Responses

API version

2026-11-11 (latest)next (preview)

PreviewDownload OpenAPI (JSON)Versioning

Preview

next shows changes that are not released or not stable yet. Use the current version for production integrations.

Create a response

POST /api/v1/llm/v1/responses

OpenAI-compatible Responses API. With store: true the completed response is kept for 30 days by default so a later request can continue it with previous_response_id; storing and threading need an organization-bound user (403 otherwise). Hosted tools are not supported and are dropped; function tools work. Requires llm:access or llm:chat.

Authentication

• API key in X-API-Key
• API key or session token in Authorization: Bearer

Headers

• Idempotency-Key string

  Run this exact request at most once in 24 hours. A replay with the same key and the same body, from the same organization, user and API key, is refused with 409 before any model call. See the Idempotency guide.

  Minimum length

  1

Request body

application/json Required

• model string

  Default

  nebula-4.5

• input string or array of objects Required

  A string, or an array of input items (messages, function_call_output).

• instructions string or null
• max_output_tokens integer or null

  Minimum

  1

• temperature number or null

  Minimum

  0

  Maximum

  2

• top_p number or null

  Minimum

  0

  Maximum

  1

• reasoning object or null
  1 field in reasoning

  • effort string or null
• tools array of objects or null

  Function tools. Hosted tools are not supported and are dropped.

• tool_choice string or object or null
• parallel_tool_calls boolean or null
• stream boolean or null

  Default

  false

• store boolean or null

  Keep the completed response (30 days by default) for retrieval and previous_response_id.

• previous_response_id string or null

  Continue a stored response you own. An id you do not own contributes no history.

• metadata object or null
• user string or null

Responses

• 200 A response object, or with stream: true a text/event-stream of response.* events.

  application/jsontext/event-stream

  Body (application/json)

  • id string
  • object string

    Always

    response

  • created_at integer
  • model string
  • status string

    Examples

    completed in_progress failed

  • output array of objects
  • output_text string
  • usage object
• 400 The request was malformed or failed a server-side check.Error envelope
• 401 Missing, invalid, expired or revoked credentials.Error envelope
• 402 The organization has no spendable credit, or its self-service spend cap is reached. Top up or raise the cap in the console. This status currently carries message: "Error" and code: "INTERNAL_9001"; rely on the HTTP status.Error envelope
• 403 The credential is valid but lacks a required scope or permission.Error envelope
• 409 This exact request (same Idempotency-Key and body) already ran, so it was not run again. Send a new Idempotency-Key to run it again.Error envelope
• 422 The request body or parameters failed schema validation.Error envelope
• 429 A per-key request limit was exceeded, or the rate limiter could not be reached (it fails closed). There is no Retry-After for a window limit; wait for the next window. A concurrency limit, when configured, also returns 429, with Retry-After.Error envelope

Example

cURLCopy

curl -X POST "https://api.breachline.io/api/v1/llm/v1/responses" \
  -H "Authorization: Bearer $BREACHLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "nebula-4.5",
    "instructions": "Answer in two sentences.",
    "input": "What does an SSRF finding let an attacker do?",
    "store": true
  }'

Example 200 responseCopy

{
  "id": "string",
  "object": "response",
  "created_at": 0,
  "model": "string",
  "status": "completed",
  "output": [
    {}
  ],
  "output_text": "string",
  "usage": {}
}

Retrieve a stored response

GET /api/v1/llm/v1/responses/{response_id}

Returns a response stored with store: true. Stored responses belong to the user and organization that created them, so any key or session of that user in that organization can read them; anyone else gets 404.

Authentication

• API key in X-API-Key
• API key or session token in Authorization: Bearer

Path parameters

• response_id string Required

Responses

• 200 The stored response.

  application/json

  Body (application/json)

  • id string
  • object string

    Always

    response

  • created_at integer
  • model string
  • status string

    Examples

    completed in_progress failed

  • output array of objects
  • output_text string
  • usage object
• 401 Missing, invalid, expired or revoked credentials.Error envelope
• 403 The credential is valid but lacks a required scope or permission.Error envelope
• 404 The resource does not exist or is not visible to this caller.Error envelope

Example

cURLCopy

curl "https://api.breachline.io/api/v1/llm/v1/responses/{response_id}" \
  -H "Authorization: Bearer $BREACHLINE_API_KEY"

Example 200 responseCopy

{
  "id": "string",
  "object": "response",
  "created_at": 0,
  "model": "string",
  "status": "completed",
  "output": [
    {}
  ],
  "output_text": "string",
  "usage": {}
}

Delete a stored response

DELETE /api/v1/llm/v1/responses/{response_id}

Authentication

• API key in X-API-Key
• API key or session token in Authorization: Bearer

Path parameters

• response_id string Required

Responses

• 200 Deleted.

  application/json

  Body (application/json)

  • id string
  • object string

    Always

    response.deleted

  • deleted boolean

    Always

    true

• 401 Missing, invalid, expired or revoked credentials.Error envelope
• 403 The credential is valid but lacks a required scope or permission.Error envelope
• 404 The resource does not exist or is not visible to this caller.Error envelope

Example

cURLCopy

curl -X DELETE "https://api.breachline.io/api/v1/llm/v1/responses/{response_id}" \
  -H "Authorization: Bearer $BREACHLINE_API_KEY"

Example 200 responseCopy

{
  "id": "string",
  "object": "response.deleted",
  "deleted": true
}