCPProfileServerTools replaces the enabled-tool set for an attached\n server (mcp_profile_backends.selectors.tools). Full-replacement (PUT)\n semantics. An EMPTY list stores/returns regex:* (include-all) -- to\n expose none, remove the server. On an \"oauth\" profile the list must hold\n 1 to 32 distinct entries, exact tool names or \"regex:\" selectors; an\n empty list and anything else is INVALID_ARGUMENT.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}", "tools" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}/tools" } } }, { "name": "TestMCPServerConnection", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"upstreamToken\": \"example-token\",\n \"upstreamTokenType\": \"\"\n}" }, "description": "TestMCPServerConnection runs an MCP handshake (initialize, then\n tools/list) against a server the caller may attach in the project. It\n calls the server's catalog URL. It sends the caller's stored OAuth\n token for an OAuth server, or upstream_token. An expired or missing\n OAuth token returns FAILED_PRECONDITION. Only a signed-in session acting\n for itself may call it. Internal: the Developer Console's Test\n connection button.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-servers", "{{server_id}}:test" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-servers/{{server_id}}:test" } } }, { "name": "ListMCPProfiles", "request": { "description": "ListMCPProfiles lists every profile owned by the given\n (user_id, customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "GetMCPProfile", "request": { "description": "GetMCPProfile returns a single profile by uuid.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } } ], "name": "agentrouter.mcp.v1.MCPProfilesService" }, { "item": [ { "name": "ListMcpOAuthClients", "request": { "description": "ListMcpOAuthClients lists every non-deleted OAuth client in the\n (customer, project) scope. Account tier: any project member may read.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients" } } }, { "name": "CreateMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"metadataJson\": {\n \"key\": 0\n },\n \"provider\": \"string\",\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "CreateMcpOAuthClient registers a new OAuth client under a project.\n The client_secret is wrapped by the secret service and discarded;\n only an sm:// reference is persisted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients" } } }, { "name": "DeleteMcpOAuthClient", "request": { "description": "DeleteMcpOAuthClient soft-deletes a client (deleted_at set).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "GetMcpOAuthClient", "request": { "description": "GetMcpOAuthClient returns a single OAuth client by id. Never returns\n the client_secret. Account tier: any project member may read.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "UpdateMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"metadataJson\": {\n \"key\": 0\n },\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"replaceMetadata\": false,\n \"replaceRedirectUris\": false,\n \"replaceScopes\": false,\n \"replaceServerIds\": false,\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "UpdateMcpOAuthClient applies a partial patch. Omitted scalar strings\n (\"\") leave the existing value untouched. A non-empty client_secret is\n stored under a new secret name; the previous secret is deleted once no\n live client uses it. Changing token_url or authorization_url of a\n confidential client requires client_secret in the same request, so the\n stored secret never goes to an endpoint it was not entered for.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "ListDeploymentMcpOAuthClients", "request": { "description": "ListDeploymentMcpOAuthClients lists the deployment's shared OAuth\n clients: the ('default', 'default') rows every project can sign in\n through, which the Admin Console manages. Offset paging, because the\n console shows page numbers. Never returns a client_secret.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/mcp-oauth-clients" } } }, { "name": "CreateDeploymentMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadataJson\": {\n \"key\": 0\n },\n \"provider\": \"string\",\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "CreateDeploymentMcpOAuthClient adds a shared OAuth client. Its provider\n must not be used by a live project client. The row keeps the Admin\n Console's storage shape, so the console can still read it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/mcp-oauth-clients" } } }, { "name": "DeleteDeploymentMcpOAuthClient", "request": { "description": "DeleteDeploymentMcpOAuthClient soft-deletes a shared OAuth client and\n deletes its secret once no live client uses it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "GetDeploymentMcpOAuthClient", "request": { "description": "GetDeploymentMcpOAuthClient returns one shared OAuth client. Never\n returns the client_secret.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "UpdateDeploymentMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadataJson\": {\n \"key\": 0\n },\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"replaceRedirectUris\": false,\n \"replaceScopes\": false,\n \"replaceServerIds\": false,\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "UpdateDeploymentMcpOAuthClient patches a shared OAuth client, with the\n rules of UpdateMcpOAuthClient. A new client_secret replaces the stored\n one, and the previous secret is deleted once no live client uses it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "ExchangeDeploymentMcpOAuthCode", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"code\": \"string\",\n \"codeVerifier\": \"string\",\n \"redirectUri\": \"https://example.com\"\n}" }, "description": "ExchangeDeploymentMcpOAuthCode completes a sign-in through a shared\n client: it trades the authorization code for an access token at the\n client's token endpoint and returns the access token. It never returns a\n refresh token, and valet stores nothing. The Admin Console uses it to list\n an MCP server's tools. redirect_uri must be one of the client's. The token\n endpoint must be https on a public address\n (MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES opens private ones), and\n redirects are not followed. Every call is audited, a failed one included.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp-oauth-clients", "{{mcp_oauth_client_id}}:exchangeCode" ], "raw": "{{baseUrl}}/v1/mcp-oauth-clients/{{mcp_oauth_client_id}}:exchangeCode" } } } ], "name": "agentrouter.mcp.v1.McpOAuthClientsService" }, { "item": [ { "name": "GetApiKeyMetric", "request": { "description": "GetApiKeyMetric returns a metric for a single API key. The key must belong\n to the resolved (customer, project) scope, else NotFound.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "api_keys", "{{api_key_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/api_keys/{{api_key_id}}/metrics/{{metric}}" } } }, { "name": "GetProjectMetric", "request": { "description": "GetProjectMetric returns a project-level metric. The caller must be a\n member of the (customer, project) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/metrics/{{metric}}" } } }, { "name": "GetUserMetric", "request": { "description": "GetUserMetric returns a metric for a single user. The user_id is forced to\n the authenticated caller: a caller can only read their own USER-layer\n metrics even within a project they share.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/metrics/{{metric}}" } } }, { "name": "GetMyMetric", "request": { "description": "GetMyMetric returns a USER-layer metric for the calling user, resolved\n entirely from the session token -- no tenancy scope is required.