openai 0.103.0 → 0.105.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b50a0bb1c17d033d4179a483168878412ecc245f68bd4192692600581db9bc0
-  data.tar.gz: 13eff5cdbaa168cb9837a9a04fc5b39a8cf8d19374d65a4f67be7028bb369d0f
+  metadata.gz: 3cf6a76c197d61e6798bc42692ee2d650c264346d4f94845644bb44930769970
+  data.tar.gz: 3bc493a3d8be33ce44a76f98662641f835523703fec8cd9932e6de926403583d
 SHA512:
-  metadata.gz: 63338541f098246944ee6a1e761d0c47ad8434eb722302059205ce4c75a92cb8ab92916d7d3d2156f6882a55ebeb79d051fd51ec25c9db8c6f515bf556d1151d
-  data.tar.gz: a8b900d61a286c864507f0a3ab0195a9df0886b825d10cb4beaa7d9125e918176a1f08f3dba71bcfd7d700df87f4a54c2ad62a0ff26232276dbb6e41d1a4d740
+  metadata.gz: a37404e98840aa8015d0d882e7e88ae0470611198d8327b691e061be71c08a456c3c9878c70ac2734ba30f74ec3ee9e122ab1633e627895ef05e0a5771001e6f
+  data.tar.gz: df0f1aef627413e41101cc122aa6bc6b8f0dbac8933f92fea715fc79cf11ca15e45e1a6dfb77f789fcbe16a3fea63e177e9970bc72058206846239e90a4f75cd

data/CHANGELOG.md

@@ -1,5 +1,103 @@
 # Changelog
 
+## [0.105.0](https://github.com/openai/openai-ruby/compare/v0.104.0...v0.105.0) (2026-10-16)
+
+
+### Features
+
+* **api:** add safety identifiers to image requests and responses ([#894](https://github.com/openai/openai-ruby/issues/894)) ([d74e0d5](https://github.com/openai/openai-ruby/commit/d74e0d5737c34a2201780ceb961ac0f7302621cc))
+
+
+### Bug Fixes
+
+* **api:** omit nil safety identifiers from image edits ([#896](https://github.com/openai/openai-ruby/issues/896)) ([a4dbd91](https://github.com/openai/openai-ruby/commit/a4dbd91cbc38ae66a641353c9cc042956cd46bdf))
+
+
+### Chores
+
+* **api:** maintain webhook verification compatibility ([#893](https://github.com/openai/openai-ruby/issues/893)) ([adbde58](https://github.com/openai/openai-ruby/commit/adbde58c45c1241a49a89c03bdb1e350c0ea0ddb))
+
+## [0.104.0](https://github.com/openai/openai-ruby/compare/v0.103.0...v0.104.0) (2026-10-16)
+
+
+### Features
+
+* **api:** add beta session spending limits ([#834](https://github.com/openai/openai-ruby/issues/834)) ([c185bc4](https://github.com/openai/openai-ruby/commit/c185bc44d83e46ea1f787caeda070ffcbb1c672d))
+* **api:** add billing_not_active session error code ([#829](https://github.com/openai/openai-ruby/issues/829)) ([519de99](https://github.com/openai/openai-ruby/commit/519de999e68e9ac45a6fccf59cd316e3ea98da36))
+* **api:** add OCI external-storage provider support ([#835](https://github.com/openai/openai-ruby/issues/835)) ([cb28e54](https://github.com/openai/openai-ruby/commit/cb28e540cd386a87bc268605ee068e617d584e3a))
+* **api:** add organization Decisions usage reporting ([#838](https://github.com/openai/openai-ruby/issues/838)) ([ab2c712](https://github.com/openai/openai-ruby/commit/ab2c7126ab00843bf0d54e664ec63ba4f4658db4))
+* **api:** add prompt-based voice creation ([#891](https://github.com/openai/openai-ruby/issues/891)) ([43450af](https://github.com/openai/openai-ruby/commit/43450afac60fbff8945f40258f99e8014d0a4b74))
+* **api:** add regional processing residency options ([#866](https://github.com/openai/openai-ruby/issues/866)) ([e27adc6](https://github.com/openai/openai-ruby/commit/e27adc6f619da8a764d347fc59d017b7909a6d54))
+* **api:** add response error diagnostics and model notices ([#872](https://github.com/openai/openai-ruby/issues/872)) ([f0c4dfd](https://github.com/openai/openai-ruby/commit/f0c4dfd8119b7b614439646d8584379b847f7660))
+* **api:** add scope-only project API key updates ([#867](https://github.com/openai/openai-ruby/issues/867)) ([53e6572](https://github.com/openai/openai-ruby/commit/53e6572113e963d63eecb143a9d9b4317834b245))
