Skip to content

Repository navigation

Commit b0407aa

Browse files
jbeckwith-oaijbeckwith-oai
authored
feat(api): add organization external key management (#1302)
## Summary Adds organization external-key registration and validation for AWS, GCP and Azure. ## Changes - Create, retrieve, list, delete and validate organization external-key registrations. - Filter external-key listings by purpose and paginate through results. Co-authored-by: jbeckwith-oai <269036200+jbeckwith-oai@users.noreply.github.com>
1 parent 03f24db commit b0407aa

35 files changed

Lines changed: 8654 additions & 10 deletions

‎.castiron.stats.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
schema_version: 1
2-
generation_id: 0b15e40f-e2d5-44bc-8a85-d3eb023353db
3-
openapi_spec_hash: cf5ab5efb669242adc379d0e918e5deb
4-
openapi_transformed_spec_hash: e2d7b7932ceee8c8ab6dd7fff0efc529
5-
config_hash: 54aec5b489c23fe13627007ad508b52c
6-
codegen_sha: 3dfb31bef4859dd4bf598781064b824e7fe69258
7-
codegen_hash: 16339097ce0069c55c119c1d7a5132fbeb0a242e33a6cc95465a7a390a21ccd1
2+
generation_id: 0bfaea39-9d43-480f-8d87-1a26b9789971
3+
openapi_spec_hash: d9fd900f905fcd9a46dbe63dae90af70
4+
openapi_transformed_spec_hash: 9f5f93198a77d0d90863b8c870305c2c
5+
config_hash: 78346af19ce52080ae1b0b0c37e74368
6+
codegen_sha: dd498b99058f35e2806a0da9ca55e63dc49c81dd
7+
codegen_hash: f186c0fe2fe5a33eed5c56893c8fc152d3fcfbd3182af53a4cc98f0dea6de92c

