{ "info": { "_postman_id": "agentrouter-api-0.3.0", "description": "AgentRouter API requests, generated from the combined OpenAPI spec by scripts/sdk-package.sh. Set the baseUrl and apiKey collection variables before sending.", "name": "AgentRouter API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "item": [ { "name": "ListAuditCheckpoints", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"afterSeq\": 0,\n \"limit\": 0,\n \"rebuild\": false\n}" }, "description": "List signed Merkle checkpoints (fraser#4599) for chain verification: each\n checkpoint's prev_root chains to the previous and its signature covers the\n root. Ordered by seq ascending, starting strictly after after_seq.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "checkpoints:list" ], "raw": "{{baseUrl}}/admin/v1/audit/checkpoints:list" } } }, { "name": "GetAuditInclusionProof", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"auditLogId\": \"string\"\n}" }, "description": "Return the Merkle inclusion proof for an audit_logs row: its leaf hash and\n audit path recomputed from current content, plus the signed checkpoint it\n belongs to, so a verifier can confirm the row is committed to a signed root.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "inclusion-proof" ], "raw": "{{baseUrl}}/admin/v1/audit/inclusion-proof" } } }, { "name": "GetAuditLog", "request": { "description": "Get a single audit_logs entry by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "logs", "{{log_id}}" ], "raw": "{{baseUrl}}/admin/v1/audit/logs/{{log_id}}" } } }, { "name": "QueryAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "Query stored audit_logs entries with filtering and pagination. The read\n complement to the SIEM forwarder (which only exports) and the checkpoint\n verification RPCs (which only prove tamper-evidence): list and inspect\n entries over the API instead of standing up a SIEM.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/audit/logs:query" } } }, { "name": "ListCatalogModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "models" ], "raw": "{{baseUrl}}/admin/v1/catalog/models" } } }, { "name": "ListCatalogProviders", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/admin/v1/catalog/providers" } } }, { "name": "ListCustomers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers" ], "raw": "{{baseUrl}}/admin/v1/customers" } } }, { "name": "CreateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers" ], "raw": "{{baseUrl}}/admin/v1/customers" } } }, { "name": "DeleteCustomer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "UpdateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}" } } }, { "name": "ResolvePendingProjectMemberships", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "ResolvePendingProjectMemberships materializes every pending email-keyed grant\n for (customer_id, email) into real project_members rows for user_id, then\n clears the resolved pending rows (#6119). Idempotent and cheap to call on\n every login: with no pending rows it is a no-op.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "pending-members:resolve" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/pending-members:resolve" } } }, { "name": "ListProjects", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects" } } }, { "name": "CreateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects" } } }, { "name": "DeleteProject", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "GetProject", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"publicEndpointUrl\": \"https://example.com\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectGatewayMembers", "request": { "description": "List a project's member gateways with their membership state (D1\n multi-gateway projects, fraser#5987 / ADR 052).\n\n This is the fleet-consistency primitive (epic tetrate-ai-platform#2865,\n gate amendment 6): for every member it reports the membership state\n machine position (syncing / ready / detached_zeroized /\n detached_unreachable), the member's last-acked config version vs. the\n project's head config version for that member, health (tri-state:\n unknown is a valid answer), last-seen, and the state timestamps. The\n shape is deliberately reusable by future consumers (D3 T1 steering,\n fleet-upgrade tooling): \"is this fleet converged on config head?\" is\n answerable per member from status + config_version + head_config_version\n alone.\n\n A member is advertised as `ready` ONLY under confirmed convergence: every\n per-gateway config slot acked by the data plane at its current version,\n PLUS the member workspace's shared PROXY (authz-map) slot when one exists\n (an absent workspace slot passes vacuously — the slot is minted on first\n authz-map generation). Because that PROXY slot is shared by every gateway\n in the workspace, a bump to it flips ALL of the workspace's members back\n to `syncing` until the new map version is acked — cross-member flap on\n workspace-slot bumps is expected behavior, not a defect. A\n previously-ready member whose project config moved ahead reports\n `syncing` again until the new head is acked. The `config_version` /\n `head_config_version` columns stay scoped to the member's own per-gateway\n slots (gateway family only): the workspace PROXY slot participates in the\n READY predicate but never in the version columns.\n\n Although marked NO_SIDE_EFFECTS, this read performs idempotent ledger\n reconciliation: attachments that predate the membership ledger are\n backfilled insert-only (a detached record is never reset by a list; only\n the Attach RPC does that). A legacy attachment backfilled this way gets a\n fabricated `attached_at` equal to the first list's server time — its true\n attach time was never recorded.\n\n A project with ZERO member gateways is fully valid: the response carries\n an empty members list (and whatever detached history exists), never an\n error.\n\n Responses carry NO credential material (gate amendment 5): identity,\n state, versions, and timestamps only.\n\n Enterprise only: on SaaS deployments (DEPLOYMENT_PRODUCT=saas) this RPC\n fails with UNIMPLEMENTED — the multi-gateway surface does not exist\n there (the existing attach/detach RPCs remain, capped at one gateway per\n project).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "gateway-members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/gateway-members" } } }, { "name": "ListProjectMcpServers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers" } } }, { "name": "AddProjectMcpServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"serverId\": \"{{server_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers" } } }, { "name": "RemoveProjectMcpServer", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-servers", "{{server_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-servers/{{server_id}}" } } }, { "name": "TriggerProjectMcp", "request": { "description": "TriggerProjectMcp (re)materializes the per-Project-Gateway MCP config for\n every gateway the (customer_id, project_id) is attached to. The dashboard\n MCP profile mutation path calls this after a profile create/update/delete so\n a freshly-created profile enters its project gateways' MCP_PROFILE config;\n without it the per-gateway config-gen never re-runs and /mcp/ 404s\n on a strict-isolation gateway DP. Best-effort + dormant when the project has\n no gateways.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp:trigger" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp:trigger" } } }, { "name": "ListProjectMembers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "AddProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"admin\",\n \"userId\": \"{{user_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "RemoveProjectMember", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{user_id}}" } } }, { "name": "UpdateProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"admin\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{user_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{user_id}}" } } }, { "name": "ListProjectModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "AddProjectModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelId\": \"{{model_id}}\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "RemoveProjectModel", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/models/{{model_id}}" } } }, { "name": "EnsureAdminProjectMembership", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"role\": \"admin\"\n}" }, "description": "EnsureAdminProjectMembership records the intent to grant an email a role on\n a project (#6119). At onboarding/provisioning time the target identity row\n usually does not exist yet (SSO users are created lazily at first login), so\n the grant is parked by email and materialized at first login via\n ResolvePendingProjectMemberships. If the identity already exists the grant is\n written straight to project_members instead. Idempotent.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "pending-members" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/pending-members" } } }, { "name": "ListProjectProviders", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers" } } }, { "name": "AddProjectProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"providerName\": \"example-name\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers" } } }, { "name": "RemoveProjectProvider", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "providers", "{{provider_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/providers/{{provider_name}}" } } }, { "name": "GetProjectSettings", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings" } } }, { "name": "DeleteProjectSetting", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings", "{{setting_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings/{{setting_name}}" } } }, { "name": "UpsertProjectSetting", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"settingValue\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "settings", "{{setting_name}}" ], "raw": "{{baseUrl}}/admin/v1/customers/{{customer_id}}/projects/{{project_id}}/settings/{{setting_name}}" } } }, { "name": "ListDataplanes", "request": { "description": "List data planes.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/dataplanes" } } }, { "name": "CreateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"dataplaneId\": \"{{dataplane_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Register a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes" ], "raw": "{{baseUrl}}/admin/v1/dataplanes" } } }, { "name": "DeleteDataplane", "request": { "description": "Delete a data plane (soft delete).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "GetDataplane", "request": { "description": "Get a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "UpdateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"autoUpgrade\": false,\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "description": "Update a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}" } } }, { "name": "SetDataplaneProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Assign a data plane to a project (omit project_id to clear to default).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "project" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/project" } } }, { "name": "SetDataplaneURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing advertised URL for a data plane.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "dataplanes", "{{dataplane_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/dataplanes/{{dataplane_id}}/url" } } }, { "name": "ListMcpCatalogServers", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/admin/v1/mcp/catalog/servers" } } }, { "name": "ListModels", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models" ], "raw": "{{baseUrl}}/admin/v1/models" } } }, { "name": "GetModel", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/admin/v1/models/{{model_id}}" } } }, { "name": "Ping", "request": { "description": "Ping endpoint for health checks and authentication testing", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "ping" ], "raw": "{{baseUrl}}/admin/v1/ping" } } }, { "name": "QueryPlatformAuditLogs", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"actionType\": \"string\",\n \"actorType\": \"string\",\n \"correlationId\": \"string\",\n \"endTime\": \"2023-01-15T01:30:15.01Z\",\n \"includeStats\": false,\n \"orderDirection\": \"string\",\n \"pageSize\": 0,\n \"pageToken\": \"example-token\",\n \"resourceId\": \"string\",\n \"resourceType\": \"string\",\n \"startTime\": \"2023-01-15T01:30:15.01Z\",\n \"success\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "QueryPlatformAuditLogs is QueryAuditLogs gated on the platform admin scope\n instead of audit_logs_reader, so platform integrations that hold only the\n provisioned admin key (e.g. the IDP customer-configuration views, #6024)\n can read audit logs. This deliberately widens the #4890 separation-of-duties\n posture — every admin-scoped key gains cross-tenant audit read — in exchange\n for not having to re-issue provisioned keys with an extra scope. Same\n request/response as QueryAuditLogs.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "platform", "audit", "logs:query" ], "raw": "{{baseUrl}}/admin/v1/platform/audit/logs:query" } } }, { "name": "ListProjectGateways", "request": { "description": "List project gateways (optionally filtered by customer, workspace, and/or\n attached project). Each returned gateway carries its attached project slugs\n in `attached_project_ids`, so reading gateway<->project attachments in bulk\n is ONE paginated request, not one ListProjectGatewayProjects call per\n gateway (#5591).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways" ], "raw": "{{baseUrl}}/admin/v1/project-gateways" } } }, { "name": "CreateProjectGateway", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectGatewayId\": \"{{project_gateway_id}}\",\n \"url\": \"https://example.com\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways" ], "raw": "{{baseUrl}}/admin/v1/project-gateways" } } }, { "name": "DeleteProjectGateway", "request": { "description": "Delete project gateway (soft delete)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "GetProjectGateway", "request": { "description": "Get project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "UpdateProjectGateway", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"url\": \"https://example.com\"\n}" }, "description": "Update project gateway", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}" } } }, { "name": "ListProjectGatewayProjects", "request": { "description": "List the project slugs attached to a project gateway.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects" } } }, { "name": "AttachProjectGatewayProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Attach a project to a project gateway (idempotent). Establishes a\n gateway<->project binding in the many-to-many project_gateway_projects\n relationship.\n\n A project gateway may host only ONE project: attaching a second, different\n project is rejected (detach the current project first). Re-attaching the\n same project is a no-op.