+* **api:** add shida to named Live voices ([#830](https://github.com/openai/openai-ruby/issues/830)) ([4918656](https://github.com/openai/openai-ruby/commit/491865696bacbd2577e7d12baa67b57ae94efb4c))
+* **api:** add vault updates and metadata filters ([#824](https://github.com/openai/openai-ruby/issues/824)) ([9967b42](https://github.com/openai/openai-ruby/commit/9967b42dcf457aae54e642d4ebb16ea171480d73))
+* **api:** align beta pagination limits and non-null parameters ([#833](https://github.com/openai/openai-ruby/issues/833)) ([e29a104](https://github.com/openai/openai-ruby/commit/e29a1049c193b9e65fcefe2d73a03a33e815aa3b))
+* **api:** expose image tool error and moderation details ([#857](https://github.com/openai/openai-ruby/issues/857)) ([ecc5ba0](https://github.com/openai/openai-ruby/commit/ecc5ba014fd20601892b520532f1d662ca901995))
+* **api:** support audio fixture playback in Live sessions ([#869](https://github.com/openai/openai-ruby/issues/869)) ([77ab2e6](https://github.com/openai/openai-ruby/commit/77ab2e66b31599bdfde48942df541bf00af2ec9f))
+* **api:** support Decisions in Live sessions ([#884](https://github.com/openai/openai-ruby/issues/884)) ([808d7de](https://github.com/openai/openai-ruby/commit/808d7dec6fc4a475e3dd9f1b3785bc0bc73a022e))
+* **api:** support image URLs and detailed safety alert explanations ([#836](https://github.com/openai/openai-ruby/issues/836)) ([9e5cc5c](https://github.com/openai/openai-ruby/commit/9e5cc5c9312213c53f5b07fa031fa31092a5239b))
+* **api:** support scopes in project API key updates ([#889](https://github.com/openai/openai-ruby/issues/889)) ([c471323](https://github.com/openai/openai-ruby/commit/c471323246e6f063851109a4b45ba816471a2956))
+* **api:** support updating project API key expiry ([#844](https://github.com/openai/openai-ruby/issues/844)) ([5490f04](https://github.com/openai/openai-ruby/commit/5490f04d01949633e750d5a0288ba73178a39f60))
+
+
+### Bug Fixes
+
+* **api:** clarify project API key scope updates ([#886](https://github.com/openai/openai-ruby/issues/886)) ([0947f00](https://github.com/openai/openai-ruby/commit/0947f007cb34ce64b4eeac6d67113351bebf2584))
+* **api:** expose Realtime response error messages ([#868](https://github.com/openai/openai-ruby/issues/868)) ([0bf770c](https://github.com/openai/openai-ruby/commit/0bf770c78789967c8c936316b189635fe0d7e18b))
+
+
+### Chores
+
+* **api:** clarify agent tool limits and environment pagination ([#843](https://github.com/openai/openai-ruby/issues/843)) ([c51092e](https://github.com/openai/openai-ruby/commit/c51092efae4da025e344e6d557d4a8bb9263e6a5))
+* **api:** clarify decision creation documentation ([#831](https://github.com/openai/openai-ruby/issues/831)) ([983a531](https://github.com/openai/openai-ruby/commit/983a5314d9dba5f3539b9e81220b185ee123b0d5))
+* **api:** clarify Decisions question and answer descriptions ([#828](https://github.com/openai/openai-ruby/issues/828)) ([bc4a105](https://github.com/openai/openai-ruby/commit/bc4a1050da3d94bc2570ded2ae76dee78470f934))
+* **api:** clarify Decisions request and response fields ([#862](https://github.com/openai/openai-ruby/issues/862)) ([cb94c48](https://github.com/openai/openai-ruby/commit/cb94c48f6d80ad1057e7e58e54909ba158a11c9f))
+* **api:** clarify the Live startup history token limit ([#881](https://github.com/openai/openai-ruby/issues/881)) ([a2688e1](https://github.com/openai/openai-ruby/commit/a2688e1a4e1a5b805923a96c2293462ba31e07b2))
