Skip to content

Commit 3ee373e

Browse files
jbeckwith-oaijbeckwith-oai
authored
feat(api): add organization external key management (#4205)
## Summary Add organization external-key registration and validation for AWS, GCP and Azure. ## Changes - Create, retrieve, list, delete and validate organization external-key registrations. - Filter external-key listings by purpose and paginate through results.
1 parent b7d440b commit 3ee373e

14 files changed

Lines changed: 2412 additions & 10 deletions

File tree

‎.castiron.stats.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
schema_version: 1
2-
generation_id: 5f43d20e-1fa7-4356-a5cf-9ba76ebd71ce
3-
openapi_spec_hash: d86a987b0943f67209611629cfe2926f
4-
openapi_transformed_spec_hash: f98b6939664e5171dadad31a12ecf50a
5-
config_hash: 0e042fd083471fc089bcbfe7011a7d01
6-
codegen_sha: eaa28252a89f885820afa16bbd1a753ec589a3c1
7-
codegen_hash: e1d1fbd9e1e10bd7f346d72af1f6a726fbf8c6f7ef655552bfc339f2be788c90
2+
generation_id: 02a4f051-9120-487b-8954-9ea8b97df229
3+
openapi_spec_hash: 017866de8f67cefec8724f830463cbe2
4+
openapi_transformed_spec_hash: d7de2a7f65152a983cdba4c6b4a20d76
5+
config_hash: 3d64bda5a8bbef3ad0572848ae7e87f7
6+
codegen_sha: ab8360c6a37ccd1f94712f0aa9646349279084b1
7+
codegen_hash: cd27c533727eae2ee5d4350f07afd15d7de38e89fd3c4c2e35dbda61cd39f5d8

‎api.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1855,6 +1855,22 @@ Methods:
18551855
- <code title="post /organization/projects/{project_id}/certificates/activate">client.admin.organization.projects.certificates.<a href="./src/openai/resources/admin/organization/projects/certificates.py">activate</a>(project_id, \*\*<a href="src/openai/types/admin/organization/projects/certificate_activate_params.py">params</a>) -> <a href="./src/openai/types/admin/organization/projects/certificate_activate_response.py">SyncPage[CertificateActivateResponse]</a></code>
18561856
- <code title="post /organization/projects/{project_id}/certificates/deactivate">client.admin.organization.projects.certificates.<a href="./src/openai/resources/admin/organization/projects/certificates.py">deactivate</a>(project_id, \*\*<a href="src/openai/types/admin/organization/projects/certificate_deactivate_params.py">params</a>) -> <a href="./src/openai/types/admin/organization/projects/certificate_deactivate_response.py">SyncPage[CertificateDeactivateResponse]</a></code>
18571857

1858+
### ExternalKeys
1859+
1860+
Types:
1861+
1862+
```python
1863+
from openai.types.admin.organization import ExternalKey, ExternalKeyValidateResponse
1864+
```
1865+
1866+
Methods:
1867+
1868+
- <code title="post /organization/external_keys">client.admin.organization.external_keys.<a href="./src/openai/resources/admin/organization/external_keys.py">create</a>(\*\*<a href="src/openai/types/admin/organization/external_key_create_params.py">params</a>) -> <a href="./src/openai/types/admin/organization/external_key.py">ExternalKey</a></code>
1869+
- <code title="get /organization/external_keys/{external_key_id}">client.admin.organization.external_keys.<a href="./src/openai/resources/admin/organization/external_keys.py">retrieve</a>(external_key_id) -> <a href="./src/openai/types/admin/organization/external_key.py">ExternalKey</a></code>
1870+
- <code title="get /organization/external_keys">client.admin.organization.external_keys.<a href="./src/openai/resources/admin/organization/external_keys.py">list</a>(\*\*<a href="src/openai/types/admin/organization/external_key_list_params.py">params</a>) -> <a href="./src/openai/types/admin/organization/external_key.py">SyncCursorPage[ExternalKey]</a></code>
1871+
- <code title="delete /organization/external_keys/{external_key_id}">client.admin.organization.external_keys.<a href="./src/openai/resources/admin/organization/external_keys.py">delete</a>(external_key_id) -> <a href="./src/openai/types/admin/organization/external_key.py">ExternalKey</a></code>
1872+
- <code title="post /organization/external_keys/{external_key_id}/validate">client.admin.organization.external_keys.<a href="./src/openai/resources/admin/organization/external_keys.py">validate</a>(external_key_id) -> <a href="./src/openai/types/admin/organization/external_key_validate_response.py">ExternalKeyValidateResponse</a></code>
1873+
18581874
# [Responses](src/openai/resources/responses/api.md)
18591875