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/me/metrics/{{metric}}" } } }, { "name": "ListMetrics", "request": { "description": "ListMetrics returns DPO's metric catalog: the known metrics, the layers\n and endpoint-layers supported, and the raw-metric passthrough route\n (DPO#22). The catalog is non-sensitive discovery metadata, so it is\n exposed here to every authenticated caller -- not just admin -- with no\n tenancy scope or special scope required. Uses a distinct path from the\n admin MetricsService.ListMetrics (/v1/metrics) to avoid colliding with\n GetMetric's /v1/metrics/{metric}.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metric-catalog" ], "raw": "{{baseUrl}}/v1/metric-catalog" } } } ], "name": "agentrouter.metrics.v1.CustomerMetricsService" }, { "item": [ { "name": "GetCustomerMetric", "request": { "description": "GetCustomerMetric returns a customer-level (CUSTOMER-layer) metric for any\n customer.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/metrics/{{metric}}" } } }, { "name": "ListMetrics", "request": { "description": "ListMetrics returns DPO's metric catalog: the known metrics, the layers\n and endpoint-layers supported, and the raw-metric passthrough route\n (DPO#22). This coexists with GetMetric's /v1/metrics/{metric}: an exact\n path match on /v1/metrics routes here.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metrics" ], "raw": "{{baseUrl}}/v1/metrics" } } }, { "name": "GetMetric", "request": { "description": "GetMetric returns a metric for any entity in any layer, including the\n infra layers DATAPLANE and GATEWAY. entity and layer are taken from the\n request.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/metrics/{{metric}}" } } }, { "name": "GetRawMetric", "request": { "description": "GetRawMetric returns an unaggregated (raw) metric, bypassing the summary\n rollup (DPO#21).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "raw-metrics", "{{raw_metric_name}}" ], "raw": "{{baseUrl}}/v1/raw-metrics/{{raw_metric_name}}" } } } ], "name": "agentrouter.metrics.v1.MetricsService" }, { "item": [ { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{fallback_chain_policy_target_key_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{fallback_chain_policy_target_key_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{fallback_chain_policy_target_key_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{fallback_chain_policy_target_key_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "UpsertFallbackPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpsertFallbackPolicy replaces the complete set of fallback entries for\n one organization, project, or API-key target. `entries` is authoritative:\n omitted protected models are removed, and an empty set deactivates the\n target. Release 1 precedence is API key > project > organization/customer;\n tag targets are reporting-only and cannot be created by this operation.\n Eligible retry categories are timeout, rate-limit/capacity, and server\n error. Malformed requests, content refusals, rejected credentials, and\n other non-eligible client failures do not advance the ordered list.\n Effective responses and request logs identify the serving model and the\n source scope/policy. The public names are FallbackPolicy,\n fallback-policies, entries, and fallback_models; FallbackChainPolicy and\n chain remain read/write aliases for legacy clients.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{fallback_policy_target_key_id}}", "policy", "fallback-policies:upsert" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{fallback_policy_target_key_id}}/policy/fallback-policies:upsert" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{target_key_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{target_key_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{target_key_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{target_key_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "UpsertFallbackPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpsertFallbackPolicy replaces the complete set of fallback entries for\n one organization, project, or API-key target. `entries` is authoritative:\n omitted protected models are removed, and an empty set deactivates the\n target. Release 1 precedence is API key > project > organization/customer;\n tag targets are reporting-only and cannot be created by this operation.\n Eligible retry categories are timeout, rate-limit/capacity, and server\n error. Malformed requests, content refusals, rejected credentials, and\n other non-eligible client failures do not advance the ordered list.\n Effective responses and request logs identify the serving model and the\n source scope/policy. The public names are FallbackPolicy,\n fallback-policies, entries, and fallback_models; FallbackChainPolicy and\n chain remain read/write aliases for legacy clients.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-policies:upsert" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-policies:upsert" } } }, { "name": "CreateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"name\": \"example-name\",\n \"split\": [\n {}\n ]\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "CreateTrafficSplitPolicy creates a new traffic-split policy scoped to a\n key, tag selector, or project (fraser#5447, item 4.2). A KEY policy is\n stored on the key's effective client, one per client: a second create\n returns ALREADY_EXISTS. The owner of a key can create its KEY policy\n without project_id (fraser#10611).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/traffic-split-policies" } } }, { "name": "SetTrafficSplitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetTrafficSplitPolicyStatus toggles a traffic split policy's\n active/inactive state (is_active). The owner of a key can set the status\n of its KEY policy without project_id (fraser#10611).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}/status" } } }, { "name": "UpdateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"name\": \"example-name\",\n \"split\": [\n {}\n ]\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateTrafficSplitPolicy updates mutable traffic split policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n A KEY policy stays on its client: a change to or from KEY scope, or to\n another key, returns INVALID_ARGUMENT. The owner of a key can update its\n KEY policy without project_id (fraser#10611).\n The policy id must be set inside the traffic_split_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "AddApiKeyTag", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tagKey\": \"example-value\",\n \"tagValue\": \"string\"\n}" }, "description": "AddApiKeyTag attaches a (tag_key, tag_value) pair to an API key. Both\n must reference an existing TagSchemaEntry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "api-keys", "{{api_key_id}}", "tags" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/api-keys/{{api_key_id}}/tags" } } }, { "name": "RemoveApiKeyTag", "request": { "description": "RemoveApiKeyTag detaches a tag from an API key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "api-keys", "{{api_key_id}}", "tags", "{{tag_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/api-keys/{{api_key_id}}/tags/{{tag_id}}" } } }, { "name": "CreateAttributeRoutingPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"attributeRoutingPolicy\": {\n \"defaultModel\": \"string\",\n \"defaultProvider\": \"string\",\n \"rules\": [\n {\n \"conditions\": [\n {}\n ],\n \"destinationModel\": \"string\",\n \"destinationProvider\": \"string\",\n \"id\": \"string\",\n \"ruleOrder\": 1\n }\n ],\n \"scopeType\": \"ATTRIBUTE_ROUTING_SCOPE_TYPE_KEY\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetApiKeyId\": \"example-value\",\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "CreateAttributeRoutingPolicy creates an ordered rule list bound to a\n project or a key. The created policy is always in MONITOR mode: nothing\n moves traffic until SetAttributeRoutingPolicyMode flips it.\n\n KNOWN LIMITATION. A destination is checked against the target project's\n catalog at save time, which is early feedback rather than a guarantee.