Account, keys and tenants

get/api/v1/activity

Activity

Newest-first request log; pass before=<ts of the last row> to page further back. traced marks rows whose spans and events are still in the tracer buffer (GET /api/v1/trace/{request_id}); outcome summarises the feedback reported for the request; logged marks rows whose prompt and answer were kept under the workspace's log_payloads policy (logging is the mode in force: off / redacted / full). tenant keeps one tenant's rows; a tenant-pinned key sees its own tenant's only.

Requires an API key

curl -s "$OSR_URL/api/v1/activity?limit=50" \
  -H "Authorization: Bearer $OSR_API_KEY"

delete/api/v1/activity/logs

Delete Activity Logs

Erase every prompt and answer the workspace's log_payloads policy stored (admin role). The activity rows, traces and outcomes stay; turn the policy to off to stop new rows.

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/activity/logs" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/alerts

Alerts

Active conditions, most severe first: budgets nearly spent or exhausted and failing requests for the workspace; on plans with stats also the deployment's readiness, 5xx rate, latency SLO, open circuit breakers, routing drift, autopilot errors, a stale routing SLM and tracing being off. Each alert names the dashboard page that shows or fixes it. Evaluated on request from the platform's own state.

Requires an API key

curl -s "$OSR_URL/api/v1/alerts" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/announcements

List Mine

Live announcements for the caller's workspace (maintenance mode first, when it is on).

Requires an API key

curl -s "$OSR_URL/api/v1/announcements" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/announcements/{announcement_id}/dismiss

Dismiss

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/announcements/<announcement_id>/dismiss" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/cache

Cache Stats

What the workspace's response cache holds: live entries, hits served, the policy TTL in force.

Requires an API key

curl -s "$OSR_URL/api/v1/cache" \
  -H "Authorization: Bearer $OSR_API_KEY"

delete/api/v1/cache

Cache Clear

Empty the workspace's response cache (admin role); the next identical request reaches a provider.

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/cache" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/email/events/acs

Acs Delivery Reports

Azure Communication Services delivery and engagement reports (an Event Grid webhook subscription on the Communication Services resource, events EmailDeliveryReportReceived and EmailEngagementTrackingReportReceived). The URL carries ?token= equal to OSR_PLATFORM_MAIL_EVENTS_TOKEN; without the setting the endpoint answers 404, with the wrong token 401. The Event Grid validation handshake is answered; a report of Bounced / Suppressed / Quarantined / FilteredSpam puts the address on the suppression list, Expired for thirty days, and every report is written to the outbox row it refers to.

No authentication

curl -s -X POST "$OSR_URL/api/v1/email/events/acs"

get/api/v1/email/preferences

Preferences By Token

The preferences page behind the *Manage e-mail preferences* link of a message (no sign-in needed).

No authentication

curl -s "$OSR_URL/api/v1/email/preferences"

put/api/v1/email/preferences

Set Preferences By Token

No authentication

curl -s -X PUT "$OSR_URL/api/v1/email/preferences" \
  -H "Content-Type: application/json" \
  -d '{ "newsletter": false, "preferences": {}, "timezone": "string" }'

{
  "newsletter": false,
  "preferences": {},
  "timezone": "string"
}

post/api/v1/email/unsubscribe

One Click Unsubscribe

RFC 8058 one-click unsubscribe (the List-Unsubscribe target): switches category off for the user the token names. Mail clients POST List-Unsubscribe=One-Click here without showing a page.

No authentication

curl -s -X POST "$OSR_URL/api/v1/email/unsubscribe"

get/api/v1/events

Events

Recent tracer events of the workspace's requests (name may end with *, e.g. route.*). Oldest first, at most limit (default 200, max 2000). Deployment-wide events without a request id (breaker transitions, autopilot) are included on plans with stats. since / until (epoch seconds) select a time range from the platform's persisted telemetry (default the last 6 hours); source says whether the rows came from the store or the in-memory buffer.