18601876
# [Live](src/openai/resources/live/api.md)

‎api_reference/openapi.transformed.yml‎

Lines changed: 349 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37508,6 +37508,125 @@ paths:
3750837508
"object": "response.input_tokens",
3750937509
"input_tokens": 11
3751037510
}
37511+
/organization/external_keys:
37512+
post:
37513+
summary: Add an external key config for an organization
37514+
description: Add an external key config for an organization
37515+
operationId: Addanexternalkeyconfigforanorganization
37516+
parameters: []
37517+
requestBody:
37518+
content:
37519+
application/json:
37520+
schema:
37521+
$ref: '#/components/schemas/V1OrganizationExternalKeysPostRequest'
37522+
required: true
37523+
responses:
37524+
'200':
37525+
description: Success
37526+
content:
37527+
application/json:
37528+
schema:
37529+
$ref: '#/components/schemas/ExternalKeyResource'
37530+
security:
37531+
- AdminApiKeyAuth: []
37532+
get:
37533+
summary: List the external key configs registered on the user's organization
37534+
description: List the external key configs registered on the user's organization
37535+
operationId: Listtheexternalkeyconfigsregisteredontheuser'sorganization
37536+
parameters:
37537+
- name: limit
37538+
in: query
37539+
required: false
37540+
schema:
37541+
type: integer
37542+
minimum: 0
37543+
maximum: 100
37544+
- name: order
37545+
in: query
37546+
required: false
37547+
schema:
37548+
$ref: '#/components/schemas/OrderEnum'
37549+
- name: after
37550+
in: query
37551+
required: false
37552+
schema:
37553+
anyOf:
37554+
- type: string
37555+
- type: 'null'
37556+
- name: purpose
37557+
in: query
37558+
description: Filter by key purpose. When omitted, returns keys of all purposes.
37559+
required: false
37560+
schema:
37561+
$ref: '#/components/schemas/ExternalKeyPurpose'
37562+
responses:
37563+
'200':
37564+
description: Success
37565+
content:
37566+
application/json:
37567+
schema:
37568+
$ref: '#/components/schemas/ListExternalKeysResource'
37569+
security:
37570+
- AdminApiKeyAuth: []
37571+
/organization/external_keys/{external_key_id}:
37572+
get:
37573+
summary: Retrieve an external key registration
37574+
description: Retrieve a stored external key registration for the user's organization.
37575+
operationId: Retrieveanexternalkeyregistration
37576+
parameters:
37577+
- name: external_key_id
37578+
in: path
37579+
required: true
37580+
schema:
37581+
type: string
37582+
responses:
37583+
'200':
37584+
description: Success
37585+
content:
37586+
application/json:
37587+
schema:
37588+
$ref: '#/components/schemas/ExternalKeyResource'
37589+
security:
37590+
- AdminApiKeyAuth: []
37591+
delete:
37592+
summary: Delete an external key config for the user's organization
37593+
description: Delete an external key config for the user's organization
37594+
operationId: Deleteanexternalkeyconfigfortheuser'sorganization
37595+
parameters:
37596+
- name: external_key_id
37597+
in: path
37598+
required: true
37599+
schema:
37600+
type: string
37601+
responses:
37602+
'200':
37603+
description: Success
37604+
content:
37605+
application/json:
37606+
schema:
37607+
$ref: '#/components/schemas/ExternalKeyResource'
37608+
security:
37609+
- AdminApiKeyAuth: []
37610+
/organization/external_keys/{external_key_id}/validate:
37611+
post:
37612+
summary: Validate an external key config for the user's organization
37613+
description: Validate an external key config for the user's organization
37614+
operationId: Validateanexternalkeyconfigfortheuser'sorganization
37615+
parameters:
37616+
- name: external_key_id
37617+
in: path
37618+
required: true
37619+
schema:
37620+
type: string
37621+