\n\n Ensure the attached project has assigned models BEFORE setting the\n gateway's URL: under strict isolation a gateway with no assigned models\n serves an EMPTY route map and will return 404 for every request. The\n response carries any such warnings in the `warnings` field.\n\n Multi-gateway projects (fraser#5987): a project may be attached to\n multiple gateways, capped per project (PROJECT_GATEWAY_CAP, default 10 on\n Enterprise; 1 on SaaS) — attaching beyond the cap is rejected with\n RESOURCE_EXHAUSTED (the cap is a quota, not a name collision;\n ALREADY_EXISTS stays reserved for hostname/slug uniqueness conflicts).\n The cap is a SOFT limit: the check is not atomic with the insert, so two\n concurrent attaches can both pass it and overshoot the cap by one.\n Attaching a gateway whose slug is shared with another live gateway is\n rejected with FAILED_PRECONDITION (rename or delete the sibling first).\n A successful attach starts the membership in the `syncing` state; see\n ListProjectGatewayMembers for the state machine.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects" } } }, { "name": "DetachProjectGatewayProject", "request": { "description": "Detach a project from a project gateway.\n\n Detach pushes a final zeroized config revision to the member (best-effort,\n DP-initiated polling) and revokes MP-side access as the authoritative\n backstop, so the membership lands in `detached_unreachable` until the data\n plane acknowledges the zero revision (then `detached_zeroized`). Detaching\n a project that is not attached is an idempotent no-op (success=false, no\n error). See ListProjectGatewayMembers for the state machine.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/projects/{{project_id}}" } } }, { "name": "SetProjectGatewayURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\",\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing URL/hostname for a project gateway.\n\n The hostname (host part of the URL) must be globally UNIQUE across all\n project gateways in the platform; setting a hostname already bound to a\n different gateway is rejected with ALREADY_EXISTS.\n\n Behavior change (strict isolation): once any gateway in a data plane's\n workspace has its URL set, that data plane serves ONLY per-gateway\n host-scoped routes -- the default all-models route is suppressed, so\n clients must call the gateway hostname rather than the workspace's shared\n URL.\n\n Best practice: attach a project and assign its models BEFORE setting the\n URL. Setting a URL on a gateway with no attached project (or whose project\n has no assigned models) makes the gateway reachable but it will return 404\n for every request until a project with assigned models is attached. The\n response surfaces any such condition in the `warnings` field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/url" } } }, { "name": "SetProjectGatewayWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Reassign a project gateway to a different dataplane (workspace).\n\n A data plane serves ONLY the hostnames of project gateways whose\n workspace_id matches its own (via per-gateway host-scoped routes plus the\n P10 authz map). Moving a gateway is therefore NOT a bare DB flip: this RPC\n tears down the gateway's per-gateway routes + authz binding on the OLD data\n plane and materializes them on the NEW one, refreshing both workspaces'\n authz maps and default-route suppression.\n\n The gateway's hostname is unchanged, so DNS is NOT moved automatically: the\n hostname still resolves to the OLD data plane's ingress until an operator\n repoints it. Until that cutover, requests to the hostname hit the old data\n plane (now torn down) and 404. The response ALWAYS includes a `warnings`\n entry reminding the operator to repoint DNS (and provision the new data\n plane's TLS cert). Recommended order: provision the new data plane's\n DNS/cert, call this RPC, then cut DNS over.\n\n Reassigning to the gateway's current workspace is a no-op. The new\n workspace must exist for the gateway's customer, and the gateway's slug\n must be free in the new workspace (a collision is rejected with\n ALREADY_EXISTS).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "project-gateways", "{{project_gateway_id}}", "workspace" ], "raw": "{{baseUrl}}/admin/v1/project-gateways/{{project_gateway_id}}/workspace" } } }, { "name": "ListServiceAccounts", "request": { "description": "List service accounts", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts" ], "raw": "{{baseUrl}}/admin/v1/service-accounts" } } }, { "name": "CreateServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiUri\": \"https://example.com\",\n \"audience\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"internalApiKey\": \"example-value\",\n \"issuer\": \"https://example.com\",\n \"jwksUri\": \"https://example.com\",\n \"roles\": [\n \"string\"\n ],\n \"routerKey\": \"example-value\",\n \"routerUrl\": \"https://example.com\",\n \"scopes\": [\n \"string\"\n ],\n \"serveUrl\": \"https://example.com\",\n \"telemetryEndpoint\": \"https://example.com\",\n \"telemetryHeaders\": {\n \"key\": \"string\"\n },\n \"telemetryInsecure\": false,\n \"telemetryLocalVars\": {\n \"key\": \"string\"\n },\n \"telemetryProtocol\": \"\",\n \"telemetryTimeout\": \"30s\",\n \"validityDays\": 1,\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts" ], "raw": "{{baseUrl}}/admin/v1/service-accounts" } } }, { "name": "GetServiceAccount", "request": { "description": "Get service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}" } } }, { "name": "RestoreServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Restore service account\n Restores a revoked service account to active status.\n Only one active service account per customer_id + workspace_id is allowed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}:restore" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}:restore" } } }, { "name": "RevokeServiceAccount", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\"\n}" }, "description": "Revoke service account", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "service-accounts", "{{service_account_id}}:revoke" ], "raw": "{{baseUrl}}/admin/v1/service-accounts/{{service_account_id}}:revoke" } } }, { "name": "GetSystemSetting", "request": { "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "UpsertSystemSetting", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"ifAbsent\": false,\n \"value\": \"string\"\n}" }, "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "system-settings", "{{system_setting_key}}" ], "raw": "{{baseUrl}}/admin/v1/system-settings/{{system_setting_key}}" } } }, { "name": "ListTelemetryConfigs", "request": { "description": "List telemetry configs", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs" } } }, { "name": "CreateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"none\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"forwardIntervalSeconds\": 0,\n \"protocol\": \"grpc\",\n \"sinkUrl\": \"https://example.com\",\n \"telemetryType\": \"traces\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "Create telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs" } } }, { "name": "TestAuditForward", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"owner\": \"string\",\n \"protocol\": \"string\",\n \"sinkUrl\": \"https://example.com\"\n}" }, "description": "Test an audit-log SIEM sink by sending a synthetic OTLP-Logs record via the\n same path the forwarder uses (POST /v1/logs with the resolved auth). Proves\n the actual log endpoint + auth, unlike the trace-based bellhop tester.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "test-forward" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/test-forward" } } }, { "name": "TriggerAuditForward", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"owner\": \"string\"\n}" }, "description": "Trigger an immediate audit-log forward run (real-time push). The management\n plane kicks the in-process forwarder; the cron ticker is the backstop.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "trigger-forward" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/trigger-forward" } } }, { "name": "DeleteTelemetryConfig", "request": { "description": "Delete telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "GetTelemetryConfig", "request": { "description": "Get telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "UpdateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"none\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"forwardIntervalSeconds\": 0,\n \"protocol\": \"grpc\",\n \"sinkUrl\": \"https://example.com\",\n \"status\": \"connected\"\n}" }, "description": "Update telemetry config", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "telemetry-configs", "{{telemetry_config_id}}" ], "raw": "{{baseUrl}}/admin/v1/telemetry-configs/{{telemetry_config_id}}" } } }, { "name": "ListUserTokens", "request": { "description": "List user tokens", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens" ], "raw": "{{baseUrl}}/admin/v1/user-tokens" } } }, { "name": "CreateUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"expiresInDays\": 1,\n \"impersonate\": false,\n \"impersonationMetadata\": {\n \"context\": {\n \"key\": \"string\"\n },\n \"impersonatorKey\": \"example-value\",\n \"reason\": \"string\"\n },\n \"name\": \"example-name\",\n \"organizationUnit\": \"string\",\n \"projectId\": \"{{project_id}}\",\n \"role\": \"string\",\n \"scopes\": [\n \"string\"\n ],\n \"userId\": \"{{user_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create user token\n Generates a JWT token for user authentication with gatekeeper.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens" ], "raw": "{{baseUrl}}/admin/v1/user-tokens" } } }, { "name": "GetUserToken", "request": { "description": "Get user token", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens", "{{user_token_jti}}" ], "raw": "{{baseUrl}}/admin/v1/user-tokens/{{user_token_jti}}" } } }, { "name": "RevokeUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"reason\": \"string\"\n}" }, "description": "Revoke user token\n Revokes a user token by its JTI (JWT ID).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "user-tokens", "{{user_token_jti}}:revoke" ], "raw": "{{baseUrl}}/admin/v1/user-tokens/{{user_token_jti}}:revoke" } } }, { "name": "ListWorkspaces", "request": { "description": "List workspaces", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces" ], "raw": "{{baseUrl}}/admin/v1/workspaces" } } }, { "name": "CreateWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "Create workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces" ], "raw": "{{baseUrl}}/admin/v1/workspaces" } } }, { "name": "DeleteWorkspace", "request": { "description": "Delete workspace (soft delete)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "GetWorkspace", "request": { "description": "Get workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "UpdateWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"autoUpgrade\": false,\n \"description\": \"Example description\",\n \"labels\": {\n \"key\": \"string\"\n },\n \"name\": \"example-name\"\n}" }, "description": "Update workspace", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}" } } }, { "name": "SetWorkspaceProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "Assign workspace to a project (or clear back to default project by omitting project_id)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}", "project" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}/project" } } }, { "name": "SetWorkspaceURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "Set the customer-facing gateway URL for a workspace data plane.\n Writes system_settings.dataplane-url: and optionally fires a PROXY_URL config event.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "admin", "v1", "workspaces", "{{workspace_id}}", "url" ], "raw": "{{baseUrl}}/admin/v1/workspaces/{{workspace_id}}/url" } } } ], "name": "agentrouter.admin.v1.AdminService" }, { "item": [ { "name": "List", "request": { "description": "List lists BYOK keys registered under a project. Returns metadata\n only -- id, provider, name, display_suffix, creation timestamp, and\n revocation timestamp if revoked. The result includes the project's\n shared keys plus the caller's own user-scoped keys (other users'\n user-scoped keys are not returned).\n\n Scope: account-tier; membership is enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys" } } }, { "name": "Register", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"name\": \"example-name\",\n \"provider\": \"PROVIDER_OPENAI\",\n \"secret\": \"example-value\",\n \"userScope\": false\n}" }, "description": "Register encrypts and stores a provider API key under a project.\n After this call, inference requests routed to the matching provider\n for this project will use this key.\n\n Scope: account-tier so any project member can register their OWN\n user-scoped key (user_scope=true). Registering a PROJECT-level key\n (user_scope=false) additionally requires the caller to be the\n project's owner -- enforced in-handler against project_members.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys" } } }, { "name": "Revoke", "request": { "description": "Revoke marks the key revoked; subsequent Fetches return\n permission_denied. Inflight cached keys on dataplanes invalidate\n within sub-second via the revocation channel (milestone C).\n\n Scope: account-tier so a member can revoke their OWN user-scoped key.\n Revoking a PROJECT-level key additionally requires project ownership\n (enforced in-handler); a member may never revoke another user's\n user-scoped key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys", "{{aikey_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys/{{aikey_id}}" } } }, { "name": "Get", "request": { "description": "Get returns the metadata record for a single BYOK key. Never returns\n the plaintext.\n\n Scope: account-tier. Any project member may read keys in the project\n (project-level and the caller's own user-scoped keys); membership is\n enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys", "{{aikey_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys/{{aikey_id}}" } } }, { "name": "GetTrafficSettings", "request": { "description": "GetTrafficSettings returns the BYOK traffic pool for one provider in a\n project: every key the caller's own inference traffic can be served by,\n with its stored traffic_weight / traffic_order / traffic_preference.\n\n The pool is the UNION the route generator actually builds for the caller\n (materializedBYOKKeys): the caller's legacy per-user keys plus the\n project's effective keys for the provider (the caller's own user-scoped\n keys when they have any, otherwise the project-level keys). Revoked rows\n are excluded -- they have no dataplane backend, so they must neither\n absorb a share of a split nor appear in a failover ladder.\n\n Scope: account-tier; membership is enforced in-handler.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys:traffic" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys:traffic" } } }, { "name": "UpdateTrafficSettings", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"preference\": \"string\",\n \"provider\": \"PROVIDER_OPENAI\",\n \"settings\": [\n {\n \"keyId\": \"{{key_id}}\",\n \"order\": 0,\n \"weight\": 0\n }\n ]\n}" }, "description": "UpdateTrafficSettings rewrites the placement of keys in one provider's\n BYOK pool -- the load-balance weights, the failover order, and the\n pool-wide usage preference.