+* **api:** document 128-character safety identifiers ([#827](https://github.com/openai/openai-ruby/issues/827)) ([951d306](https://github.com/openai/openai-ruby/commit/951d306a7d4365041e530bdb9ab9846673068265))
+* **api:** document decision choice constraints ([#832](https://github.com/openai/openai-ruby/issues/832)) ([c15703a](https://github.com/openai/openai-ruby/commit/c15703ae2c7838c17e870b2f8922b51a9a0c74ed))
+* **api:** document Files API rate-limit responses ([#826](https://github.com/openai/openai-ruby/issues/826)) ([9208b6f](https://github.com/openai/openai-ruby/commit/9208b6ff9e5bbe216377ce4622865ae5e94e1d22))
+* **api:** maintain structured output compatibility ([#885](https://github.com/openai/openai-ruby/issues/885)) ([cc7ff70](https://github.com/openai/openai-ruby/commit/cc7ff7072bd332744fe575256a9be2d6938d9148))
+* **api:** preserve agent resource helper loading ([#858](https://github.com/openai/openai-ruby/issues/858)) ([fa4626b](https://github.com/openai/openai-ruby/commit/fa4626bbd15ba42ed3ad1981aebf3df1c0c31a86))
+* **api:** preserve Ruby SDK compatibility ([#837](https://github.com/openai/openai-ruby/issues/837)) ([1c0c5a6](https://github.com/openai/openai-ruby/commit/1c0c5a6e82c8456a81971e887087d6aa1bdd31d5))
+* **api:** preserve structured-output input types ([#882](https://github.com/openai/openai-ruby/issues/882)) ([04a3164](https://github.com/openai/openai-ruby/commit/04a3164b5fc3daa1401e93228cc8d41949be49af))
+* **api:** preserve structured-output schema inputs ([#880](https://github.com/openai/openai-ruby/issues/880)) ([3fcdc5d](https://github.com/openai/openai-ruby/commit/3fcdc5d9cfd44c34ed3821c43c915b1730dd4421))
+* **api:** preserve structured-output tool inputs ([#877](https://github.com/openai/openai-ruby/issues/877)) ([39e09c2](https://github.com/openai/openai-ruby/commit/39e09c2dda914a53d1ebeaa0bd6050857a7bc136))
+* **api:** preserve webhook diagnostic redaction ([#879](https://github.com/openai/openai-ruby/issues/879)) ([b9ec465](https://github.com/openai/openai-ruby/commit/b9ec4658e4e76577e9f9c59f14d6c1cd59f58409))
+* **ci:** prepare the next release branch ([#863](https://github.com/openai/openai-ruby/issues/863)) ([5f6a60b](https://github.com/openai/openai-ruby/commit/5f6a60b0f904a6ddc7584cfa3206d600aaf5582e))
+* **deps-dev:** bump sorbet-runtime from 0.6.13508 to 0.6.13528 in the development-dependencies group ([#845](https://github.com/openai/openai-ruby/issues/845)) ([6e01d68](https://github.com/openai/openai-ruby/commit/6e01d68d2c8fb10bcfa2a2a9a6771b9c656cb6fd))
+* **deps:** bump actions/create-github-app-token from 3.2.0 to 3.3.0 ([#847](https://github.com/openai/openai-ruby/issues/847)) ([ceac848](https://github.com/openai/openai-ruby/commit/ceac8485637b04e7f7f3b1ddb05309c3d4850dfb))
+* **deps:** bump ruby/setup-ruby from 1.327.0 to 1.329.0 ([#846](https://github.com/openai/openai-ruby/issues/846)) ([51cd56e](https://github.com/openai/openai-ruby/commit/51cd56e5a39f8d02ad90ef2305595d79ed9469e5))
+* **deps:** bump the codeql group with 2 updates ([#888](https://github.com/openai/openai-ruby/issues/888)) ([df298b6](https://github.com/openai/openai-ruby/commit/df298b634b5c88dfea2f3bd5e1e243ece8cf7295))
+
+
+### Documentation
+
+* document hosted checker rollout on main ([#873](https://github.com/openai/openai-ruby/issues/873)) ([9196a24](https://github.com/openai/openai-ruby/commit/9196a24282555fb7312844eb7d792ed589f2ea64))
+
+
+### Styles
+