responses:
37622+
'200':
37623+
description: Success
37624+
content:
37625+
application/json:
37626+
schema:
37627+
$ref: '#/components/schemas/ValidateExternalKeyResource'
37628+
security:
37629+
- AdminApiKeyAuth: []
3751137630
webhooks:
3751237631
agent_environment_expired:
3751337632
post:
@@ -110678,6 +110797,236 @@ components:
110678110797
- num_requests
110679110798
title: Web search usage
110680110799
description: Usage details for web search requests that ran while generating the response.
110800+
AwsExternalKeyParams:
110801+
properties:
110802+
name:
110803+
type: string
110804+
description: A friendly name to identify this config
110805+
type:
110806+
type: string
110807+
enum:
110808+
- aws
110809+
default: aws
110810+
x-stainless-const: true
110811+
role_arn:
110812+
type: string
110813+
pattern: ^arn:aws:iam::\d{12}:role/.+$
110814+
description: The Role ARN that OpenAI will assume to call your KMS
110815+
kms_arn:
110816+
type: string
110817+
description: The Key Management System ARN for the master key you manage
110818+
external_id:
110819+
type: string
110820+
description: The ExternalID that OpenAI will pass in the AssumeRole call for the customer's AWS account. This must be the OpenAI organization ID or an API project ID that belongs to the organization.
110821+
purpose:
110822+
$ref: '#/components/schemas/ExternalKeyPurpose'
110823+
type: object
110824+
required:
110825+
- name
110826+
- type
110827+
- role_arn
110828+
- kms_arn
110829+
- external_id
110830+
AzureExternalKeyParams:
110831+
properties:
110832+
name:
110833+
type: string
110834+
description: A friendly name to identify this config
110835+
type:
110836+
type: string
110837+
enum:
110838+
- azure
110839+
default: azure
110840+
x-stainless-const: true
110841+
tenant_id:
110842+
type: string
110843+
pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
110844+
description: Your Azure tenant UUID
110845+
vault_uri:
110846+
type: string
110847+
pattern: ^https://.+\.vault\.azure\.net/?$
110848+
description: The URI of the Azure vault containing the master key you manage
110849+
key_name:
110850+
type: string
110851+
maxLength: 127
110852+
pattern: ^org-[0-9a-zA-Z-]*--[0-9a-zA-Z-]*$
110853+
description: The name of the Azure Key Vault master key that you manage
110854+
purpose:
110855+
$ref: '#/components/schemas/ExternalKeyPurpose'
110856+
key_version:
110857+
type: string
110858+
pattern: ^[0-9a-fA-F]{32}$
110859+
description: An exact Azure Key Vault key version. Required for PSP decryption; not accepted for EKM.
110860+
type: object
110861+
required:
110862+
- name
110863+
- type
110864+
- tenant_id
110865+
- vault_uri
110866+
- key_name
110867+
ExternalKeyPurpose:
110868+
type: string
110869+
enum:
110870+
- ekm
110871+
- psp_decryption
110872+
ExternalKeyResource:
110873+
properties:
110874+
object:
110875+
type: string
110876+
id:
110877+
type: string
110878+
type:
110879+
type: string
110880+
purpose:
110881+
$ref: '#/components/schemas/ExternalKeyPurpose'
110882+
name:
110883+
type: string
110884+
api_project_ids:
110885+
items:
110886+
type: string
110887+
type: array
110888+
workspace_id:
110889+
type: string
110890+
created_at:
110891+
type: integer
110892+
role_arn:
110893+
type: string
110894+
external_id:
110895+
type: string
110896+
kms_arn:
110897+
type: string
110898+
workload_identity_project_number:
110899+
type: string
110900+
workload_identity_pool_id:
110901+
type: string
110902+
workload_identity_provider_id:
110903+
type: string
110904+
audience:
110905+
type: string
110906+
kms_project_id:
110907+
type: string
110908+
kms_key_ring_name:
110909+
type: string
110910+
kms_key_name:
110911+
type: string