\n\n Only rows the caller OWNS are writable: a shared project key another\n member registered is returned by GetTrafficSettings (it serves the\n caller's traffic) but naming it here is rejected rather than silently\n dropped. Rows the request does not name keep their current placement.\n\n Scope: account-tier; membership is enforced in-handler, and rewriting a\n PROJECT-level (shared) key additionally requires project ownership --\n the same split Register and Revoke apply.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "aikeys:traffic" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/aikeys:traffic" } } } ], "name": "agentrouter.aikeys.v1.AiKeysService" }, { "item": [ { "name": "ListApiKeys", "request": { "description": "ListApiKeys returns the platform-wide API-key directory, including\n soft-deleted keys needed for historical spend attribution.\n It is intentionally restricted to platform admin keys; customer-scoped\n org admins are not elevated for this collection-wide operation.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys" ], "raw": "{{baseUrl}}/v1/api-keys" } } }, { "name": "CreateApiKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"name\": \"example-name\",\n \"userId\": \"{{user_id}}\",\n \"userKeyAddress\": \"example-value\"\n}" }, "description": "CreateApiKey creates a new JWT user-token API key for a user and returns the plaintext token exactly once.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys" ], "raw": "{{baseUrl}}/v1/api-keys" } } }, { "name": "DeleteApiKey", "request": { "description": "DeleteApiKey soft-deletes an API key (sets deleted_at).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/api-keys/{{key_id}}" } } }, { "name": "UpdateApiKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"isActive\": false,\n \"name\": \"example-name\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "UpdateApiKey updates mutable fields of an API key (name and/or active state).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "api-keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/api-keys/{{key_id}}" } } } ], "name": "agentrouter.api_keys.v1.ApiKeysService" }, { "item": [ { "name": "GetJWKS", "request": { "description": "JWKS endpoint.\n Public endpoint - no authentication required.\n Returns JSON Web Key Set for verifying JWT tokens.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ ".well-known", "jwks.json" ], "raw": "{{baseUrl}}/.well-known/jwks.json" } } } ], "name": "agentrouter.auth.v1.AuthService" }, { "item": [ { "name": "ListModels", "request": { "description": "ListModels returns catalog models, optionally filtered to a single\n provider via the provider_id query parameter.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models" ], "raw": "{{baseUrl}}/v1/catalog/models" } } }, { "name": "UpsertModel", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"additionalPricePerMillion\": {\n \"key\": 0\n },\n \"backendUrls\": [\n \"https://example.com\"\n ],\n \"cacheReadPerMillion\": \"string\",\n \"cachingPerMillion\": \"string\",\n \"capabilities\": [\n \"string\"\n ],\n \"inputModalities\": [\n \"string\"\n ],\n \"inputPerMillion\": \"string\",\n \"isEnabled\": false,\n \"limits\": {\n \"key\": 0\n },\n \"maxContextTokens\": 0,\n \"maxCostPerRequest\": \"string\",\n \"metadata\": {\n \"key\": 0\n },\n \"mode\": \"string\",\n \"name\": \"example-name\",\n \"outputModalities\": [\n \"string\"\n ],\n \"outputPerMillion\": \"string\",\n \"providerId\": \"{{provider_id}}\",\n \"suppressRouteRegen\": false,\n \"upstreamModel\": \"string\"\n}" }, "description": "UpsertModel creates or fully replaces a model record.\n\n The provider must already exist (FAILED_PRECONDITION otherwise), and\n must be enabled if this model is going to be enabled -- an enabled\n model under a disabled provider could never become routable, yet\n would read as available. Writing an explicitly DISABLED model under a\n disabled provider is allowed: neither appears in any route map, so\n nothing is misrepresented, and it is how a catalog sync stages a\n provider's models before an operator turns the provider on.\n\n A successful write propagates to the gateway automatically\n (no separate publish step): the model appears in the data plane's\n /v1/models and becomes promptable once the refreshed configuration\n lands. Poll /v1/models to confirm. The exception is\n `suppress_route_regen`, which defers that propagation to the\n caller's own configurator.TriggerUpdate.\n\n `is_enabled` is tri-state: omit it and the stored value is left\n alone, so a model an operator disabled is not silently re-enabled by\n a later write. A new model defaults to enabled.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models" ], "raw": "{{baseUrl}}/v1/catalog/models" } } }, { "name": "DeleteModel", "request": { "description": "DeleteModel removes a model entry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/catalog/models/{{model_id}}" } } }, { "name": "GetModel", "request": { "description": "GetModel returns a single model by id (UUID) or by unique model name,\n including its pricing, context window, capabilities, modalities, and limits.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/catalog/models/{{model_id}}" } } }, { "name": "ListProviders", "request": { "description": "ListProviders returns all registered AI providers. Supports\n cursor-based pagination via page_size and page_token.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/catalog/providers" } } }, { "name": "UpsertProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"baseUrl\": \"https://example.com\",\n \"displayName\": \"example-name\",\n \"id\": \"string\",\n \"isEnabled\": false,\n \"metadata\": {\n \"key\": 0\n },\n \"supportedAuthSchemes\": [\n \"string\"\n ],\n \"suppressRouteRegen\": false\n}" }, "description": "UpsertProvider creates or fully replaces a provider record.\n\n `is_enabled` is tri-state: omit it and the stored value is left\n alone (a provider an operator disabled stays disabled). A new\n provider defaults to disabled -- the data plane does not reconcile\n an AIServiceBackend or fetch credentials for it until it is both\n enabled and credentialed via SetProviderCredential.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers" ], "raw": "{{baseUrl}}/v1/catalog/providers" } } }, { "name": "DeleteProvider", "request": { "description": "DeleteProvider removes a provider, along with the project assignments that\n granted access to it. Refuses while any model still references it, while any\n BYOK API key is registered against it (revoke those keys first), or when it\n is the only provider assigned to a project that still has models assigned.\n On success, any revoked BYOK keys for this provider and their stored secrets\n are permanently removed, and the provider's own stored credential is retired.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}" } } }, { "name": "GetProvider", "request": { "description": "GetProvider returns a single provider by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}" } } }, { "name": "SetProviderCredential", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"credential\": \"string\"\n}" }, "description": "SetProviderCredential stores or rotates the credential used to\n authenticate requests to this provider. The plaintext is never\n returned; the provider's credential_suffix reflects the last 4\n characters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "catalog", "providers", "{{provider_id}}", "credential" ], "raw": "{{baseUrl}}/v1/catalog/providers/{{provider_id}}/credential" } } }, { "name": "ListProjectModels", "request": { "description": "ListProjectModels returns every catalog model assigned to a project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "AssignModelToProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"modelId\": \"{{model_id}}\"\n}" }, "description": "AssignModelToProject grants a project access to a catalog model.\n Idempotent: re-assigning a model is a no-op.\n\n The model's provider must be enabled (FAILED_PRECONDITION otherwise) --\n a model under a disabled provider is absent from the route map and could\n not be served.\n\n Propagates automatically to any Project Gateway attached to the\n project (per-gateway route maps serve only assigned models); no\n separate publish step is needed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models" } } }, { "name": "UnassignModelFromProject", "request": { "description": "UnassignModelFromProject removes a project's access to a catalog model.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "models", "{{model_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/models/{{model_id}}" } } } ], "name": "agentrouter.catalog.v1.CatalogService" }, { "item": [ { "name": "ListClients", "request": { "description": "ListClients returns every client owned by the caller within the\n given (customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients" } } }, { "name": "CreateClientWithKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"keyName\": \"example-name\",\n \"title\": \"string\"\n}" }, "description": "CreateClientWithKey creates a new client and a new API key attached\n 1:1 (client_id == key_id at bootstrap).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients" } } }, { "name": "GetClient", "request": { "description": "GetClient returns a single client by id within the scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "UpdateClientTitle", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"title\": \"string\"\n}" }, "description": "UpdateClientTitle updates the editable client title.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}" } } }, { "name": "AddKeyToClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"keyId\": \"{{key_id}}\"\n}" }, "description": "AddKeyToClient attaches an existing key to a client. A key still in the\n default project is moved into the client's project.\n\n Fails with FAILED_PRECONDITION when the key would leave a client that\n other keys stay in and whose per-key budget is active: that budget\n sums the client's current keys, so the move would carry the key's\n accrued spend out of it. Deactivate the budget first, then attach.\n\n Fails with ALREADY_EXISTS when the key carries its own per-key budget\n and the client already holds an active one at the same intent: a\n standalone key's budget moves with it, and two cannot govern one\n client. The attachment is rolled back with it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys" } } }, { "name": "RotateKeyInClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"destroyAfter\": \"string\",\n \"disableAfter\": \"string\",\n \"enterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"keyName\": \"example-name\",\n \"oldKeyDestroyAt\": \"2023-01-15T01:30:15.01Z\",\n \"oldKeyDisableAt\": \"2023-01-15T01:30:15.01Z\",\n \"oldKeyId\": \"example-value\",\n \"userKeyAddress\": \"example-value\"\n}" }, "description": "RotateKeyInClient creates a new key attached to client_id and may\n schedule the prior key's disable/destroy lifecycle.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "rotate" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/rotate" } } }, { "name": "DestroyKeyVersionInClient", "request": { "description": "DestroyKeyVersionInClient permanently destroys a key version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}" } } }, { "name": "DisableKeyVersionInClient", "request": { "description": "DisableKeyVersionInClient disables a key version immediately (reversible).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "disable" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/disable" } } }, { "name": "EmergencyRevokeKeyVersion", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"generateReplacement\": false,\n \"replacementEnterpriseContext\": {\n \"customerId\": \"{{customer_id}}\",\n \"organizationUnit\": \"string\",\n \"workspaceId\": \"{{workspace_id}}\"\n },\n \"replacementKeyName\": \"example-name\",\n \"replacementUserKeyAddress\": \"example-value\"\n}" }, "description": "EmergencyRevokeKeyVersion disables a key immediately and optionally\n creates a replacement.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "emergency-revoke" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/emergency-revoke" } } }, { "name": "EnableKeyVersionInClient", "request": { "description": "EnableKeyVersionInClient re-enables a disabled key version.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "clients", "{{client_id}}", "keys", "{{key_version}}", "enable" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/clients/{{client_id}}/keys/{{key_version}}/enable" } } } ], "name": "agentrouter.clients.v1.ClientsService" }, { "item": [ { "name": "AcknowledgeEvent", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"eventId\": \"string\",\n \"workerId\": \"string\"\n}" }, "description": "AcknowledgeEvent marks an event as acknowledged by a worker.\n This prevents other workers from processing the same event.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "acknowledge-event" ], "raw": "{{baseUrl}}/configurator/v1/acknowledge-event" } } }, { "name": "ListActiveProviders", "request": { "description": "ListActiveProviders returns a list of active (enabled) AI providers.\n Used for monitoring, debugging, and querying available provider configurations.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "active-providers" ], "raw": "{{baseUrl}}/configurator/v1/active-providers" } } }, { "name": "ListActiveUsers", "request": { "description": "ListActiveUsers returns a list of user IDs that have active configurations.\n Used for monitoring and debugging.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "active-users" ], "raw": "{{baseUrl}}/configurator/v1/active-users" } } }, { "name": "SaveBYOKBackends", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"backends\": [\n {\n \"byokPolicy\": \"string\",\n \"isExternal\": false,\n \"modelName\": \"example-name\",\n \"name\": \"example-name\",\n \"owner\": \"string\",\n \"priority\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"keyAddress\": \"example-value\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "SaveBYOKBackends saves BYOK provider backends configuration.\n Used by workers to persist BYOK backend metadata to database.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "byok-backends" ], "raw": "{{baseUrl}}/configurator/v1/byok-backends" } } }, { "name": "DeleteBYOKBackends", "request": { "description": "DeleteBYOKBackends deletes BYOK provider backends configuration.\n Used by workers to remove BYOK backend metadata from database.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "byok-backends", "{{user_id}}" ], "raw": "{{baseUrl}}/configurator/v1/byok-backends/{{user_id}}" } } }, { "name": "CompleteEvent", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"errorMessage\": \"string\",\n \"eventId\": \"string\",\n \"success\": false\n}" }, "description": "CompleteEvent marks an event as successfully applied or failed.