Requires an API key

curl -s "$OSR_URL/api/v1/events?limit=200" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/events/stream

Events Stream

The same events as GET /api/v1/events, pushed as they are recorded (server-sent events). Each event is one event: <name> / data: {...} frame; a : ping comment every 15 seconds keeps the connection alive; the stream ends after max_s seconds (default and ceiling one hour - reconnect to continue). Filters are the list endpoint's request_id / name / kind / level. Every replica reads the shared telemetry store, so the stream sees every replica's events; without a store it follows this process's buffer. A disabled tracer answers 404 before the stream starts.

Requires an API key

curl -s "$OSR_URL/api/v1/events/stream" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/governance

Governance

One view of the AI-governance posture of the workspace on this deployment. Controls in force (input guard, PII redaction, output guard, audit chain, metrics, tracing), the workspace policy and tenants with their budgets and spend, the plan's limits and quota, the catalogue's data boundaries and PII-capable targets, data retention, the API-key hygiene (keys), the guard verdicts of the last 24 hours (guard_activity) and the compliance findings with a 0-100 posture score (posture).

Requires an API key

curl -s "$OSR_URL/api/v1/governance" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/governance/report

Governance Report

The compliance evidence bundle (admin role): the governance payload plus members and roles, the SSO connection (no secret), every active key with scopes, limits and expiry, and the platform identity. format=markdown downloads it as a Markdown document for an audit file.

Requires an API key

curl -s "$OSR_URL/api/v1/governance/report?format=json" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/insights

Insights

What the last days say, as findings: cost against the window before with the targets that moved it, unusual days, failures, speed, concentration on one target, savings against the baseline and spend the extension saw outside the router - each with its evidence and the page that acts on it. A headline sums it up. Computed from the workspace's own metered rows; no model is involved.

Requires an API key

curl -s "$OSR_URL/api/v1/insights?days=7" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/insights/ask

Ask

Answer a plain-words question about this workspace (*why did my cost go up*, *is anything slower*, *where could I save*) from the same findings: the subject is read from the question, the matching findings come back with one answer sentence, and the rest of the questions people ask as suggestions.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/insights/ask" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "question": "string" }'

{
  "question": "string"
}

get/api/v1/keys

Keys

The workspace's API keys (prefixes, never the secret); a tenant-pinned key lists its tenant's only.

Requires an API key

curl -s "$OSR_URL/api/v1/keys" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/keys

Create Key

Mint a key (admin role). team names one of the organization's teams: the key is pinned to the team's tenant, and a lead of that team may mint it without the admin role.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/keys" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "expires_in_days": 1, "limits": {}, "scopes": [], "team": "string", "tenant": "string" }'

{
  "expires_in_days": 1,
  "limits": {},
  "scopes": [],
  "team": "string",
  "tenant": "string"
}

get/api/v1/keys/scopes

Key Scopes

The scopes a key can be limited to (POST /keys scopes), the longest allowed expiry and the limits keys (budgets, allowed targets).

No authentication

curl -s "$OSR_URL/api/v1/keys/scopes"

patch/api/v1/keys/{key_id}

Rename Key

Rename an active key, change its scopes and / or replace its limits (the secret does not change). Admin role, or a lead of the team the key was minted for.

Requires an API key

curl -s -X PATCH "$OSR_URL/api/v1/keys/<key_id>" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "expires_in_days": 1, "limits": {}, "scopes": [], "team": "string", "tenant": "string" }'

{
  "expires_in_days": 1,
  "limits": {},
  "scopes": [],
  "team": "string",
  "tenant": "string"
}

delete/api/v1/keys/{key_id}

Revoke Key

Revoke a key (admin role, or a lead of the team the key was minted for).