\n Availability for a given key also depends on the provider, the project's\n provider filter, the key's own route map and the gateway binding, all of\n which are resolved when the routing snapshot is rendered. A rule can\n therefore save cleanly and still never fire, because the destination was\n dropped at render time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies" } } }, { "name": "UpdateAttributeRoutingPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"attributeRoutingPolicy\": {\n \"defaultModel\": \"string\",\n \"defaultProvider\": \"string\",\n \"rules\": [\n {\n \"conditions\": [\n {}\n ],\n \"destinationModel\": \"string\",\n \"destinationProvider\": \"string\",\n \"id\": \"string\",\n \"ruleOrder\": 1\n }\n ],\n \"scopeType\": \"ATTRIBUTE_ROUTING_SCOPE_TYPE_KEY\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetApiKeyId\": \"example-value\",\n \"targetProjectId\": \"string\"\n },\n \"clearRules\": false\n}" }, "description": "UpdateAttributeRoutingPolicy applies a partial update. A present `rules`\n field replaces the ENTIRE rule list: a rule carrying its id is updated in\n place, a rule with no id is created, and a rule left out is deleted.\n Omitting `rules` leaves the list untouched. Mode, status, scope_type,\n target_api_key_id, and target_project_id are NOT settable here.\n\n KNOWN LIMITATION. A destination is checked against the target project's\n catalog at save time, which is early feedback rather than a guarantee.\n Availability for a given key also depends on the provider, the project's\n provider filter, the key's own route map and the gateway binding, all of\n which are resolved when the routing snapshot is rendered. A rule can\n therefore save cleanly and still never fire, because the destination was\n dropped at render time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}" } } }, { "name": "DeleteAttributeRoutingPolicy", "request": { "description": "DeleteAttributeRoutingPolicy removes a policy; its rules and conditions\n go with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}" } } }, { "name": "SetAttributeRoutingPolicyMode", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"mode\": \"ATTRIBUTE_ROUTING_MODE_MONITOR\"\n}" }, "description": "SetAttributeRoutingPolicyMode flips a policy between monitoring and\n enforcing. Its own RPC, and its own audit action, because this is the\n moment live traffic starts moving.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}", "mode" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}/mode" } } }, { "name": "SetAttributeRoutingPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetAttributeRoutingPolicyStatus switches a policy on or off. Independent\n of mode: pausing a policy does not forget whether it monitors or\n enforces.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}/status" } } }, { "name": "CreateBudgetPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"budgetPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"alertThresholds\": [\n 0\n ],\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"fallbackModel\": \"string\",\n \"fallbackModels\": {\n \"key\": \"string\"\n },\n \"groupId\": \"{{group_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"spendLimit\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\"\n }\n}" }, "description": "CreateBudgetPolicy creates a new budget policy. For API_KEY scope, the\n named key's client and project are resolved under its row lock. Returns\n ABORTED if the key's project changed after authorization; a retry must\n still satisfy the request project's ownership check. A PROJECT scope\n policy applies to every key of budget_policy.project_id, and stops traffic\n at its limit only with action BLOCK. Only an organization admin can create\n one (PERMISSION_DENIED otherwise), and the project must be a live project\n of customer_id (NOT_FOUND otherwise).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies" } } }, { "name": "UpdateBudgetPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"budgetPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"alertThresholds\": [\n 0\n ],\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"fallbackModel\": \"string\",\n \"fallbackModels\": {\n \"key\": \"string\"\n },\n \"groupId\": \"{{group_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"spendLimit\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\"\n }\n}" }, "description": "UpdateBudgetPolicy updates mutable budget policy fields. Omitted/empty\n scalar string fields leave the existing value untouched. Enum fields set\n to *_UNSPECIFIED leave the existing value untouched. The policy id must\n be set inside the budget_policy field. Restating the same api_key_id on\n an existing API_KEY policy preserves its stored client and project;\n supplying a different key retargets it. When a key target is supplied,\n returns ABORTED if its project changed after authorization. A retry must\n still satisfy the request project's ownership check. Moving a policy of\n another scope onto PROJECT scope needs an organization admin\n (PERMISSION_DENIED otherwise).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "DeleteBudgetPolicy", "request": { "description": "DeleteBudgetPolicy deactivates a budget policy (is_active = false); the\n row remains, still listed under statuses INACTIVE, and can be removed\n with PurgeBudgetPolicy once inactive.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "PurgeBudgetPolicy", "request": { "description": "PurgeBudgetPolicy permanently removes an INACTIVE budget policy.\n DeleteBudgetPolicy only deactivates (budget_policies has no deleted_at\n column), so without this RPC an API-only operator could never remove a\n row. The policy must already be inactive -- deactivate it first through\n SetBudgetPolicyStatus or DeleteBudgetPolicy -- and that check is part of\n the delete statement itself, so a policy reactivated concurrently is left\n in place rather than destroyed.\n\n A caller without the admin scope may purge only PROJECT- and API_KEY-scoped\n policies within the request project. After request authorization, unknown\n policies and targets outside this allow-list both return NOT_FOUND. An\n active policy returns FAILED_PRECONDITION only if the caller is authorized\n to purge it.\n Alert history survives the purge\n with BudgetAlert.policy_id cleared (budget_alerts.policy_id is ON DELETE\n SET NULL), so ListBudgetAlerts can no longer find those alerts by\n policy_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}", "purge" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}/purge" } } }, { "name": "SetBudgetPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetBudgetPolicyStatus toggles a budget policy's active/inactive state\n (is_active). Activation retries concurrent changes to the policy's stored\n scope, client or project. Returns ABORTED if the target cannot be stabilized\n within the retry limit; the caller may retry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}/status" } } }, { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "UpsertFallbackPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpsertFallbackPolicy replaces the complete set of fallback entries for\n one organization, project, or API-key target. `entries` is authoritative:\n omitted protected models are removed, and an empty set deactivates the\n target. Release 1 precedence is API key > project > organization/customer;\n tag targets are reporting-only and cannot be created by this operation.\n Eligible retry categories are timeout, rate-limit/capacity, and server\n error. Malformed requests, content refusals, rejected credentials, and\n other non-eligible client failures do not advance the ordered list.\n Effective responses and request logs identify the serving model and the\n source scope/policy. The public names are FallbackPolicy,\n fallback-policies, entries, and fallback_models; FallbackChainPolicy and\n chain remain read/write aliases for legacy clients.