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "complete-event" ], "raw": "{{baseUrl}}/configurator/v1/complete-event" } } }, { "name": "GetConfiguration", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"queries\": [\n {\n \"configType\": \"CONFIG_TYPE_GLOBAL_ROUTES\",\n \"currentVersion\": 0,\n \"keyId\": \"{{key_id}}\",\n \"userId\": \"{{user_id}}\"\n }\n ]\n}" }, "description": "GetConfiguration retrieves the latest configuration for a user.\n Returns configuration only if the version is newer than the provided\n version. Supports batch queries for multiple users for efficiency.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "config" ], "raw": "{{baseUrl}}/configurator/v1/config" } } }, { "name": "ListConfigurations", "request": { "description": "ListConfigurations lists all configurations with optional filtering.\n Used for debugging and monitoring.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "configs" ], "raw": "{{baseUrl}}/configurator/v1/configs" } } }, { "name": "SubmitDataplaneUpgradeCredentials", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"credentials\": [\n {\n \"password\": \"string\",\n \"registry\": \"string\",\n \"slot\": \"string\",\n \"username\": \"string\"\n }\n ],\n \"persistInCluster\": false,\n \"upgradeEventId\": \"string\"\n}" }, "description": "SubmitDataplaneUpgradeCredentials stores operator-provided registry\n credentials for a DATAPLANE_UPGRADE event parked in NeedsCredentials.\n Payload is KEK-envelope encrypted at MP and stored in\n dataplane_upgrade_credentials. Dashboard (admin) is the only caller.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "dataplane-upgrade-credentials" ], "raw": "{{baseUrl}}/configurator/v1/dataplane-upgrade-credentials" } } }, { "name": "AckDataplaneUpgradeCredentials", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"delivered\": false,\n \"upgradeEventId\": \"string\"\n}" }, "description": "AckDataplaneUpgradeCredentials confirms the worker successfully\n materialised the credentials Secret in-cluster. MP DELETEs the\n ciphertext row immediately — no 30-day retention. Workspace claim\n must match. Idempotent: a second Ack on an already-deleted row\n returns success.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "dataplane-upgrade-credentials", "ack" ], "raw": "{{baseUrl}}/configurator/v1/dataplane-upgrade-credentials/ack" } } }, { "name": "GetDataplaneUpgradeCredentials", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"upgradeEventId\": \"string\"\n}" }, "description": "GetDataplaneUpgradeCredentials returns the operator-submitted\n credentials for an upgrade event. MP decrypts server-side and\n returns plaintext over TLS — the worker (DP cluster) never has\n KEK access. Caller's workspace claim must match the event's\n workspace. Read-only — no state change until AckDataplaneUpgradeCredentials.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "dataplane-upgrade-credentials", "get" ], "raw": "{{baseUrl}}/configurator/v1/dataplane-upgrade-credentials/get" } } }, { "name": "CancelDataplaneUpgrade", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"upgradeEventId\": \"string\"\n}" }, "description": "CancelDataplaneUpgrade emits a pending UPGRADE_CANCEL event against\n the workspace. The liaison worker picks it up via the normal\n ListPendingEvents poll, matches the in-flight TarsUpgrade CR by name\n (= upgrade_event_id), and patches spec.cancel so the running Job\n initiates helm --atomic rollback at its next 5s poll tick. Idempotent:\n a no-op when the CR already has spec.cancel=true or has reached a\n terminal phase.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "dataplane-upgrade", "cancel" ], "raw": "{{baseUrl}}/configurator/v1/dataplane-upgrade/cancel" } } }, { "name": "RollbackDataplaneUpgrade", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"upgradeEventId\": \"string\"\n}" }, "description": "RollbackDataplaneUpgrade emits a pending UPGRADE_ROLLBACK event\n against the workspace. Operator-initiated post-Completed rollback:\n dashboard shows a Rollback button after a successful upgrade so the\n operator can return to the prior helm revision (e.g. they want to\n unwind a release that's behaving badly under real traffic). Worker\n spawns a new rollback Job that runs\n `helm rollback tars --wait --atomic`. The new event\n becomes the latest dataplane-upgrade view so the dashboard renders\n the in-flight rollback through phase RollingBack → RolledBack.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "dataplane-upgrade", "rollback" ], "raw": "{{baseUrl}}/configurator/v1/dataplane-upgrade/rollback" } } }, { "name": "SetDataplaneURL", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggerUpdate\": false,\n \"url\": \"https://example.com\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "SetDataplaneURL persists the customer-facing gateway URL for a data plane\n (workspace). Called by `tare install` to register the URL at install time\n and by the management-plane dashboard when an admin edits it later.\n\n trigger_update=false (install path) only writes the system_settings row.\n trigger_update=true (admin-edit path) additionally fires a PROXY_URL\n configuration event so the running data plane converges on the new URL\n via the worker's existing event-handling loop.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "dataplane-url" ], "raw": "{{baseUrl}}/configurator/v1/dataplane-url" } } }, { "name": "UpdateEventMetadata", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"eventId\": \"string\",\n \"metadata\": \"string\"\n}" }, "description": "Replaces metadata JSON on an existing liaison_configuration_events row.\n Lets workers push mid-flight progress onto an event without changing\n its status (AcknowledgeEvent/CompleteEvent are terminal-only).\n Worker writes are scoped to the caller's workspace claim.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "event-metadata" ], "raw": "{{baseUrl}}/configurator/v1/event-metadata" } } }, { "name": "FullSyncWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "FullSyncWorkspace is the heavier \"last resort\" replay path: walks\n `liaison_configurations` directly rather than sibling events, so it\n can recover legacy unscoped events the drift sweep can't see. Worker\n calls this once on startup and every Nth drift sweep tick. Workspace\n and customer are resolved from the caller's auth claims.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "full-sync-workspace" ], "raw": "{{baseUrl}}/configurator/v1/full-sync-workspace" } } }, { "name": "UpsertMCPCatalogServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authentication\": \"string\",\n \"categories\": [\n \"string\"\n ],\n \"description\": \"Example description\",\n \"forceOverwrite\": false,\n \"iconUrl\": \"https://example.com\",\n \"id\": \"string\",\n \"name\": \"example-name\",\n \"requiresAuth\": false,\n \"url\": \"https://example.com\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "UpsertMCPCatalogServer wires a deployed in-cluster MCP server into the\n customer's catalog. Used by `tare mcp enable `: the CLI looks\n up the server's seed entry in mcp-catalog-tare-mcp-with-tools.json, asks\n the operator for the in-cluster URL, and submits this RPC to set\n is_enabled=true on the corresponding mcp_catalog_servers row.\n\n Default behaviour (force_overwrite=false): if the row exists, only\n url + is_enabled (+updated_at) are updated; dashboard-set fields\n (description / icon / categories / tools / etc.) are preserved.\n If the row is new, the seed-provided fields are used to populate it.\n\n force_overwrite=true: every seed field is written, clobbering any\n dashboard edits. Use sparingly — intended for \"reset this row to\n seed defaults\" repairs.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "mcp-catalog", "upsert" ], "raw": "{{baseUrl}}/configurator/v1/mcp-catalog/upsert" } } }, { "name": "ReportMCPRouteStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"message\": \"string\",\n \"projectId\": \"{{project_id}}\",\n \"ready\": false,\n \"userId\": \"{{user_id}}\"\n}" }, "description": "ReportMCPRouteStatus carries a data plane's observed readiness of a\n per-owner MCP route (the RouteDeployment + its child MCPRoute \"Accepted\"\n condition) back to the management plane so it can set the owning MCP\n profiles' status. owner_kind=gateway -> owner_id is the Project Gateway\n UUID; owner_kind=user -> owner_id is the user id (per-user MCP path). One\n route covers all that owner's profiles, so they move together: ready=true\n -> active (error cleared); ready=false -> error with the message. Called by\n the worker on its poll cadence; workspace is resolved from the SA claim.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "mcp-route-status" ], "raw": "{{baseUrl}}/configurator/v1/mcp-route-status" } } }, { "name": "ListPendingEvents", "request": { "description": "ListPendingEvents returns configuration events that need processing.\n Used by workers to discover which configurations have updates. The worker\n piggybacks its tare-doctor runtime observation onto this poll\n (request.doctor_runtime) so MP can explain a stale doctor report — hence\n this is no longer NO_SIDE_EFFECTS: a poll updates the data plane's\n doctor-runtime state.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "pending-events" ], "raw": "{{baseUrl}}/configurator/v1/pending-events" } } }, { "name": "ReconcileWorkspace", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "ReconcileWorkspace re-enqueues missing or stale slot events for\n the caller's workspace by cloning the latest sibling event of each\n slot the workspace has not yet converged on. Used by the worker's\n periodic drift sweep. Workspace is resolved from the caller's auth\n claims; callers without a workspace claim are rejected.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "reconcile-workspace" ], "raw": "{{baseUrl}}/configurator/v1/reconcile-workspace" } } }, { "name": "TriggerUpdate", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"configType\": \"CONFIG_TYPE_GLOBAL_ROUTES\",\n \"eventType\": \"EVENT_TYPE_NEW\",\n \"keyId\": \"{{key_id}}\",\n \"metadata\": {\n \"dataplaneUpgrade\": {\n \"acknowledgedPreflightChecks\": [\n \"string\"\n ],\n \"allowDowntime\": false,\n \"credentialsRef\": \"string\",\n \"persistInCluster\": false,\n \"targetVersion\": \"string\"\n },\n \"guardrails\": {\n \"changeKind\": \"GUARDRAILS_CHANGE_KIND_GUARDRAIL\",\n \"changedRef\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"originatingProjectId\": \"string\"\n }\n },\n \"projectGatewayHostname\": \"string\",\n \"projectGatewayId\": \"{{project_gateway_id}}\",\n \"projectGatewayUuid\": \"string\",\n \"userId\": \"{{user_id}}\",\n \"workspaceId\": \"{{workspace_id}}\"\n}" }, "description": "TriggerUpdate triggers a configuration update for a specific user and\n config type. This is called by the dashboard when configuration changes.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "trigger" ], "raw": "{{baseUrl}}/configurator/v1/trigger" } } }, { "name": "RevokeUserToken", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"reason\": \"string\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "RevokeUserToken revokes a user token by JTI.\n Used by workers in enterprise mode to revoke tokens when API keys are deleted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "user-tokens", "{{user_token_jti}}:revoke" ], "raw": "{{baseUrl}}/configurator/v1/user-tokens/{{user_token_jti}}:revoke" } } }, { "name": "ValidateDataplane", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "ValidateDataplane lets a data plane's filter confirm that this DP is\n still a valid (non-revoked) member of the customer and fetch the\n customer's current gatekeeper public keys. Authentication is via the\n caller's service-account JWT signed with its DP keypair\n (kid=`instance-<...>`). When the DP keypair has been soft-deleted at\n MP, the auth layer rejects the call with Unauthenticated — the filter\n treats that as \"revoked\" without needing a separate response field.\n On success, the response carries the customer's gatekeeper public\n keys so the filter can repopulate its in-memory cache (and the\n worker can repopulate `tars-config[gatekeeper-public-keys]`).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "configurator", "v1", "validate-dataplane" ], "raw": "{{baseUrl}}/configurator/v1/validate-dataplane" } } } ], "name": "agentrouter.configurator.v1.ConfiguratorService" }, { "item": [ { "name": "ListGuardrailProviders", "request": { "description": "ListGuardrailProviders returns providers visible to the requested scope,\n including globally-seeded providers.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers" } } }, { "name": "CreateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreateGuardrailProvider registers a new guardrail provider.\n Returns PERMISSION_DENIED when attempting to create a globally-seeded\n provider kind (regexp / builtin / tetrate).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers" } } }, { "name": "DeleteGuardrailProvider", "request": { "description": "DeleteGuardrailProvider soft-deletes a user-defined provider (sets\n deleted_at; the row disappears from List/Get). Historical trigger records\n referencing this provider REMAIN queryable.\n Returns PERMISSION_DENIED when attempting to delete a globally-seeded\n provider row.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "GetGuardrailProvider", "request": { "description": "GetGuardrailProvider returns a single provider by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } }, { "name": "UpdateGuardrailProvider", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"provider\": {\n \"config\": {\n \"key\": 0\n },\n \"customerId\": \"{{customer_id}}\",\n \"enabled\": false,\n \"kind\": \"string\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdateGuardrailProvider updates mutable fields of a user-defined provider.\n Omitted/empty scalar string fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. Absent\n message fields (config) leave the existing value untouched; a present\n config Struct REPLACES the stored configuration wholesale (no deep merge).\n Returns PERMISSION_DENIED when attempting to modify a globally-seeded\n provider row.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "providers", "{{provider_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/providers/{{provider_id}}" } } } ], "name": "agentrouter.guardrails.v1.GuardrailProvidersService" }, { "item": [ { "name": "GetDashboard", "request": { "description": "GetDashboard returns a combined summary of guardrail posture and recent\n trigger activity for the dashboard view.