{ "info": { "_postman_id": "agentrouter-api-0.5.0-gfec9f31", "description": "AgentRouter API requests, generated from the combined OpenAPI spec by scripts/sdk-package.sh. Set the baseUrl and apiKey collection variables before sending.", "name": "AgentRouter API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "item": [ { "name": "ListAuditCheckpoints", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"afterSeq\": 0,\n \"limit\": 0,\n \"rebuild\": false\n}" }, "description": "List signed Merkle checkpoints (fraser#4599) for chain verification: each\n checkpoint's prev_root chains to the previous and its signature covers the\n root. Ordered by seq ascending, starting strictly after after_seq.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "checkpoints:list" ], "raw": "{{baseUrl}}/admin/v1/audit/checkpoints:list" } } }, { "name": "GetAuditInclusionProof", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"auditLogId\": \"string\"\n}" }, "description": "Return the Merkle inclusion proof for an audit_logs row: its leaf hash and\n audit path recomputed from current content, plus the signed checkpoint it\n belongs to, so a verifier can confirm the row is committed to a signed root.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "inclusion-proof" ], "raw": "{{baseUrl}}/admin/v1/audit/inclusion-proof" } } }, { "name": "GetAuditLog", "request": { "description": "Get a single audit_logs entry by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "logs", "{{log_id}}" ], "raw": "{{baseUrl}}/admin/v1/audit/logs/{{log_id}}" } } }, { "name": "QueryAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"subjectUserId\": \"string\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "Query stored audit_logs entries with filtering and pagination. The read\n complement to the SIEM forwarder (which only exports) and the checkpoint\n verification RPCs (which only prove tamper-evidence): list and inspect\n entries over the API instead of standing up a SIEM.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/audit/logs:query" } } }, { "name": "ListCatalogModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "models" ], "raw": "{{baseUrl}}/admin/v1/catalog/models" } } }, { "name": "UpsertCatalogModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"additionalPricePerMillion\": {\n \"key\": 0\n },\n \"backendUrls\": [\n \"https://example.com\"\n ],\n \"cacheReadPerMillion\": \"string\",\n \"cachingPerMillion\": \"string\",\n \"capabilities\": [\n \"string\"\n ],\n \"inputModalities\": [\n \"string\"\n ],\n \"inputPerMillion\": \"string\",\n \"isEnabled\": false,\n \"limits\": {\n \"key\": 0\n },\n \"maxContextTokens\": 0,\n \"maxCostPerRequest\": \"string\",\n \"metadata\": {\n \"key\": 0\n },\n \"mode\": \"string\",\n \"name\": \"example-name\",\n \"outputModalities\": [\n \"string\"\n ],\n \"outputPerMillion\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"suppressRouteRegen\": false,\n \"upstreamModel\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "models" ], "raw": "{{baseUrl}}/admin/v1/catalog/models" } } }, { "name": "ListCatalogProviders", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/admin/v1/catalog/providers" } } }, { "name": "UpsertCatalogProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"baseUrl\": \"https://example.com\",\n \"displayName\": \"example-name\",\n \"id\": \"string\",\n \"isEnabled\": false,\n \"metadata\": {\n \"key\": 0\n },\n \"supportedAuthSchemes\": [\n \"string\"\n ],\n \"suppressRouteRegen\": false\n}" }, "description": "Admin-key catalog WRITES (fraser#8451).\n\n The identity-authenticated CatalogService.UpsertProvider/UpsertModel are\n mounted on the IA mux, which accepts only a session token or an\n `
.` public.api_keys key -- so a platform admin_api_keys key\n can never reach them. That is the same wall #6025 hit for READS, solved\n the same way: expose the operation behind the admin auth path.\n\n These delegate to catalog.Server, so validation, metadata handling,\n suppress_route_regen semantics and the per-gateway fan-out are the SAME\n code as the identity surface rather than a parallel implementation.\n\n The motivating caller is the catalog-sync CronJob, whose only credential\n on a provisioned management plane is that plane's admin key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/admin/v1/catalog/providers/{{provider_id}}" } } }, { "name": "GetCatalogSyncState", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync-state" } } }, { "name": "RecordCatalogSync", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"run\": {\n \"applied\": false,\n \"applyMode\": false,\n \"catalogVersion\": \"string\",\n \"modelsWritten\": 0,\n \"providersWritten\": 0,\n \"sources\": [\n {\n \"display\": \"string\",\n \"pinned\": false,\n \"sha256\": \"string\"\n }\n ]\n }\n}" }, "description": "Catalog sync freshness (fraser#7951), admin-key half.\n\n Same wall, same shape as the writes above: the catalog-sync CronJob's only\n credential on a provisioned management plane is that plane's admin key,\n which cannot reach agentrouter.catalog.v1.CatalogService at all. Both routes\n delegate to the same catalog.Server, so there is one record and one set of\n merge rules whichever surface wrote it -- a hand-run with a session token\n and a nightly job with an admin key update the same row. Two records would\n be worse than none: each would look stale whenever the other ran.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/admin/v1/catalog/sync-state" } } }, { "name": "RegenerateCatalogRoutes", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Publish the catalogue to the data plane: one GLOBAL_ROUTES regeneration.\n\n The counterpart to suppress_route_regen on the two upserts above. A batch\n caller suppresses per-write regeneration and calls this ONCE at the end,\n so ~700 entries cost one fan-out rather than ~700.\n\n Deliberately takes NO caller-supplied scope. The underlying trigger must\n carry the \"system\" sentinel or the configurator narrows delivery to the\n caller's own customer, stranding every other workspace on the previous\n catalogue -- and the catalogue is global (ai_providers is keyed by name,\n ai_models is not customer-scoped). Server-side only, so a caller cannot\n get that wrong.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog:regenerate-routes" ], "raw": "{{baseUrl}}/admin/v1/catalog:regenerate-routes" } } }, { "name": "ListCustomers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers" ], "raw": "{{baseUrl}}/admin/v1/customers" } } }, { "name": "CreateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers" ], "raw": "{{baseUrl}}/admin/v1/customers" } } }, { "name": "DeleteCustomer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "UpdateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "ResolvePendingProjectMemberships", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "ResolvePendingProjectMemberships materializes every pending email-keyed grant\n for (customer_id, email) into real project_members rows for user_id, then\n clears the resolved pending rows (#6119). Idempotent and cheap to call on\n every login: with no pending rows it is a no-op.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "pending-members:resolve" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/pending-members:resolve" } } }, { "name": "ListProjects", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects" } } }, { "name": "CreateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects" } } }, { "name": "DeleteProject", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "GetProject", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"publicEndpointUrl\": \"https://example.com\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectGatewayMembers", "request": { "description": "List a project's member gateways with their membership state (D1\n multi-gateway projects, fraser#5987 / ADR 052).\n\n This is the fleet-consistency primitive (epic tetrate-ai-platform#2865,\n gate amendment 6): for every member it reports the membership state\n machine position (syncing / ready / detached_zeroized /\n detached_unreachable), the member's last-acked config version vs. the\n project's head config version for that member, health (tri-state:\n unknown is a valid answer), last-seen, and the state timestamps. The\n shape is deliberately reusable by future consumers (D3 T1 steering,\n fleet-upgrade tooling): \"is this fleet converged on config head?\" is\n answerable per member from status + config_version + head_config_version\n alone.\n\n A member is advertised as `ready` ONLY under confirmed convergence: every\n per-gateway config slot acked by the data plane at its current version,\n PLUS the member workspace's shared PROXY (authz-map) slot when one exists\n (an absent workspace slot passes vacuously — the slot is minted on first\n authz-map generation). Because that PROXY slot is shared by every gateway\n in the workspace, a bump to it flips ALL of the workspace's members back\n to `syncing` until the new map version is acked — cross-member flap on\n workspace-slot bumps is expected behavior, not a defect. A\n previously-ready member whose project config moved ahead reports\n `syncing` again until the new head is acked. The `config_version` /\n `head_config_version` columns stay scoped to the member's own per-gateway\n slots (gateway family only): the workspace PROXY slot participates in the\n READY predicate but never in the version columns.\n\n Although marked NO_SIDE_EFFECTS, this read performs idempotent ledger\n reconciliation: attachments that predate the membership ledger are\n backfilled insert-only (a detached record is never reset by a list; only\n the Attach RPC does that). A legacy attachment backfilled this way gets a\n fabricated `attached_at` equal to the first list's server time — its true\n attach time was never recorded.\n\n A project with ZERO member gateways is fully valid: the response carries\n an empty members list (and whatever detached history exists), never an\n error.\n\n Responses carry NO credential material (gate amendment 5): identity,\n state, versions, and timestamps only.\n\n Enterprise only: on SaaS deployments (DEPLOYMENT_PRODUCT=saas) this RPC\n fails with UNIMPLEMENTED — the multi-gateway surface does not exist\n there (the existing attach/detach RPCs remain, capped at one gateway per\n project).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "gateway-members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/gateway-members" } } }, { "name": "ListProjectMcpServers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers" } } }, { "name": "AddProjectMcpServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"serverId\": \"{{server_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers" } } }, { "name": "RemoveProjectMcpServer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers", "{{server_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers/{{server_id}}" } } }, { "name": "TriggerProjectMcp", "request": { "description": "TriggerProjectMcp (re)materializes the per-Project-Gateway MCP config for\n every gateway the (customer_id, project_id) is attached to. The dashboard\n MCP profile mutation path calls this after a profile create/update/delete so\n a freshly-created profile enters its project gateways' MCP_PROFILE config;\n without it the per-gateway config-gen never re-runs and /mcp/ 404s\n on a strict-isolation gateway DP. Best-effort + dormant when the project has\n no gateways.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp:trigger" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp:trigger" } } }, { "name": "ListProjectMembers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "AddProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"admin\",\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "RemoveProjectMember", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{user_id}}" } } }, { "name": "UpdateProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"admin\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{user_id}}" } } }, { "name": "ListProjectModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "AddProjectModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelId\": \"{{model_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "RemoveProjectModel", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models/{{model_id}}" } } }, { "name": "EnsureAdminProjectMembership", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"role\": \"admin\"\n}" }, "description": "EnsureAdminProjectMembership records the intent to grant an email a role on\n a project (#6119). At onboarding/provisioning time the target identity row\n usually does not exist yet (SSO users are created lazily at first login), so\n the grant is parked by email and materialized at first login via\n ResolvePendingProjectMemberships. If the identity already exists the grant is\n written straight to project_members instead. Idempotent.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "pending-members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/pending-members" } } }, { "name": "ListProjectProviders", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers" } } }, { "name": "AddProjectProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"providerName\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers" } } }, { "name": "RemoveProjectProvider", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers", "{{provider_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers/{{provider_name}}" } } }, { "name": "GetProjectSettings", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings" } } }, { "name": "DeleteProjectSetting", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings", "{{setting_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings/{{setting_name}}" } } }, { "name": "UpsertProjectSetting", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"settingValue\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings", "{{setting_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings/{{setting_name}}" } } }, { "name": "ListDataplanes", "request": { "description": "List data planes.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/dataplanes" } } }, { "name": "CreateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"dataplaneId\": \"{{dataplane_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Register a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/dataplanes" } } }, { "name": "DeleteDataplane", "request": { "description": "Delete a data plane (soft delete).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "GetDataplane", "request": { "description": "Get a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "UpdateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"autoUpgrade\": false,\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "description": "Update a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "SetDataplaneProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Assign a data plane to a project (omit project_id to clear to default).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "project" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/project" } } }, { "name": "SetDataplaneURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing advertised URL for a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/url" } } }, { "name": "ListMcpCatalogServers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/admin/v1/mcp/catalog/servers" } } }, { "name": "ListModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models" ], "raw": "{{baseUrl}}/admin/v1/models" } } }, { "name": "GetModel", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/admin/v1/models/{{model_id}}" } } }, { "name": "Ping", "request": { "description": "Ping endpoint for health checks and authentication testing", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "ping" ], "raw": "{{baseUrl}}/admin/v1/ping" } } }, { "name": "QueryPlatformAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"subjectUserId\": \"string\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "QueryPlatformAuditLogs is QueryAuditLogs gated on the platform admin scope\n instead of audit_logs_reader, so platform integrations that hold only the\n provisioned admin key (e.g. the IDP customer-configuration views, #6024)\n can read audit logs. This deliberately widens the #4890 separation-of-duties\n posture — every admin-scoped key gains cross-tenant audit read — in exchange\n for not having to re-issue provisioned keys with an extra scope. Same\n request/response as QueryAuditLogs.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "platform", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/platform/audit/logs:query" } } }, { "name": "ListProjectGateways", "request": { "description": "List project gateways (optionally filtered by customer, workspace, and/or\n attached project). Each returned gateway carries its attached project slugs\n in `attached_project_ids`, so reading gateway<->project attachments in bulk\n is ONE paginated request, not one ListProjectGatewayProjects call per\n gateway (#5591).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways" ], "raw": "{{baseUrl}}/admin/v1/project-gateways" } } }, { "name": "CreateProjectGateway", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectGatewayId\": \"{{project_gateway_id}}\",\n \"url\": \"https://example.com\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways" ], "raw": "{{baseUrl}}/admin/v1/project-gateways" } } }, { "name": "DeleteProjectGateway", "request": { "description": "Delete project gateway (soft delete)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "GetProjectGateway", "request": { "description": "Get project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "UpdateProjectGateway", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"url\": \"https://example.com\"\n}" }, "description": "Update project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "ListProjectGatewayProjects", "request": { "description": "List the project slugs attached to a project gateway.