From 9ca5d66ee465524a7cd784cfe2fd52e4b55ca9a6 Mon Sep 17 00:00:00 2001 From: OpenRouter SDK Bot Date: Fri, 21 Aug 2026 06:07:23 +0000 Subject: [PATCH] chore: update OpenAPI spec [sdk-bot] --- .speakeasy/in.openapi.yaml | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/.speakeasy/in.openapi.yaml b/.speakeasy/in.openapi.yaml index b561fbed..16c3ee0e 100644 --- a/.speakeasy/in.openapi.yaml +++ b/.speakeasy/in.openapi.yaml @@ -6908,6 +6908,18 @@ components: name: 'Production OpenAI Key' provider: 'openai' properties: + allowed_api_key_hashes: + description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.' + example: + - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943' + items: + pattern: '^[a-f0-9]{64}$' + type: 'string' + maxItems: 100 + minItems: 1 + type: + - 'array' + - 'null' allowed_models: description: 'Optional allowlist of model slugs this credential may be used for. `null` means no restriction.' example: null @@ -24785,6 +24797,18 @@ components: disabled: false name: 'Updated OpenAI Key' properties: + allowed_api_key_hashes: + description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` clears the restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.' + example: + - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943' + items: + pattern: '^[a-f0-9]{64}$' + type: 'string' + maxItems: 100 + minItems: 1 + type: + - 'array' + - 'null' allowed_models: description: 'Optional allowlist of model slugs this credential may be used for. `null` means no restriction.' example: null @@ -28004,7 +28028,7 @@ paths: results: '$.data' type: 'offsetLimit' post: - description: 'Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. [Management key](/docs/guides/overview/auth/management-api-keys) required.' + description: 'Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.' operationId: 'createBYOKKey' requestBody: content: @@ -28207,7 +28231,7 @@ paths: - 'BYOK' x-speakeasy-name-override: 'get' patch: - description: 'Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.' + description: 'Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.' operationId: 'updateBYOKKey' parameters: - description: 'The BYOK credential ID (UUID).'