+* align webhook source with generated baseline ([#861](https://github.com/openai/openai-ruby/issues/861)) ([4d2b7d2](https://github.com/openai/openai-ruby/commit/4d2b7d2aa5a5b166e55a4625a4d08760fc9c60a8))
+
+
+### Refactors
+
+* isolate agent file helpers from generated resources ([#853](https://github.com/openai/openai-ruby/issues/853)) ([bc078ba](https://github.com/openai/openai-ruby/commit/bc078baeb9b2274e182b8421b2bf46206bbd23eb))
+* isolate agent session stream helper from generated resource ([#854](https://github.com/openai/openai-ruby/issues/854)) ([bdc2d86](https://github.com/openai/openai-ruby/commit/bdc2d866c0ac5049c0d9eb4722a0980c4010b3be))
+* isolate chat completion stream helper from generated resource ([#855](https://github.com/openai/openai-ruby/issues/855)) ([9efcd4e](https://github.com/openai/openai-ruby/commit/9efcd4efde9370281ae4273aad737542f09655aa))
+* isolate client request and copying methods ([#860](https://github.com/openai/openai-ruby/issues/860)) ([37195b2](https://github.com/openai/openai-ruby/commit/37195b2963fe68058440f781ac7b1822bb35fd5e))
+* isolate file polling in SDK extensions ([#840](https://github.com/openai/openai-ruby/issues/840)) ([d8c5f75](https://github.com/openai/openai-ruby/commit/d8c5f75ac43e87c84833fb15daabd77299121080))
+* isolate parsed chat fields from generated models ([#851](https://github.com/openai/openai-ruby/issues/851)) ([7b13907](https://github.com/openai/openai-ruby/commit/7b13907e3a1913b7f53940db70e2525487484ebe))
+* isolate parsed response fields from generated models ([#852](https://github.com/openai/openai-ruby/issues/852)) ([7e54b76](https://github.com/openai/openai-ruby/commit/7e54b768b908961680183ec3dcbef7f498e3415c))
+* isolate response output text helper from generated model ([#850](https://github.com/openai/openai-ruby/issues/850)) ([a75091c](https://github.com/openai/openai-ruby/commit/a75091c9d877ed310aa401f2a1aee69745791aef))
+* isolate response stream helpers from generated resource ([#856](https://github.com/openai/openai-ruby/issues/856)) ([b8ca246](https://github.com/openai/openai-ruby/commit/b8ca246f47ca5c3c1ce528eef068118b2d9d6b60))
+* isolate vector store file batch helpers ([#842](https://github.com/openai/openai-ruby/issues/842)) ([3a15812](https://github.com/openai/openai-ruby/commit/3a158124ce0f4f5c5e0b7f88249adcebe2f4c4bf))
+* isolate vector store file helpers ([#841](https://github.com/openai/openai-ruby/issues/841)) ([0344821](https://github.com/openai/openai-ruby/commit/03448210f4726ed995b317ca6af8e3da75c0fbbf))
+* reuse response output text helper in streams ([#839](https://github.com/openai/openai-ruby/issues/839)) ([9c847e9](https://github.com/openai/openai-ruby/commit/9c847e93a4ec40eb2f6d06386b5c3a9c3f69251f))
+* share Live and Translation WebSocket failure handling ([#871](https://github.com/openai/openai-ruby/issues/871)) ([a60ebe9](https://github.com/openai/openai-ruby/commit/a60ebe95ea89df2f6bc44f671877b48b24bce2e2))
+* use generated Ruby WebSocket bindings ([#887](https://github.com/openai/openai-ruby/issues/887)) ([6baf841](https://github.com/openai/openai-ruby/commit/6baf84161558cd87fcf21885db62887fbf8620e9))
+
 ## [0.103.0](https://github.com/openai/openai-ruby/compare/v0.102.0...v0.103.0) (2026-10-09)
 
 

data/README.md

@@ -15,7 +15,7 @@ To use this gem, install via Bundler by adding the following to your application
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "openai", "~> 0.103.0"
+gem "openai", "~> 0.105.0"
 ```
 
 <!-- x-release-please-end -->
@@ -1212,6 +1212,28 @@ All parameter and response objects inherit from `OpenAI::Internal::Type::BaseMod
 
