Messages

API version

2026-11-11 (latest)next (preview)

PreviewDownload OpenAPI (JSON)Versioning

Preview

next shows changes that are not released or not stable yet. Use the current version for production integrations.

Create a message (Anthropic-compatible)

POST /api/v1/llm/v1/messages Beta

Beta. Anthropic Messages wire format over the same gateway as chat completions, so scopes (llm:access or llm:chat), rate limits, the credit check and Idempotency-Key behave identically. Point an Anthropic SDK at the base URL https://api.breachline.io/api/v1/llm with a BreachLine API key in x-api-key. Server tools, mcp_servers, container and URL or file document sources are refused with 400 rather than silently dropped. temperature and top_p accept 0 to 1. top_k, cache_control, service_tier and context_management are accepted and ignored. The anthropic-version header is accepted and not used.

Authentication

• API key in x-api-key
• API key or session token in Authorization: Bearer

Headers

• Idempotency-Key string

  Run this exact request at most once in 24 hours. A replay with the same key and the same body, from the same organization, user and API key, is refused with 409 before any model call. See the Idempotency guide.

  Minimum length

  1

• anthropic-version string

  Accepted for SDK compatibility. Not used.

  Examples

  2023-06-01

Request body

application/json Required

• model string Required

  Examples

  nebula-4.5

  Maximum length

  256

• max_tokens integer Required

  Minimum

  1

• messages array of objects Required

  user and assistant turns with text, image (base64 or URL), document (base64 PDF, text or content), thinking, tool_use and tool_result blocks.

  Minimum items

  1

• system string or array of objects
• stop_sequences array of strings

  Maximum items

  16

• stream boolean

  Default

  false

• temperature number

  Minimum

  0

  Maximum

  1

• top_p number

  Minimum

  0

  Maximum

  1

• top_k integer

  Accepted and ignored.

• tools array of objects

  Custom tools with name, description and input_schema. Server tools are refused.

  Maximum items

  512

• tool_choice object

  auto, any, tool (with name) or none; disable_parallel_tool_use is honoured.

• thinking object

  { "type": "enabled" | "adaptive" | "disabled", "budget_tokens"?: int, "display"?: "summarized" | "omitted" }

• output_config object

  effort (low, medium, high, xhigh, max) and format ({ "type": "json_schema", "schema": { … } }).

• metadata object

Responses

• 200 An Anthropic message, or with stream: true a text/event-stream of message_start, content_block_start, content_block_delta, content_block_stop, message_delta, message_stop and ping events. Usage follows the Anthropic convention: input_tokens excludes cache reads and writes, which are reported separately.

  application/jsontext/event-stream

  Body (application/json)

  • id string
  • type string

    Always

    message

  • role string

    Always

    assistant

  • model string
  • content array of objects

    text, thinking and tool_use blocks.

  • stop_reason string

    One of

    end_turn max_tokens stop_sequence tool_use refusal

  • stop_sequence string or null
  • usage object
    4 fields in usage

    • input_tokens integer
    • output_tokens integer
    • cache_creation_input_tokens integer
    • cache_read_input_tokens integer
• 400 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 401 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 402 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 403 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 409 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 429 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 503 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string

Example

cURLCopy

curl -X POST "https://api.breachline.io/api/v1/llm/v1/messages" \
  -H "x-api-key: $BREACHLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nebula-4.5",
    "max_tokens": 1024,
    "system": "You are a concise security assistant.",
    "messages": [
      {
        "role": "user",
        "content": "Summarise the risk of a missing Content-Security-Policy header."
      }
    ]
  }'

Example 200 responseCopy

{
  "id": "string",
  "type": "message",
  "role": "assistant",
  "model": "string",
  "content": [
    {}
  ],
  "stop_reason": "end_turn",
  "stop_sequence": "string",
  "usage": {
    "input_tokens": 0,
    "output_tokens": 0,
    "cache_creation_input_tokens": 0,
    "cache_read_input_tokens": 0
  }
}

Count tokens (estimate)

POST /api/v1/llm/v1/messages/count_tokens Beta

Beta. Returns an estimate of about 4 characters per token over the translated request: requests are routed across engines with different tokenizers, so there is no single exact count. No model runs and nothing is charged, but the call is rate limited like chat and the body is capped at 4 MiB (413 above that).

Authentication

• API key in x-api-key
• API key or session token in Authorization: Bearer

Request body

application/json Required

• model string Required

  Examples

  nebula-4.5

  Maximum length

  256

• max_tokens integer Required

  Minimum

  1

• messages array of objects Required

  user and assistant turns with text, image (base64 or URL), document (base64 PDF, text or content), thinking, tool_use and tool_result blocks.

  Minimum items

  1

• system string or array of objects
• stop_sequences array of strings

  Maximum items

  16

• stream boolean

  Default

  false

• temperature number

  Minimum

  0

  Maximum

  1

• top_p number

  Minimum

  0

  Maximum

  1

• top_k integer

  Accepted and ignored.

• tools array of objects

  Custom tools with name, description and input_schema. Server tools are refused.

  Maximum items

  512

• tool_choice object

  auto, any, tool (with name) or none; disable_parallel_tool_use is honoured.

• thinking object

  { "type": "enabled" | "adaptive" | "disabled", "budget_tokens"?: int, "display"?: "summarized" | "omitted" }

• output_config object

  effort (low, medium, high, xhigh, max) and format ({ "type": "json_schema", "schema": { … } }).

• metadata object

Responses

• 200 The estimate.

  application/json

  Body (application/json)

  • input_tokens integer

    Minimum

    1

• 400 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 403 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 413 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string
• 429 Anthropic error envelope with the same HTTP status. Retry-After and X-Request-ID are passed through, and x-should-retry: false is set when a retry cannot succeed (402, 409). An over-long prompt starts its message with prompt is too long so clients that compact on overflow can recover.

  application/json

  Body (application/json)

  • type string

    Always

    error

  • error object
    2 fields in error

    • type string

      One of

      invalid_request_error authentication_error billing_error permission_error not_found_error request_too_large rate_limit_error overloaded_error api_error

    • message string

Example

cURLCopy

curl -X POST "https://api.breachline.io/api/v1/llm/v1/messages/count_tokens" \
  -H "x-api-key: $BREACHLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nebula-4.5",
    "max_tokens": 1,
    "messages": [
      {}
    ]
  }'

Example 200 responseCopy

{
  "input_tokens": 1
}