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-policies:upsert" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-policies:upsert" } } }, { "name": "CreateRateLimitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rateLimitPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"displayName\": \"example-name\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"limit\": {\n \"inputTokensPerHour\": 0,\n \"outputTokensPerHour\": 0,\n \"requestsPerHour\": 0,\n \"requestsPerMinute\": 0,\n \"totalTokensPerHour\": 0,\n \"totalTokensPerMinute\": 0\n },\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "CreateRateLimitPolicy creates a new rate-limit policy.\n\n A policy sets any mix of six limits, and each one applies on its own. A\n dimension left at 0 is unset and has no limit.\n - input_tokens_per_hour: input (prompt) tokens per rolling hour.\n - output_tokens_per_hour: output (completion) tokens per rolling hour.\n - total_tokens_per_hour: input plus output tokens per rolling hour. This\n is the \"tokens per hour\" limit.\n - total_tokens_per_minute: input plus output tokens per rolling minute.\n - requests_per_minute: requests per rolling minute. Each request counts\n 1 when it arrives.\n - requests_per_hour: requests per rolling hour.\n\n requests_per_minute, requests_per_hour and total_tokens_per_minute are\n accepted only with scope_type PROJECT or API_KEY and action BLOCK. The\n server refuses them on any other scope or action with InvalidArgument.\n Tag, system and monitor policies keep the first three dimensions.\n\n Every dimension that is set must be between 1 and 1,000,000,000. The\n server refuses any other value with InvalidArgument.\n\n A project-scope limit is counted for each API key in the project on its\n own, not shared across the project.\n\n The period field has no effect: the server stores and returns it, and each\n dimension's window comes from the dimension's name.\n\n The server refuses the policy with FailedPrecondition when it sets one of\n the three newer dimensions and a data plane serving the target project\n reports a build older than 0.8.0, or no build.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies" } } }, { "name": "DeleteRateLimitPolicy", "request": { "description": "DeleteRateLimitPolicy deletes a rate-limit policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "SetRateLimitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetRateLimitPolicyStatus toggles a rate-limit policy's active/inactive\n state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}/status" } } }, { "name": "UpdateRateLimitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"clearDimensions\": [\n \"RATE_LIMIT_DIMENSION_INPUT_TOKENS_PER_HOUR\"\n ],\n \"rateLimitPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"displayName\": \"example-name\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"limit\": {\n \"inputTokensPerHour\": 0,\n \"outputTokensPerHour\": 0,\n \"requestsPerHour\": 0,\n \"requestsPerMinute\": 0,\n \"totalTokensPerHour\": 0,\n \"totalTokensPerMinute\": 0\n },\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "UpdateRateLimitPolicy updates mutable rate-limit policy fields.\n Omitted/empty scalar fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. The\n policy id must be set inside the rate_limit_policy field. To remove a\n dimension, list it in clear_dimensions.\n\n A policy sets any mix of six limits, and each one applies on its own.\n - input_tokens_per_hour: input (prompt) tokens per rolling hour.\n - output_tokens_per_hour: output (completion) tokens per rolling hour.\n - total_tokens_per_hour: input plus output tokens per rolling hour. This\n is the \"tokens per hour\" limit.\n - total_tokens_per_minute: input plus output tokens per rolling minute.\n - requests_per_minute: requests per rolling minute. Each request counts\n 1 when it arrives.\n - requests_per_hour: requests per rolling hour.\n\n requests_per_minute, requests_per_hour and total_tokens_per_minute are\n accepted only with scope_type PROJECT or API_KEY and action BLOCK. The\n server refuses them on any other scope or action with InvalidArgument.\n\n Every dimension that is set must be between 1 and 1,000,000,000. The\n server refuses any other value with InvalidArgument.\n\n A project-scope limit is counted for each API key in the project on its\n own, not shared across the project.\n\n The period field has no effect: the server stores and returns it, and each\n dimension's window comes from the dimension's name.\n\n The server refuses the update with FailedPrecondition when it sets one of\n the three newer dimensions and a data plane serving the target project\n reports a build older than 0.8.0, or no build.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "CreateRequestAttribute", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"requestAttribute\": {\n \"allowedValues\": [\n \"string\"\n ],\n \"name\": \"example-name\",\n \"source\": \"REQUEST_ATTRIBUTE_SOURCE_METADATA\",\n \"valueType\": \"REQUEST_ATTRIBUTE_VALUE_TYPE_ENUM\"\n }\n}" }, "description": "CreateRequestAttribute adds one entry to the customer's org-wide routing\n vocabulary.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "request-attributes" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/request-attributes" } } }, { "name": "DeleteRequestAttribute", "request": { "description": "DeleteRequestAttribute removes a vocabulary entry. Refused with\n FailedPrecondition, naming the blocking policies, when a live rule\n condition still compares against it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "request-attributes", "{{request_attribute_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/request-attributes/{{request_attribute_id}}" } } }, { "name": "UpdateRequestAttribute", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"requestAttribute\": {\n \"allowedValues\": [\n \"string\"\n ],\n \"name\": \"example-name\",\n \"source\": \"REQUEST_ATTRIBUTE_SOURCE_METADATA\",\n \"valueType\": \"REQUEST_ATTRIBUTE_VALUE_TYPE_ENUM\"\n }\n}" }, "description": "UpdateRequestAttribute replaces a vocabulary entry's name, value type and\n allowed values. Removing an allowed value that a live rule compares\n against is permitted and does NOT break the rule structurally; it makes\n that condition stop matching, which is why fraser#8662 warns first.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "request-attributes", "{{request_attribute_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/request-attributes/{{request_attribute_id}}" } } }, { "name": "CreateTagSchemaEntry", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tagSchemaEntry\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"projectId\": \"{{project_id}}\",\n \"tagKey\": \"example-value\",\n \"tagValue\": \"string\"\n }\n}" }, "description": "CreateTagSchemaEntry adds an allowed (tag_key, tag_value) pair to the\n tag catalog.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema" } } }, { "name": "DeleteTagSchemaEntry", "request": { "description": "DeleteTagSchemaEntry removes an allowed (tag_key, tag_value) pair from\n the tag catalog.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema", "{{tag_schema_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema/{{tag_schema_id}}" } } }, { "name": "UpdateTagSchemaEntry", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\"\n}" }, "description": "UpdateTagSchemaEntry replaces a tag catalog entry's description. The\n description is the only mutable field: tag_key and tag_value are the\n identity that api_key_tags rows and policy tag selectors match on, so\n they are fixed once created. An empty description clears it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema", "{{tag_schema_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema/{{tag_schema_id}}" } } }, { "name": "CreateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"name\": \"example-name\",\n \"split\": [\n {}\n ]\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "CreateTrafficSplitPolicy creates a new traffic-split policy scoped to a\n key, tag selector, or project (fraser#5447, item 4.2). A KEY policy is\n stored on the key's effective client, one per client: a second create\n returns ALREADY_EXISTS. The owner of a key can create its KEY policy\n without project_id (fraser#10611).