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/keys/<key_id>" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/keys/{key_id}/rotate

Rotate Key

Issue a new secret for the key and invalidate the old one immediately; the new value is shown once. The key keeps its id and name, so dashboards and audit rows stay attached to it. Admin role, or a lead of the team the key was minted for.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/keys/<key_id>/rotate" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/learning

Learning

How the router learns on this deployment: the strategy ensemble and its weights, the learner state (persistence, drift resets, quarantined state), per-target outcome statistics from feedback, the routing SLM in service (rows, sources, encoder, calibration, accuracy history) and the autopilot (schedule, drift monitor, last cycle, recent champion-vs-challenger reports). Deployment-wide aggregates only - no request text, no per-workspace data. Available on every plan.

Requires an API key

curl -s "$OSR_URL/api/v1/learning" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/legal

Public Legal

The versions of the terms of service and the privacy notice: what applies today, what is announced for a later date and the history. No key needed.

No authentication

curl -s "$OSR_URL/api/v1/legal"

get/api/v1/me

Me

Requires an API key

curl -s "$OSR_URL/api/v1/me" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/me/audit

My Audit

The signed-in person's own account history: sign-ins, password and email changes, memberships.

Requires an API key

curl -s "$OSR_URL/api/v1/me/audit?limit=50" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/me/delete

Delete Me

Delete the signed-in user: sessions, linked identities and memberships go; workspaces they alone owned are disabled with their keys. Organizations with other members need another owner first. Requires the password when one is set and the account email typed as confirmation.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/me/delete" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "password": "string" }'

{
  "password": "string"
}

get/api/v1/me/email-preferences

My Preferences

What the platform may e-mail you: the optional categories, the newsletter subscription of your address and (owners and admins) the workspace's usage-report schedule.

Requires an API key

curl -s "$OSR_URL/api/v1/me/email-preferences" \
  -H "Authorization: Bearer $OSR_API_KEY"

put/api/v1/me/email-preferences

Set My Preferences

Switch categories on or off and subscribe to or leave the newsletter. A verified address joins the newsletter at once; an unverified one receives the usual confirmation link.

Requires an API key

curl -s -X PUT "$OSR_URL/api/v1/me/email-preferences" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "newsletter": false, "preferences": {}, "timezone": "string" }'

{
  "newsletter": false,
  "preferences": {},
  "timezone": "string"
}

get/api/v1/me/export

My Export

Everything the platform holds about the signed-in person and the current workspace, as one JSON document (data portability): profile, identities, sessions, memberships, the workspace with its keys (prefixes only), tenants, policy, SSO connection, usage summary, request log and reported outcomes for the last days (max 365), plus the account history. Prompt text is stored only under a log_payloads policy; request_logs carries whatever was kept.

Requires an API key

curl -s "$OSR_URL/api/v1/me/export?days=365" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/me/legal

My Legal

Which versions of the terms and the privacy notice you accepted, whether the versions in effect are covered (pending lists the ones that still need your acceptance) and announced changes.

Requires an API key

curl -s "$OSR_URL/api/v1/me/legal" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/me/legal/accept

Accept Legal

Record that you accept the newest published version of the given documents (default: all). Every acceptance is kept with its time and source; the response is the updated status.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/me/legal/accept" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "documents": [] }'

{
  "documents": []
}

put/api/v1/me/login-alerts

Set Login Alerts

When the person is told about a sign-in (mail and the bell): new - a device or a country the account has not been seen on, the default - or always - every sign-in. The notice cannot be switched off: it is the one message that tells someone their account is being used.

Requires an API key

curl -s -X PUT "$OSR_URL/api/v1/me/login-alerts" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "mode": "string" }'

{
  "mode": "string"
}

get/api/v1/notifications

Inbox

The workspace's alert episodes and the reader's own account notices, newest first, with the unread counts the dashboard bell shows.

Requires an API key

curl -s "$OSR_URL/api/v1/notifications?unread=false&limit=50" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/notifications/channels

Channels

The workspace's channels plus what they can be configured with: alert rules and severities, and the platform event_types a webhook / Slack / Teams channel can subscribe to (events on the channel; "*" and "key.*" patterns work). Event deliveries carry X-OSR-Event and, with a secret, X-OSR-Signature; they are listed under /deliveries and retried like alert deliveries.