‎api_reference/openapi.transformed.yml‎

Lines changed: 349 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37514,6 +37514,125 @@ paths:
3751437514
"object": "response.input_tokens",
3751537515
"input_tokens": 11
3751637516
}
37517+
/organization/external_keys:
37518+
post:
37519+
summary: Add an external key config for an organization
37520+
description: Add an external key config for an organization
37521+
operationId: Addanexternalkeyconfigforanorganization
37522+
parameters: []
37523+
requestBody:
37524+
content:
37525+
application/json:
37526+
schema:
37527+
$ref: '#/components/schemas/V1OrganizationExternalKeysPostRequest'
37528+
required: true
37529+
responses:
37530+
'200':
37531+
description: Success
37532+
content:
37533+
application/json:
37534+
schema:
37535+
$ref: '#/components/schemas/ExternalKeyResource'
37536+
security:
37537+
- AdminApiKeyAuth: []
37538+
get:
37539+
summary: List the external key configs registered on the user's organization
37540+
description: List the external key configs registered on the user's organization
37541+
operationId: Listtheexternalkeyconfigsregisteredontheuser'sorganization
37542+
parameters:
37543+
- name: limit
37544+
in: query
37545+
required: false
37546+
schema:
37547+
type: integer
37548+
minimum: 0
37549+
maximum: 100
37550+
- name: order
37551+
in: query
37552+
required: false
37553+
schema:
37554+
$ref: '#/components/schemas/OrderEnum'
37555+
- name: after
37556+
in: query
37557+
required: false
37558+
schema:
37559+
anyOf:
37560+
- type: string
37561+
- type: 'null'
37562+
- name: purpose
37563+
in: query
37564+
description: Filter by key purpose. When omitted, returns keys of all purposes.
37565+
required: false
37566+
schema:
37567+
$ref: '#/components/schemas/ExternalKeyPurpose'
37568+
responses:
37569+
'200':
37570+
description: Success
37571+
content:
37572+
application/json:
37573+
schema:
37574+
$ref: '#/components/schemas/ListExternalKeysResource'
37575+
security:
37576+
- AdminApiKeyAuth: []
37577+
/organization/external_keys/{external_key_id}:
37578+
get:
37579+
summary: Retrieve an external key registration
37580+
description: Retrieve a stored external key registration for the user's organization.
37581+
operationId: Retrieveanexternalkeyregistration
37582+
parameters:
37583+
- name: external_key_id
37584+
in: path
37585+
required: true
37586+
schema:
37587+
type: string
37588+
responses:
37589+
'200':
37590+
description: Success
37591+
content:
37592+
application/json:
37593+
schema:
37594+
$ref: '#/components/schemas/ExternalKeyResource'
37595+
security:
37596+
- AdminApiKeyAuth: []
37597+
delete:
37598+
summary: Delete an external key config for the user's organization
37599+
description: Delete an external key config for the user's organization
37600+
operationId: Deleteanexternalkeyconfigfortheuser'sorganization
37601+
parameters:
37602+
- name: external_key_id
37603+
in: path
37604+
required: true
37605+
schema:
37606+
type: string
37607+
responses:
37608+
'200':
37609+
description: Success
37610+
content:
37611+
application/json:
37612+
schema:
37613+
$ref: '#/components/schemas/ExternalKeyResource'
37614+
security:
37615+
- AdminApiKeyAuth: []
37616+
/organization/external_keys/{external_key_id}/validate:
37617+
post:
37618+
summary: Validate an external key config for the user's organization
37619+
description: Validate an external key config for the user's organization
37620+
operationId: Validateanexternalkeyconfigfortheuser'sorganization
37621+
parameters:
37622+
- name: external_key_id
37623+
in: path
37624+
required: true
37625+
schema:
37626+
type: string
37627+
responses:
37628+
'200':
37629+
description: Success
37630+
content:
37631+
application/json:
37632+
schema:
37633+
$ref: '#/components/schemas/ValidateExternalKeyResource'
37634+
security:
37635+
- AdminApiKeyAuth: []
3751737636
webhooks:
3751837637
agent_environment_expired:
3751937638
post:
@@ -110640,6 +110759,236 @@ components:
110640110759
- num_requests
110641110760
title: Web search usage
110642110761
description: Usage details for web search requests that ran while generating the response.
110762+
AwsExternalKeyParams:
110763+
properties:
110764+
name:
110765+
type: string
110766+
description: A friendly name to identify this config
110767+
type:
110768+
type: string
110769+
enum:
110770+
- aws
110771+
default: aws
110772+
x-stainless-const: true
110773+
role_arn:
110774+
type: string
110775+
pattern: ^arn:aws:iam::\d{12}:role/.+$
110776+
description: The Role ARN that OpenAI will assume to call your KMS
110777+
kms_arn:
110778+
type: string
110779+
description: The Key Management System ARN for the master key you manage
110780+
external_id:
110781+
type: string
110782+
description: The ExternalID that OpenAI will pass in the AssumeRole call for the customer's AWS account. This must be the OpenAI organization ID or an API project ID that belongs to the organization.
110783+
purpose:
110784+
$ref: '#/components/schemas/ExternalKeyPurpose'
110785+
type: object
110786+
required:
110787+
- name
110788+
- type
110789+
- role_arn
110790+
- kms_arn
110791+
- external_id
110792+
AzureExternalKeyParams:
110793+
properties:
110794+
name:
110795+
type: string
110796+
description: A friendly name to identify this config
110797+
type:
110798+
type: string
110799+
enum:
110800+
- azure
110801+
default: azure
110802+
x-stainless-const: true
110803+
tenant_id:
110804+
type: string
110805+
pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
