API reference

Chat completions

POST /v1/chat/completions (OpenAI shape) and POST /v1/messages (Anthropic shape). Provider keys stay in the vault.

Receipts

Every response includes prune_metadata. Verify offline with signed receipts. Agent runs: GET /v1/runs/{run_id}/receipt.

Opt-in savings headers

• X-Prune-Model-Policy: balanced - cheaper model for simple tasks
• X-Prune-Cache: semantic + X-Prune-Max-Cache-Error - paraphrase cache (off by default)
• X-Prune-Batch: true - non-stream OpenAI calls go to the provider Batch API (about 50% off, results within 24h). Returns 202 with an id; poll GET /v1/batches/{id} for the result.
• X-Prune-Budget-Downgrade: true + X-Prune-Budget-Downgrade-Model - switch to a cheaper model when this key is near its daily spend cap (default: 15% of the cap left; or set X-Prune-Budget-Downgrade-Below-Usd).

Scoped keys

POST /v1/keys mints a key limited by any of allowed_models, allowed_tools, denied_tools, allowed_ips, expires_in_days, rate_limit_per_minute, daily_spend_limit_usd and monthly_spend_limit_usd. The secret is returned once. GET /v1/keys lists keys; DELETE /v1/keys/{id} revokes one. Scoped keys cannot mint or revoke keys.

Audit log

GET /v1/audit/events returns Shield events (blocks, PII, injection, tool policy, spend caps) and key changes, newest first. Filters: since, before, event_type, api_key_id, limit (max 500). Page with next_before.

Streaming

Streams get the same tool-call firewall as non-stream calls: tool call arguments are held until the call is complete, checked, and either sent or replaced with an SSE error event (finish_reason: "content_filter").