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies" } } }, { "name": "DeleteTrafficSplitPolicy", "request": { "description": "DeleteTrafficSplitPolicy deletes a traffic split policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "SetTrafficSplitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetTrafficSplitPolicyStatus toggles a traffic split policy's\n active/inactive state (is_active). The owner of a key can set the status\n of its KEY policy without project_id (fraser#10611).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}/status" } } }, { "name": "UpdateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"name\": \"example-name\",\n \"split\": [\n {}\n ]\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateTrafficSplitPolicy updates mutable traffic split policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n A KEY policy stays on its client: a change to or from KEY scope, or to\n another key, returns INVALID_ARGUMENT. The owner of a key can update its\n KEY policy without project_id (fraser#10611).\n The policy id must be set inside the traffic_split_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "CreateUserGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userGroup\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreateUserGroup creates a new user group (team).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups" } } }, { "name": "DeleteUserGroup", "request": { "description": "DeleteUserGroup deletes a user group. The group must be empty and\n unreferenced: a group that still has members, or that an active budget\n policy targets, is refused with FAILED_PRECONDITION, so callers remove the\n members (RemoveUserGroupMembers) and deactivate the policies first.\n Inactive budget policies targeting the group are deleted with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}" } } }, { "name": "UpdateUserGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"clearDescription\": false,\n \"userGroup\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdateUserGroup updates mutable user group fields. Omitted/empty scalar\n string fields leave the existing value untouched. The group id must be\n set inside the user_group field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}" } } }, { "name": "AddUserGroupMembers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "AddUserGroupMembers puts users into a group. A user already in another\n group is moved into this one, and the group they left comes back in\n `moves` -- the tag it overwrites is the only record of it. Ids that do\n not name a user are reported in `failed`; the rest of the batch still\n applies.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}/members" } } }, { "name": "RemoveUserGroupMembers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "RemoveUserGroupMembers takes users out of a group. Removal is idempotent:\n a listed user who is not in the group is left alone rather than reported\n as an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}", "members", "remove" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}/members/remove" } } }, { "name": "ListApiKeyIdsByTag", "request": { "description": "ListApiKeyIdsByTag returns the IDs of the caller's API keys that carry a\n tag, or, with untagged set, the IDs of keys that carry none. Deleted keys\n are left out; revoked keys are included, since they can still be tagged.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "api-key-ids" ], "raw": "{{baseUrl}}/v1/policy/api-key-ids" } } }, { "name": "BatchListApiKeyTags", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyIds\": [\n \"00000000-0000-4000-8000-000000000000\"\n ],\n \"customerId\": \"{{customer_id}}\"\n}" }, "description": "BatchListApiKeyTags returns the tags on each of a set of API keys in one\n call. Deleted keys and keys the caller does not own are left out rather\n than erroring.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "api-key-tags", "lookup" ], "raw": "{{baseUrl}}/v1/policy/api-key-tags/lookup" } } }, { "name": "ListApiKeyTags", "request": { "description": "ListApiKeyTags returns tags attached to an API key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "api-keys", "{{api_key_id}}", "tags" ], "raw": "{{baseUrl}}/v1/policy/api-keys/{{api_key_id}}/tags" } } }, { "name": "ListAttributeRoutingPolicies", "request": { "description": "ListAttributeRoutingPolicies returns policies matching the filters,\n WITHOUT their rule bodies: the list surfaces show targets, modes, and a\n lightweight rule_count / distinct_destination_model_count summary. Use\n GetAttributeRoutingPolicy to load the rules themselves.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "attribute-routing-policies" ], "raw": "{{baseUrl}}/v1/policy/attribute-routing-policies" } } }, { "name": "GetAttributeRoutingPolicy", "request": { "description": "GetAttributeRoutingPolicy returns a single policy with its ordered rules\n and their conditions.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/attribute-routing-policies/{{attribute_routing_policy_id}}" } } }, { "name": "GetAttributeRoutingPolicyAnalytics", "request": { "description": "GetAttributeRoutingPolicyAnalytics returns the monitor/enforce readout\n derived from hourly routing-decision rollups.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}", "analytics" ], "raw": "{{baseUrl}}/v1/policy/attribute-routing-policies/{{attribute_routing_policy_id}}/analytics" } } }, { "name": "ListBudgetAlerts", "request": { "description": "ListBudgetAlerts returns system-fired budget alerts matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-alerts" ], "raw": "{{baseUrl}}/v1/policy/budget-alerts" } } }, { "name": "GetBudgetAlert", "request": { "description": "GetBudgetAlert returns a single budget alert by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-alerts", "{{budget_alert_id}}" ], "raw": "{{baseUrl}}/v1/policy/budget-alerts/{{budget_alert_id}}" } } }, { "name": "GetBudgetConsumption", "request": { "description": "GetBudgetConsumption reports what an organization, or the projects inside\n it, consumed in the current accounting period, and the budget in force at\n that scope when one is set. Exactly two scopes are reported, the\n organization and a project, and this surface has no others.\n\n Consumption is measured from the usage rollups at read time and never\n stored, over the same two windows BudgetSpend is computed from: daily\n rollups before the current UTC day, hourly rollups from it on. It is\n reported in money and in tokens.\n\n The budget is a money figure. No budget in this system is denominated in\n tokens, and no field on this RPC is a token ceiling.\n\n `budget` is read from the active budget policy already stored at that\n scope, and is absent when there is none, so a caller can say that no\n budget is set rather than showing a zero. This RPC authors nothing: an\n organization admin creates a project budget with CreateBudgetPolicy,\n which does not create an organization budget.\n\n This RPC states consumption and limit, and says nothing about what\n happens when the limit is reached. That belongs to the budget system --\n BudgetPolicy.action, the alert evaluator and the enforcement resolver --\n and no field here adds to it or restates it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-consumption" ], "raw": "{{baseUrl}}/v1/policy/budget-consumption" } } }, { "name": "ListBudgetPolicies", "request": { "description": "ListBudgetPolicies returns budget policies matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies" ], "raw": "{{baseUrl}}/v1/policy/budget-policies" } } }, { "name": "GetBudgetSpendHistory", "request": { "description": "GetBudgetSpendHistory returns monthly billable spend for a target, even\n before a budget policy exists. Like other budget reads, this is a\n tenant-wide budget_policies.read operation, not a project-scoped read.