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects" } } }, { "name": "AttachProjectGatewayProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Attach a project to a project gateway (idempotent). Establishes a\n gateway<->project binding in the many-to-many project_gateway_projects\n relationship.\n\n A project gateway may host only ONE project: attaching a second, different\n project is rejected (detach the current project first). Re-attaching the\n same project is a no-op.\n\n Ensure the attached project has assigned models BEFORE setting the\n gateway's URL: under strict isolation a gateway with no assigned models\n serves an EMPTY route map and will return 404 for every request. The\n response carries any such warnings in the `warnings` field.\n\n Multi-gateway projects (fraser#5987): a project may be attached to\n multiple gateways, capped per project (PROJECT_GATEWAY_CAP, default 10 on\n Enterprise; 1 on SaaS) — attaching beyond the cap is rejected with\n RESOURCE_EXHAUSTED (the cap is a quota, not a name collision;\n ALREADY_EXISTS stays reserved for hostname/slug uniqueness conflicts).\n The cap is a SOFT limit: the check is not atomic with the insert, so two\n concurrent attaches can both pass it and overshoot the cap by one.\n Attaching a gateway whose slug is shared with another live gateway is\n rejected with FAILED_PRECONDITION (rename or delete the sibling first).\n A successful attach starts the membership in the `syncing` state; see\n ListProjectGatewayMembers for the state machine.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects" } } }, { "name": "DetachProjectGatewayProject", "request": { "description": "Detach a project from a project gateway.\n\n Detach pushes a final zeroized config revision to the member (best-effort,\n DP-initiated polling) and revokes MP-side access as the authoritative\n backstop, so the membership lands in `detached_unreachable` until the data\n plane acknowledges the zero revision (then `detached_zeroized`). Detaching\n a project that is not attached is an idempotent no-op (success=false, no\n error). See ListProjectGatewayMembers for the state machine.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects/{{project_id}}" } } }, { "name": "SetProjectGatewayURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing URL/hostname for a project gateway.\n\n The hostname (host part of the URL) must be globally UNIQUE across all\n project gateways in the platform; setting a hostname already bound to a\n different gateway is rejected with ALREADY_EXISTS.\n\n Behavior change (strict isolation): once any gateway in a data plane's\n workspace has its URL set, that data plane serves ONLY per-gateway\n host-scoped routes -- the default all-models route is suppressed, so\n clients must call the gateway hostname rather than the workspace's shared\n URL.\n\n Best practice: attach a project and assign its models BEFORE setting the\n URL. Setting a URL on a gateway with no attached project (or whose project\n has no assigned models) makes the gateway reachable but it will return 404\n for every request until a project with assigned models is attached. The\n response surfaces any such condition in the `warnings` field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/url" } } }, { "name": "SetProjectGatewayWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Reassign a project gateway to a different dataplane (workspace).\n\n A data plane serves ONLY the hostnames of project gateways whose\n workspace_id matches its own (via per-gateway host-scoped routes plus the\n P10 authz map). Moving a gateway is therefore NOT a bare DB flip: this RPC\n tears down the gateway's per-gateway routes + authz binding on the OLD data\n plane and materializes them on the NEW one, refreshing both workspaces'\n authz maps and default-route suppression.\n\n The gateway's hostname is unchanged, so DNS is NOT moved automatically: the\n hostname still resolves to the OLD data plane's ingress until an operator\n repoints it. Until that cutover, requests to the hostname hit the old data\n plane (now torn down) and 404. The response ALWAYS includes a `warnings`\n entry reminding the operator to repoint DNS (and provision the new data\n plane's TLS cert). Recommended order: provision the new data plane's\n DNS/cert, call this RPC, then cut DNS over.\n\n Reassigning to the gateway's current workspace is a no-op. The new\n workspace must exist for the gateway's customer, and the gateway's slug\n must be free in the new workspace (a collision is rejected with\n ALREADY_EXISTS).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "workspace" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/workspace" } } }, { "name": "ListServiceAccounts", "request": { "description": "List service accounts", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts" ], "raw": "{{baseUrl}}/admin/v1/service-accounts" } } }, { "name": "CreateServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiUri\": \"https://example.com\",\n \"audience\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"internalApiKey\": \"example-value\",\n \"issuer\": \"https://example.com\",\n \"jwksUri\": \"https://example.com\",\n \"roles\": [\n \"string\"\n ],\n \"routerKey\": \"example-value\",\n \"routerUrl\": \"https://example.com\",\n \"scopes\": [\n \"string\"\n ],\n \"serveUrl\": \"https://example.com\",\n \"telemetryEndpoint\": \"https://example.com\",\n \"telemetryHeaders\": {\n \"key\": \"string\"\n },\n \"telemetryInsecure\": false,\n \"telemetryLocalVars\": {\n \"key\": \"string\"\n },\n \"telemetryProtocol\": \"\",\n \"telemetryTimeout\": \"30s\",\n \"validityDays\": 1,\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts" ], "raw": "{{baseUrl}}/admin/v1/service-accounts" } } }, { "name": "GetServiceAccount", "request": { "description": "Get service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}" } } }, { "name": "RestoreServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Restore service account\n Restores a revoked service account to active status.\n Only one active service account per customer_id + workspace_id is allowed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}:restore" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}:restore" } } }, { "name": "RevokeServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Revoke service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}:revoke" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}:revoke" } } }, { "name": "GetSystemSetting", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "UpsertSystemSetting", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"ifAbsent\": false,\n \"value\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "ListTelemetryConfigs", "request": { "description": "List telemetry configs", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs" } } }, { "name": "CreateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"none\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"forwardIntervalSeconds\": 0,\n \"protocol\": \"grpc\",\n \"sinkUrl\": \"https://example.com\",\n \"telemetryType\": \"traces\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "Create telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs" } } }, { "name": "TestAuditForward", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"owner\": \"string\",\n \"protocol\": \"string\",\n \"sinkUrl\": \"https://example.com\"\n}" }, "description": "Test an audit-log SIEM sink by sending a synthetic OTLP-Logs record via the\n same path the forwarder uses (POST /v1/logs with the resolved auth). Proves\n the actual log endpoint + auth, unlike the trace-based bellhop tester.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "test-forward" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/test-forward" } } }, { "name": "TriggerAuditForward", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"owner\": \"string\"\n}" }, "description": "Trigger an immediate audit-log forward run (real-time push). The management\n plane kicks the in-process forwarder; the cron ticker is the backstop.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "trigger-forward" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/trigger-forward" } } }, { "name": "DeleteTelemetryConfig", "request": { "description": "Delete telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "GetTelemetryConfig", "request": { "description": "Get telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "UpdateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"none\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"forwardIntervalSeconds\": 0,\n \"protocol\": \"grpc\",\n \"sinkUrl\": \"https://example.com\",\n \"status\": \"connected\"\n}" }, "description": "Update telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "ListUserTokens", "request": { "description": "List user tokens", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens" ], "raw": "{{baseUrl}}/admin/v1/user-tokens" } } }, { "name": "CreateUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"expiresInDays\": 1,\n \"impersonate\": false,\n \"impersonationMetadata\": {\n \"context\": {\n \"key\": \"string\"\n },\n \"impersonatorKey\": \"example-value\",\n \"reason\": \"string\"\n },\n \"name\": \"example-name\",\n \"organizationUnit\": \"string\",\n \"projectId\": \"{{project_id}}\",\n \"role\": \"string\",\n \"scopes\": [\n \"string\"\n ],\n \"userId\": \"{{user_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create user token\n Generates a JWT token for user authentication with gatekeeper.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens" ], "raw": "{{baseUrl}}/admin/v1/user-tokens" } } }, { "name": "GetUserToken", "request": { "description": "Get user token", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens", "{{user_token_jti}}" ], "raw": "{{baseUrl}}/admin/v1/user-tokens/{{user_token_jti}}" } } }, { "name": "RevokeUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"reason\": \"string\"\n}" }, "description": "Revoke user token\n Revokes a user token by its JTI (JWT ID).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens", "{{user_token_jti}}:revoke" ], "raw": "{{baseUrl}}/admin/v1/user-tokens/{{user_token_jti}}:revoke" } } }, { "name": "ListWorkspaces", "request": { "description": "List workspaces", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces" ], "raw": "{{baseUrl}}/admin/v1/workspaces" } } }, { "name": "CreateWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces" ], "raw": "{{baseUrl}}/admin/v1/workspaces" } } }, { "name": "DeleteWorkspace", "request": { "description": "Delete workspace (soft delete)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "GetWorkspace", "request": { "description": "Get workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "UpdateWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"autoUpgrade\": false,\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "description": "Update workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "SetWorkspaceProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Assign workspace to a project (or clear back to default project by omitting project_id)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}", "project" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}/project" } } }, { "name": "SetWorkspaceURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing gateway URL for a workspace data plane.\n Writes system_settings.dataplane-url: and optionally fires a PROXY_URL config event.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}/url" } } } ], "name": "agentrouter.admin.v1.AdminService" }, { "item": [ { "name": "List", "request": { "description": "List lists BYOK keys registered under a project. Returns metadata\n only -- id, provider, name, display_suffix, creation timestamp, and\n revocation timestamp if revoked. The result includes the project's\n shared keys plus the caller's own user-scoped keys (other users'\n user-scoped keys are not returned).\n\n Scope: account-tier; membership is enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys" } } }, { "name": "Register", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\",\n \"provider\": \"PROVIDER_OPENAI\",\n \"secret\": \"example-value\",\n \"userScope\": false\n}" }, "description": "Register encrypts and stores a provider API key under a project.\n After this call, inference requests routed to the matching provider\n for this project will use this key.\n\n Scope: account-tier so any project member can register their OWN\n user-scoped key (user_scope=true). Registering a PROJECT-level key\n (user_scope=false) additionally requires the caller to be the\n project's owner -- enforced in-handler against project_members.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys" } } }, { "name": "Revoke", "request": { "description": "Revoke marks the key revoked; subsequent Fetches return\n permission_denied. Inflight cached keys on dataplanes invalidate\n within sub-second via the revocation channel (milestone C).\n\n Scope: account-tier so a member can revoke their OWN user-scoped key.\n Revoking a PROJECT-level key additionally requires project ownership\n (enforced in-handler); a member may never revoke another user's\n user-scoped key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys", "{{aikey_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys/{{aikey_id}}" } } }, { "name": "Get", "request": { "description": "Get returns the metadata record for a single BYOK key. Never returns\n the plaintext.\n\n Scope: account-tier. Any project member may read keys in the project\n (project-level and the caller's own user-scoped keys); membership is\n enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys", "{{aikey_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys/{{aikey_id}}" } } }, { "name": "GetTrafficSettings", "request": { "description": "GetTrafficSettings returns the BYOK traffic pool for one provider in a\n project: every key the caller's own inference traffic can be served by,\n with its stored traffic_weight / traffic_order / traffic_preference.\n\n The pool is the UNION the route generator actually builds for the caller\n (materializedBYOKKeys): the caller's legacy per-user keys plus the\n project's effective keys for the provider (the caller's own user-scoped\n keys when they have any, otherwise the project-level keys). Revoked rows\n are excluded -- they have no dataplane backend, so they must neither\n absorb a share of a split nor appear in a failover ladder.\n\n Scope: account-tier; membership is enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys:traffic" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys:traffic" } } }, { "name": "UpdateTrafficSettings", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"preference\": \"string\",\n \"provider\": \"PROVIDER_OPENAI\",\n \"settings\": [\n {\n \"keyId\": \"{{key_id}}\",\n \"order\": 0,\n \"weight\": 0\n }\n ]\n}" }, "description": "UpdateTrafficSettings rewrites the placement of keys in one provider's\n BYOK pool -- the load-balance weights, the failover order, and the\n pool-wide usage preference.\n\n Only rows the caller OWNS are writable: a shared project key another\n member registered is returned by GetTrafficSettings (it serves the\n caller's traffic) but naming it here is rejected rather than silently\n dropped. Rows the request does not name keep their current placement.\n\n Scope: account-tier; membership is enforced in-handler, and rewriting a\n PROJECT-level (shared) key additionally requires project ownership --\n the same split Register and Revoke apply.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys:traffic" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys:traffic" } } } ], "name": "agentrouter.aikeys.v1.AiKeysService" }, { "item": [ { "name": "ListApiKeys", "request": { "description": "ListApiKeys returns the platform-wide API-key directory, including\n soft-deleted keys needed for historical spend attribution.\n It is intentionally restricted to platform admin keys; customer-scoped\n org admins are not elevated for this collection-wide operation.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys" ], "raw": "{{baseUrl}}/v1/api-keys" } } }, { "name": "CreateApiKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"name\": \"example-name\",\n \"userId\": \"{{user_id}}\",\n \"userKeyAddress\": \"example-value\"\n}" }, "description": "CreateApiKey creates a new JWT user-token API key for a user and returns the plaintext token exactly once.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys" ], "raw": "{{baseUrl}}/v1/api-keys" } } }, { "name": "DeleteApiKey", "request": { "description": "DeleteApiKey soft-deletes an API key (sets deleted_at).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/api-keys/{{key_id}}" } } }, { "name": "UpdateApiKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"isActive\": false,\n \"name\": \"example-name\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "UpdateApiKey updates mutable fields of an API key (name and/or active state).