Skip to main content

Overview

Store host-bound secrets for a workspace or for one intern. Scope is selected by the API key. Responses return metadata only, never secret values. See https://openrouter.ai/docs/guides/ori/vault.

Available Operations

ListInternVaultSecrets

Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with limit and offset. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage

Parameters

Response

*components.VaultSecretListResponse, error

Errors

DeleteInternVaultSecret

Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage

Parameters

Response

error

Errors

StoreInternVaultSecret

Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames in hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage: body-timed-out

Example Usage: body-too-large

Example Usage: internal-error

Example Usage: invalid-or-missing-api-key

Example Usage: invalid-vault-request

Example Usage: invalid-vault-response

Example Usage: not-found

Example Usage: rate-limited

Example Usage: regional-hostname

Example Usage: route-deadline

Example Usage: transfer-in-progress

Example Usage: vault-request-failed

Example Usage: vault-timed-out

Example Usage: vault-unavailable

Example Usage: workspace-scope-unavailable

Example Usage: writes-disabled

Parameters

Response

*components.VaultSecretResponse, error

Errors

CopyVaultSecretsToIntern

Copies the named workspace secrets into one intern’s scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whose hosts is null cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage: body-timed-out

Example Usage: body-too-large

Example Usage: copy-conflict

Example Usage: internal-error

Example Usage: invalid-or-missing-api-key

Example Usage: invalid-vault-request

Example Usage: invalid-vault-response

Example Usage: not-found

Example Usage: rate-limited

Example Usage: regional-hostname

Example Usage: route-deadline

Example Usage: vault-request-failed

Example Usage: vault-timed-out

Example Usage: vault-unavailable

Example Usage: workspace-scope-unavailable

Example Usage: writes-disabled

Parameters

Response

*components.VaultSecretCopyResponse, error

Errors

ListVaultSecrets

Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated with limit and offset. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage

Parameters

Response

*components.VaultSecretListResponse, error

Errors

DeleteVaultSecret

Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage

Parameters

Response

error

Errors

StoreVaultSecret

Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames in hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.

Example Usage: body-timed-out

Example Usage: body-too-large

Example Usage: internal-error

Example Usage: invalid-or-missing-api-key

Example Usage: invalid-vault-request

Example Usage: invalid-vault-response

Example Usage: not-found

Example Usage: rate-limited

Example Usage: regional-hostname

Example Usage: route-deadline

Example Usage: vault-request-failed

Example Usage: vault-timed-out

Example Usage: vault-unavailable

Example Usage: workspace-scope-unavailable

Example Usage: writes-disabled

Parameters

Response

*components.VaultSecretResponse, error

Errors