110806+
description: Your Azure tenant UUID
110807+
vault_uri:
110808+
type: string
110809+
pattern: ^https://.+\.vault\.azure\.net/?$
110810+
description: The URI of the Azure vault containing the master key you manage
110811+
key_name:
110812+
type: string
110813+
maxLength: 127
110814+
pattern: ^org-[0-9a-zA-Z-]*--[0-9a-zA-Z-]*$
110815+
description: The name of the Azure Key Vault master key that you manage
110816+
purpose:
110817+
$ref: '#/components/schemas/ExternalKeyPurpose'
110818+
key_version:
110819+
type: string
110820+
pattern: ^[0-9a-fA-F]{32}$
110821+
description: An exact Azure Key Vault key version. Required for PSP decryption; not accepted for EKM.
110822+
type: object
110823+
required:
110824+
- name
110825+
- type
110826+
- tenant_id
110827+
- vault_uri
110828+
- key_name
110829+
ExternalKeyPurpose:
110830+
type: string
110831+
enum:
110832+
- ekm
110833+
- psp_decryption
110834+
ExternalKeyResource:
110835+
properties:
110836+
object:
110837+
type: string
110838+
id:
110839+
type: string
110840+
type:
110841+
type: string
110842+
purpose:
110843+
$ref: '#/components/schemas/ExternalKeyPurpose'
110844+
name:
110845+
type: string
110846+
api_project_ids:
110847+
items:
110848+
type: string
110849+
type: array
110850+
workspace_id:
110851+
type: string
110852+
created_at:
110853+
type: integer
110854+
role_arn:
110855+
type: string
110856+
external_id:
110857+
type: string
110858+
kms_arn:
110859+
type: string
110860+
workload_identity_project_number:
110861+
type: string
110862+
workload_identity_pool_id:
110863+
type: string
110864+
workload_identity_provider_id:
110865+
type: string
110866+
audience:
110867+
type: string
110868+
kms_project_id:
110869+
type: string
110870+
kms_key_ring_name:
110871+
type: string
110872+
kms_key_name:
110873+
type: string
110874+
kms_key_location:
110875+
type: string
110876+
kms_key_version:
110877+
type: string
110878+
tenant_id:
110879+
type: string
110880+
vault_uri:
110881+
type: string
110882+
key_name:
110883+
type: string
110884+
key_version:
110885+
type: string
110886+
type: object
110887+
required:
110888+
- object
110889+
- id
110890+
- type
110891+
- name
110892+
- api_project_ids
110893+
- workspace_id
110894+
- created_at
110895+
GcpExternalKeyParams:
110896+
properties:
110897+
name:
110898+
type: string
110899+
description: A friendly name to identify this config
110900+
type:
110901+
type: string
110902+
enum:
110903+
- gcp
110904+
default: gcp
110905+
x-stainless-const: true
110906+
workload_identity_project_number:
110907+
type: string
110908+
pattern: ^[0-9]{1,19}$
110909+
description: The numeric GCP project number where you registered OpenAI's workload identity
110910+
workload_identity_pool_id:
110911+
type: string
110912+
description: The pool containing the Workload Identity provider that you registered for OpenAI
110913+
workload_identity_provider_id:
110914+
type: string
110915+
description: The Workload Identity provider that you registered for OpenAI
110916+
kms_project_id:
110917+
type: string
110918+
description: The string GCP project name where your KMS resides
110919+
kms_key_ring_name:
110920+
type: string
110921+
description: The Key Management System key ring for the master key you manage
110922+
kms_key_name:
110923+
type: string
110924+
description: The name of the Key Management System master key you manage
110925+
kms_key_location:
110926+
type: string
110927+
description: The region where your Key Management System master key is located
110928+
audience:
110929+
type: string
110930+
description: The aud field in the identity token OpenAI will pass in the call to the customer's GCP STS. This must be the OpenAI organization ID or an API project ID that belongs to the organization.
110931+
purpose:
110932+
$ref: '#/components/schemas/ExternalKeyPurpose'
110933+
kms_key_version:
110934+
type: string
110935+
pattern: ^[1-9][0-9]*$
110936+
description: An exact CryptoKeyVersion number. Required for PSP decryption; not accepted for EKM.
110937+
type: object
110938+
required:
110939+
- name
110940+
- type
110941+
- workload_identity_project_number
110942+
- workload_identity_pool_id
110943+
- workload_identity_provider_id
110944+
- kms_project_id
110945+
- kms_key_ring_name
110946+
- kms_key_name
110947+
- kms_key_location
110948+
- audience
110949+
ListExternalKeysResource:
110950+
properties:
110951+
object:
110952+
type: string
110953+
enum:
110954+
- list
110955+
default: list
110956+
x-stainless-const: true
110957+
data:
110958+
items:
110959+
$ref: '#/components/schemas/ExternalKeyResource'
110960+
type: array
110961+
first_id:
110962+
anyOf:
110963+
- type: string
110964+
- type: 'null'
110965+
last_id:
110966+
anyOf:
110967+
- type: string
110968+
- type: 'null'
110969+
has_more:
110970+
type: boolean
110971+
type: object
110972+
required:
110973+
- object
110974+
- data
110975+
- first_id
110976+
- last_id
110977+
- has_more
110978+
V1OrganizationExternalKeysPostRequest:
110979+
discriminator:
110980+
propertyName: type
110981+
anyOf:
110982+
- $ref: '#/components/schemas/AwsExternalKeyParams'
110983+
- $ref: '#/components/schemas/GcpExternalKeyParams'
110984+
- $ref: '#/components/schemas/AzureExternalKeyParams'
110985+
ValidateExternalKeyResource:
110986+
properties:
110987+
status:
110988+
type: string
110989+
type: object
110990+
required:
110991+
- status
110643110992
SessionSpendControlResource:
110644110993
type: object
110645110994
properties:

0 commit comments

Comments
 (0)