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/api-keys/{{key_id}}" } } } ], "name": "agentrouter.api_keys.v1.ApiKeysService" }, { "item": [ { "name": "GetJWKS", "request": { "description": "JWKS endpoint.\n Public endpoint - no authentication required.\n Returns JSON Web Key Set for verifying JWT tokens.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ ".well-known", "jwks.json" ], "raw": "{{baseUrl}}/.well-known/jwks.json" } } } ], "name": "agentrouter.auth.v1.AuthService" }, { "item": [ { "name": "ListModels", "request": { "description": "ListModels returns catalog models, optionally filtered to a single\n provider via the provider_id query parameter.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models" ], "raw": "{{baseUrl}}/v1/catalog/models" } } }, { "name": "UpsertModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"additionalPricePerMillion\": {\n \"key\": 0\n },\n \"backendUrls\": [\n \"https://example.com\"\n ],\n \"cacheReadPerMillion\": \"string\",\n \"cachingPerMillion\": \"string\",\n \"capabilities\": [\n \"string\"\n ],\n \"inputModalities\": [\n \"string\"\n ],\n \"inputPerMillion\": \"string\",\n \"isEnabled\": false,\n \"limits\": {\n \"key\": 0\n },\n \"maxContextTokens\": 0,\n \"maxCostPerRequest\": \"string\",\n \"metadata\": {\n \"key\": 0\n },\n \"mode\": \"string\",\n \"name\": \"example-name\",\n \"outputModalities\": [\n \"string\"\n ],\n \"outputPerMillion\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"suppressRouteRegen\": false,\n \"upstreamModel\": \"string\"\n}" }, "description": "UpsertModel creates or fully replaces a model record.\n\n The provider must already exist (FAILED_PRECONDITION otherwise), and\n must be enabled if this model is going to be enabled -- an enabled\n model under a disabled provider could never become routable, yet\n would read as available. Writing an explicitly DISABLED model under a\n disabled provider is allowed: neither appears in any route map, so\n nothing is misrepresented, and it is how a catalog sync stages a\n provider's models before an operator turns the provider on.\n\n A successful write propagates to the gateway automatically\n (no separate publish step): the model appears in the data plane's\n /v1/models and becomes promptable once the refreshed configuration\n lands. Poll /v1/models to confirm. The exception is\n `suppress_route_regen`, which defers that propagation to the\n caller's own configurator.TriggerUpdate.\n\n `is_enabled` is tri-state: omit it and the stored value is left\n alone, so a model an operator disabled is not silently re-enabled by\n a later write. A new model defaults to enabled.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models" ], "raw": "{{baseUrl}}/v1/catalog/models" } } }, { "name": "DeleteModel", "request": { "description": "DeleteModel removes a model entry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/catalog/models/{{model_id}}" } } }, { "name": "GetModel", "request": { "description": "GetModel returns a single model by id (UUID) or by unique model name,\n including its pricing, context window, capabilities, modalities, and limits.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/catalog/models/{{model_id}}" } } }, { "name": "ListProviders", "request": { "description": "ListProviders returns all registered AI providers. Supports\n cursor-based pagination via page_size and page_token.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/catalog/providers" } } }, { "name": "UpsertProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"baseUrl\": \"https://example.com\",\n \"displayName\": \"example-name\",\n \"id\": \"string\",\n \"isEnabled\": false,\n \"metadata\": {\n \"key\": 0\n },\n \"supportedAuthSchemes\": [\n \"string\"\n ],\n \"suppressRouteRegen\": false\n}" }, "description": "UpsertProvider creates or fully replaces a provider record.\n\n `is_enabled` is tri-state: omit it and the stored value is left\n alone (a provider an operator disabled stays disabled). A new\n provider defaults to disabled -- the data plane does not reconcile\n an AIServiceBackend or fetch credentials for it until it is both\n enabled and credentialed via SetProviderCredential.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/catalog/providers" } } }, { "name": "DeleteProvider", "request": { "description": "DeleteProvider removes a provider, along with the project assignments that\n granted access to it. Refuses while any model still references it, while any\n BYOK API key is registered against it (revoke those keys first), or when it\n is the only provider assigned to a project that still has models assigned.\n On success, any revoked BYOK keys for this provider and their stored secrets\n are permanently removed, and the provider's own stored credential is retired.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}" } } }, { "name": "GetProvider", "request": { "description": "GetProvider returns a single provider by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}" } } }, { "name": "SetProviderCredential", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"credential\": \"string\"\n}" }, "description": "SetProviderCredential stores or rotates the credential used to\n authenticate requests to this provider. The plaintext is never\n returned; the provider's credential_suffix reflects the last 4\n characters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}", "credential" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}/credential" } } }, { "name": "GetCatalogSyncState", "request": { "description": "GetCatalogSyncState returns this plane's catalog sync record.\n\n Never NotFound: a plane that has never recorded a sync returns a state\n with both timestamps unset, which is itself the answer -- \"no sync has\n ever run here\" is a different and more actionable report than an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/v1/catalog/sync-state" } } }, { "name": "RecordCatalogSync", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"applied\": false,\n \"applyMode\": false,\n \"catalogVersion\": \"string\",\n \"modelsWritten\": 0,\n \"providersWritten\": 0,\n \"sources\": [\n {\n \"display\": \"string\",\n \"pinned\": false,\n \"sha256\": \"string\"\n }\n ]\n}" }, "description": "RecordCatalogSync persists what the last catalog sync saw and did.\n\n A sync runs in the client: it fetches a published catalog, compares it\n with this management plane and writes the difference. The catalog version\n that drove a run is only known to that client, and a report-only run\n changes nothing the server could observe, so a run reports itself here.\n\n How the record advances:\n\n - checked_at / checked_version advance on every recorded run, including\n report-only ones. They say when this plane last looked at a published\n catalog, and which one.\n - applied_at / applied_version advance only when `applied` is set, which\n means the run wrote the catalog and left nothing unwritten. They say\n which published catalog this plane is actually on.\n\n The two together are the drift an operator acts on: the published catalog\n is at version X, this plane is on version Y, applied N days ago.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "sync-state" ], "raw": "{{baseUrl}}/v1/catalog/sync-state" } } }, { "name": "ListProjectModels", "request": { "description": "ListProjectModels returns every catalog model assigned to a project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "AssignModelToProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelId\": \"{{model_id}}\"\n}" }, "description": "AssignModelToProject grants a project access to a catalog model.\n Idempotent: re-assigning a model is a no-op.\n\n The model's provider must be enabled (FAILED_PRECONDITION otherwise) --\n a model under a disabled provider is absent from the route map and could\n not be served.\n\n Propagates automatically to any Project Gateway attached to the\n project (per-gateway route maps serve only assigned models); no\n separate publish step is needed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "UnassignModelFromProject", "request": { "description": "UnassignModelFromProject removes a project's access to a catalog model.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models/{{model_id}}" } } } ], "name": "agentrouter.catalog.v1.CatalogService" }, { "item": [ { "name": "ListClients", "request": { "description": "ListClients returns every client owned by the caller within the\n given (customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients" } } }, { "name": "CreateClientWithKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"keyName\": \"example-name\",\n \"title\": \"string\"\n}" }, "description": "CreateClientWithKey creates a new client and a new API key attached\n 1:1 (client_id == key_id at bootstrap).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients" } } }, { "name": "GetClient", "request": { "description": "GetClient returns a single client by id within the scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "UpdateClientTitle", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"title\": \"string\"\n}" }, "description": "UpdateClientTitle updates the editable client title.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "AddKeyToClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"keyId\": \"{{key_id}}\"\n}" }, "description": "AddKeyToClient attaches an existing key to a client. A key still in the\n default project is moved into the client's project.\n\n Fails with FAILED_PRECONDITION when the key would leave a client that\n other keys stay in and whose per-key budget is active: that budget\n sums the client's current keys, so the move would carry the key's\n accrued spend out of it. Deactivate the budget first, then attach.\n\n Fails with ALREADY_EXISTS when the key carries its own per-key budget\n and the client already holds an active one at the same intent: a\n standalone key's budget moves with it, and two cannot govern one\n client. The attachment is rolled back with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys" } } }, { "name": "RotateKeyInClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"destroyAfter\": \"string\",\n \"disableAfter\": \"string\",\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"keyName\": \"example-name\",\n \"oldKeyDestroyAt\": \"2023-01-15T01:30:15.01Z\",\n \"oldKeyDisableAt\": \"2023-01-15T01:30:15.01Z\",\n \"oldKeyId\": \"example-value\",\n \"userKeyAddress\": \"example-value\"\n}" }, "description": "RotateKeyInClient creates a new key attached to client_id and may\n schedule the prior key's disable/destroy lifecycle.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "rotate" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/rotate" } } }, { "name": "DestroyKeyVersionInClient", "request": { "description": "DestroyKeyVersionInClient permanently destroys a key version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}" } } }, { "name": "DisableKeyVersionInClient", "request": { "description": "DisableKeyVersionInClient disables a key version immediately (reversible).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "disable" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/disable" } } }, { "name": "EmergencyRevokeKeyVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"generateReplacement\": false,\n \"replacementEnterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"replacementKeyName\": \"example-name\",\n \"replacementUserKeyAddress\": \"example-value\"\n}" }, "description": "EmergencyRevokeKeyVersion disables a key immediately and optionally\n creates a replacement.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "emergency-revoke" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/emergency-revoke" } } }, { "name": "EnableKeyVersionInClient", "request": { "description": "EnableKeyVersionInClient re-enables a disabled key version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "enable" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/enable" } } } ], "name": "agentrouter.clients.v1.ClientsService" }, { "item": [ { "name": "ListGuardrailProviders", "request": { "description": "ListGuardrailProviders returns the providers visible in the requested\n scope: the project's own instances plus the global rows. Catalog\n templates are omitted unless include_templates is set.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers" } } }, { "name": "CreateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreateGuardrailProvider registers a new provider instance in the\n requested scope. Any accepted `kind` may be created, including the kinds\n the catalog templates use. Returns ALREADY_EXISTS when the name is taken\n in that scope, and INVALID_ARGUMENT for an unaccepted kind, a\n configuration the kind cannot be built from, or a credential in `config`.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers" } } }, { "name": "DeleteGuardrailProvider", "request": { "description": "DeleteGuardrailProvider soft-deletes a user-defined provider (sets\n deleted_at; the row disappears from List/Get). Historical trigger records\n referencing this provider REMAIN queryable.\n Returns PERMISSION_DENIED for a global row or a catalog template (both\n are read-only), and NOT_FOUND when no such provider is visible in the\n requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "GetGuardrailProvider", "request": { "description": "GetGuardrailProvider returns a single provider by id, from the project's\n own instances or the global rows. Returns NOT_FOUND when no such provider\n is visible in the requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "SetGuardrailProviderSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKey\": \"example-value\"\n}" }, "description": "SetGuardrailProviderSecret stores the credential a provider authenticates\n to its backing service with. This is the ONLY way a credential enters the\n system: it is never accepted in GuardrailProvider.config.\n\n Write-only. The value is encrypted at rest, the provider row keeps only a\n reference to it, and no read path -- List, Get, or the data-plane\n configuration -- ever returns it. GuardrailProvider.has_api_key is all a\n reader learns.\n\n Calling it again ROTATES: the stored credential is replaced in place and\n the provider keeps its id, its configuration and every rule bound to it.\n There is no un-set; deleting the provider's project destroys the stored\n credential.\n\n The operation is audit-logged. The audit entry records who set a\n credential on which provider, never the value.\n\n Returns NOT_FOUND when no such provider is visible in the requested scope,\n and PERMISSION_DENIED for a global row or a catalog template (both are\n read-only; a template is copied into an instance before it is used).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}", "secret" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}/secret" } } }, { "name": "UpdateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdateGuardrailProvider updates mutable fields of a user-defined provider.\n Omitted/empty scalar string fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. Absent\n message fields (config) leave the existing value untouched; a present\n config Struct REPLACES the stored configuration wholesale (no deep merge).\n Returns PERMISSION_DENIED for a global row or a catalog template (both\n are read-only), and NOT_FOUND when no such provider is visible in the\n requested scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } } ], "name": "agentrouter.guardrails.v1.GuardrailProvidersService" }, { "item": [ { "name": "GetDashboard", "request": { "description": "GetDashboard returns a combined summary of guardrail posture and recent\n trigger activity for the dashboard view.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "dashboard" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/dashboard" } } }, { "name": "ListGuardrailTriggers", "request": { "description": "ListGuardrailTriggers lists trigger events matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers" } } }, { "name": "GetGuardrailTriggerStats", "request": { "description": "GetGuardrailTriggerStats returns aggregate statistics for trigger events\n in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers/stats" } } }, { "name": "GetGuardrailTrigger", "request": { "description": "GetGuardrailTrigger returns a single trigger event by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers", "{{trigger_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers/{{trigger_id}}" } } }, { "name": "ReportGuardrailTriggers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggers\": [\n {\n \"consumerId\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"executionDurationMs\": 0,\n \"guardrailId\": \"{{guardrail_id}}\",\n \"id\": \"string\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"projectId\": \"{{project_id}}\",\n \"resourceId\": \"string\",\n \"ruleEvaluations\": [\n {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"checkType\": \"CHECK_TYPE_PII\",\n \"executeOnContentType\": \"EXECUTE_ON_CONTENT_TYPE_ALL\",\n \"executedOn\": \"EXECUTE_ON_INPUT\",\n \"executionDurationMs\": 0,\n \"guardrailRuleId\": \"string\",\n \"inputResults\": [],\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"outputResults\": [],\n \"providerId\": \"{{provider_id}}\",\n \"score\": 0\n }\n ],\n \"triggeredAt\": \"2023-01-15T01:30:15.01Z\"\n }\n ]\n}" }, "description": "ReportGuardrailTriggers ingests a batch of trigger events from the data\n plane. Idempotent on trigger.id (duplicate ids return success=true with no\n error). Per-item failure model: a malformed or unknown-reference trigger\n yields success=false for that item only; the RPC itself fails only for auth\n errors, an empty batch, or a batch exceeding 1000 triggers\n (INVALID_ARGUMENT). Authenticated as a service account only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "guardrails", "triggers", "report" ], "raw": "{{baseUrl}}/v1/guardrails/triggers/report" } } } ], "name": "agentrouter.guardrails.v1.GuardrailTriggersService" }, { "item": [ { "name": "ListGuardrails", "request": { "description": "ListGuardrails returns guardrails matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails" } } }, { "name": "CreateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n }\n}" }, "description": "CreateGuardrail creates a new guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails" } } }, { "name": "CreateGuardrailFromTemplate", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"templateId\": \"string\"\n}" }, "description": "CreateGuardrailFromTemplate instantiates a new guardrail from a platform\n template row (is_template=true). The resulting guardrail is editable and\n scoped to (customer_id, project_id).