Requires an API key

curl -s "$OSR_URL/api/v1/notifications/channels" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/notifications/channels

Create Channel

Add an email, webhook, Slack or Teams channel; webhooks may carry a secret for X-OSR-Signature and webhook / Slack / Teams channels may subscribe to platform events.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/notifications/channels" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "kind": "string", "target": "string" }'

{
  "kind": "string",
  "target": "string"
}

patch/api/v1/notifications/channels/{channel_id}

Patch Channel

Requires an API key

curl -s -X PATCH "$OSR_URL/api/v1/notifications/channels/<channel_id>" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "enabled": false, "events": [], "min_severity": "string", "name": "default", "rules": [], "secret": "string", "target": "string" }'

{
  "enabled": false,
  "events": [],
  "min_severity": "string",
  "name": "default",
  "rules": [],
  "secret": "string",
  "target": "string"
}

delete/api/v1/notifications/channels/{channel_id}

Delete Channel

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/notifications/channels/<channel_id>" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/notifications/channels/{channel_id}/test

Test Channel

Send a test notification through the channel and report the result.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/notifications/channels/<channel_id>/test" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/notifications/deliveries

Deliveries

Requires an API key

curl -s "$OSR_URL/api/v1/notifications/deliveries?limit=100" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/notifications/read

Read

Mark the given notifications (or all) as read for the workspace.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/notifications/read" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "ids": [] }'

{
  "ids": []
}

get/api/v1/notifications/unread

Unread

Requires an API key

curl -s "$OSR_URL/api/v1/notifications/unread" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/onboarding

Onboarding

Getting-started checklist of the calling workspace: what is done, what to do next, with the links. steps is *setup readiness*: verify the e-mail address, create an API key, route a first request, report a first outcome, connect a model provider (executable targets), invite a teammate (organizations). complete is the share of steps done; the dashboard shows the list until every step is done. value is kept apart from setup on purpose - a finished checklist is not proof the workspace got anything out of the platform: its milestones are the first *executed* request (a target answered, not only a decision), the first outcome reported as a success and a return visit on another day, each with the count behind it.

Requires an API key

curl -s "$OSR_URL/api/v1/onboarding" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/policy

Policy

The workspace-wide routing policy: constraints and budgets applied to every request.

Requires an API key

curl -s "$OSR_URL/api/v1/policy" \
  -H "Authorization: Bearer $OSR_API_KEY"

put/api/v1/policy

Set Policy

Replace the workspace policy (admin role). Target ids are checked against the catalogue.

Requires an API key

curl -s -X PUT "$OSR_URL/api/v1/policy" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "config": {} }'

{
  "config": {}
}

delete/api/v1/policy

Delete Policy

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/policy" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/prompts

Prompts List

Every prompt of the workspace: newest version, version count, labels and the variables it uses.

Requires an API key

curl -s "$OSR_URL/api/v1/prompts" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/prompts

Prompts Create

Add a version: version 1 of a new name, or the next version of an existing one (versions are immutable). labels named here move to this version. manage scope.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/prompts" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "content": "Prove that sqrt(2) is irrational.", "name": "default" }'

{
  "content": "Prove that sqrt(2) is irrational.",
  "name": "default"
}

get/api/v1/prompts/{name}

Prompts Versions

Every version of name, newest first, with content.

Requires an API key

curl -s "$OSR_URL/api/v1/prompts/<name>" \
  -H "Authorization: Bearer $OSR_API_KEY"

delete/api/v1/prompts/{name}

Prompts Delete

Delete a prompt with every version (requests naming it answer 404 from then on).