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "dashboard" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/dashboard" } } }, { "name": "ListGuardrailTriggers", "request": { "description": "ListGuardrailTriggers lists trigger events matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers" } } }, { "name": "GetGuardrailTriggerStats", "request": { "description": "GetGuardrailTriggerStats returns aggregate statistics for trigger events\n in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers/stats" } } }, { "name": "GetGuardrailTrigger", "request": { "description": "GetGuardrailTrigger returns a single trigger event by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "triggers", "{{trigger_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/triggers/{{trigger_id}}" } } }, { "name": "ReportGuardrailTriggers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"triggers\": [\n {\n \"consumerId\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"executionDurationMs\": 0,\n \"guardrailId\": \"{{guardrail_id}}\",\n \"id\": \"string\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"projectId\": \"{{project_id}}\",\n \"resourceId\": \"string\",\n \"ruleEvaluations\": [\n {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"checkType\": \"CHECK_TYPE_PII\",\n \"executeOnContentType\": \"EXECUTE_ON_CONTENT_TYPE_ALL\",\n \"executedOn\": \"EXECUTE_ON_INPUT\",\n \"executionDurationMs\": 0,\n \"guardrailRuleId\": \"string\",\n \"inputResults\": [],\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"outputResults\": [],\n \"providerId\": \"{{provider_id}}\",\n \"score\": 0\n }\n ],\n \"triggeredAt\": \"2023-01-15T01:30:15.01Z\"\n }\n ]\n}" }, "description": "ReportGuardrailTriggers ingests a batch of trigger events from the data\n plane. Idempotent on trigger.id (duplicate ids return success=true with no\n error). Per-item failure model: a malformed or unknown-reference trigger\n yields success=false for that item only; the RPC itself fails only for auth\n errors, an empty batch, or a batch exceeding 1000 triggers\n (INVALID_ARGUMENT). Authenticated as a service account only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "guardrails", "triggers", "report" ], "raw": "{{baseUrl}}/v1/guardrails/triggers/report" } } } ], "name": "agentrouter.guardrails.v1.GuardrailTriggersService" }, { "item": [ { "name": "ListGuardrails", "request": { "description": "ListGuardrails returns guardrails matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails" } } }, { "name": "CreateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n }\n}" }, "description": "CreateGuardrail creates a new guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails" } } }, { "name": "CreateGuardrailFromTemplate", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"templateId\": \"string\"\n}" }, "description": "CreateGuardrailFromTemplate instantiates a new guardrail from a platform\n template row (is_template=true). The resulting guardrail is editable and\n scoped to (customer_id, project_id).\n Returns NOT_FOUND when template_id does not reference an existing template\n guardrail (non-template ids are treated as not found).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "from-template" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/from-template" } } }, { "name": "GetGuardrailStats", "request": { "description": "GetGuardrailStats returns aggregate statistics for guardrails in scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/stats" } } }, { "name": "UpdateGuardrail", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"guardrail\": {\n \"category\": \"GUARDRAIL_CATEGORY_DATA_PRIVACY\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"enabled\": false,\n \"evaluationTimeoutMs\": 0,\n \"failureMode\": \"FAILURE_MODE_FAIL_CLOSE\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\",\n \"severity\": \"GUARDRAIL_SEVERITY_LOW\",\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n },\n \"type\": \"GUARDRAIL_TYPE_COMPLIANCE\"\n }\n}" }, "description": "UpdateGuardrail updates mutable guardrail fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response) leave the existing value untouched; a present\n triggered_response replaces it wholesale. The guardrail id must be set\n inside the guardrail field.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "ListGuardrailRules", "request": { "description": "ListGuardrailRules returns rules for the specified guardrail.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "CreateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"example-value\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n }\n}" }, "description": "CreateGuardrailRule adds a new rule to a guardrail.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules" } } }, { "name": "DeleteGuardrailRule", "request": { "description": "DeleteGuardrailRule soft-deletes a rule (sets deleted_at; the row\n disappears from List/Get). Historical trigger records referencing this rule\n REMAIN queryable.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "GetGuardrailRule", "request": { "description": "GetGuardrailRule returns a single rule by id.\n Returns NOT_FOUND when the rule does not exist under the given guardrail_id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "UpdateGuardrailRule", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rule\": {\n \"action\": \"RULE_ACTION_BLOCK\",\n \"active\": false,\n \"checkType\": \"CHECK_TYPE_PII\",\n \"configuration\": {\n \"banCompetitor\": {\n \"brandSelf\": \"string\",\n \"competitors\": [\n \"string\"\n ]\n }\n },\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"executeOn\": \"EXECUTE_ON_INPUT\",\n \"guardrailId\": \"{{guardrail_id}}\",\n \"mode\": \"RULE_MODE_ENFORCE\",\n \"name\": \"example-name\",\n \"providerId\": \"{{provider_id}}\",\n \"targetKeyId\": \"example-value\",\n \"targetTagSelector\": {\n \"key\": \"string\"\n },\n \"targetType\": \"RULE_TARGET_TYPE_PROJECT\",\n \"triggeredResponse\": {\n \"callerTemplate\": \"string\"\n }\n }\n}" }, "description": "UpdateGuardrailRule updates mutable rule fields. Omitted/empty scalar\n string fields leave the existing value untouched. Enum fields set to\n *_UNSPECIFIED leave the existing value untouched. Absent message fields\n (triggered_response, configuration) leave the existing value untouched; a\n present configuration Struct REPLACES the stored configuration wholesale\n (no deep merge). The rule id must be set inside the rule field.\n Returns PERMISSION_DENIED when the target rule's parent guardrail is a\n template (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "rules", "{{rule_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/rules/{{rule_id}}" } } }, { "name": "DeleteGuardrail", "request": { "description": "DeleteGuardrail soft-deletes a guardrail (sets deleted_at; the row\n disappears from List/Get). Child rules of the soft-deleted guardrail are\n no longer served. Historical trigger records referencing this guardrail\n REMAIN queryable.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "GetGuardrail", "request": { "description": "GetGuardrail returns a single guardrail by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}" } } }, { "name": "SetGuardrailStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false,\n \"status\": \"GUARDRAIL_STATUS_ACTIVE\"\n}" }, "description": "SetGuardrailStatus updates the status and/or enabled flag of a guardrail.\n At least one of status/enabled must be provided; otherwise INVALID_ARGUMENT.\n Returns PERMISSION_DENIED when the target guardrail is a template\n (is_template=true); templates are instantiated via\n CreateGuardrailFromTemplate, never mutated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "{{guardrail_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/{{guardrail_id}}/status" } } } ], "name": "agentrouter.guardrails.v1.GuardrailsService" }, { "item": [ { "name": "ListPatterns", "request": { "description": "ListPatterns returns patterns visible to the requested scope, including\n built-in patterns which are globally visible.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns" } } }, { "name": "CreatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreatePattern creates a new user-defined pattern.\n Returns PERMISSION_DENIED when attempting to create a pattern with\n is_builtin=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns" } } }, { "name": "DeletePattern", "request": { "description": "DeletePattern soft-deletes a user-defined pattern (sets deleted_at; the\n row disappears from List/Get). Historical trigger records referencing this\n pattern REMAIN queryable.\n Returns PERMISSION_DENIED when attempting to delete a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "GetPattern", "request": { "description": "GetPattern returns a single pattern by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } }, { "name": "UpdatePattern", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"pattern\": {\n \"category\": \"string\",\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"name\": \"example-name\",\n \"pattern\": \"string\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdatePattern updates mutable fields of a user-defined pattern. Omitted/\n empty scalar string fields leave the existing value untouched. Enum fields\n set to *_UNSPECIFIED leave the existing value untouched.\n Returns PERMISSION_DENIED when attempting to modify a built-in pattern.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "guardrails", "patterns", "{{pattern_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/guardrails/patterns/{{pattern_id}}" } } } ], "name": "agentrouter.guardrails.v1.PatternsService" }, { "item": [ { "name": "ListUsers", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userIds\": [\n \"string\"\n ]\n}" }, "description": "ListUsers batch-resolves user_ids to directory entries in one call,\n so a stats/management caller can resolve a whole page of grouped\n insights rows without N round-trips. Unknown ids are silently\n omitted from the response.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "lookup" ], "raw": "{{baseUrl}}/v1/users/lookup" } } }, { "name": "GetUser", "request": { "description": "GetUser resolves a single user_id to its directory entry (email +\n name). This is the attribution/display lookup that per-user\n insights/usage views need: those views key data by the opaque\n authn.user.id, and this maps that id back to a named person. It is a\n directory lookup only -- not identity propagation or authorization,\n and callers must not read the auth DB directly.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users", "{{user_id}}" ], "raw": "{{baseUrl}}/v1/users/{{user_id}}" } } } ], "name": "agentrouter.identity.v1.IdentityService" }, { "item": [ { "name": "Login", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"codeChallenge\": \"string\",\n \"codeChallengeMethod\": \"string\",\n \"issuer\": \"string\",\n \"redirectUri\": \"https://example.com\"\n}" }, "description": "Login initiates an OIDC authorization-code + PKCE flow. Returns an\n authorization_url the caller must redirect the user's browser to.\n After the IdP authenticates and redirects to redirect_uri, the\n platform establishes a session cookie for subsequent requests.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "login" ], "raw": "{{baseUrl}}/v1/auth/login" } } }, { "name": "Logout", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{}" }, "description": "Logout invalidates the caller's current OIDC session. Subsequent\n requests using the session cookie return 401 unauthenticated. Does\n not revoke API keys the identity may have issued.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "auth", "logout" ], "raw": "{{baseUrl}}/v1/auth/logout" } } }, { "name": "GetMe", "request": { "description": "GetMe returns the full identity record for the authenticated caller.\n Use to verify which identity a credential belongs to, populate a\n \"logged in as\" UI element, or confirm role assignments before making\n permission-gated calls.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me" ], "raw": "{{baseUrl}}/v1/me" } } }, { "name": "ListMyKeys", "request": { "description": "ListMyKeys lists all API keys belonging to the caller. Returns\n metadata (id, name, creation timestamp, last-used timestamp) but\n never the plaintext secret.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys" ], "raw": "{{baseUrl}}/v1/me/keys" } } }, { "name": "IssueMyKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"idempotencyKey\": \"example-value\",\n \"name\": \"example-name\",\n \"platformRoles\": [\n \"string\"\n ],\n \"projectId\": \"{{project_id}}\",\n \"scopes\": [\n \"string\"\n ],\n \"tags\": {\n \"key\": \"string\"\n },\n \"type\": \"API_KEY_TYPE_PROMPT\"\n}" }, "description": "IssueMyKey issues a new long-lived API key for the caller. The\n secret field in the response is returned exactly once and cannot be\n retrieved again. Store it in a secrets manager immediately.\n\n Issuing a management key (type API_KEY_TYPE_MANAGEMENT) requires the\n api_keys.create permission for the target customer -- the built-in Super\n Admin and User Admin roles carry it -- or the request fails with\n PERMISSION_DENIED. Inference keys (the default) are open to any\n authenticated session.\n\n The key carries the caller's own access, not the organization's: a caller\n who cannot already administer the customer receives read-only management\n scopes, and asking for broader ones fails with PERMISSION_DENIED.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys" ], "raw": "{{baseUrl}}/v1/me/keys" } } }, { "name": "RevokeMyKey", "request": { "description": "RevokeMyKey permanently and irrevocably revokes an API key.\n Revocation propagates to all active data planes within sub-second;\n requests already in flight that passed authentication before\n propagation may still complete.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/me/keys/{{key_id}}" } } }, { "name": "UpdateMyKey", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"clearPlatformRoles\": false,\n \"clearScopes\": false,\n \"clearTags\": false,\n \"platformRoles\": [\n \"string\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"tags\": {\n \"key\": \"string\"\n }\n}" }, "description": "UpdateMyKey replaces the scope set of a caller-owned management key\n in place, so an existing key can be re-scoped without rotating its\n secret. The caller may only assign scopes it is authorized to delegate.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "keys", "{{key_id}}" ], "raw": "{{baseUrl}}/v1/me/keys/{{key_id}}" } } }, { "name": "ListMyProjects", "request": { "description": "ListMyProjects lists the projects the calling identity can access within\n one customer, with the caller's role in each.\n\n Access is the union of three sources: the caller's project_members rows,\n the projects their project-scoped RBAC bindings reach, and -- when they\n hold an org-scoped grant -- every project in the customer.\n\n The customer-wide `default` project travels with EVERY customer the caller\n belongs to, not only the oldest one that fills an omitted customer_id, and\n with a caller who has no customer yet, which is the first-login state it\n exists for. An established caller naming a tenant they hold no membership\n in does NOT receive that tenant's `default` project; they get an empty list.\n\n `role` reports what the platform actually enforces for the caller on that\n project, not merely what the membership row says, so a project listed as\n \"admin\" is one the caller is genuinely admitted to as owner. A caller with\n no access receives an empty page, not an error.