Overview
Store host-bound secrets for a workspace or for one intern. Scope is selected by the API key. Responses return metadata only, never secret values. See https://openrouter.ai/docs/guides/ori/vault.Available Operations
- ListInternVaultSecrets - List intern secrets
- DeleteInternVaultSecret - Delete an intern secret
- StoreInternVaultSecret - Store an intern secret
- CopyVaultSecretsToIntern - Copy workspace secrets to an intern
- ListVaultSecrets - List workspace secrets
- DeleteVaultSecret - Delete a workspace secret
- StoreVaultSecret - Store a workspace secret
ListInternVaultSecrets
Lists secret metadata stored for one intern. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated withlimit and offset. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.
Example Usage
Parameters
Response
*components.VaultSecretListResponse, errorErrors
DeleteInternVaultSecret
Deletes a secret stored for one intern. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such aseu.openrouter.ai are refused. API key required.
Example Usage
Parameters
Response
errorErrors
StoreInternVaultSecret
Creates or replaces a secret stored for one intern. The value is encrypted at rest and released only to the exact hostnames inhosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.
Example Usage: body-timed-out
Example Usage: body-too-large
Example Usage: internal-error
Example Usage: invalid-or-missing-api-key
Example Usage: invalid-vault-request
Example Usage: invalid-vault-response
Example Usage: not-found
Example Usage: rate-limited
Example Usage: regional-hostname
Example Usage: route-deadline
Example Usage: transfer-in-progress
Example Usage: vault-request-failed
Example Usage: vault-timed-out
Example Usage: vault-unavailable
Example Usage: workspace-scope-unavailable
Example Usage: writes-disabled
Parameters
Response
*components.VaultSecretResponse, errorErrors
CopyVaultSecretsToIntern
Copies the named workspace secrets into one intern’s scope, replacing any intern secret with the same name. Each copy keeps the source value and host bindings. Every name must exist in the workspace scope or the request fails with 404 and nothing is copied. A workspace secret whosehosts is null cannot be copied: the request fails with 409 and nothing is copied until that secret is stored again with hosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.
Example Usage: body-timed-out
Example Usage: body-too-large
Example Usage: copy-conflict
Example Usage: internal-error
Example Usage: invalid-or-missing-api-key
Example Usage: invalid-vault-request
Example Usage: invalid-vault-response
Example Usage: not-found
Example Usage: rate-limited
Example Usage: regional-hostname
Example Usage: route-deadline
Example Usage: vault-request-failed
Example Usage: vault-timed-out
Example Usage: vault-unavailable
Example Usage: workspace-scope-unavailable
Example Usage: writes-disabled
Parameters
Response
*components.VaultSecretCopyResponse, errorErrors
ListVaultSecrets
Lists secret metadata for the workspace of the authenticated API key. Responses contain names, bound hosts, fingerprints and creation times, never secret values. Results are ordered by name and paginated withlimit and offset. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.
Example Usage
Parameters
Response
*components.VaultSecretListResponse, errorErrors
DeleteVaultSecret
Deletes a secret from the workspace of the authenticated API key. Returns 204 with no body on success and 404 when the secret does not exist in the selected scope. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such aseu.openrouter.ai are refused. API key required.
Example Usage
Parameters
Response
errorErrors
StoreVaultSecret
Creates or replaces a secret in the workspace of the authenticated API key. The value is encrypted at rest and released only to the exact hostnames inhosts. The response carries metadata only. Writes return 503 while vault writes are disabled for the caller. The scope is selected by the API key: workspace routes act on the key’s active workspace and intern routes act on one intern inside that workspace. There is no default workspace and no fallback to another scope. Every vault route, including reads, requires access to the Intern API programme and returns 404 outside it. Requests on regional hostnames such as eu.openrouter.ai are refused. API key required.