\n Returns NOT_FOUND when template_id does not reference an existing template\n guardrail (non-template ids are treated as not found).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "from-template" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/from-template" } } }, { "name": "GetGuardrailStats", "request": { "description": "GetGuardrailStats returns aggregate statistics for guardrails in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/stats" } } }, { "name": "UpdateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n }\n}" }, "description": "UpdateGuardrail updates mutable guardrail fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response) leave the existing value untouched; a present\n triggered_response replaces it wholesale. The guardrail id must be set\n inside the guardrail field.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "ListGuardrailRules", "request": { "description": "ListGuardrailRules returns rules for the specified guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "CreateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n }\n}" }, "description": "CreateGuardrailRule adds a new rule to a guardrail.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "DeleteGuardrailRule", "request": { "description": "DeleteGuardrailRule soft-deletes a rule (sets deleted_at; the row\n disappears from List/Get). Historical trigger records referencing this rule\n REMAIN queryable.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "GetGuardrailRule", "request": { "description": "GetGuardrailRule returns a single rule by id.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "UpdateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n }\n}" }, "description": "UpdateGuardrailRule updates mutable rule fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response, configuration) leave the existing value untouched; a\n present configuration Struct REPLACES the stored configuration wholesale\n (no deep merge). The rule id must be set inside the rule field.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "DeleteGuardrail", "request": { "description": "DeleteGuardrail soft-deletes a guardrail (sets deleted_at; the row\n disappears from List/Get). Child rules of the soft-deleted guardrail are\n no longer served. Historical trigger records referencing this guardrail\n REMAIN queryable.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "GetGuardrail", "request": { "description": "GetGuardrail returns a single guardrail by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "SetGuardrailStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false,\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\"\n}" }, "description": "SetGuardrailStatus updates the status and/or enabled flag of a guardrail.\n At least one of status/enabled must be provided; otherwise INVALID_ARGUMENT.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/status" } } } ], "name": "agentrouter.guardrails.v1.GuardrailsService" }, { "item": [ { "name": "ListPatterns", "request": { "description": "ListPatterns returns patterns visible to the requested scope, including\n built-in patterns which are globally visible.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns" } } }, { "name": "CreatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreatePattern creates a new user-defined pattern.\n Returns PERMISSION_DENIED when attempting to create a pattern with\n is_builtin=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns" } } }, { "name": "DeletePattern", "request": { "description": "DeletePattern soft-deletes a user-defined pattern (sets deleted_at; the\n row disappears from List/Get). Historical trigger records referencing this\n pattern REMAIN queryable.\n Returns PERMISSION_DENIED when attempting to delete a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "GetPattern", "request": { "description": "GetPattern returns a single pattern by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "UpdatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdatePattern updates mutable fields of a user-defined pattern. Omitted/\n empty scalar string fields leave the existing value untouched. Enum fields\n set to *_UNSPECIFIED leave the existing value untouched.\n Returns PERMISSION_DENIED when attempting to modify a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } } ], "name": "agentrouter.guardrails.v1.PatternsService" }, { "item": [ { "name": "ListSSOProviders", "request": { "description": "ListSSOProviders returns every registered provider. Secrets are never\n included: client_secret is write-only on this surface.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers" ], "raw": "{{baseUrl}}/v1/sso-providers" } } }, { "name": "CreateOrUpdateSSOProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"adminEmails\": \"developer@example.com\",\n \"domain\": \"string\",\n \"enabled\": false,\n \"oidc\": {\n \"authorizationEndpoint\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"discoveryEndpoint\": \"https://example.com\",\n \"issuer\": \"string\",\n \"jwksEndpoint\": \"https://example.com\",\n \"tokenEndpoint\": \"https://example.com\",\n \"userinfoEndpoint\": \"https://example.com\"\n },\n \"organizationId\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"providerType\": \"string\",\n \"roleClaimPath\": \"string\",\n \"roleMapping\": {\n \"roles\": {\n \"key\": \"string\"\n }\n },\n \"roleSyncMode\": \"string\",\n \"saml\": {\n \"audience\": \"string\",\n \"cert\": \"string\",\n \"emailAttribute\": \"developer@example.com\",\n \"entryPoint\": \"string\",\n \"idpEntityId\": \"string\",\n \"issuer\": \"string\",\n \"nameAttribute\": \"string\",\n \"nameIdFormat\": \"string\",\n \"wantAssertionsSigned\": false\n }\n}" }, "description": "CreateOrUpdateSSOProvider upserts the deployment's SSO provider row. The\n oidc_config jsonb it writes keeps fraser-auth's camelCase keys, because\n valet's own login parses those exact keys back out\n (identitysvc.SSOProviderOIDC): a write that renamed them would break the\n next sign-in rather than fail here.\n\n One gate, both verbs. fraser-auth reaches this row two ways and answers\n differently on each -- /api/sso-providers requires a grant while\n /api/sso-init requires nothing at all -- and that split is deliberately not\n ported: create and edit are separate verbs on one resource behind one\n annotation, so there is no second way in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers" ], "raw": "{{baseUrl}}/v1/sso-providers" } } }, { "name": "DeleteSSOProvider", "request": { "description": "DeleteSSOProvider removes a provider row. Corporate login stops working the\n moment it lands, so it admits the same callers a write does.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/sso-providers/{{provider_id}}" } } }, { "name": "GetSSOProvider", "request": { "description": "GetSSOProvider returns one provider by id. Same secret rule as the list.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/sso-providers/{{provider_id}}" } } }, { "name": "ListUsers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "ListUsers batch-resolves user_ids to directory entries in one call,\n so a stats/management caller can resolve a whole page of grouped\n insights rows without N round-trips. Unknown ids are silently\n omitted from the response.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "lookup" ], "raw": "{{baseUrl}}/v1/users/lookup" } } }, { "name": "SearchUsers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"excludeUserGroupId\": \"string\",\n \"excludeUserIds\": [\n \"string\"\n ],\n \"hasUserGroup\": false,\n \"limit\": 0,\n \"offset\": 0,\n \"role\": \"string\",\n \"search\": \"string\",\n \"sortBy\": \"USER_SORT_CREATED_AT\",\n \"sortDir\": \"USER_SORT_DIRECTION_ASCENDING\",\n \"status\": \"USER_STATUS_ACTIVE\",\n \"unassignedUserGroup\": false,\n \"userGroupId\": \"{{user_group_id}}\",\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "SearchUsers browses the directory the way the admin console's Users\n page needs (fraser#8695): a case-insensitive substring match on name\n or email, a status filter, and limit/offset paging with a total, so\n the console renders its numbered pages and stat cards without\n reading the auth DB directly (fraser#5521). The same users_reader\n gate and in-handler tenant boundary as GetUser/ListUsers apply.\n\n An UNSPECIFIED status hides deleted users -- deleted_at IS NULL is\n the default everywhere active lists are rendered -- so a caller sees\n the active population unless it asks for USER_STATUS_DELETED\n explicitly. ACTIVE and BANNED also exclude deleted users: a delete\n is a separate state from an operator ban, not a flavor of one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "search" ], "raw": "{{baseUrl}}/v1/users/search" } } }, { "name": "GetUserStats", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"excludeUserGroupId\": \"string\",\n \"excludeUserIds\": [\n \"string\"\n ],\n \"hasUserGroup\": false,\n \"role\": \"string\",\n \"search\": \"string\",\n \"unassignedUserGroup\": false,\n \"userGroupId\": \"{{user_group_id}}\",\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "GetUserStats returns the per-status counts the Users page's stat\n cards render, over the same boundary and the same non-status filters\n as SearchUsers -- one call instead of four filtered searches. The\n status filter is the one SearchUsers predicate this request omits:\n the counts ARE the status breakdown. total counts non-deleted users\n (active + banned), so deleted users never inflate a \"total users\"\n card.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "stats" ], "raw": "{{baseUrl}}/v1/users/stats" } } }, { "name": "DeleteUser", "request": { "description": "DeleteUser soft-deletes a user (fraser#8692). The authn.user row is\n never removed: delete sets banned = true with the USER_DELETED ban\n reason, stamps deleted_at/deleted_by, revokes every live API key the\n user owns (writing deleted_at, revoked_at and is_active), deletes the\n RBAC bindings those keys carried, and removes their authn.session\n rows -- all in one transaction, so a key-revocation failure leaves the\n user unchanged. RestoreUser reverses it.\n\n Restorable by design, and visibly distinct from an operator ban: a\n deleted account carries the USER_DELETED sentinel as its ban reason.\n\n Refuses with FAILED_PRECONDITION when the target is the last active\n administrator -- of the platform (legacy admin role or a platform-scope\n admin binding) or of any customer they hold an org-scope admin binding\n for -- so a deployment cannot delete its way out of being\n administrable. Refuses with FAILED_PRECONDITION when the user is\n already deleted; NOT_FOUND for an unknown user_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}" } } }, { "name": "GetUser", "request": { "description": "GetUser resolves a single user_id to its directory entry (email +\n name). This is the attribution/display lookup that per-user\n insights/usage views need: those views key data by the opaque\n authn.user.id, and this maps that id back to a named person. It is a\n directory lookup only -- not identity propagation or authorization,\n and callers must not read the auth DB directly.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}" } } }, { "name": "BanUser", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "BanUser bans a user (authn.user.banned = true) with a reason, and\n immediately revokes every live session and API key the user holds.\n This is the valet-native equivalent of fraser-auth's better-auth\n admin ban-user endpoint (fraser#9001): the flag lives on the shared\n authn.user row, the session revocation matches better-auth's\n ban-time deletion, and the key soft-delete matches the\n fraser#8689 hook (keys are marked deleted_at, never restored --\n an unbanned user issues fresh keys).\n\n Admin-gated and session-only, carrying the same caller contract as\n DeleteUser (fraser#9151): an interactive session that holds the admin\n scope, or the users.edit permission on a platform-scope RBAC binding.\n A ban revokes every session and every API key the target holds, so its\n blast radius equals a delete's and the two admit the same\n administrators. users.edit is also the atom fraser-auth authorizes its\n own ban endpoints on (fraser#8689), so valet and fraser-auth answer a\n ban from one permission.\n\n The request names a bare user_id and no tenant, so users.edit is\n authorized at PLATFORM reach. The handler re-checks the session half:\n an API key is refused even when it carries users.edit.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "ban" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/ban" } } }, { "name": "RestoreUser", "request": { "description": "RestoreUser reverses DeleteUser: it clears deleted_at/deleted_by, and\n lifts the USER_DELETED ban the delete wrote. It does not touch an\n operator's separate suspension (a ban whose reason is not the\n USER_DELETED sentinel survives a restore), and it does not resurrect\n the revoked API keys or deleted sessions -- those stay revoked, and the\n user mints new credentials on next login. NOT_FOUND when the user_id\n has no row or carries no deleted_at (shaped as \"not deleted\").", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "restore" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/restore" } } }, { "name": "RevokeUserSessions", "request": { "description": "RevokeUserSessions signs a user out everywhere by deleting every\n authn.session row they hold. It touches nothing else: API keys stay\n live and the account is not banned. This is the valet-native\n equivalent of fraser-auth's better-auth admin revoke-user-sessions\n endpoint, which the admin console calls when it lowers a user's role so\n the old role's sessions do not outlive the change. Revoking your own\n sessions is allowed, as it is on fraser-auth.\n\n Same caller contract as BanUser: an interactive session that holds the\n admin scope, or the users.edit permission on a platform-scope RBAC\n binding. users.edit is the atom fraser-auth authorizes its own\n revoke-user-sessions endpoint on (the same gate as its ban endpoints),\n so valet and fraser-auth admit the same administrators. The request\n names a bare user_id and no tenant, so users.edit is authorized at\n PLATFORM reach, and the handler refuses any credential that is not a\n session, even an API key carrying users.edit.\n\n NOT_FOUND for an unknown user_id. A known user with no sessions\n succeeds with revoked_count 0.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "revoke-sessions" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/revoke-sessions" } } }, { "name": "UnbanUser", "request": { "description": "UnbanUser clears a user's ban (authn.user.banned, ban_reason,\n ban_expires). It deliberately restores nothing: sessions deleted\n by the ban stay logged out and API keys soft-deleted by the ban\n stay dead, so a re-enabled user must sign in again and issue\n fresh keys (fraser#8689). Same caller gate as BanUser, declared the\n same way: lifting a ban is as consequential as writing one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}", "unban" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}/unban" } } } ], "name": "agentrouter.identity.v1.IdentityService" }, { "item": [ { "name": "ChangePassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"currentPassword\": \"string\",\n \"newPassword\": \"string\"\n}" }, "description": "ChangePassword sets a new password for the signed-in caller, who must\n prove the current one. Every OTHER session the user holds is revoked, so a\n password change ends any session an attacker may already have.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "change-password" ], "raw": "{{baseUrl}}/v1/auth/change-password" } } }, { "name": "Login", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"codeChallenge\": \"string\",\n \"codeChallengeMethod\": \"string\",\n \"issuer\": \"string\",\n \"redirectUri\": \"https://example.com\"\n}" }, "description": "Login initiates an OIDC authorization-code + PKCE flow. Returns an\n authorization_url the caller must redirect the user's browser to.\n After the IdP authenticates and redirects to redirect_uri, the\n platform establishes a session cookie for subsequent requests.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "login" ], "raw": "{{baseUrl}}/v1/auth/login" } } }, { "name": "Logout", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "Logout invalidates the caller's current OIDC session. Subsequent\n requests using the session cookie return 401 unauthenticated. Does\n not revoke API keys the identity may have issued.