\n RBAC and policy_reader scope authorization follow the other budget reads.\n customer_id remains explicit so authorization resolves the tenant before\n the handler runs; API-key boundaries apply on either authorization path.\n Project-bound non-admin API keys cannot call this organization operation.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies", "spend-history" ], "raw": "{{baseUrl}}/v1/policy/budget-policies/spend-history" } } }, { "name": "GetBudgetPolicy", "request": { "description": "GetBudgetPolicy returns a single budget policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "GetPolicyCoverage", "request": { "description": "GetPolicyCoverage reports whether a scope reference has at least one\n applicable BudgetPolicy, and lists which ones apply.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "coverage" ], "raw": "{{baseUrl}}/v1/policy/coverage" } } }, { "name": "GetEffectivePolicy", "request": { "description": "GetEffectivePolicy resolves every BudgetPolicy applicable to a\n scope-target tuple down to the single clamp-winning policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "effective-policy" ], "raw": "{{baseUrl}}/v1/policy/effective-policy" } } }, { "name": "ListFallbackChainPolicies", "request": { "description": "ListFallbackChainPolicies returns fallback chain policies matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/policy/fallback-chain-policies" } } }, { "name": "GetFallbackChainPolicy", "request": { "description": "GetFallbackChainPolicy returns a single fallback chain policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "ListPolicies", "request": { "description": "ListPolicies returns a read-only, paginated list for the caller's tenant.\n Budget, rate-limit, fallback-chain and traffic-split policies include only\n PROJECT and TAG targets. Their KEY targets remain on the key's config page;\n the other legacy budget/rate-limit scopes remain excluded.\n Attribute-routing policies include PROJECT and KEY targets. A row appears\n only when the caller could read it through GetAttributeRoutingPolicy in its\n effective project. Visibility and request filters apply before totals and\n pagination. Mutations still use each family's type-specific RPCs.\n\n UnifiedPolicy.match_count retains target membership counts for the existing\n families. Attribute-routing coverage counts eligible keys where the policy\n is the enabled winner, independent of monitor/enforce mode.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "policies" ], "raw": "{{baseUrl}}/v1/policy/policies" } } }, { "name": "ListRateLimitPolicies", "request": { "description": "ListRateLimitPolicies returns rate-limit policies matching the specified\n filters. The period field has no effect on enforcement.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies" } } }, { "name": "GetRateLimitPolicy", "request": { "description": "GetRateLimitPolicy returns a single rate-limit policy by id. The period\n field has no effect on enforcement.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "GetRateLimitPolicyAnalytics", "request": { "description": "GetRateLimitPolicyAnalytics computes a \"would-have-limited\" analytics\n preview for a MONITOR-action rate-limit policy (fraser#5446 pass 2, item\n 4.4 / ADR-036 R2 Option B): for each hour in the lookback window, it sums\n the policy's audience (the same scope resolution the min-clamp resolver\n uses -- key / tag / project / system) from the existing usage rollups\n (usage_hourly_rollups) and reports how many of those hours would have\n breached the policy's triplet ceiling, had the policy been enforced. This\n is NOT true shadow-mode enforcement (no per-request evaluation, no\n sub-hour granularity) -- it is a rollup-derived retrospective estimate,\n intended to help an operator decide whether flipping a MONITOR policy to\n BLOCK is safe (see the Flow-1 monitor->active flip, fraser#5448).\n Rejects a BLOCK-action policy's id with FailedPrecondition: a BLOCK\n policy is already actually enforced by the min-clamp resolver, so a\n retrospective \"would it have limited\" estimate is not meaningful for it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}", "analytics" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies/{{rate_limit_policy_id}}/analytics" } } }, { "name": "ListRequestAttributes", "request": { "description": "ListRequestAttributes returns the customer's routing vocabulary, ordered\n by name. A project-scoped read is confined to the project through which\n the caller was authorized; an org-wide read requires organization-level\n read access.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "request-attributes" ], "raw": "{{baseUrl}}/v1/policy/request-attributes" } } }, { "name": "GetRequestAttribute", "request": { "description": "GetRequestAttribute returns a single vocabulary entry by id, including\n the policies that reference it so a caller can tell whether deleting it\n would break a live rule. A project-scoped read is confined to the project\n through which the caller was authorized; an org-wide read requires\n organization-level read access.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "request-attributes", "{{request_attribute_id}}" ], "raw": "{{baseUrl}}/v1/policy/request-attributes/{{request_attribute_id}}" } } }, { "name": "ListTagSchema", "request": { "description": "ListTagSchema returns allowed tag key/value pairs matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "tag-schema" ], "raw": "{{baseUrl}}/v1/policy/tag-schema" } } }, { "name": "ListTrafficSplitPolicies", "request": { "description": "ListTrafficSplitPolicies returns traffic split policies matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/policy/traffic-split-policies" } } }, { "name": "GetTrafficSplitPolicy", "request": { "description": "GetTrafficSplitPolicy returns a single traffic split policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "ListUserGroups", "request": { "description": "ListUserGroups returns user groups matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups" ], "raw": "{{baseUrl}}/v1/policy/user-groups" } } }, { "name": "GetUserGroup", "request": { "description": "GetUserGroup returns a single user group by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/policy/user-groups/{{user_group_id}}" } } }, { "name": "ListUserGroupMembers", "request": { "description": "ListUserGroupMembers returns the users who belong to a group, ordered by\n name.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups", "{{user_group_id}}", "members" ], "raw": "{{baseUrl}}/v1/policy/user-groups/{{user_group_id}}/members" } } } ], "name": "agentrouter.policy.v1.PolicyService" }, { "item": [ { "name": "ListBindings", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings" ], "raw": "{{baseUrl}}/api/rbac/bindings" } } }, { "name": "CreateBinding", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"permissions\": [\n \"string\"\n ],\n \"principalId\": \"string\",\n \"principalType\": \"string\",\n \"roleId\": \"{{role_id}}\",\n \"scopeId\": \"string\",\n \"scopeType\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings" ], "raw": "{{baseUrl}}/api/rbac/bindings" } } }, { "name": "DeleteBinding", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings", "{{binding_id}}" ], "raw": "{{baseUrl}}/api/rbac/bindings/{{binding_id}}" } } }, { "name": "UpdateBinding", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"permissions\": [\n \"string\"\n ],\n \"roleId\": \"{{role_id}}\",\n \"scopeId\": \"string\",\n \"scopeType\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings", "{{binding_id}}" ], "raw": "{{baseUrl}}/api/rbac/bindings/{{binding_id}}" } } }, { "name": "ListGroups", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups" ], "raw": "{{baseUrl}}/api/rbac/groups" } } }, { "name": "CreateGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups" ], "raw": "{{baseUrl}}/api/rbac/groups" } } }, { "name": "ListGroupMembers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups", "{{group_id}}", "members" ], "raw": "{{baseUrl}}/api/rbac/groups/{{group_id}}/members" } } }, { "name": "AddGroupMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups", "{{group_id}}", "members" ], "raw": "{{baseUrl}}/api/rbac/groups/{{group_id}}/members" } } }, { "name": "RemoveGroupMember", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups", "{{group_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/api/rbac/groups/{{group_id}}/members/{{user_id}}" } } }, { "name": "ListRoles", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles" ], "raw": "{{baseUrl}}/api/rbac/roles" } } }, { "name": "CreateRole", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"permissions\": [\n \"string\"\n ],\n \"scopeType\": \"string\",\n \"scopeTypes\": [\n \"string\"\n ],\n \"slug\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles" ], "raw": "{{baseUrl}}/api/rbac/roles" } } }, { "name": "DeleteRole", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles", "{{role_id}}" ], "raw": "{{baseUrl}}/api/rbac/roles/{{role_id}}" } } }, { "name": "UpdateRole", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"permissions\": [\n \"string\"\n ]\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles", "{{role_id}}" ], "raw": "{{baseUrl}}/api/rbac/roles/{{role_id}}" } } }, { "name": "GrantSuperAdmin", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "super-admins" ], "raw": "{{baseUrl}}/api/rbac/super-admins" } } }, { "name": "RevokeSuperAdmin", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "super-admins", "{{user_id}}" ], "raw": "{{baseUrl}}/api/rbac/super-admins/{{user_id}}" } } }, { "name": "DeleteTeamAccessGroup", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "teams", "{{team_id}}", "access-group" ], "raw": "{{baseUrl}}/api/rbac/teams/{{team_id}}/access-group" } } }, { "name": "GetTeamAccessGroup", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "teams", "{{team_id}}", "access-group" ], "raw": "{{baseUrl}}/api/rbac/teams/{{team_id}}/access-group" } } }, { "name": "EnsureTeamAccessGroup", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "teams", "{{team_id}}", "access-group" ], "raw": "{{baseUrl}}/api/rbac/teams/{{team_id}}/access-group" } } } ], "name": "agentrouter.rbac.v1.RbacService" }, { "item": [ { "name": "ListSecrets", "request": { "description": "ListSecrets lists all secrets for the authenticated user.\n Returns metadata only, not plaintext values.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets" ], "raw": "{{baseUrl}}/v1/secrets" } } }, { "name": "CreateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"realm\": \"string\",\n \"tags\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\",\n \"value\": \"string\"\n}" }, "description": "CreateSecret creates or updates a secret.\n If a secret with the same name exists, it will be updated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets" ], "raw": "{{baseUrl}}/v1/secrets" } } }, { "name": "DeleteSecret", "request": { "description": "DeleteSecret deletes a secret by name.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}" } } }, { "name": "GetSecret", "request": { "description": "GetSecret retrieves a secret by name.\n Returns metadata only, not the plaintext value.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}" } } }, { "name": "RotateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"newValue\": \"string\",\n \"realm\": \"string\"\n}" }, "description": "RotateSecret replaces a secret's encrypted value in place.\n The secret keeps its ID and remains active.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "rotate" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/rotate" } } }, { "name": "ValidateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"realm\": \"string\"\n}" }, "description": "ValidateSecret validates that a secret can be decrypted.\n Used for health checks and troubleshooting.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "validate" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/validate" } } }, { "name": "GetSecretValue", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"realm\": \"string\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "GetSecretValue retrieves the plaintext value of a secret.\n INTERNAL USE ONLY - This endpoint decrypts and returns the actual secret\n value. Should only be called by internal services (Liaison, Butler2, etc.)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "value" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/value" } } } ], "name": "agentrouter.secret.v1.SecretService" }, { "item": [ { "name": "ListTelemetryConfigs", "request": { "description": "ListTelemetryConfigs lists every configuration owned by the caller\n within the (customer, project) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry" } } }, { "name": "CreateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"endpoint\": \"https://example.com\",\n \"headers\": {\n \"key\": \"string\"\n },\n \"protocol\": \"string\",\n \"telemetryType\": \"string\"\n}" }, "description": "CreateTelemetryConfig creates a new OTel export configuration.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry" } } }, { "name": "GetProjectTelemetryConfig", "request": { "description": "GetProjectTelemetryConfig returns the PROJECT-level telemetry config.\n Project-owner-tier (the shared project default is managed by owners).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "project" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/project" } } }, { "name": "SetProjectTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"endpoint\": \"https://example.com\",\n \"protocol\": \"string\",\n \"telemetryType\": \"string\"\n}" }, "description": "SetProjectTelemetryConfig upserts the PROJECT-level telemetry export\n config (the shared default applied to project members who have no\n config of their own). Project-owner-tier: only the project's owner may\n set it. A user's own per-user config OVERRIDES this at emit time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "project" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/project" } } }, { "name": "DeleteTelemetryConfig", "request": { "description": "DeleteTelemetryConfig removes a configuration.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } }, { "name": "GetTelemetryConfig", "request": { "description": "GetTelemetryConfig returns a single configuration by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } }, { "name": "UpdateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": \"string\",\n \"endpoint\": \"https://example.com\",\n \"protocol\": \"string\",\n \"status\": \"string\"\n}" }, "description": "UpdateTelemetryConfig updates a configuration's mutable fields.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } } ], "name": "agentrouter.telemetry.v1.TelemetryService" }, { "item": [ { "name": "ListProjects", "request": { "description": "ListProjects lists projects within a customer scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects" } } }, { "name": "CreateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "CreateProject creates a project within a customer scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects" } } }, { "name": "ArchiveProject", "request": { "description": "ArchiveProject soft-deletes a project. Refuses to archive the\n default project, matching the existing admin.v1 behaviour.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "GetProject", "request": { "description": "GetProject returns a single project by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "UpdateProject updates mutable project fields.