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/prompts/<name>" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/prompts/{name}/render

Prompts Render

Preview a version with variables - what the instruction and the examples become, nothing routed.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/prompts/<name>/render" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "label": "string", "variables": {}, "version": 1 }'

{
  "label": "string",
  "variables": {},
  "version": 1
}

get/api/v1/prompts/{name}/stats

Prompts Stats

How each version did on the requests that named it in the last days: requests, answered share, tokens, cost, median latency, reported success rate and mean quality - version against version.

Requires an API key

curl -s "$OSR_URL/api/v1/prompts/<name>/stats?days=30" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/prompts/{name}/{version}

Prompts Get

Requires an API key

curl -s "$OSR_URL/api/v1/prompts/<name>/<version>" \
  -H "Authorization: Bearer $OSR_API_KEY"

delete/api/v1/prompts/{name}/{version}

Prompts Delete Version

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/prompts/<name>/<version>" \
  -H "Authorization: Bearer $OSR_API_KEY"

put/api/v1/prompts/{name}/{version}/labels

Prompts Labels

Deploy by label: the labels this version carries (production, staging ...). A label names one version, so naming it here takes it from the version that had it. manage scope.

Requires an API key

curl -s -X PUT "$OSR_URL/api/v1/prompts/<name>/<version>/labels" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "labels": [] }'

{
  "labels": []
}

get/api/v1/quota

Quota

Where the workspace stands against its plan this month: used / limit / remaining, percent, resets_at (start of the next UTC month), state (ok | warning | overage | exhausted) and, on plans with an overage rate, the requests beyond the quota and their estimated cost. Not metered.

Requires an API key

curl -s "$OSR_URL/api/v1/quota" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/referrals

My Referrals

The workspace's referral code and link, the terms, the referrals so far and what they earned.

Requires an API key

curl -s "$OSR_URL/api/v1/referrals" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/referrals/invite

Invite

E-mail the referral link to one address (twenty a day per workspace).

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/referrals/invite" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "email": "ada@example.com" }'

{
  "email": "ada@example.com"
}

get/api/v1/referrals/lookup

Lookup

What a visitor on a referral link is offered: whether the code is live and the welcome credit. Names the inviting workspace by its initials only.

No authentication

curl -s "$OSR_URL/api/v1/referrals/lookup"

get/api/v1/savings

Savings

Baseline-vs-routed cost over the window; baseline defaults to the priciest model. A tenant-pinned key sees its tenant's executed traffic only.

Requires an API key

curl -s "$OSR_URL/api/v1/savings?days=30" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/signals

Signals

The account's own product-usage signals (the same facts sales sees in /admin/pql).

Requires an API key

curl -s "$OSR_URL/api/v1/signals?days=30" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/sla

Sla

What the plan commits to and how the calendar month is going against it: availability (the share of the workspace's metered requests the platform answered without a 5xx, against sla_uptime_pct) and support (first-response times of the tickets opened this month, against the tier's support_response_hours). met is null until there is something to measure; plans without a commitment still get the figures, with target null.

Requires an API key

curl -s "$OSR_URL/api/v1/sla" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/telemetry/series

Telemetry Series

The workspace's traffic as a time series: requests, failures, p50 / p95 latency, cost and tokens per bucket over window (1h, 6h, 24h, 7d, 30d), with totals per target and endpoint. Plans with stats also get http: the deployment's requests, 5xx and latency percentiles per bucket. Computed from the platform's own records - no external metrics system.

Requires an API key

curl -s "$OSR_URL/api/v1/telemetry/series?window=24h" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/tenants

Tenants

Every tenant with this month's usage, today's and this month's spend against its budgets, and the number of API keys pinned to it. A tenant-pinned key sees its own tenant only.