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "logout" ], "raw": "{{baseUrl}}/v1/auth/logout" } } }, { "name": "RequestPasswordReset", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"redirectTo\": \"string\"\n}" }, "description": "RequestPasswordReset emails a single-use reset link. The response is the\n same whether or not the address has an account, so it cannot be used to\n discover who has one.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "request-password-reset" ], "raw": "{{baseUrl}}/v1/auth/request-password-reset" } } }, { "name": "ResetPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"newPassword\": \"string\",\n \"token\": \"example-token\"\n}" }, "description": "ResetPassword consumes a reset token and sets the new password. The token\n is single-use and expires an hour after it is issued.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "reset-password" ], "raw": "{{baseUrl}}/v1/auth/reset-password" } } }, { "name": "SendVerificationEmail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"callbackUrl\": \"https://example.com\",\n \"email\": \"developer@example.com\"\n}" }, "description": "SendVerificationEmail re-sends the verification link. The response is the\n same whether or not the address has an unverified account.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "send-verification-email" ], "raw": "{{baseUrl}}/v1/auth/send-verification-email" } } }, { "name": "SignInWithPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"password\": \"string\"\n}" }, "description": "SignInWithPassword exchanges an email and password for a session. Serves\n the same credential store as the auth service (authn.account, provider\n \"credential\"), so a password set by either stack works on both.\n\n Registered only where credential sign-in is enabled: a deployment running\n corporate SSO has no password surface at all.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "sign-in", "email" ], "raw": "{{baseUrl}}/v1/auth/sign-in/email" } } }, { "name": "SignUpWithPassword", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"callbackUrl\": \"https://example.com\",\n \"email\": \"developer@example.com\",\n \"name\": \"example-name\",\n \"password\": \"string\"\n}" }, "description": "SignUpWithPassword creates an account with an email and password and sends\n a verification link. Available only where self-serve sign-up is enabled;\n elsewhere an administrator provisions the user instead.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "sign-up", "email" ], "raw": "{{baseUrl}}/v1/auth/sign-up/email" } } }, { "name": "ListSocialProviders", "request": { "description": "ListSocialProviders names the social logins this deployment has credentials\n for, so a sign-in page renders the buttons that will actually work. Public\n and thin for the same reason GetSSOProviderStatus is: it carries no client\n id and no secret, only the names.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "social", "providers" ], "raw": "{{baseUrl}}/v1/auth/social/providers" } } }, { "name": "StartSocialLogin", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": \"string\",\n \"returnUrl\": \"https://example.com\"\n}" }, "description": "StartSocialLogin opens a Google or GitHub login, the same browser shape as\n StartSSOLogin and with the same signed state.\n\n Corporate SSO and social login differ in where the provider is configured,\n not in how the flow runs: corporate is a row an administrator registers at\n runtime, while the social apps are deployment credentials supplied as\n environment variables, because their client secrets belong to the operator\n rather than to a tenant. That is why this takes a provider NAME from a\n closed set instead of a provider id.\n\n Public of necessity: it runs before anyone is signed in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "social", "start" ], "raw": "{{baseUrl}}/v1/auth/social/start" } } }, { "name": "StartSSOLogin", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"providerId\": \"{{provider_id}}\",\n \"returnUrl\": \"https://example.com\"\n}" }, "description": "StartSSOLogin opens the browser-shaped corporate SSO flow. Login hands PKCE\n orchestration to the CLI, which owns the loopback redirect; a browser has\n nowhere to keep a verifier, so this mints the whole attempt server-side and\n signs the return URL into the state. Any replica can then complete the\n callback -- no shared store, no session affinity (the reason login state is\n stateless at all, fraser#5339).\n\n Public of necessity: it runs before anyone is signed in.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "sso", "start" ], "raw": "{{baseUrl}}/v1/auth/sso/start" } } }, { "name": "VerifyEmail", "request": { "description": "VerifyEmail consumes a verification link and marks the address verified.\n The token is the same signed form the auth service issues, so a link from\n either stack works on both.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "verify-email" ], "raw": "{{baseUrl}}/v1/auth/verify-email" } } }, { "name": "GetMe", "request": { "description": "GetMe returns the full identity record for the authenticated caller.\n Use to verify which identity a credential belongs to, populate a\n \"logged in as\" UI element, or confirm role assignments before making\n permission-gated calls. A session caller also receives its session claims:\n the organization-level permission set and whether the deployment has an\n administrator.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me" ], "raw": "{{baseUrl}}/v1/me" } } }, { "name": "UpdateMe", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\"\n}" }, "description": "UpdateMe changes the signed-in caller's own display name\n (authn.user.name) and returns the updated identity. It acts only on the\n caller: there is no user id in the request, so it cannot rename anyone\n else.\n\n Name only. fraser-auth's better-auth update-user also accepts image,\n phone, website and address, but the console's profile dialog sends only\n name, so that is all this serves. Email and role are never\n caller-editable.\n\n Session-only, like ChangePassword: an API key is refused even though it\n belongs to the same user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me" ], "raw": "{{baseUrl}}/v1/me" } } }, { "name": "ListMyKeys", "request": { "description": "ListMyKeys lists all API keys belonging to the caller. Returns\n metadata (id, name, creation timestamp, last-used timestamp) but\n never the plaintext secret.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys" ], "raw": "{{baseUrl}}/v1/me/keys" } } }, { "name": "IssueMyKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"idempotencyKey\": \"example-value\",\n \"name\": \"example-name\",\n \"platformRoles\": [\n \"string\"\n ],\n \"projectId\": \"{{project_id}}\",\n \"scopes\": [\n \"string\"\n ],\n \"tags\": {\n \"key\": \"string\"\n },\n \"type\": \"API_KEY_TYPE_PROMPT\"\n}" }, "description": "IssueMyKey issues a new long-lived API key for the caller. The\n secret field in the response is returned exactly once and cannot be\n retrieved again. Store it in a secrets manager immediately.\n\n Issuing a management key (type API_KEY_TYPE_MANAGEMENT) requires the\n api_keys.create permission for the target customer -- the built-in Super\n Admin and User Admin roles carry it -- or the request fails with\n PERMISSION_DENIED. Inference keys (the default) are open to any\n authenticated session.\n\n The key carries the caller's own access, not the organization's: a caller\n who cannot already administer the customer receives read-only management\n scopes, and asking for broader ones fails with PERMISSION_DENIED.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys" ], "raw": "{{baseUrl}}/v1/me/keys" } } }, { "name": "RevokeMyKey", "request": { "description": "RevokeMyKey permanently and irrevocably revokes an API key.\n Revocation propagates to all active data planes within sub-second;\n requests already in flight that passed authentication before\n propagation may still complete.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/me/keys/{{key_id}}" } } }, { "name": "UpdateMyKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"clearPlatformRoles\": false,\n \"clearScopes\": false,\n \"clearTags\": false,\n \"platformRoles\": [\n \"string\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"tags\": {\n \"key\": \"string\"\n }\n}" }, "description": "UpdateMyKey replaces the scope set of a caller-owned management key\n in place, so an existing key can be re-scoped without rotating its\n secret. The caller may only assign scopes it is authorized to delegate.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/me/keys/{{key_id}}" } } }, { "name": "ResolveMyPermissions", "request": { "description": "ResolveMyPermissions returns every RBAC permission the calling identity\n holds at one target: the customer's org level when project_id is empty, or\n that project otherwise.\n\n This is the read the console renders from -- it decides which controls\n exist, not whether a call is allowed. Enforcement stays at the interceptor.\n\n This read and the interceptor's RBAC leg resolve through the SAME bindings,\n so they cannot disagree about a binding-derived grant. They can still\n disagree in one direction, and it is worth stating plainly: authorization is\n an additive OR of the RBAC leg and the static coarse-scope leg, so a caller\n the interceptor admits on a coarse scope alone -- holding no binding --\n resolves an empty set here. The `admin` scope is carved out below and\n unioned in; the other scope tokens are not, and neither is a management key\n riding delegated scopes. Such a caller sees fewer controls than it may in\n fact use. That is the safe direction (it hides, it never offers a control\n that 403s), but it is not \"identical\".\n\n `resolved` reports whether the frontier was actually computed. It is never\n a silent empty: a resolve failure answers an error rather than an empty\n permission list, because \"no permissions\" and \"could not tell\" render the\n same way and only one of them is safe to act on.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "permissions" ], "raw": "{{baseUrl}}/v1/me/permissions" } } }, { "name": "ListMyProjects", "request": { "description": "ListMyProjects lists the projects the calling identity can access within\n one customer, with the caller's role in each.\n\n Access is the union of three sources: the caller's project_members rows,\n the projects their project-scoped RBAC bindings reach, and -- when they\n hold an org-scoped grant -- every project in the customer.\n\n The customer-wide `default` project travels with EVERY customer the caller\n belongs to, not only the oldest one that fills an omitted customer_id, and\n with a caller who has no customer yet, which is the first-login state it\n exists for. An established caller naming a tenant they hold no membership\n in does NOT receive that tenant's `default` project; they get an empty list.\n\n `role` reports what the platform actually enforces for the caller on that\n project, not merely what the membership row says, so a project listed as\n \"admin\" is one the caller is genuinely admitted to as owner. A caller with\n no access receives an empty page, not an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "projects" ], "raw": "{{baseUrl}}/v1/me/projects" } } }, { "name": "ListMyReachableProjects", "request": { "description": "ListMyReachableProjects returns the bare project ids the calling identity\n can reach in one customer, carrying read access.\n\n ListMyProjects answers the same frontier with full project records and a\n role per project; this returns only the ids, because the console's project\n scoping splices them into a query and never reads the rest. `all_projects`\n reports an org-wide grant, where the caller reaches every project in the\n customer and the id list is therefore empty rather than exhaustive.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "reachable-projects" ], "raw": "{{baseUrl}}/v1/me/reachable-projects" } } }, { "name": "GetPermissionCatalog", "request": { "description": "GetPermissionCatalog returns the seeded permission vocabulary grouped by\n domain, for the surfaces that render a permission picker.\n\n The catalog grants nothing and is the same for every caller in a\n deployment, so it is authenticated but otherwise ungated -- matching the\n endpoint it replaces. It is sourced from authn.rbac_permission, which\n carries the atom, its domain and its scope set; the menu metadata and\n descriptions in fraser-auth's authored manifest do not reach the database\n and are not returned.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "permissions", "catalog" ], "raw": "{{baseUrl}}/v1/permissions/catalog" } } }, { "name": "GetSSOProviderStatus", "request": { "description": "GetSSOProviderStatus reports whether a provider is configured and enabled\n and which protocol it speaks. Public and deliberately thin: a sign-in page\n has to ask before anyone is signed in, so the response carries no issuer,\n no client id and no endpoints -- only enough to decide whether to offer the\n corporate button.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "sso-providers", "{{provider_id}}", "status" ], "raw": "{{baseUrl}}/v1/sso-providers/{{provider_id}}/status" } } }, { "name": "CreateUser", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"initialPassword\": \"string\",\n \"issueSession\": false,\n \"name\": \"example-name\",\n \"sendPasswordSetupEmail\": false\n}" }, "description": "CreateUser provisions a user identity (an authn.user row). Admin-scoped\n and session-only: only platform operators (admin scope) acting through an\n interactive session may create users; API keys are rejected. Intended for\n tenant onboarding where users do not arrive via interactive SSO. When\n issue_session is true a session is also created and its token returned\n ONCE, so the caller can immediately act as the new user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users" ], "raw": "{{baseUrl}}/v1/users" } } } ], "name": "agentrouter.identity.v1.MeService" }, { "item": [ { "name": "Prompt", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"idempotencyKey\": \"example-value\",\n \"keyId\": \"{{key_id}}\",\n \"model\": \"string\",\n \"prompt\": \"string\"\n}" }, "description": "Prompt sends a prompt to an upstream LLM and returns the model's\n completion. The gateway selects an eligible data plane, retrieves\n and applies the project's BYOK key, enforces quota, records a\n request log entry, and proxies the call to the upstream provider.\n Streaming, multi-turn conversations, tools, and vision are not yet\n supported on this path.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "prompts" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/prompts" } } }, { "name": "GetDataplaneURL", "request": { "description": "GetDataplaneURL returns one dataplane (gateway) URL for a single project.\n The project is deduced from the caller's credential -- no input is required\n in the common case: a caller who belongs to one project gets that project's\n dataplane; one whose identity spans several gets their default (the oldest\n membership). Pass project_id to disambiguate or target a specific project\n (it is membership-checked). The customer is derived the same way. When the\n credential itself already pins a workspace, a gateway on that workspace is\n preferred. When several Project Gateways are eligible, the first by\n project_gateway_id is returned; use ListDataplaneURLs to retrieve the set.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "dataplane-url" ], "raw": "{{baseUrl}}/v1/dataplane-url" } } }, { "name": "ListDataplaneURLs", "request": { "description": "ListDataplaneURLs returns every dataplane URL the caller can reach. For a\n project with attached Project Gateways it returns one entry per configured\n gateway; otherwise it preserves the legacy one-entry-per-workspace shape.\n Key-deduced; no input. Use GetDataplaneURL when one project's preferred URL\n is wanted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "dataplane-urls" ], "raw": "{{baseUrl}}/v1/dataplane-urls" } } } ], "name": "agentrouter.inference.v1.InferenceIngressService" }, { "item": [ { "name": "ListCustomerRequestLogs", "request": { "description": "ListCustomerRequestLogs returns the caller's own request logs,\n filtered by the supplied tenancy scope. Forced filter:\n `user_id = caller.UserID`.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs" } } }, { "name": "GetCustomerRequestLogStats", "request": { "description": "GetCustomerRequestLogStats returns aggregated statistics over the\n calling user's request logs within the supplied tenancy scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs/stats" } } }, { "name": "GetCustomerRequestLog", "request": { "description": "GetCustomerRequestLog returns a single request log row owned by the\n calling user. Cross-user NotFound: the user cannot read another\n user's log even within the same customer/project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs", "{{request_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs/{{request_id}}" } } } ], "name": "agentrouter.insights.v1.CustomerRequestLogsService" }, { "item": [ { "name": "QueryRequestLogs", "request": { "description": "QueryRequestLogs retrieves request logs with filtering and pagination.