 4. Helpers such as `#to_h`, `#deep_to_h`, `#to_json`, and `#to_yaml`.
 
+### Updating project API-key scopes
+
+Use `update_scopes` to replace a project's API-key restrictions without changing
+its expiration. Configure an admin API key with permission to write project API
+keys:
+
+```ruby
+client = OpenAI::Client.new(admin_api_key: ENV.fetch("OPENAI_ADMIN_KEY"))
+key = client.admin.organization.projects.api_keys.update_scopes(
+  "key_example",
+  project_id: "proj_example",
+  scopes: ["api.all.read"]
+)
+```
+
+An empty `scopes: []` removes key restrictions (All permissions), subject to the
+owner's effective access; it does **not** mean no access. This does not change
+roles or grant administrative permissions. Expired keys cannot be updated, and
+scope changes follow the same authentication-cache propagation as dashboard edits.
+The response contains the redacted key, never its secret. Use the existing
+`update(..., expires_in_seconds: ...)` method to change expiration.
+
 ### Making custom or undocumented requests
 
 #### Undocumented properties

data/lib/openai/client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "helpers/data_residency"
+require_relative "helpers/client_runtime"
 
 module OpenAI
   class Client < OpenAI::Internal::Transport::BaseClient
@@ -40,6 +41,7 @@ module OpenAI
     # @api private
     attr_reader :workload_identity_auth
 
+    # Generated resource accessors.
     # @return [OpenAI::Resources::Decisions]
     attr_reader :decisions
 
@@ -180,392 +182,6 @@ module OpenAI
       {"authorization" => "Bearer #{@admin_api_key}"}
     end
 
-    # @api private
-    private def x509_identity?(identity)
-      OpenAI::Auth::X509Transport.exact_instance?(identity, OpenAI::Auth::X509WorkloadIdentity)
-    end
-
-    # @api private
-    private def x509_transport?(transport)
-      OpenAI::Auth::X509Transport.exact_instance?(transport, OpenAI::Auth::X509Transport)
-    end
-
-    # Creates and returns a new client for interacting with the API.
-    #
-    # @param api_key [String, nil] Defaults to `ENV["OPENAI_API_KEY"]`.
-    #   Mutually exclusive with `workload_identity`.
-    #
-
-    # @api private
-    private def build_request(request, options)
-      if @provider_runtime
-        built = super
-        body = built[:body]
-        # Capture only the final model; provider hooks run after body encoding.
-        model = body.reverse_each.find { |key, _| key == :model || key == "model" }&.last if body.is_a?(Hash)
-        model = model.to_s if model.is_a?(Symbol)
-        return built.merge(provider_request_model: model)
-      end
-
-      unless @workload_identity_auth && x509_transport?(@requester)
-        return super
-      end
-
-      selected = {}.merge(request.fetch(:security, {bearer_auth: true, admin_api_key_auth: true})).freeze
-      if selected.any? { |scheme, enabled| enabled && scheme != :bearer_auth && scheme != :admin_api_key_auth }
-        raise ArgumentError, "Unsupported authentication security scheme for X.509 workload identity"
-      end
-
-      security = {
-        bearer_auth: selected[:bearer_auth] == true,
-        admin_api_key_auth: selected[:admin_api_key_auth] == true
-      }.freeze
-      expected = auth_headers(security: security)["authorization"]
-      built = super(request.merge(security: security), options)
-      canonical_headers = @requester.validate_api_request!(
-        url: built.fetch(:url),
-        headers: built.fetch(:headers)
-      )
-      unless expected == canonical_headers["authorization"]
-        raise OpenAI::Errors::Error, "X.509 requests cannot override the selected authorization credential"
-      end
-
-      auth_max_retries = options.fetch(:max_retries, @max_retries)
-      built.merge(headers: canonical_headers, x509_auth_max_retries: auth_max_retries)
-    end
-
-    # @api private
-    private def prepare_request(request, redirect_count:, retry_count:)
-      if workload_identity_request?(request)
-        request = prepare_workload_identity_request(request, retry_count: retry_count)
-      end
-
-      preparer = @provider_runtime&.prepare_request