Requires an API key

curl -s "$OSR_URL/api/v1/tenants" \
  -H "Authorization: Bearer $OSR_API_KEY"

put/api/v1/tenants

Upsert Tenant

Requires an API key

curl -s -X PUT "$OSR_URL/api/v1/tenants" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "slug": "eu-health", "config": { "region": "eu", "data_boundary": "private" } }'

{
  "slug": "eu-health",
  "config": {
    "region": "eu",
    "data_boundary": "private"
  }
}

delete/api/v1/tenants/{slug}

Delete Tenant

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/tenants/<slug>" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/trace/{request_id}

Trace

Every span and event the router recorded for one of the workspace's requests, in time order. Spans (kind: "span") carry duration_ms and status; events carry the stage's facts (signals, policy rejections, ranking, escalation, fallback, guard verdicts, execution steps). outcomes lists the feedback reported for the request and audit its hash-chained records (plans with audit). Request text never appears - only its digest. 404 when the request id is not this workspace's.

Requires an API key

curl -s "$OSR_URL/api/v1/trace/<request_id>" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/usage

Usage

Requests, tokens, cost and latency over days per day, target, endpoint and tenant; tenant narrows the window to one tenant slug (its by_tenant still lists every tenant). A tenant-pinned key always gets its own tenant's figures and nothing else.

Requires an API key

curl -s "$OSR_URL/api/v1/usage?days=30" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/usage/activity

Activity List

The workspace's client events, newest first; before=<ts of the last row> pages further back, app picks one client, kind one event kind or a prefix (pii.*).

Requires an API key

curl -s "$OSR_URL/api/v1/usage/activity?days=30&limit=200" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/usage/activity

Activity Ingest

Record what the browser extension or the desktop app did (kinds, counts and figures - never text). feedback scope (the path is in auth._FEEDBACK_PATHS). The plan caps events per day (activity_events_per_day): a batch that would cross it answers 429 with Retry-After and nothing is recorded; the answer always names the cap and the plan's retention.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/usage/activity" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "items": [] }'

{
  "items": []
}

get/api/v1/usage/activity/summary

Activity Summary

Totals per app, kind and site and the per-day series of client events, plus what the plan keeps (retention_days) and allows (limit_per_day, today).

Requires an API key

curl -s "$OSR_URL/api/v1/usage/activity/summary?days=30" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/usage/imports

List Imports

The analyses kept for the workspace, newest first, with their headline figures.

Requires an API key

curl -s "$OSR_URL/api/v1/usage/imports" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/usage/imports

Create Import

Analyse a usage export from your model provider and, unless dry_run=true, keep the analysis. text is the export as the provider gave it: the OpenAI usage or costs CSV, the Anthropic console usage CSV, an Azure cost-analysis export, or any CSV / JSON with a date, a model and token or amount columns (provider names the provider when the rows carry none; auto infers it from the model names) - or the text of an invoice, whose line items are read with their amounts. Every line is priced at what the export says it cost - or at catalogue list price when it carries no amounts - and at what the router's recommended target would have charged for the same token shape. The answer is the analysis: totals, the saving, the split per provider and model, the daily series, the lines (up to 5,000 inline; the file exports carry all) and notes on what was assumed. Dates, names and numbers are read; every other column is ignored and never stored.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/usage/imports?dry_run=false" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "text": "Prove that sqrt(2) is irrational." }'

{
  "text": "Prove that sqrt(2) is irrational."
}

get/api/v1/usage/imports/samples

List Samples

Sample exports in each provider's own layout (invented figures), to try the analysis before touching a real bill: post one as text with ?dry_run=true.

Requires an API key

curl -s "$OSR_URL/api/v1/usage/imports/samples" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/usage/imports/upload

Upload Import

The same analysis for a multipart upload (file + optional name and provider fields), for curl and integrations that hold the file rather than its text. A PDF is read as an invoice: the vendor, the billing period and every line item that names a model with an amount.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/usage/imports/upload?dry_run=false" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/usage/imports/{import_id}

Get Import

One analysis with its lines; format=csv downloads the lines, xlsx a workbook (summary, by provider, by model, daily, lines) and pdf the report.

Requires an API key

curl -s "$OSR_URL/api/v1/usage/imports/<import_id>?format=json" \
  -H "Authorization: Bearer $OSR_API_KEY"

delete/api/v1/usage/imports/{import_id}

Delete Import

Delete an analysis and its lines.