110912+
kms_key_location:
110913+
type: string
110914+
kms_key_version:
110915+
type: string
110916+
tenant_id:
110917+
type: string
110918+
vault_uri:
110919+
type: string
110920+
key_name:
110921+
type: string
110922+
key_version:
110923+
type: string
110924+
type: object
110925+
required:
110926+
- object
110927+
- id
110928+
- type
110929+
- name
110930+
- api_project_ids
110931+
- workspace_id
110932+
- created_at
110933+
GcpExternalKeyParams:
110934+
properties:
110935+
name:
110936+
type: string
110937+
description: A friendly name to identify this config
110938+
type:
110939+
type: string
110940+
enum:
110941+
- gcp
110942+
default: gcp
110943+
x-stainless-const: true
110944+
workload_identity_project_number:
110945+
type: string
110946+
pattern: ^[0-9]{1,19}$
110947+
description: The numeric GCP project number where you registered OpenAI's workload identity
110948+
workload_identity_pool_id:
110949+
type: string
110950+
description: The pool containing the Workload Identity provider that you registered for OpenAI
110951+
workload_identity_provider_id:
110952+
type: string
110953+
description: The Workload Identity provider that you registered for OpenAI
110954+
kms_project_id:
110955+
type: string
110956+
description: The string GCP project name where your KMS resides
110957+
kms_key_ring_name:
110958+
type: string
110959+
description: The Key Management System key ring for the master key you manage
110960+
kms_key_name:
110961+
type: string
110962+
description: The name of the Key Management System master key you manage
110963+
kms_key_location:
110964+
type: string
110965+
description: The region where your Key Management System master key is located
110966+
audience:
110967+
type: string
110968+
description: The aud field in the identity token OpenAI will pass in the call to the customer's GCP STS. This must be the OpenAI organization ID or an API project ID that belongs to the organization.
110969+
purpose:
110970+
$ref: '#/components/schemas/ExternalKeyPurpose'
110971+
kms_key_version:
110972+
type: string
110973+
pattern: ^[1-9][0-9]*$
110974+
description: An exact CryptoKeyVersion number. Required for PSP decryption; not accepted for EKM.
110975+
type: object
110976+
required:
110977+
- name
110978+
- type
110979+
- workload_identity_project_number
110980+
- workload_identity_pool_id
110981+
- workload_identity_provider_id
110982+
- kms_project_id
110983+
- kms_key_ring_name
110984+
- kms_key_name
110985+
- kms_key_location
110986+
- audience
110987+
ListExternalKeysResource:
110988+
properties:
110989+
object:
110990+
type: string
110991+
enum:
110992+
- list
110993+
default: list
110994+
x-stainless-const: true
110995+
data:
110996+
items:
110997+
$ref: '#/components/schemas/ExternalKeyResource'
110998+
type: array
110999+
first_id:
111000+
anyOf:
111001+
- type: string
111002+
- type: 'null'
111003+
last_id:
111004+
anyOf:
111005+
- type: string
111006+
- type: 'null'
111007+
has_more:
111008+
type: boolean
111009+
type: object
111010+
required:
111011+
- object
111012+
- data
111013+
- first_id
111014+
- last_id
111015+
- has_more
111016+
V1OrganizationExternalKeysPostRequest:
111017+
discriminator:
111018+
propertyName: type
111019+
anyOf:
111020+
- $ref: '#/components/schemas/AwsExternalKeyParams'
111021+
- $ref: '#/components/schemas/GcpExternalKeyParams'
111022+
- $ref: '#/components/schemas/AzureExternalKeyParams'
111023+
ValidateExternalKeyResource:
111024+
properties:
111025+
status:
111026+
type: string
111027+
type: object
111028+
required:
111029+
- status
110681111030
SessionSpendControlResource:
110682111031
type: object
110683111032
properties:

0 commit comments

Comments
 (0)