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "projects" ], "raw": "{{baseUrl}}/v1/me/projects" } } }, { "name": "CreateUser", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"email\": \"developer@example.com\",\n \"issueSession\": false,\n \"name\": \"example-name\"\n}" }, "description": "CreateUser provisions a user identity (an authn.user row). Admin-scoped\n and session-only: only platform operators (admin scope) acting through an\n interactive session may create users; API keys are rejected. Intended for\n tenant onboarding where users do not arrive via interactive SSO. When\n issue_session is true a session is also created and its token returned\n ONCE, so the caller can immediately act as the new user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "users" ], "raw": "{{baseUrl}}/v1/users" } } } ], "name": "agentrouter.identity.v1.MeService" }, { "item": [ { "name": "Prompt", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"idempotencyKey\": \"example-value\",\n \"keyId\": \"{{key_id}}\",\n \"model\": \"string\",\n \"prompt\": \"string\"\n}" }, "description": "Prompt sends a prompt to an upstream LLM and returns the model's\n completion. The gateway selects an eligible data plane, retrieves\n and applies the project's BYOK key, enforces quota, records a\n request log entry, and proxies the call to the upstream provider.\n Streaming, multi-turn conversations, tools, and vision are not yet\n supported on this path.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "prompts" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/prompts" } } }, { "name": "GetDataplaneURL", "request": { "description": "GetDataplaneURL returns one dataplane (gateway) URL for a single project.\n The project is deduced from the caller's credential -- no input is required\n in the common case: a caller who belongs to one project gets that project's\n dataplane; one whose identity spans several gets their default (the oldest\n membership). Pass project_id to disambiguate or target a specific project\n (it is membership-checked). The customer is derived the same way. When the\n credential itself already pins a workspace, a gateway on that workspace is\n preferred. When several Project Gateways are eligible, the first by\n project_gateway_id is returned; use ListDataplaneURLs to retrieve the set.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "dataplane-url" ], "raw": "{{baseUrl}}/v1/dataplane-url" } } }, { "name": "ListDataplaneURLs", "request": { "description": "ListDataplaneURLs returns every dataplane URL the caller can reach. For a\n project with attached Project Gateways it returns one entry per configured\n gateway; otherwise it preserves the legacy one-entry-per-workspace shape.\n Key-deduced; no input. Use GetDataplaneURL when one project's preferred URL\n is wanted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "dataplane-urls" ], "raw": "{{baseUrl}}/v1/dataplane-urls" } } } ], "name": "agentrouter.inference.v1.InferenceIngressService" }, { "item": [ { "name": "ListCustomerRequestLogs", "request": { "description": "ListCustomerRequestLogs returns the caller's own request logs,\n filtered by the supplied tenancy scope. Forced filter:\n `user_id = caller.UserID`.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs" } } }, { "name": "GetCustomerRequestLogStats", "request": { "description": "GetCustomerRequestLogStats returns aggregated statistics over the\n calling user's request logs within the supplied tenancy scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs", "stats" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs/stats" } } }, { "name": "GetCustomerRequestLog", "request": { "description": "GetCustomerRequestLog returns a single request log row owned by the\n calling user. Cross-user NotFound: the user cannot read another\n user's log even within the same customer/project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "request-logs", "{{request_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/request-logs/{{request_id}}" } } } ], "name": "agentrouter.insights.v1.CustomerRequestLogsService" }, { "item": [ { "name": "QueryRequestLogs", "request": { "description": "QueryRequestLogs retrieves request logs with filtering and pagination.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs" ], "raw": "{{baseUrl}}/v1/request-logs" } } }, { "name": "GetRequestLogStats", "request": { "description": "GetRequestLogStats returns aggregated statistics for request logs.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "stats" ], "raw": "{{baseUrl}}/v1/request-logs/stats" } } }, { "name": "GetRequestLog", "request": { "description": "GetRequestLog retrieves a single request log by request ID.\n Requires request_logs_reader (admin implies it).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "request-logs", "{{request_id}}" ], "raw": "{{baseUrl}}/v1/request-logs/{{request_id}}" } } } ], "name": "agentrouter.insights.v1.RequestLogsService" }, { "item": [ { "name": "ListCatalogServers", "request": { "description": "ListCatalogServers returns every catalog entry, including disabled\n rows so operators can re-enable them. The dashboard's read-only\n view filters to is_enabled=true.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers" } } }, { "name": "UpsertCatalogServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authentication\": \"string\",\n \"categories\": [\n \"string\"\n ],\n \"description\": \"Example description\",\n \"iconUrl\": \"https://example.com\",\n \"id\": \"string\",\n \"name\": \"example-name\",\n \"note\": \"string\",\n \"requiresAuth\": false,\n \"requiresProfile\": false,\n \"url\": \"https://example.com\"\n}" }, "description": "UpsertCatalogServer creates or replaces a catalog entry. Idempotent\n on `id`. Operator-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers" } } }, { "name": "DeleteCatalogServer", "request": { "description": "DeleteCatalogServer removes a catalog entry by id. Operator-only.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "GetCatalogServer", "request": { "description": "GetCatalogServer returns a single catalog entry by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}" } } }, { "name": "SetCatalogServerEnabled", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"enabled\": false\n}" }, "description": "SetCatalogServerEnabled flips the operator visibility toggle on a\n catalog entry. Split from UpsertCatalogServer so a re-upsert that\n refreshes content fields (display_name, url, ...) cannot silently\n re-enable a previously-disabled row through the proto bool zero\n value.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "mcp", "catalog", "servers", "{{server_id}}", "enabled" ], "raw": "{{baseUrl}}/v1/mcp/catalog/servers/{{server_id}}/enabled" } } } ], "name": "agentrouter.mcp.v1.MCPCatalogService" }, { "item": [ { "name": "ListAvailableMCPServers", "request": { "description": "ListAvailableMCPServers lists the MCP servers a user may attach to a\n profile in the given project: enabled catalog servers granted to the\n project (project_mcp_servers), each with its tool catalog so the client\n can pick which tools to enable on attach.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "available-mcp-servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/available-mcp-servers" } } }, { "name": "ListMCPProfiles", "request": { "description": "ListMCPProfiles lists every profile owned by the given\n (user_id, customer_id, project_id) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "CreateMCPProfile", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"securityPolicyType\": \"https://example.com\",\n \"securityPolicyValue\": \"https://example.com\"\n}" }, "description": "CreateMCPProfile registers a new MCP server for a user.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles" } } }, { "name": "DeleteMCPProfile", "request": { "description": "DeleteMCPProfile soft-deletes a profile (deleted_at set; row kept\n for FK integrity against historical request logs).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "GetMCPProfile", "request": { "description": "GetMCPProfile returns a single profile by uuid.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "UpdateMCPProfile", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"securityPolicyType\": \"https://example.com\",\n \"securityPolicyValue\": \"https://example.com\"\n}" }, "description": "UpdateMCPProfile updates mutable profile fields. Omitted scalar\n strings (\"\") leave the existing value untouched.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}" } } }, { "name": "AddMCPProfileServer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiToken\": \"example-token\",\n \"bearerToken\": \"example-token\",\n \"serverId\": \"{{server_id}}\",\n \"tools\": [\n \"string\"\n ]\n}" }, "description": "AddMCPProfileServer attaches an MCP server to a profile with all of its\n tools enabled by default. The CLI has no per-tool flag, so `add` always\n attaches with all tools; use the SDK/REST SetMCPProfileServerTools to\n enable a subset. Creates a row in mcp_profile_backends with an optional\n per-server credential; the server must be enabled in the catalog and\n granted to the profile's project (project_mcp_servers), and re-adding an\n already-attached server updates its tools/credential in place.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers" } } }, { "name": "RemoveMCPProfileServer", "request": { "description": "RemoveMCPProfileServer detaches an MCP server from a profile, deleting\n the mcp_profile_backends row and any per-server credential. Idempotent:\n removing an already-detached server succeeds.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}" } } }, { "name": "SetMCPProfileServerTools", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tools\": [\n \"string\"\n ]\n}" }, "description": "SetMCPProfileServerTools replaces the enabled-tool set for an attached\n server (mcp_profile_backends.selectors.tools). Full-replacement (PUT)\n semantics. An EMPTY list stores/returns regex:* (include-all) -- to\n expose none, remove the server.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "mcp-profiles", "{{profile_id}}", "servers", "{{server_id}}", "tools" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/mcp-profiles/{{profile_id}}/servers/{{server_id}}/tools" } } } ], "name": "agentrouter.mcp.v1.MCPProfilesService" }, { "item": [ { "name": "ListMcpOAuthClients", "request": { "description": "ListMcpOAuthClients lists every non-deleted OAuth client in the\n (customer, project) scope. Account tier: any project member may read.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients" } } }, { "name": "CreateMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"provider\": \"string\",\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "CreateMcpOAuthClient registers a new OAuth client under a project.\n The client_secret is wrapped by the secret service and discarded;\n only an sm:// reference is persisted.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients" } } }, { "name": "DeleteMcpOAuthClient", "request": { "description": "DeleteMcpOAuthClient soft-deletes a client (deleted_at set).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "GetMcpOAuthClient", "request": { "description": "GetMcpOAuthClient returns a single OAuth client by id. Never returns\n the client_secret. Account tier: any project member may read.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } }, { "name": "UpdateMcpOAuthClient", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"authorizationUrl\": \"https://example.com\",\n \"clientId\": \"string\",\n \"clientSecret\": \"example-value\",\n \"metadata\": {\n \"key\": \"string\"\n },\n \"providerName\": \"example-name\",\n \"redirectUris\": [\n \"https://example.com\"\n ],\n \"replaceMetadata\": false,\n \"replaceRedirectUris\": false,\n \"replaceScopes\": false,\n \"replaceServerIds\": false,\n \"scopes\": [\n \"string\"\n ],\n \"serverIds\": [\n \"string\"\n ],\n \"status\": \"string\",\n \"tokenUrl\": \"https://example.com\"\n}" }, "description": "UpdateMcpOAuthClient applies a partial patch. Omitted scalar strings\n (\"\") leave the existing value untouched. A non-empty client_secret\n rotates the wrapped secret in place.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "mcp-oauth-clients", "{{mcp_oauth_client_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/mcp-oauth-clients/{{mcp_oauth_client_id}}" } } } ], "name": "agentrouter.mcp.v1.McpOAuthClientsService" }, { "item": [ { "name": "GetApiKeyMetric", "request": { "description": "GetApiKeyMetric returns a metric for a single API key. The key must belong\n to the resolved (customer, project) scope, else NotFound.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "api_keys", "{{api_key_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/api_keys/{{api_key_id}}/metrics/{{metric}}" } } }, { "name": "GetProjectMetric", "request": { "description": "GetProjectMetric returns a project-level metric. The caller must be a\n member of the (customer, project) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/metrics/{{metric}}" } } }, { "name": "GetUserMetric", "request": { "description": "GetUserMetric returns a metric for a single user. The user_id is forced to\n the authenticated caller: a caller can only read their own USER-layer\n metrics even within a project they share.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "users", "{{user_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/users/{{user_id}}/metrics/{{metric}}" } } }, { "name": "GetMyMetric", "request": { "description": "GetMyMetric returns a USER-layer metric for the calling user, resolved\n entirely from the session token -- no tenancy scope is required.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "me", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/me/metrics/{{metric}}" } } }, { "name": "ListMetrics", "request": { "description": "ListMetrics returns DPO's metric catalog: the known metrics, the layers\n and endpoint-layers supported, and the raw-metric passthrough route\n (DPO#22). The catalog is non-sensitive discovery metadata, so it is\n exposed here to every authenticated caller -- not just admin -- with no\n tenancy scope or special scope required. Uses a distinct path from the\n admin MetricsService.ListMetrics (/v1/metrics) to avoid colliding with\n GetMetric's /v1/metrics/{metric}.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metric-catalog" ], "raw": "{{baseUrl}}/v1/metric-catalog" } } } ], "name": "agentrouter.metrics.v1.CustomerMetricsService" }, { "item": [ { "name": "GetCustomerMetric", "request": { "description": "GetCustomerMetric returns a customer-level (CUSTOMER-layer) metric for any\n customer.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/metrics/{{metric}}" } } }, { "name": "ListMetrics", "request": { "description": "ListMetrics returns DPO's metric catalog: the known metrics, the layers\n and endpoint-layers supported, and the raw-metric passthrough route\n (DPO#22). This coexists with GetMetric's /v1/metrics/{metric}: an exact\n path match on /v1/metrics routes here.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metrics" ], "raw": "{{baseUrl}}/v1/metrics" } } }, { "name": "GetMetric", "request": { "description": "GetMetric returns a metric for any entity in any layer, including the\n infra layers DATAPLANE and GATEWAY. entity and layer are taken from the\n request.