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectMembers", "request": { "description": "ListProjectMembers lists all members of a project and their roles.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "AddProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"identityId\": \"{{identity_id}}\",\n \"role\": \"string\"\n}" }, "description": "AddProjectMember grants an identity access to a project with the\n given role bundle.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "RemoveProjectMember", "request": { "description": "RemoveProjectMember revokes an identity's membership in a project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{identity_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{identity_id}}" } } }, { "name": "UpdateProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"string\"\n}" }, "description": "UpdateProjectMember updates an existing project member's role.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{identity_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{identity_id}}" } } }, { "name": "SetPreferredEndpoint", "request": { "description": "SetPreferredEndpoint stars one of the project's endpoints as the address\n the consoles print in code samples and setup snippets, or clears the\n star. It moves no traffic, so it sends no configuration to a data plane.\n\n The server checks the request against the project's endpoints, the list\n InferenceIngressService.ListDataplaneURLs returns for project_id with\n include_unaddressed. target_id names an entry by its target_id and stores\n that entry's first address. address must equal one of the addresses of an\n entry. When the entry has no address, or the address serves no entry,\n the call returns FailedPrecondition and stores nothing.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}:setPreferredEndpoint" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}:setPreferredEndpoint" } } } ], "name": "agentrouter.tenancy.v1.ProjectsService" }, { "item": [ { "name": "ListCustomers", "request": { "description": "ListCustomers lists all customers visible to the caller.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers" ], "raw": "{{baseUrl}}/v1/customers" } } }, { "name": "CreateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "CreateCustomer creates a new customer record. A customer owns\n projects, identities, and billing. Typically called once during\n provisioning of a new tenant.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers" ], "raw": "{{baseUrl}}/v1/customers" } } }, { "name": "ArchiveCustomer", "request": { "description": "ArchiveCustomer soft-deletes a customer. The row stays in the\n database with deleted_at set; future Get / List calls treat it as\n missing.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomer", "request": { "description": "GetCustomer returns a single customer by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } }, { "name": "UpdateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "UpdateCustomer updates mutable customer fields (display_name,\n description, labels). `customer_id` is immutable.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } } ], "name": "agentrouter.tenancy.v1.TenancyService" } ], "variable": [ { "key": "baseUrl", "type": "string", "value": "https://api.agentrouter.example" }, { "key": "apiKey", "type": "string", "value": "" }, { "key": "aikey_id", "type": "string", "value": "example-aikey-id" }, { "key": "alert_destination_id", "type": "string", "value": "example-alert-destination-id" }, { "key": "api_key_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "attribute_routing_policy_id", "type": "string", "value": "example-attribute-routing-policy-id" }, { "key": "binding_id", "type": "string", "value": "example-binding-id" }, { "key": "budget_alert_id", "type": "string", "value": "example-budget-alert-id" }, { "key": "budget_policy_id", "type": "string", "value": "example-budget-policy-id" }, { "key": "claim_project_binding_id", "type": "string", "value": "example-claim-project-binding-id" }, { "key": "client_id", "type": "string", "value": "example-client-id" }, { "key": "config_difference_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "config_id", "type": "string", "value": "example-config-id" }, { "key": "customer_id", "type": "string", "value": "example-customer-id" }, { "key": "dataplane_id", "type": "string", "value": "example-dataplane-id" }, { "key": "email_domain_policy_id", "type": "string", "value": "example-email-domain-policy-id" }, { "key": "fallback_chain_policy_id", "type": "string", "value": "example-fallback-chain-policy-id" }, { "key": "fallback_chain_policy_target_key_id", "type": "string", "value": "example-fallback-chain-policy-target-key-id" }, { "key": "fallback_policy_target_key_id", "type": "string", "value": "example-fallback-policy-target-key-id" }, { "key": "gateway_auth_policy_id", "type": "string", "value": "example-gateway-auth-policy-id" }, { "key": "group_id", "type": "string", "value": "example-group-id" }, { "key": "guardrail_id", "type": "string", "value": "example-guardrail-id" }, { "key": "identity_id", "type": "string", "value": "example-identity-id" }, { "key": "identity_mapping_rule_id", "type": "string", "value": "example-identity-mapping-rule-id" }, { "key": "key_id", "type": "string", "value": "example-key-id" }, { "key": "key_version", "type": "string", "value": "1" }, { "key": "log_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "mcp_oauth_client_id", "type": "string", "value": "example-mcp-oauth-client-id" }, { "key": "metric", "type": "string", "value": "requests" }, { "key": "model_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "pattern_id", "type": "string", "value": "example-pattern-id" }, { "key": "policy_id", "type": "string", "value": "example-policy-id" }, { "key": "profile_id", "type": "string", "value": "example-profile-id" }, { "key": "project_gateway_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "project_id", "type": "string", "value": "example-project-id" }, { "key": "provider_id", "type": "string", "value": "example-provider-id" }, { "key": "provider_name", "type": "string", "value": "example-provider-name" }, { "key": "rate_limit_policy_id", "type": "string", "value": "example-rate-limit-policy-id" }, { "key": "raw_metric_name", "type": "string", "value": "example-raw-metric-name" }, { "key": "request_attribute_id", "type": "string", "value": "example-request-attribute-id" }, { "key": "request_id", "type": "string", "value": "example-request-id" }, { "key": "role_id", "type": "string", "value": "example-role-id" }, { "key": "rule_id", "type": "string", "value": "example-rule-id" }, { "key": "secret_name", "type": "string", "value": "example-secret-name" }, { "key": "server_id", "type": "string", "value": "example-server-id" }, { "key": "service_account_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "setting_name", "type": "string", "value": "global-fallback" }, { "key": "system_setting_key", "type": "string", "value": "example-system-setting-key" }, { "key": "tag_id", "type": "string", "value": "example-tag-id" }, { "key": "tag_schema_id", "type": "string", "value": "example-tag-schema-id" }, { "key": "target_key_id", "type": "string", "value": "example-target-key-id" }, { "key": "team_id", "type": "string", "value": "example-team-id" }, { "key": "telemetry_config_id", "type": "string", "value": "example-telemetry-config-id" }, { "key": "traffic_split_policy_id", "type": "string", "value": "example-traffic-split-policy-id" }, { "key": "trigger_id", "type": "string", "value": "example-trigger-id" }, { "key": "user_group_id", "type": "string", "value": "example-user-group-id" }, { "key": "user_id", "type": "string", "value": "example-user-id" }, { "key": "user_token_jti", "type": "string", "value": "example-user-token-jti" }, { "key": "version_id", "type": "string", "value": "example-version-id" }, { "key": "workspace_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" } ] }