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs" ], "raw": "{{baseUrl}}/v1/request-logs" } } }, { "name": "GetRequestLogStats", "request": { "description": "GetRequestLogStats returns aggregated statistics for request logs.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "stats" ], "raw": "{{baseUrl}}/v1/request-logs/stats" } } }, { "name": "GetRequestLog", "request": { "description": "GetRequestLog retrieves a single request log by request ID.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "{{request_id}}" ], "raw": "{{baseUrl}}/v1/request-logs/{{request_id}}" } } } ], "name": "agentrouter.insights.v1.RequestLogsService" }, { "item": [ { "name": "ListCatalogServers", "request": { "description": "ListCatalogServers returns every catalog entry, including disabled\n rows so operators can re-enable them. The dashboard's read-only\n view filters to is_enabled=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers" } } }, { "name": "UpsertCatalogServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authentication\": \"string\",\n \"categories\": [\n \"string\"\n ],\n \"description\": \"Example description\",\n \"iconUrl\": \"https://example.com\",\n \"id\": \"string\",\n \"name\": \"example-name\",\n \"note\": \"string\",\n \"requiresAuth\": false,\n \"requiresProfile\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "UpsertCatalogServer creates or replaces a catalog entry. Idempotent\n on `id`. Operator-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers" } } }, { "name": "DeleteCatalogServer", "request": { "description": "DeleteCatalogServer removes a catalog entry by id. Operator-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "GetCatalogServer", "request": { "description": "GetCatalogServer returns a single catalog entry by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "SetCatalogServerEnabled", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false\n}" }, "description": "SetCatalogServerEnabled flips the operator visibility toggle on a\n catalog entry. Split from UpsertCatalogServer so a re-upsert that\n refreshes content fields (display_name, url, ...) cannot silently\n re-enable a previously-disabled row through the proto bool zero\n value.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}", "enabled" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}/enabled" } } } ], "name": "agentrouter.mcp.v1.MCPCatalogService" }, { "item": [ { "name": "ListAvailableMCPServers", "request": { "description": "ListAvailableMCPServers lists the MCP servers a user may attach to a\n profile in the given project: enabled catalog servers granted to the\n project (project_mcp_servers), each with its tool catalog so the client\n can pick which tools to enable on attach.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "available-mcp-servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/available-mcp-servers" } } }, { "name": "ListMCPProfiles", "request": { "description": "ListMCPProfiles lists every profile owned by the given\n (user_id, customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "CreateMCPProfile", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"securityPolicyType\": \"https://example.com\",\n \"securityPolicyValue\": \"https://example.com\"\n}" }, "description": "CreateMCPProfile registers a new MCP server for a user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "DeleteMCPProfile", "request": { "description": "DeleteMCPProfile soft-deletes a profile (deleted_at set; row kept\n for FK integrity against historical request logs).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "GetMCPProfile", "request": { "description": "GetMCPProfile returns a single profile by uuid.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "UpdateMCPProfile", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"securityPolicyType\": \"https://example.com\",\n \"securityPolicyValue\": \"https://example.com\"\n}" }, "description": "UpdateMCPProfile updates mutable profile fields. Omitted scalar\n strings (\"\") leave the existing value untouched.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "AddMCPProfileServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiToken\": \"example-token\",\n \"bearerToken\": \"example-token\",\n \"serverId\": \"{{server_id}}\",\n \"tools\": [\n \"string\"\n ]\n}" }, "description": "AddMCPProfileServer attaches an MCP server to a profile with all of its\n tools enabled by default. The CLI has no per-tool flag, so `add` always\n attaches with all tools; use the SDK/REST SetMCPProfileServerTools to\n enable a subset. Creates a row in mcp_profile_backends with an optional\n per-server credential; the server must be enabled in the catalog and\n granted to the profile's project (project_mcp_servers), and re-adding an\n already-attached server updates its tools/credential in place.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers" } } }, { "name": "RemoveMCPProfileServer", "request": { "description": "RemoveMCPProfileServer detaches an MCP server from a profile, deleting\n the mcp_profile_backends row and any per-server credential. Idempotent:\n removing an already-detached server succeeds.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}" } } }, { "name": "SetMCPProfileServerTools", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tools\": [\n \"string\"\n ]\n}" }, "description": "SetMCPProfileServerTools replaces the enabled-tool set for an attached\n server (mcp_profile_backends.selectors.tools). Full-replacement (PUT)\n semantics. An EMPTY list stores/returns regex:* (include-all) -- to\n expose none, remove the server.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}", "tools" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}/tools" } } } ], "name": "agentrouter.mcp.v1.MCPProfilesService" }, { "item": [ { "name": "ListMcpOAuthClients", "request": { "description": "ListMcpOAuthClients lists every non-deleted OAuth client in the\n (customer, project) scope. Account tier: any project member may read.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients" } } }, { "name": "CreateMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"provider\": \"string\",\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "CreateMcpOAuthClient registers a new OAuth client under a project.\n The client_secret is wrapped by the secret service and discarded;\n only an sm:// reference is persisted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients" } } }, { "name": "DeleteMcpOAuthClient", "request": { "description": "DeleteMcpOAuthClient soft-deletes a client (deleted_at set).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "GetMcpOAuthClient", "request": { "description": "GetMcpOAuthClient returns a single OAuth client by id. Never returns\n the client_secret. Account tier: any project member may read.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "UpdateMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"replaceMetadata\": false,\n \"replaceRedirectUris\": false,\n \"replaceScopes\": false,\n \"replaceServerIds\": false,\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "UpdateMcpOAuthClient applies a partial patch. Omitted scalar strings\n (\"\") leave the existing value untouched. A non-empty client_secret\n rotates the wrapped secret in place.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } } ], "name": "agentrouter.mcp.v1.McpOAuthClientsService" }, { "item": [ { "name": "GetApiKeyMetric", "request": { "description": "GetApiKeyMetric returns a metric for a single API key. The key must belong\n to the resolved (customer, project) scope, else NotFound.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "api_keys", "{{api_key_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/api_keys/{{api_key_id}}/metrics/{{metric}}" } } }, { "name": "GetProjectMetric", "request": { "description": "GetProjectMetric returns a project-level metric. The caller must be a\n member of the (customer, project) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/metrics/{{metric}}" } } }, { "name": "GetUserMetric", "request": { "description": "GetUserMetric returns a metric for a single user. The user_id is forced to\n the authenticated caller: a caller can only read their own USER-layer\n metrics even within a project they share.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/metrics/{{metric}}" } } }, { "name": "GetMyMetric", "request": { "description": "GetMyMetric returns a USER-layer metric for the calling user, resolved\n entirely from the session token -- no tenancy scope is required.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/me/metrics/{{metric}}" } } }, { "name": "ListMetrics", "request": { "description": "ListMetrics returns DPO's metric catalog: the known metrics, the layers\n and endpoint-layers supported, and the raw-metric passthrough route\n (DPO#22). The catalog is non-sensitive discovery metadata, so it is\n exposed here to every authenticated caller -- not just admin -- with no\n tenancy scope or special scope required. Uses a distinct path from the\n admin MetricsService.ListMetrics (/v1/metrics) to avoid colliding with\n GetMetric's /v1/metrics/{metric}.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metric-catalog" ], "raw": "{{baseUrl}}/v1/metric-catalog" } } } ], "name": "agentrouter.metrics.v1.CustomerMetricsService" }, { "item": [ { "name": "GetCustomerMetric", "request": { "description": "GetCustomerMetric returns a customer-level (CUSTOMER-layer) metric for any\n customer.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/metrics/{{metric}}" } } }, { "name": "ListMetrics", "request": { "description": "ListMetrics returns DPO's metric catalog: the known metrics, the layers\n and endpoint-layers supported, and the raw-metric passthrough route\n (DPO#22). This coexists with GetMetric's /v1/metrics/{metric}: an exact\n path match on /v1/metrics routes here.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metrics" ], "raw": "{{baseUrl}}/v1/metrics" } } }, { "name": "GetMetric", "request": { "description": "GetMetric returns a metric for any entity in any layer, including the\n infra layers DATAPLANE and GATEWAY. entity and layer are taken from the\n request.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/metrics/{{metric}}" } } }, { "name": "GetRawMetric", "request": { "description": "GetRawMetric returns an unaggregated (raw) metric, bypassing the summary\n rollup (DPO#21).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "raw-metrics", "{{raw_metric_name}}" ], "raw": "{{baseUrl}}/v1/raw-metrics/{{raw_metric_name}}" } } } ], "name": "agentrouter.metrics.v1.MetricsService" }, { "item": [ { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{fallback_chain_policy_target_key_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{fallback_chain_policy_target_key_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{fallback_chain_policy_target_key_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{fallback_chain_policy_target_key_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "UpsertFallbackPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpsertFallbackPolicy replaces the complete set of fallback entries for\n one organization, project, or API-key target. `entries` is authoritative:\n omitted protected models are removed, and an empty set deactivates the\n target. Release 1 precedence is API key > project > organization/customer;\n tag targets are reporting-only and cannot be created by this operation.\n Eligible retry categories are timeout, rate-limit/capacity, and server\n error. Malformed requests, content refusals, rejected credentials, and\n other non-eligible client failures do not advance the ordered list.\n Effective responses and request logs identify the serving model and the\n source scope/policy. The public names are FallbackPolicy,\n fallback-policies, entries, and fallback_models; FallbackChainPolicy and\n chain remain read/write aliases for legacy clients.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{fallback_policy_target_key_id}}", "policy", "fallback-policies:upsert" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{fallback_policy_target_key_id}}/policy/fallback-policies:upsert" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{target_key_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{target_key_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "api-keys", "{{target_key_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/api-keys/{{target_key_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "UpsertFallbackPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n },\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "UpsertFallbackPolicy replaces the complete set of fallback entries for\n one organization, project, or API-key target. `entries` is authoritative:\n omitted protected models are removed, and an empty set deactivates the\n target. Release 1 precedence is API key > project > organization/customer;\n tag targets are reporting-only and cannot be created by this operation.\n Eligible retry categories are timeout, rate-limit/capacity, and server\n error. Malformed requests, content refusals, rejected credentials, and\n other non-eligible client failures do not advance the ordered list.\n Effective responses and request logs identify the serving model and the\n source scope/policy. The public names are FallbackPolicy,\n fallback-policies, entries, and fallback_models; FallbackChainPolicy and\n chain remain read/write aliases for legacy clients.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "policy", "fallback-policies:upsert" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/policy/fallback-policies:upsert" } } }, { "name": "AddApiKeyTag", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tagKey\": \"example-value\",\n \"tagValue\": \"string\"\n}" }, "description": "AddApiKeyTag attaches a (tag_key, tag_value) pair to an API key. Both\n must reference an existing TagSchemaEntry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "api-keys", "{{api_key_id}}", "tags" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/api-keys/{{api_key_id}}/tags" } } }, { "name": "RemoveApiKeyTag", "request": { "description": "RemoveApiKeyTag detaches a tag from an API key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "api-keys", "{{api_key_id}}", "tags", "{{tag_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/api-keys/{{api_key_id}}/tags/{{tag_id}}" } } }, { "name": "CreateAttributeRoutingPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"attributeRoutingPolicy\": {\n \"defaultModel\": \"string\",\n \"defaultProvider\": \"string\",\n \"rules\": [\n {\n \"conditions\": [\n {}\n ],\n \"destinationModel\": \"string\",\n \"destinationProvider\": \"string\",\n \"id\": \"string\",\n \"ruleOrder\": 1\n }\n ],\n \"scopeType\": \"ATTRIBUTE_ROUTING_SCOPE_TYPE_KEY\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetApiKeyId\": \"example-value\",\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "CreateAttributeRoutingPolicy creates an ordered rule list bound to a\n project or a key. The created policy is always in MONITOR mode: nothing\n moves traffic until SetAttributeRoutingPolicyMode flips it.\n\n KNOWN LIMITATION. A destination is checked against the target project's\n catalog at save time, which is early feedback rather than a guarantee.\n Availability for a given key also depends on the provider, the project's\n provider filter, the key's own route map and the gateway binding, all of\n which are resolved when the routing snapshot is rendered. A rule can\n therefore save cleanly and still never fire, because the destination was\n dropped at render time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies" } } }, { "name": "UpdateAttributeRoutingPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"attributeRoutingPolicy\": {\n \"defaultModel\": \"string\",\n \"defaultProvider\": \"string\",\n \"rules\": [\n {\n \"conditions\": [\n {}\n ],\n \"destinationModel\": \"string\",\n \"destinationProvider\": \"string\",\n \"id\": \"string\",\n \"ruleOrder\": 1\n }\n ],\n \"scopeType\": \"ATTRIBUTE_ROUTING_SCOPE_TYPE_KEY\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetApiKeyId\": \"example-value\",\n \"targetProjectId\": \"string\"\n },\n \"clearRules\": false\n}" }, "description": "UpdateAttributeRoutingPolicy applies a partial update. A present `rules`\n field replaces the ENTIRE rule list: a rule carrying its id is updated in\n place, a rule with no id is created, and a rule left out is deleted.\n Omitting `rules` leaves the list untouched. Mode, status, scope_type,\n target_api_key_id, and target_project_id are NOT settable here.\n\n KNOWN LIMITATION. A destination is checked against the target project's\n catalog at save time, which is early feedback rather than a guarantee.\n Availability for a given key also depends on the provider, the project's\n provider filter, the key's own route map and the gateway binding, all of\n which are resolved when the routing snapshot is rendered. A rule can\n therefore save cleanly and still never fire, because the destination was\n dropped at render time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}" } } }, { "name": "DeleteAttributeRoutingPolicy", "request": { "description": "DeleteAttributeRoutingPolicy removes a policy; its rules and conditions\n go with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}" } } }, { "name": "SetAttributeRoutingPolicyMode", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"mode\": \"ATTRIBUTE_ROUTING_MODE_MONITOR\"\n}" }, "description": "SetAttributeRoutingPolicyMode flips a policy between monitoring and\n enforcing. Its own RPC, and its own audit action, because this is the\n moment live traffic starts moving.