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "metrics", "{{metric}}" ], "raw": "{{baseUrl}}/v1/metrics/{{metric}}" } } }, { "name": "GetRawMetric", "request": { "description": "GetRawMetric returns an unaggregated (raw) metric, bypassing the summary\n rollup (DPO#21).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "raw-metrics", "{{raw_metric_name}}" ], "raw": "{{baseUrl}}/v1/raw-metrics/{{raw_metric_name}}" } } } ], "name": "agentrouter.metrics.v1.MetricsService" }, { "item": [ { "name": "AddApiKeyTag", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tagKey\": \"example-value\",\n \"tagValue\": \"string\"\n}" }, "description": "AddApiKeyTag attaches a (tag_key, tag_value) pair to an API key. Both\n must reference an existing TagSchemaEntry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "api-keys", "{{api_key_id}}", "tags" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/api-keys/{{api_key_id}}/tags" } } }, { "name": "RemoveApiKeyTag", "request": { "description": "RemoveApiKeyTag detaches a tag from an API key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "api-keys", "{{api_key_id}}", "tags", "{{tag_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/api-keys/{{api_key_id}}/tags/{{tag_id}}" } } }, { "name": "CreateBudgetPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"budgetPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"alertThresholds\": [\n 0\n ],\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"fallbackModel\": \"string\",\n \"fallbackModels\": {\n \"key\": \"string\"\n },\n \"groupId\": \"string\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"spendLimit\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\"\n }\n}" }, "description": "CreateBudgetPolicy creates a new budget policy. For API_KEY scope, the\n named key's client and project are resolved under its row lock. Returns\n ABORTED if the key's project changed after authorization; a retry must\n still satisfy the request project's ownership check.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies" } } }, { "name": "UpdateBudgetPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"budgetPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"alertThresholds\": [\n 0\n ],\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"fallbackModel\": \"string\",\n \"fallbackModels\": {\n \"key\": \"string\"\n },\n \"groupId\": \"string\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"spendLimit\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\"\n }\n}" }, "description": "UpdateBudgetPolicy updates mutable budget policy fields. Omitted/empty\n scalar string fields leave the existing value untouched. Enum fields set\n to *_UNSPECIFIED leave the existing value untouched. The policy id must\n be set inside the budget_policy field. Restating the same api_key_id on\n an existing API_KEY policy preserves its stored client and project;\n supplying a different key retargets it. When a key target is supplied,\n returns ABORTED if its project changed after authorization. A retry must\n still satisfy the request project's ownership check.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "DeleteBudgetPolicy", "request": { "description": "DeleteBudgetPolicy deletes a budget policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "SetBudgetPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetBudgetPolicyStatus toggles a budget policy's active/inactive state\n (is_active). Activation retries concurrent changes to the policy's stored\n scope, client or project. Returns ABORTED if the target cannot be stabilized\n within the retry limit; the caller may retry.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "budget-policies", "{{budget_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/budget-policies/{{budget_policy_id}}/status" } } }, { "name": "CreateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"example-value\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "CreateFallbackChainPolicy creates a new fallback-chain policy scoped to\n a key, tag selector, or project (fraser#5447, item 4.2).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies" } } }, { "name": "UpdateFallbackChainPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"fallbackChainPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"chain\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\"\n }\n ],\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"maxAttempts\": 0,\n \"projectId\": \"{{project_id}}\",\n \"retryDelay\": 0,\n \"retryOn\": \"string\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"example-value\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateFallbackChainPolicy updates mutable fallback chain policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the fallback_chain_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "DeleteFallbackChainPolicy", "request": { "description": "DeleteFallbackChainPolicy deletes a fallback chain policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "SetFallbackChainPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetFallbackChainPolicyStatus toggles a fallback chain policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/fallback-chain-policies/{{fallback_chain_policy_id}}/status" } } }, { "name": "CreateRateLimitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rateLimitPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"limit\": {\n \"inputTokensPerHour\": 0,\n \"outputTokensPerHour\": 0,\n \"totalTokensPerHour\": 0\n },\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "CreateRateLimitPolicy creates a new rate-limit policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies" } } }, { "name": "DeleteRateLimitPolicy", "request": { "description": "DeleteRateLimitPolicy deletes a rate-limit policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "SetRateLimitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetRateLimitPolicyStatus toggles a rate-limit policy's active/inactive\n state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}/status" } } }, { "name": "UpdateRateLimitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"rateLimitPolicy\": {\n \"action\": \"POLICY_ACTION_MONITOR\",\n \"apiKeyId\": \"{{api_key_id}}\",\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"limit\": {\n \"inputTokensPerHour\": 0,\n \"outputTokensPerHour\": 0,\n \"totalTokensPerHour\": 0\n },\n \"name\": \"example-name\",\n \"period\": \"POLICY_PERIOD_DAILY\",\n \"projectId\": \"{{project_id}}\",\n \"scopeType\": \"POLICY_SCOPE_TYPE_TEAM\",\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"tagSelector\": {\n \"key\": \"string\"\n },\n \"targetProjectId\": \"string\"\n }\n}" }, "description": "UpdateRateLimitPolicy updates mutable rate-limit policy fields.\n Omitted/empty scalar fields leave the existing value untouched. Enum\n fields set to *_UNSPECIFIED leave the existing value untouched. The\n policy id must be set inside the rate_limit_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "CreateTagSchemaEntry", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"tagSchemaEntry\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"projectId\": \"{{project_id}}\",\n \"tagKey\": \"example-value\",\n \"tagValue\": \"string\"\n }\n}" }, "description": "CreateTagSchemaEntry adds an allowed (tag_key, tag_value) pair to the\n tag catalog.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema" } } }, { "name": "DeleteTagSchemaEntry", "request": { "description": "DeleteTagSchemaEntry removes an allowed (tag_key, tag_value) pair from\n the tag catalog.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "tag-schema", "{{tag_schema_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/tag-schema/{{tag_schema_id}}" } } }, { "name": "CreateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"example-value\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "CreateTrafficSplitPolicy creates a new traffic-split policy scoped to a\n key, tag selector, or project (fraser#5447, item 4.2).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies" } } }, { "name": "DeleteTrafficSplitPolicy", "request": { "description": "DeleteTrafficSplitPolicy deletes a traffic split policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "SetTrafficSplitPolicyStatus", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"status\": \"POLICY_STATUS_ACTIVE\"\n}" }, "description": "SetTrafficSplitPolicyStatus toggles a traffic split policy's\n active/inactive state (is_active).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}", "status" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}/status" } } }, { "name": "UpdateTrafficSplitPolicy", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"trafficSplitPolicy\": {\n \"allowedModels\": [\n \"string\"\n ],\n \"customerId\": \"{{customer_id}}\",\n \"intent\": \"POLICY_INTENT_DEFAULT\",\n \"projectId\": \"{{project_id}}\",\n \"split\": [\n {\n \"model\": \"string\",\n \"order\": 0,\n \"provider\": \"string\",\n \"weight\": 0\n }\n ],\n \"status\": \"POLICY_STATUS_ACTIVE\",\n \"targetKeyId\": \"example-value\",\n \"targetProjectId\": \"string\",\n \"targetScopeType\": \"POLICY_TARGET_SCOPE_TYPE_KEY\",\n \"targetTag\": {\n \"key\": \"string\"\n }\n }\n}" }, "description": "UpdateTrafficSplitPolicy updates mutable traffic split policy fields.\n Omitted/empty scalar string fields leave the existing value untouched.\n The policy id must be set inside the traffic_split_policy field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "CreateUserGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userGroup\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "CreateUserGroup creates a new user group (team).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups" } } }, { "name": "DeleteUserGroup", "request": { "description": "DeleteUserGroup deletes a user group.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}" } } }, { "name": "UpdateUserGroup", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"userGroup\": {\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n }\n}" }, "description": "UpdateUserGroup updates mutable user group fields. Omitted/empty scalar\n string fields leave the existing value untouched. The group id must be\n set inside the user_group field.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/policy/user-groups/{{user_group_id}}" } } }, { "name": "ListApiKeyTags", "request": { "description": "ListApiKeyTags returns tags attached to an API key.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "api-keys", "{{api_key_id}}", "tags" ], "raw": "{{baseUrl}}/v1/policy/api-keys/{{api_key_id}}/tags" } } }, { "name": "ListBudgetAlerts", "request": { "description": "ListBudgetAlerts returns system-fired budget alerts matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-alerts" ], "raw": "{{baseUrl}}/v1/policy/budget-alerts" } } }, { "name": "GetBudgetAlert", "request": { "description": "GetBudgetAlert returns a single budget alert by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-alerts", "{{budget_alert_id}}" ], "raw": "{{baseUrl}}/v1/policy/budget-alerts/{{budget_alert_id}}" } } }, { "name": "ListBudgetPolicies", "request": { "description": "ListBudgetPolicies returns budget policies matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies" ], "raw": "{{baseUrl}}/v1/policy/budget-policies" } } }, { "name": "GetBudgetPolicy", "request": { "description": "GetBudgetPolicy returns a single budget policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "budget-policies", "{{budget_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/budget-policies/{{budget_policy_id}}" } } }, { "name": "GetPolicyCoverage", "request": { "description": "GetPolicyCoverage reports whether a scope reference has at least one\n applicable BudgetPolicy, and lists which ones apply.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "coverage" ], "raw": "{{baseUrl}}/v1/policy/coverage" } } }, { "name": "GetEffectivePolicy", "request": { "description": "GetEffectivePolicy resolves every BudgetPolicy applicable to a\n scope-target tuple down to the single clamp-winning policy.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "effective-policy" ], "raw": "{{baseUrl}}/v1/policy/effective-policy" } } }, { "name": "ListFallbackChainPolicies", "request": { "description": "ListFallbackChainPolicies returns fallback chain policies matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "fallback-chain-policies" ], "raw": "{{baseUrl}}/v1/policy/fallback-chain-policies" } } }, { "name": "GetFallbackChainPolicy", "request": { "description": "GetFallbackChainPolicy returns a single fallback chain policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "fallback-chain-policies", "{{fallback_chain_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/fallback-chain-policies/{{fallback_chain_policy_id}}" } } }, { "name": "ListPolicies", "request": { "description": "ListPolicies returns a UNIFIED, read-only, paginated list of every\n PROJECT- or TAG-targeted policy across all policy types (budget,\n rate-limit, fallback-chain, traffic-split) for the caller's tenant\n (fraser#5448, item 5.2 -- the unified Policies area). This is a\n read-model composed on top of the existing type-specific repositories;\n it introduces no new write path -- creating/updating/deleting a policy\n still goes through the type-specific RPCs above (CreateBudgetPolicy,\n CreateRateLimitPolicy, CreateFallbackChainPolicy,\n CreateTrafficSplitPolicy, and their Update/Delete/SetStatus siblings).\n\n KEY-targeted policies (BudgetPolicy/RateLimitPolicy scope_type =\n POLICY_SCOPE_TYPE_API_KEY, or a FallbackChainPolicy/TrafficSplitPolicy\n target_scope_type = POLICY_TARGET_SCOPE_TYPE_KEY) are deliberately\n EXCLUDED from this list -- they remain scoped to the owning API key's\n config page. TEAM/TEAM_PER_USER_DEFAULT/TEAM_PER_KEY_DEFAULT/USER/\n SYSTEM/CUSTOMER-scoped BudgetPolicy and SYSTEM-scoped RateLimitPolicy\n rows are also excluded: this surface is specifically \"every policy that\n targets a project or a tag selector\", not every policy that exists.\n\n UnifiedPolicy.match_count reports how many API keys the policy's target\n currently resolves to: for a TAG target this is the same\n tagselector.Count query GetPolicyCoverage already runs; for a PROJECT\n target it is a count of that project's API keys.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "policies" ], "raw": "{{baseUrl}}/v1/policy/policies" } } }, { "name": "ListRateLimitPolicies", "request": { "description": "ListRateLimitPolicies returns rate-limit policies matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies" } } }, { "name": "GetRateLimitPolicy", "request": { "description": "GetRateLimitPolicy returns a single rate-limit policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies/{{rate_limit_policy_id}}" } } }, { "name": "GetRateLimitPolicyAnalytics", "request": { "description": "GetRateLimitPolicyAnalytics computes a \"would-have-limited\" analytics\n preview for a MONITOR-action rate-limit policy (fraser#5446 pass 2, item\n 4.4 / ADR-036 R2 Option B): for each hour in the lookback window, it sums\n the policy's audience (the same scope resolution the min-clamp resolver\n uses -- key / tag / project / system) from the existing usage rollups\n (usage_hourly_rollups) and reports how many of those hours would have\n breached the policy's triplet ceiling, had the policy been enforced. This\n is NOT true shadow-mode enforcement (no per-request evaluation, no\n sub-hour granularity) -- it is a rollup-derived retrospective estimate,\n intended to help an operator decide whether flipping a MONITOR policy to\n BLOCK is safe (see the Flow-1 monitor->active flip, fraser#5448).