-      return super(request, redirect_count: redirect_count, retry_count: retry_count) unless preparer
-      preparer.call(request)
-    end
-
-    # @api private
-    private def validate_prepared_request(request, original_request:)
-      prepared_request = super
-      return prepared_request unless @workload_identity_auth && x509_transport?(@requester)
-
-      canonical_headers = @requester.validate_api_request!(
-        url: prepared_request.fetch(:url),
-        headers: prepared_request.fetch(:headers)
-      )
-      expected = if (context = original_request[:x509_request_context])
-        "Bearer #{context.fetch(:token)}"
-      else
-        original_request.fetch(:headers)["authorization"]
-      end
-
-      unless canonical_headers["authorization"] == expected
-        raise OpenAI::Errors::Error, "X.509 requests cannot override the selected authorization credential"
-      end
-
-      prepared_request.merge(headers: canonical_headers)
-    end
-
-    # @api private
-    private def validate_retry_delay!(request, delay:)
-      deadline = request[:x509_request_context]&.fetch(:deadline) || request[:workload_identity_deadline]
-      if deadline && delay >= deadline - OpenAI::Internal::Util.monotonic_secs
-        raise WORKLOAD_IDENTITY_DEADLINE_ERROR, "request timed out during workload identity authentication"
-      end
-
-      super
-    end
-
-    # @api private
-    private def send_request(request, redirect_count:, retry_count:, send_retry_header:)
-      if @workload_identity_auth && x509_transport?(@requester)
-        canonical_headers = @requester.validate_api_request!(
-          url: request.fetch(:url),
-          headers: request.fetch(:headers)
-        )
-        request = request.merge(headers: canonical_headers)
-        authorization = canonical_headers["authorization"]
-        expected = "Bearer #{WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER}"
-        admin_authorization = @admin_api_key && "Bearer #{@admin_api_key}"
-        unless authorization.nil? || authorization == expected || authorization == admin_authorization
-          raise OpenAI::Errors::Error, "X.509 requests cannot override the selected authorization credential"
-        end
-      end
-
-      return super unless workload_identity_request?(request)
-
-      x509_request = x509_transport?(@requester)
-      previous_context = request[:x509_request_context]
-      deadline = if x509_request
-        previous_context&.fetch(:deadline) ||
-          request[:workload_identity_deadline] ||
-          request[:timeout]&.then { OpenAI::Internal::Util.monotonic_secs + _1 }
-      else
-        request[:workload_identity_deadline] ||
-          request[:timeout]&.then { OpenAI::Internal::Util.monotonic_secs + _1 }
-      end
-
-      request = request.merge(workload_identity_deadline: deadline)
-      if x509_request
-        replay_state = previous_context&.fetch(:replay_state) || []
-        issuer_retries = previous_context&.fetch(:issuer_retries, 0) || 0
-        auth_max_retries = previous_context&.fetch(:auth_max_retries) || request.fetch(:x509_auth_max_retries)
-        api_max_retries = previous_context&.fetch(:api_max_retries) || request.fetch(:max_retries)
-        log_context = previous_context&.fetch(:log_context) || yield
-        context = {
-          deadline: deadline,
-          replay_state: replay_state,
-          issuer_retries: issuer_retries,
-          auth_max_retries: auth_max_retries,
-          api_max_retries: api_max_retries,
-          log_context: log_context,
-          token: nil
-        }
-        request = request.merge(x509_request_context: context, max_retries: 0)
-      end
-
-      begin
-        super(
-          request,
-          redirect_count: redirect_count,
-          retry_count: retry_count,
-          send_retry_header: send_retry_header
-        )
-      rescue OpenAI::Errors::AuthenticationError
-        if x509_request
-          rejected_token = request.fetch(:x509_request_context).fetch(:token)
-          raise if rejected_token.nil?