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/usage/imports/<import_id>" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/usage/observed

Observed List

The recent observations, newest first - the extension's history as the platform stored it.

Requires an API key

curl -s "$OSR_URL/api/v1/usage/observed?days=30&limit=200" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/usage/observed

Observed Ingest

Record calls the browser extension observed on third-party AI surfaces (shape only, never text). Each observation is priced at the observed model's catalogue list price and re-quoted through the router for the same token shape, so the opportunity report can compare them. feedback scope (the path is in auth._FEEDBACK_PATHS; a scoped key that may report outcomes may report observations).

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/usage/observed" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "items": [] }'

{
  "items": []
}

get/api/v1/usage/opportunity

Opportunity

What the workspace spent outside the router (as the extension observed it) against what the router's recommended targets would have cost for the same requests: totals, per model / source / task / day and the models with the largest gap.

Requires an API key

curl -s "$OSR_URL/api/v1/usage/opportunity?days=30" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/usage/report

Routed Report

The workspace's routed usage as one report: requests, tokens in / out / cached, provider cost and your charge per day, model, provider and API key, and the saving against the savings baseline. format=csv downloads the day-model-provider lines, xlsx a workbook with every breakdown, pdf the report.

Requires an API key

curl -s "$OSR_URL/api/v1/usage/report?days=30&format=json" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/workspace/log-export

Log Export List

The workspace's export destinations with their cursors, counts and last error (credentials never).

Requires an API key

curl -s "$OSR_URL/api/v1/workspace/log-export" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/workspace/log-export

Log Export Create

Add a destination: azure_blob (container URL + SAS), webhook (HTTPS URL + bearer token), langfuse (host + public:secret keys) or otlp (an OTLP/HTTP traces endpoint + bearer token or header=value;... pairs) - the last two receive traces with OpenInference attributes and scores. Rows newer than start_from (default: now) are exported every interval_s; include_payloads adds the kept prompt and answer. manage scope.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/workspace/log-export" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "kind": "string", "name": "default", "url": "string" }'

{
  "kind": "string",
  "name": "default",
  "url": "string"
}

patch/api/v1/workspace/log-export/{export_id}

Log Export Update

Rename, re-point, rotate or clear the credential, change the interval, pause or resume.

Requires an API key

curl -s -X PATCH "$OSR_URL/api/v1/workspace/log-export/<export_id>" \
  -H "Authorization: Bearer $OSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "credential": "string", "enabled": false, "include_payloads": false, "interval_s": 0.5, "name": "default", "prefix": "string", "url": "string" }'

{
  "credential": "string",
  "enabled": false,
  "include_payloads": false,
  "interval_s": 0.5,
  "name": "default",
  "prefix": "string",
  "url": "string"
}

delete/api/v1/workspace/log-export/{export_id}

Log Export Delete

Requires an API key

curl -s -X DELETE "$OSR_URL/api/v1/workspace/log-export/<export_id>" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/workspace/log-export/{export_id}/run

Log Export Run

Ship the next batch now (the dashboard's *Export now*) and report rows sent or the error.

Requires an API key

curl -s -X POST "$OSR_URL/api/v1/workspace/log-export/<export_id>/run" \
  -H "Authorization: Bearer $OSR_API_KEY"

get/api/v1/workspace/mcp-servers

Mcp Servers List

The workspace's connected MCP servers with their tools, approval mode, health and last sync.

Requires an API key

curl -s "$OSR_URL/api/v1/workspace/mcp-servers" \
  -H "Authorization: Bearer $OSR_API_KEY"

post/api/v1/workspace/mcp-servers

Mcp Servers Create

Connect a Streamable-HTTP MCP server: name (the tool id prefix), url, an optional bearer credential, extra_headers and the approval mode (auto / read_only / manual). The server is initialised and its tools listed at once; they join the routing pool as name:tool targets.

Requires an API key