\n Rejects a BLOCK-action policy's id with FailedPrecondition: a BLOCK\n policy is already actually enforced by the min-clamp resolver, so a\n retrospective \"would it have limited\" estimate is not meaningful for it.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "rate-limit-policies", "{{rate_limit_policy_id}}", "analytics" ], "raw": "{{baseUrl}}/v1/policy/rate-limit-policies/{{rate_limit_policy_id}}/analytics" } } }, { "name": "ListTagSchema", "request": { "description": "ListTagSchema returns allowed tag key/value pairs matching the specified\n filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "tag-schema" ], "raw": "{{baseUrl}}/v1/policy/tag-schema" } } }, { "name": "ListTrafficSplitPolicies", "request": { "description": "ListTrafficSplitPolicies returns traffic split policies matching the\n specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "traffic-split-policies" ], "raw": "{{baseUrl}}/v1/policy/traffic-split-policies" } } }, { "name": "GetTrafficSplitPolicy", "request": { "description": "GetTrafficSplitPolicy returns a single traffic split policy by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "traffic-split-policies", "{{traffic_split_policy_id}}" ], "raw": "{{baseUrl}}/v1/policy/traffic-split-policies/{{traffic_split_policy_id}}" } } }, { "name": "ListUserGroups", "request": { "description": "ListUserGroups returns user groups matching the specified filters.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups" ], "raw": "{{baseUrl}}/v1/policy/user-groups" } } }, { "name": "GetUserGroup", "request": { "description": "GetUserGroup returns a single user group by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "policy", "user-groups", "{{user_group_id}}" ], "raw": "{{baseUrl}}/v1/policy/user-groups/{{user_group_id}}" } } } ], "name": "agentrouter.policy.v1.PolicyService" }, { "item": [ { "name": "ListSecrets", "request": { "description": "ListSecrets lists all secrets for the authenticated user.\n Returns metadata only, not plaintext values.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets" ], "raw": "{{baseUrl}}/v1/secrets" } } }, { "name": "CreateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"name\": \"example-name\",\n \"realm\": \"string\",\n \"tags\": {\n \"key\": \"string\"\n },\n \"userId\": \"{{user_id}}\",\n \"value\": \"string\"\n}" }, "description": "CreateSecret creates or updates a secret.\n If a secret with the same name exists, it will be updated.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets" ], "raw": "{{baseUrl}}/v1/secrets" } } }, { "name": "DeleteSecret", "request": { "description": "DeleteSecret deletes a secret by name.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}" } } }, { "name": "GetSecret", "request": { "description": "GetSecret retrieves a secret by name.\n Returns metadata only, not the plaintext value.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}" } } }, { "name": "RotateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"newValue\": \"string\",\n \"realm\": \"string\"\n}" }, "description": "RotateSecret replaces a secret's encrypted value in place.\n The secret keeps its ID and remains active.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "rotate" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/rotate" } } }, { "name": "ValidateSecret", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"realm\": \"string\"\n}" }, "description": "ValidateSecret validates that a secret can be decrypted.\n Used for health checks and troubleshooting.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "validate" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/validate" } } }, { "name": "GetSecretValue", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"realm\": \"string\",\n \"userId\": \"{{user_id}}\"\n}" }, "description": "GetSecretValue retrieves the plaintext value of a secret.\n INTERNAL USE ONLY - This endpoint decrypts and returns the actual secret\n value. Should only be called by internal services (Liaison, Butler2, etc.)", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "secrets", "{{secret_name}}", "value" ], "raw": "{{baseUrl}}/v1/secrets/{{secret_name}}/value" } } } ], "name": "agentrouter.secret.v1.SecretService" }, { "item": [ { "name": "ListTelemetryConfigs", "request": { "description": "ListTelemetryConfigs lists every configuration owned by the caller\n within the (customer, project) scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry" } } }, { "name": "CreateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"endpoint\": \"https://example.com\",\n \"headers\": {\n \"key\": \"string\"\n },\n \"protocol\": \"string\",\n \"telemetryType\": \"string\"\n}" }, "description": "CreateTelemetryConfig creates a new OTel export configuration.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry" } } }, { "name": "GetProjectTelemetryConfig", "request": { "description": "GetProjectTelemetryConfig returns the PROJECT-level telemetry config.\n Project-owner-tier (the shared project default is managed by owners).", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "project" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/project" } } }, { "name": "SetProjectTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": false,\n \"endpoint\": \"https://example.com\",\n \"protocol\": \"string\",\n \"telemetryType\": \"string\"\n}" }, "description": "SetProjectTelemetryConfig upserts the PROJECT-level telemetry export\n config (the shared default applied to project members who have no\n config of their own). Project-owner-tier: only the project's owner may\n set it. A user's own per-user config OVERRIDES this at emit time.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PUT", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "project" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/project" } } }, { "name": "DeleteTelemetryConfig", "request": { "description": "DeleteTelemetryConfig removes a configuration.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } }, { "name": "GetTelemetryConfig", "request": { "description": "GetTelemetryConfig returns a single configuration by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } }, { "name": "UpdateTelemetryConfig", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"apiKeyHeader\": \"example-value\",\n \"authType\": \"string\",\n \"authValue\": \"string\",\n \"enabled\": \"string\",\n \"endpoint\": \"https://example.com\",\n \"protocol\": \"string\",\n \"status\": \"string\"\n}" }, "description": "UpdateTelemetryConfig updates a configuration's mutable fields.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "telemetry", "{{config_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/telemetry/{{config_id}}" } } } ], "name": "agentrouter.telemetry.v1.TelemetryService" }, { "item": [ { "name": "ListProjects", "request": { "description": "ListProjects lists projects within a customer scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects" } } }, { "name": "CreateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\",\n \"projectId\": \"{{project_id}}\"\n}" }, "description": "CreateProject creates a project within a customer scope.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects" } } }, { "name": "ArchiveProject", "request": { "description": "ArchiveProject soft-deletes a project. Refuses to archive the\n default project, matching the existing admin.v1 behaviour.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "GetProject", "request": { "description": "GetProject returns a single project by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "UpdateProject", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "UpdateProject updates mutable project fields.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}" } } }, { "name": "ListProjectMembers", "request": { "description": "ListProjectMembers lists all members of a project and their roles.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "AddProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"identityId\": \"{{identity_id}}\",\n \"role\": \"string\"\n}" }, "description": "AddProjectMember grants an identity access to a project with the\n given role bundle.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members" } } }, { "name": "RemoveProjectMember", "request": { "description": "RemoveProjectMember revokes an identity's membership in a project.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{identity_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{identity_id}}" } } }, { "name": "UpdateProjectMember", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"role\": \"string\"\n}" }, "description": "UpdateProjectMember updates an existing project member's role.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}", "projects", "{{project_id}}", "members", "{{identity_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}/projects/{{project_id}}/members/{{identity_id}}" } } } ], "name": "agentrouter.tenancy.v1.ProjectsService" }, { "item": [ { "name": "ListCustomers", "request": { "description": "ListCustomers lists all customers visible to the caller.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers" ], "raw": "{{baseUrl}}/v1/customers" } } }, { "name": "CreateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"customerId\": \"{{customer_id}}\",\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "CreateCustomer creates a new customer record. A customer owns\n projects, identities, and billing. Typically called once during\n provisioning of a new tenant.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers" ], "raw": "{{baseUrl}}/v1/customers" } } }, { "name": "ArchiveCustomer", "request": { "description": "ArchiveCustomer soft-deletes a customer. The row stays in the\n database with deleted_at set; future Get / List calls treat it as\n missing.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "DELETE", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } }, { "name": "GetCustomer", "request": { "description": "GetCustomer returns a single customer by id.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } }, { "name": "UpdateCustomer", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"description\": \"Example description\",\n \"displayName\": \"example-name\"\n}" }, "description": "UpdateCustomer updates mutable customer fields (display_name,\n description, labels). `customer_id` is immutable.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "PATCH", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "customers", "{{customer_id}}" ], "raw": "{{baseUrl}}/v1/customers/{{customer_id}}" } } } ], "name": "agentrouter.tenancy.v1.TenancyService" }, { "item": [ { "name": "GetRevocationList", "request": { "description": "GetRevocationList returns a list of revoked token JTIs.\n This is used by dataplane to cache and check token revocations locally.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" } ], "method": "GET", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "tokens", "revocations" ], "raw": "{{baseUrl}}/v1/tokens/revocations" } } }, { "name": "UpdateLastUsed", "request": { "body": { "mode": "raw", "options": { "raw": { "language": "json" } }, "raw": "{\n \"jti\": \"string\",\n \"usedAt\": \"2023-01-15T01:30:15.01Z\"\n}" }, "description": "UpdateLastUsed updates the last used timestamp for a token.\n Called by dataplane when a token is used for authentication.", "header": [ { "key": "Authorization", "value": "Bearer {{apiKey}}" }, { "key": "Content-Type", "value": "application/json" } ], "method": "POST", "url": { "host": [ "{{baseUrl}}" ], "path": [ "v1", "tokens", "usage" ], "raw": "{{baseUrl}}/v1/tokens/usage" } } } ], "name": "agentrouter.tokens.v1.TokensService" } ], "variable": [ { "key": "baseUrl", "type": "string", "value": "https://api.agentrouter.example" }, { "key": "apiKey", "type": "string", "value": "" }, { "key": "aikey_id", "type": "string", "value": "example-aikey-id" }, { "key": "api_key_id", "type": "string", "value": "example-api-key-id" }, { "key": "budget_alert_id", "type": "string", "value": "example-budget-alert-id" }, { "key": "budget_policy_id", "type": "string", "value": "example-budget-policy-id" }, { "key": "client_id", "type": "string", "value": "example-client-id" }, { "key": "config_id", "type": "string", "value": "example-config-id" }, { "key": "customer_id", "type": "string", "value": "example-customer-id" }, { "key": "dataplane_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "fallback_chain_policy_id", "type": "string", "value": "example-fallback-chain-policy-id" }, { "key": "guardrail_id", "type": "string", "value": "example-guardrail-id" }, { "key": "identity_id", "type": "string", "value": "example-identity-id" }, { "key": "key_id", "type": "string", "value": "example-key-id" }, { "key": "key_version", "type": "string", "value": "1" }, { "key": "log_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "mcp_oauth_client_id", "type": "string", "value": "example-mcp-oauth-client-id" }, { "key": "metric", "type": "string", "value": "requests" }, { "key": "model_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "pattern_id", "type": "string", "value": "example-pattern-id" }, { "key": "profile_id", "type": "string", "value": "example-profile-id" }, { "key": "project_gateway_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "project_id", "type": "string", "value": "example-project-id" }, { "key": "provider_id", "type": "string", "value": "example-provider-id" }, { "key": "provider_name", "type": "string", "value": "example-provider-name" }, { "key": "rate_limit_policy_id", "type": "string", "value": "example-rate-limit-policy-id" }, { "key": "raw_metric_name", "type": "string", "value": "example-raw-metric-name" }, { "key": "request_id", "type": "string", "value": "example-request-id" }, { "key": "rule_id", "type": "string", "value": "example-rule-id" }, { "key": "secret_name", "type": "string", "value": "example-secret-name" }, { "key": "server_id", "type": "string", "value": "example-server-id" }, { "key": "service_account_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" }, { "key": "setting_name", "type": "string", "value": "global-fallback" }, { "key": "system_setting_key", "type": "string", "value": "example-system-setting-key" }, { "key": "tag_id", "type": "string", "value": "example-tag-id" }, { "key": "tag_schema_id", "type": "string", "value": "example-tag-schema-id" }, { "key": "telemetry_config_id", "type": "string", "value": "example-telemetry-config-id" }, { "key": "traffic_split_policy_id", "type": "string", "value": "example-traffic-split-policy-id" }, { "key": "trigger_id", "type": "string", "value": "example-trigger-id" }, { "key": "user_group_id", "type": "string", "value": "example-user-group-id" }, { "key": "user_id", "type": "string", "value": "example-user-id" }, { "key": "user_token_jti", "type": "string", "value": "example-user-token-jti" }, { "key": "workspace_id", "type": "string", "value": "00000000-0000-4000-8000-000000000000" } ] }