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}", "mode" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}/mode" } } }, { "name": "SetAttributeRoutingPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetAttributeRoutingPolicyStatus switches a policy on or off. Independent\n of mode: pausing a policy does not forget whether it monitors or\n enforces.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/attribute-routing-policies/{{attribute_routing_policy_id}}/status" } } }, { "name": "CreateBudgetPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"budgetPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"alertThresholds\": [\n 0\n ],\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"fallbackModel\": \"string\",\n \"fallbackModels\": {\n \"key\": \"string\"\n },\n \"groupId\": \"{{group_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"spendLimit\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\"\n }\n}" }, "description": "CreateBudgetPolicy creates a new budget policy. For API_KEY scope, the\n named key's client and project are resolved under its row lock. Returns\n ABORTED if the key's project changed after authorization; a retry must\n still satisfy the request project's ownership check.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies" } } }, { "name": "UpdateBudgetPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"budgetPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"alertThresholds\": [\n 0\n ],\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"fallbackModel\": \"string\",\n \"fallbackModels\": {\n \"key\": \"string\"\n },\n \"groupId\": \"{{group_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"spendLimit\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\"\n }\n}" }, "description": "UpdateBudgetPolicy updates mutable budget policy fields. Omitted/empty\n scalar string fields leave the existing value untouched. Enum fields set\n to *_UNSPECIFIED leave the existing value untouched. The policy id must\n be set inside the budget_policy field. Restating the same api_key_id on\n an existing API_KEY policy preserves its stored client and project;\n supplying a different key retargets it. When a key target is supplied,\n returns ABORTED if its project changed after authorization. A retry must\n still satisfy the request project's ownership check.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "DeleteBudgetPolicy", "request": { "description": "DeleteBudgetPolicy deactivates a budget policy (is_active = false); the\n row remains, still listed under statuses INACTIVE, and can be removed\n with PurgeBudgetPolicy once inactive.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "PurgeBudgetPolicy", "request": { "description": "PurgeBudgetPolicy permanently removes an INACTIVE budget policy.\n DeleteBudgetPolicy only deactivates (budget_policies has no deleted_at\n column), so without this RPC an API-only operator could never remove a\n row. The policy must already be inactive -- deactivate it first through\n SetBudgetPolicyStatus or DeleteBudgetPolicy -- and that check is part of\n the delete statement itself, so a policy reactivated concurrently is left\n in place rather than destroyed.\n\n A caller without the admin scope may purge only PROJECT- and API_KEY-scoped\n policies within the request project. After request authorization, unknown\n policies and targets outside this allow-list both return NOT_FOUND. An\n active policy returns FAILED_PRECONDITION only if the caller is authorized\n to purge it.\n Alert history survives the purge\n with BudgetAlert.policy_id cleared (budget_alerts.policy_id is ON DELETE\n SET NULL), so ListBudgetAlerts can no longer find those alerts by\n policy_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}", "purge" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}/purge" } } }, { "name": "SetBudgetPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetBudgetPolicyStatus toggles a budget policy's active/inactive state\n (is_active). Activation retries concurrent changes to the policy's stored\n scope, client or project. Returns ABORTED if the target cannot be stabilized\n within the retry limit; the caller may retry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}/status" } } }, { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "UpsertFallbackPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"entries\": [\n {\n \"fallbackModels\": [\n {}\n ],\n \"model\": {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n }\n ],\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpsertFallbackPolicy replaces the complete set of fallback entries for\n one organization, project, or API-key target. `entries` is authoritative:\n omitted protected models are removed, and an empty set deactivates the\n target. Release 1 precedence is API key > project > organization/customer;\n tag targets are reporting-only and cannot be created by this operation.\n Eligible retry categories are timeout, rate-limit/capacity, and server\n error. Malformed requests, content refusals, rejected credentials, and\n other non-eligible client failures do not advance the ordered list.\n Effective responses and request logs identify the serving model and the\n source scope/policy. The public names are FallbackPolicy,\n fallback-policies, entries, and fallback_models; FallbackChainPolicy and\n chain remain read/write aliases for legacy clients.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-policies:upsert" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-policies:upsert" } } }, { "name": "CreateRateLimitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rateLimitPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"limit\": {\n \"inputTokensPerHour\": 0,\n \"outputTokensPerHour\": 0,\n \"totalTokensPerHour\": 0\n },\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "CreateRateLimitPolicy creates a new rate-limit policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies" } } }, { "name": "DeleteRateLimitPolicy", "request": { "description": "DeleteRateLimitPolicy deletes a rate-limit policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "SetRateLimitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetRateLimitPolicyStatus toggles a rate-limit policy's active/inactive\n state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}/status" } } }, { "name": "UpdateRateLimitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rateLimitPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"limit\": {\n \"inputTokensPerHour\": 0,\n \"outputTokensPerHour\": 0,\n \"totalTokensPerHour\": 0\n },\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "UpdateRateLimitPolicy updates mutable rate-limit policy fields.\n Omitted/empty scalar fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. The\n policy id must be set inside the rate_limit_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "CreateRequestAttribute", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"requestAttribute\": {\n \"allowedValues\": [\n \"string\"\n ],\n \"name\": \"example-name\",\n \"source\": \"REQUEST_ATTRIBUTE_SOURCE_METADATA\",\n \"valueType\": \"REQUEST_ATTRIBUTE_VALUE_TYPE_ENUM\"\n }\n}" }, "description": "CreateRequestAttribute adds one entry to the customer's org-wide routing\n vocabulary.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "request-attributes" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/request-attributes" } } }, { "name": "DeleteRequestAttribute", "request": { "description": "DeleteRequestAttribute removes a vocabulary entry. Refused with\n FailedPrecondition, naming the blocking policies, when a live rule\n condition still compares against it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "request-attributes", "{{request_attribute_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/request-attributes/{{request_attribute_id}}" } } }, { "name": "UpdateRequestAttribute", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"requestAttribute\": {\n \"allowedValues\": [\n \"string\"\n ],\n \"name\": \"example-name\",\n \"source\": \"REQUEST_ATTRIBUTE_SOURCE_METADATA\",\n \"valueType\": \"REQUEST_ATTRIBUTE_VALUE_TYPE_ENUM\"\n }\n}" }, "description": "UpdateRequestAttribute replaces a vocabulary entry's name, value type and\n allowed values. Removing an allowed value that a live rule compares\n against is permitted and does NOT break the rule structurally; it makes\n that condition stop matching, which is why fraser#8662 warns first.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "request-attributes", "{{request_attribute_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/request-attributes/{{request_attribute_id}}" } } }, { "name": "CreateTagSchemaEntry", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tagSchemaEntry\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"projectId\": \"{{project_id}}\",\n \"tagKey\": \"example-value\",\n \"tagValue\": \"string\"\n }\n}" }, "description": "CreateTagSchemaEntry adds an allowed (tag_key, tag_value) pair to the\n tag catalog.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema" } } }, { "name": "DeleteTagSchemaEntry", "request": { "description": "DeleteTagSchemaEntry removes an allowed (tag_key, tag_value) pair from\n the tag catalog.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema", "{{tag_schema_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema/{{tag_schema_id}}" } } }, { "name": "CreateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "CreateTrafficSplitPolicy creates a new traffic-split policy scoped to a\n key, tag selector, or project (fraser#5447, item 4.2).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies" } } }, { "name": "DeleteTrafficSplitPolicy", "request": { "description": "DeleteTrafficSplitPolicy deletes a traffic split policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "SetTrafficSplitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetTrafficSplitPolicyStatus toggles a traffic split policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}/status" } } }, { "name": "UpdateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"{{target_key_id}}\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateTrafficSplitPolicy updates mutable traffic split policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the traffic_split_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "CreateUserGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userGroup\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreateUserGroup creates a new user group (team).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups" } } }, { "name": "DeleteUserGroup", "request": { "description": "DeleteUserGroup deletes a user group. The group must be empty and\n unreferenced: a group that still has members, or that an active budget\n policy targets, is refused with FAILED_PRECONDITION, so callers remove the\n members (RemoveUserGroupMembers) and deactivate the policies first.\n Inactive budget policies targeting the group are deleted with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}" } } }, { "name": "UpdateUserGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"clearDescription\": false,\n \"userGroup\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdateUserGroup updates mutable user group fields. Omitted/empty scalar\n string fields leave the existing value untouched. The group id must be\n set inside the user_group field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}" } } }, { "name": "AddUserGroupMembers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "AddUserGroupMembers puts users into a group. A user already in another\n group is moved into this one, and the group they left comes back in\n `moves` -- the tag it overwrites is the only record of it. Ids that do\n not name a user are reported in `failed`; the rest of the batch still\n applies.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}/members" } } }, { "name": "RemoveUserGroupMembers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "RemoveUserGroupMembers takes users out of a group. Removal is idempotent:\n a listed user who is not in the group is left alone rather than reported\n as an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}", "members", "remove" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}/members/remove" } } }, { "name": "ListApiKeyTags", "request": { "description": "ListApiKeyTags returns tags attached to an API key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "api-keys", "{{api_key_id}}", "tags" ], "raw": "{{baseUrl}}/v1/policy/api-keys/{{api_key_id}}/tags" } } }, { "name": "ListAttributeRoutingPolicies", "request": { "description": "ListAttributeRoutingPolicies returns policies matching the filters,\n WITHOUT their rule bodies: the list surfaces show targets and modes. Use\n GetAttributeRoutingPolicy to load rules.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "attribute-routing-policies" ], "raw": "{{baseUrl}}/v1/policy/attribute-routing-policies" } } }, { "name": "GetAttributeRoutingPolicy", "request": { "description": "GetAttributeRoutingPolicy returns a single policy with its ordered rules\n and their conditions.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "attribute-routing-policies", "{{attribute_routing_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/attribute-routing-policies/{{attribute_routing_policy_id}}" } } }, { "name": "ListBudgetAlerts", "request": { "description": "ListBudgetAlerts returns system-fired budget alerts matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-alerts" ], "raw": "{{baseUrl}}/v1/policy/budget-alerts" } } }, { "name": "GetBudgetAlert", "request": { "description": "GetBudgetAlert returns a single budget alert by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-alerts", "{{budget_alert_id}}" ], "raw": "{{baseUrl}}/v1/policy/budget-alerts/{{budget_alert_id}}" } } }, { "name": "ListBudgetPolicies", "request": { "description": "ListBudgetPolicies returns budget policies matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies" ], "raw": "{{baseUrl}}/v1/policy/budget-policies" } } }, { "name": "GetBudgetPolicy", "request": { "description": "GetBudgetPolicy returns a single budget policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "GetPolicyCoverage", "request": { "description": "GetPolicyCoverage reports whether a scope reference has at least one\n applicable BudgetPolicy, and lists which ones apply.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "coverage" ], "raw": "{{baseUrl}}/v1/policy/coverage" } } }, { "name": "GetEffectivePolicy", "request": { "description": "GetEffectivePolicy resolves every BudgetPolicy applicable to a\n scope-target tuple down to the single clamp-winning policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "effective-policy" ], "raw": "{{baseUrl}}/v1/policy/effective-policy" } } }, { "name": "ListFallbackChainPolicies", "request": { "description": "ListFallbackChainPolicies returns fallback chain policies matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/policy/fallback-chain-policies" } } }, { "name": "GetFallbackChainPolicy", "request": { "description": "GetFallbackChainPolicy returns a single fallback chain policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "ListPolicies", "request": { "description": "ListPolicies returns a read-only, paginated list for the caller's tenant.\n Budget, rate-limit, fallback-chain and traffic-split policies include only\n PROJECT and TAG targets. Their KEY targets remain on the key's config page;\n the other legacy budget/rate-limit scopes remain excluded.\n Attribute-routing policies include PROJECT and KEY targets. A row appears\n only when the caller could read it through GetAttributeRoutingPolicy in its\n effective project. Visibility and request filters apply before totals and\n pagination. Mutations still use each family's type-specific RPCs.\n\n UnifiedPolicy.match_count retains target membership counts for the existing\n families. Attribute-routing coverage counts eligible keys where the policy\n is the enabled winner, independent of monitor/enforce mode.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "policies" ], "raw": "{{baseUrl}}/v1/policy/policies" } } }, { "name": "ListRateLimitPolicies", "request": { "description": "ListRateLimitPolicies returns rate-limit policies matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies" } } }, { "name": "GetRateLimitPolicy", "request": { "description": "GetRateLimitPolicy returns a single rate-limit policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "GetRateLimitPolicyAnalytics", "request": { "description": "GetRateLimitPolicyAnalytics computes a \"would-have-limited\" analytics\n preview for a MONITOR-action rate-limit policy (fraser#5446 pass 2, item\n 4.4 / ADR-036 R2 Option B): for each hour in the lookback window, it sums\n the policy's audience (the same scope resolution the min-clamp resolver\n uses -- key / tag / project / system) from the existing usage rollups\n (usage_hourly_rollups) and reports how many of those hours would have\n breached the policy's triplet ceiling, had the policy been enforced. This\n is NOT true shadow-mode enforcement (no per-request evaluation, no\n sub-hour granularity) -- it is a rollup-derived retrospective estimate,\n intended to help an operator decide whether flipping a MONITOR policy to\n BLOCK is safe (see the Flow-1 monitor->active flip, fraser#5448).