Models & routing
Governance and route simulation
Inspect bounded evidence without granting inference access
Governance read, compliance read and route simulation use credentials deliberately separated from route scope. They expose content-free tenant evidence and route planning, not generation history or a consumer billing ledger.
Read the tenant governance summary
GET /v1/governance/summary requires governance:read, admin or * and always uses the tenant bound to the verified credential. event_limit is 1–200; optional key_id is a safe non-secret service-key filter.
GET https://api.octoryn.dev/v1/governance/summary?event_limit=50
Authorization: Bearer $OCTORYN_GOVERNANCE_KEYUnderstand the read-model boundary
The response contains exact-string tenant budget state, bounded usage aggregates, key attribution, metadata-only audit events and compliance decisions. It reports whether its local event window is partial and never returns prompts, outputs, detected values, raw tokens or token hashes.
Inspect active Compliance & Trust posture
GET /v1/compliance/summary requires compliance:read, governance:read, admin or *. It returns the configured mode, active immutable policy versions and reviewed Provider Trust metadata for the credential-bound tenant. It does not expose policy content values, credentials or customer data.
GET https://api.octoryn.dev/v1/compliance/summary?product_id=care
Authorization: Bearer $OCTORYN_COMPLIANCE_READ_KEYIssue trust context at an enterprise boundary
When CTE enforcement is enabled, a trusted enterprise edge issues a short-lived HMAC-signed context bound to request ID, tenant and product. It can carry verified SSO, MFA, device, mTLS, deployment-region and network signals. The Router rejects unverified caller headers and consumes each assertion ID once.
Promote policy from Shadow to Enforce
Policy documents are schema-versioned YAML or JSON. Approved versions are immutable; activation and rollback produce content-free evidence. Disabled preserves current routing, Shadow records decisions without filtering or mutation, and Enforce applies mask, deny, HITL and Provider Trust gates.
Simulate a route
POST /v1/route/simulate requires route:simulate, admin or *. It evaluates identity, product, policy, Compliance & Trust decisions, provider eligibility, catalogue, health, circuit and preferences without resolving provider credentials, reserving budget or invoking a provider. Simulation also does not consume a Trust Context assertion.
POST https://api.octoryn.dev/v1/route/simulate?operation=chat
Authorization: Bearer $OCTORYN_SIMULATION_KEY
Content-Type: application/json
{"model":"policy/frontier","provider":{"sort":"latency"}}Do not treat simulation as a reservation
A later live request can still fail budget, capacity or provider availability checks. Simulation is an explainability and review capability, not a guarantee or a content-bearing dry run.