\n Rejects a BLOCK-action policy's id with FailedPrecondition: a BLOCK\n policy is already actually enforced by the min-clamp resolver, so a\n retrospective \"would it have limited\" estimate is not meaningful for it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}", "analytics" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies/{{rate_limit_policy_id}}/analytics" } } }, { "name": "ListRequestAttributes", "request": { "description": "ListRequestAttributes returns the customer's routing vocabulary, ordered\n by name.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "request-attributes" ], "raw": "{{baseUrl}}/v1/policy/request-attributes" } } }, { "name": "GetRequestAttribute", "request": { "description": "GetRequestAttribute returns a single vocabulary entry by id, including\n the policies that reference it so a caller can tell whether deleting it\n would break a live rule.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "request-attributes", "{{request_attribute_id}}" ], "raw": "{{baseUrl}}/v1/policy/request-attributes/{{request_attribute_id}}" } } }, { "name": "ListTagSchema", "request": { "description": "ListTagSchema returns allowed tag key/value pairs matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "tag-schema" ], "raw": "{{baseUrl}}/v1/policy/tag-schema" } } }, { "name": "ListTrafficSplitPolicies", "request": { "description": "ListTrafficSplitPolicies returns traffic split policies matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/policy/traffic-split-policies" } } }, { "name": "GetTrafficSplitPolicy", "request": { "description": "GetTrafficSplitPolicy returns a single traffic split policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "ListUserGroups", "request": { "description": "ListUserGroups returns user groups matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups" ], "raw": "{{baseUrl}}/v1/policy/user-groups" } } }, { "name": "GetUserGroup", "request": { "description": "GetUserGroup returns a single user group by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/policy/user-groups/{{user_group_id}}" } } }, { "name": "ListUserGroupMembers", "request": { "description": "ListUserGroupMembers returns the users who belong to a group, ordered by\n name.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups", "{{user_group_id}}", "members" ], "raw": "{{baseUrl}}/v1/policy/user-groups/{{user_group_id}}/members" } } } ], "name": "agentrouter.policy.v1.PolicyService" }, { "item": [ { "name": "ListBindings", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings" ], "raw": "{{baseUrl}}/api/rbac/bindings" } } }, { "name": "CreateBinding", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"permissions\": [\n \"string\"\n ],\n \"principalId\": \"string\",\n \"principalType\": \"string\",\n \"roleId\": \"{{role_id}}\",\n \"scopeId\": \"string\",\n \"scopeType\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings" ], "raw": "{{baseUrl}}/api/rbac/bindings" } } }, { "name": "DeleteBinding", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings", "{{binding_id}}" ], "raw": "{{baseUrl}}/api/rbac/bindings/{{binding_id}}" } } }, { "name": "UpdateBinding", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"permissions\": [\n \"string\"\n ],\n \"roleId\": \"{{role_id}}\",\n \"scopeId\": \"string\",\n \"scopeType\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "bindings", "{{binding_id}}" ], "raw": "{{baseUrl}}/api/rbac/bindings/{{binding_id}}" } } }, { "name": "ListGroups", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups" ], "raw": "{{baseUrl}}/api/rbac/groups" } } }, { "name": "CreateGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups" ], "raw": "{{baseUrl}}/api/rbac/groups" } } }, { "name": "ListGroupMembers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups", "{{group_id}}", "members" ], "raw": "{{baseUrl}}/api/rbac/groups/{{group_id}}/members" } } }, { "name": "AddGroupMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups", "{{group_id}}", "members" ], "raw": "{{baseUrl}}/api/rbac/groups/{{group_id}}/members" } } }, { "name": "RemoveGroupMember", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "groups", "{{group_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/api/rbac/groups/{{group_id}}/members/{{user_id}}" } } }, { "name": "ListRoles", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles" ], "raw": "{{baseUrl}}/api/rbac/roles" } } }, { "name": "CreateRole", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"permissions\": [\n \"string\"\n ],\n \"scopeType\": \"string\",\n \"scopeTypes\": [\n \"string\"\n ],\n \"slug\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles" ], "raw": "{{baseUrl}}/api/rbac/roles" } } }, { "name": "DeleteRole", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles", "{{role_id}}" ], "raw": "{{baseUrl}}/api/rbac/roles/{{role_id}}" } } }, { "name": "UpdateRole", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"permissions\": [\n \"string\"\n ]\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "roles", "{{role_id}}" ], "raw": "{{baseUrl}}/api/rbac/roles/{{role_id}}" } } }, { "name": "GrantSuperAdmin", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "super-admins" ], "raw": "{{baseUrl}}/api/rbac/super-admins" } } }, { "name": "RevokeSuperAdmin", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "super-admins", "{{user_id}}" ], "raw": "{{baseUrl}}/api/rbac/super-admins/{{user_id}}" } } }, { "name": "DeleteTeamAccessGroup", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "teams", "{{team_id}}", "access-group" ], "raw": "{{baseUrl}}/api/rbac/teams/{{team_id}}/access-group" } } }, { "name": "GetTeamAccessGroup", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "teams", "{{team_id}}", "access-group" ], "raw": "{{baseUrl}}/api/rbac/teams/{{team_id}}/access-group" } } }, { "name": "EnsureTeamAccessGroup", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "api", "rbac", "teams", "{{team_id}}", "access-group" ], "raw": "{{baseUrl}}/api/rbac/teams/{{team_id}}/access-group" } } } ], "name": "agentrouter.rbac.v1.RbacService" }, { "item": [ { "name": "ListSecrets", "request": { "description": "ListSecrets lists all secrets for the authenticated user.\n Returns metadata only, not plaintext values.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets" ], "raw": "{{baseUrl}}/v1/secrets" } } }, { "name": "CreateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"realm\": \"string\",\n \"tags\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\",\n \"value\": \"string\"\n}" }, "description": "CreateSecret creates or updates a secret.\n If a secret with the same name exists, it will be updated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets" ], "raw": "{{baseUrl}}/v1/secrets" } } }, { "name": "DeleteSecret", "request": { "description": "DeleteSecret deletes a secret by name.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}" } } }, { "name": "GetSecret", "request": { "description": "GetSecret retrieves a secret by name.\n Returns metadata only, not the plaintext value.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}" } } }, { "name": "RotateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"newValue\": \"string\",\n \"realm\": \"string\"\n}" }, "description": "RotateSecret replaces a secret's encrypted value in place.\n The secret keeps its ID and remains active.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "rotate" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/rotate" } } }, { "name": "ValidateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"realm\": \"string\"\n}" }, "description": "ValidateSecret validates that a secret can be decrypted.\n Used for health checks and troubleshooting.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "validate" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/validate" } } }, { "name": "GetSecretValue", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"realm\": \"string\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "GetSecretValue retrieves the plaintext value of a secret.\n INTERNAL USE ONLY - This endpoint decrypts and returns the actual secret\n value. Should only be called by internal services (Liaison, Butler2, etc.)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "value" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/value" } } } ], "name": "agentrouter.secret.v1.SecretService" }, { "item": [ { "name": "ListTelemetryConfigs", "request": { "description": "ListTelemetryConfigs lists every configuration owned by the caller\n within the (customer, project) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry" } } }, { "name": "CreateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"endpoint\": \"https://example.com\",\n \"headers\": {\n \"key\": \"string\"\n },\n \"protocol\": \"string\",\n \"telemetryType\": \"string\"\n}" }, "description": "CreateTelemetryConfig creates a new OTel export configuration.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry" } } }, { "name": "GetProjectTelemetryConfig", "request": { "description": "GetProjectTelemetryConfig returns the PROJECT-level telemetry config.\n Project-owner-tier (the shared project default is managed by owners).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "project" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/project" } } }, { "name": "SetProjectTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"endpoint\": \"https://example.com\",\n \"protocol\": \"string\",\n \"telemetryType\": \"string\"\n}" }, "description": "SetProjectTelemetryConfig upserts the PROJECT-level telemetry export\n config (the shared default applied to project members who have no\n config of their own). Project-owner-tier: only the project's owner may\n set it. A user's own per-user config OVERRIDES this at emit time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "project" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/project" } } }, { "name": "DeleteTelemetryConfig", "request": { "description": "DeleteTelemetryConfig removes a configuration.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } }, { "name": "GetTelemetryConfig", "request": { "description": "GetTelemetryConfig returns a single configuration by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } }, { "name": "UpdateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": \"string\",\n \"endpoint\": \"https://example.com\",\n \"protocol\": \"string\",\n \"status\": \"string\"\n}" }, "description": "UpdateTelemetryConfig updates a configuration's mutable fields.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } } ], "name": "agentrouter.telemetry.v1.TelemetryService" }, { "item": [ { "name": "ListProjects", "request": { "description": "ListProjects lists projects within a customer scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects" } } }, { "name": "CreateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "CreateProject creates a project within a customer scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects" } } }, { "name": "ArchiveProject", "request": { "description": "ArchiveProject soft-deletes a project. Refuses to archive the\n default project, matching the existing admin.v1 behaviour.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "GetProject", "request": { "description": "GetProject returns a single project by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "UpdateProject updates mutable project fields.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectMembers", "request": { "description": "ListProjectMembers lists all members of a project and their roles.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "AddProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"identityId\": \"{{identity_id}}\",\n \"role\": \"string\"\n}" }, "description": "AddProjectMember grants an identity access to a project with the\n given role bundle.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "RemoveProjectMember", "request": { "description": "RemoveProjectMember revokes an identity's membership in a project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{identity_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{identity_id}}" } } }, { "name": "UpdateProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"string\"\n}" }, "description": "UpdateProjectMember updates an existing project member's role.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{identity_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{identity_id}}" } } } ], "name": "agentrouter.tenancy.v1.ProjectsService" }, { "item": [ { "name": "ListCustomers", "request": { "description": "ListCustomers lists all customers visible to the caller.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers" ], "raw": "{{baseUrl}}/v1/customers" } } }, { "name": "CreateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "CreateCustomer creates a new customer record. A customer owns\n projects, identities, and billing. Typically called once during\n provisioning of a new tenant.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers" ], "raw": "{{baseUrl}}/v1/customers" } } }, { "name": "ArchiveCustomer", "request": { "description": "ArchiveCustomer soft-deletes a customer. The row stays in the\n database with deleted_at set; future Get / List calls treat it as\n missing.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomer", "request": { "description": "GetCustomer returns a single customer by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } }, { "name": "UpdateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "UpdateCustomer updates mutable customer fields (display_name,\n description, labels). `customer_id` is immutable.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } } ], "name": "agentrouter.tenancy.v1.TenancyService" } ], "variable": [ { "key": "baseUrl", "type": "string", "value": "https://api.agentrouter.example" }, { "key": "apiKey", "type": "string", "value": "" }, { "key": "aikey_id", "type": "string", "value": "example-aikey-id" }, { "key": "api_key_id", "type": "string", "value": "example-api-key-id" }, { "key": "attribute_routing_policy_id", "type": "string", "value": "example-attribute-routing-policy-id" }, { "key": "binding_id", "type": "string", "value": "example-binding-id" }, { "key": "budget_alert_id", "type": "string", "value": "example-budget-alert-id" }, { "key": "budget_policy_id", "type": "string", "value": "example-budget-policy-id" }, { "key": "client_id", "type": "string", "value": "example-client-id" }, { "key": "config_id", "type": "string", "value": "example-config-id" }, { "key": "customer_id", "type": "string", "value": "example-customer-id" }, { "key": "dataplane_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "fallback_chain_policy_id", "type": "string", "value": "example-fallback-chain-policy-id" }, { "key": "fallback_chain_policy_target_key_id", "type": "string", "value": "example-fallback-chain-policy-target-key-id" }, { "key": "fallback_policy_target_key_id", "type": "string", "value": "example-fallback-policy-target-key-id" }, { "key": "group_id", "type": "string", "value": "example-group-id" }, { "key": "guardrail_id", "type": "string", "value": "example-guardrail-id" }, { "key": "identity_id", "type": "string", "value": "example-identity-id" }, { "key": "key_id", "type": "string", "value": "example-key-id" }, { "key": "key_version", "type": "string", "value": "1" }, { "key": "log_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "mcp_oauth_client_id", "type": "string", "value": "example-mcp-oauth-client-id" }, { "key": "metric", "type": "string", "value": "requests" }, { "key": "model_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "pattern_id", "type": "string", "value": "example-pattern-id" }, { "key": "profile_id", "type": "string", "value": "example-profile-id" }, { "key": "project_gateway_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "project_id", "type": "string", "value": "example-project-id" }, { "key": "provider_id", "type": "string", "value": "example-provider-id" }, { "key": "provider_name", "type": "string", "value": "example-provider-name" }, { "key": "rate_limit_policy_id", "type": "string", "value": "example-rate-limit-policy-id" }, { "key": "raw_metric_name", "type": "string", "value": "example-raw-metric-name" }, { "key": "request_attribute_id", "type": "string", "value": "example-request-attribute-id" }, { "key": "request_id", "type": "string", "value": "example-request-id" }, { "key": "role_id", "type": "string", "value": "example-role-id" }, { "key": "rule_id", "type": "string", "value": "example-rule-id" }, { "key": "secret_name", "type": "string", "value": "example-secret-name" }, { "key": "server_id", "type": "string", "value": "example-server-id" }, { "key": "service_account_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "setting_name", "type": "string", "value": "global-fallback" }, { "key": "system_setting_key", "type": "string", "value": "example-system-setting-key" }, { "key": "tag_id", "type": "string", "value": "example-tag-id" }, { "key": "tag_schema_id", "type": "string", "value": "example-tag-schema-id" }, { "key": "target_key_id", "type": "string", "value": "example-target-key-id" }, { "key": "team_id", "type": "string", "value": "example-team-id" }, { "key": "telemetry_config_id", "type": "string", "value": "example-telemetry-config-id" }, { "key": "traffic_split_policy_id", "type": "string", "value": "example-traffic-split-policy-id" }, { "key": "trigger_id", "type": "string", "value": "example-trigger-id" }, { "key": "user_group_id", "type": "string", "value": "example-user-group-id" }, { "key": "user_id", "type": "string", "value": "example-user-id" }, { "key": "user_token_jti", "type": "string", "value": "example-user-token-jti" }, { "key": "workspace_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" } ] }