-
-          @workload_identity_auth.invalidate_token(rejected_token)
-        end
-
-        replay_allowed = request_replayable?(request)
-        replay_allowed &&= x509_request ? replay_state.empty? : retry_count.zero?
-        raise unless replay_allowed
-
-        if x509_request
-          replay_state << true
-          replay_state.freeze
-          issuer_retries = context.fetch(:issuer_retries)
-          auth_max_retries = context.fetch(:auth_max_retries)
-          api_max_retries = context.fetch(:api_max_retries)
-          log_context = context.fetch(:log_context)
-          context = {
-            deadline: deadline,
-            replay_state: replay_state,
-            issuer_retries: issuer_retries,
-            auth_max_retries: auth_max_retries,
-            api_max_retries: api_max_retries,
-            log_context: log_context,
-            token: nil
-          }
-          request = request.merge(x509_request_context: context)
-        else
-          @workload_identity_auth.invalidate_token
-        end
-
-        begin
-          super(
-            request,
-            redirect_count: redirect_count,
-            retry_count: retry_count + 1,
-            send_retry_header: send_retry_header
-          )
-        rescue OpenAI::Errors::AuthenticationError
-          if x509_request && (rejected_token = request.fetch(:x509_request_context).fetch(:token))
-            @workload_identity_auth.invalidate_token(rejected_token)
-          end
-
-          raise
-        end
-      end
-
-    rescue Timeout::Error => error
-      unless x509_request
-        raise unless error.is_a?(WORKLOAD_IDENTITY_DEADLINE_ERROR)
-
-        url = request.fetch(:url).dup
-        url.query = nil
-        url.fragment = nil
-        cause = Timeout::Error.new(error.message)
-        raise OpenAI::Errors::APITimeoutError.new(url: url, message: error.message), cause: cause
-      end
-
-      url = request.fetch(:url).dup
-      url.query = nil
-      url.fragment = nil
-      message = "request timed out during workload identity authentication"
-      raise OpenAI::Errors::APITimeoutError.new(url: url, message: message), cause: nil
-    end
-
-    private def workload_identity_request?(request)
-      return false unless @workload_identity_auth
-
-      expected = "Bearer #{WORKLOAD_IDENTITY_API_KEY_PLACEHOLDER}"
-      request[:headers]["authorization"] == expected
-    end
-
-    private def prepare_workload_identity_request(request, retry_count:)
-      deadline = request[:workload_identity_deadline]
-      previous_issuer_retries = request[:x509_request_context]&.fetch(:issuer_retries, 0) || 0
-      attempts = 0
-      begin
-        token = @workload_identity_auth.get_token(deadline: deadline)
-      rescue OpenAI::Errors::APIError => error
-        status = error.status
-        connection_failure = error.is_a?(OpenAI::Errors::APIConnectionError)
-        retryable_connection_failure = connection_failure &&
-          false.equal?(error.request_may_have_been_sent?)
-        retryable_status = retryable_connection_failure ||
-          [408, 409, 429].include?(status) ||
-          (status.is_a?(Integer) && (500..599).cover?(status))
-        consumed_retries = attempts + previous_issuer_retries + retry_count
-        unless x509_transport?(@requester) &&
-            retryable_status &&
-            consumed_retries < request.fetch(:x509_request_context).fetch(:auth_max_retries) &&
-            (retryable_connection_failure || self.class.should_retry?(status, headers: error.headers || {}))
-          raise
-        end
-
-        delay = retry_delay(error.headers || {}, retry_count: attempts)
-        if deadline && delay >= deadline - OpenAI::Internal::Util.monotonic_secs
-          raise Timeout::Error, "request timed out during workload identity authentication"
-        end
-
-        context = request.fetch(:x509_request_context)
-        response = if connection_failure
-          nil
-        else
-          OpenAI::ResponseMetadata.new(status: status, headers: error.headers || {})
-        end
-
-        context.fetch(:log_context).retry_scheduled(
-          connection_failure ? error : status,
-          delay: delay,
-          response: response,
-          retry_count: consumed_retries,
-          max_retries: context.fetch(:auth_max_retries)
-        )
-        sleep(delay)
-        attempts += 1
-        retry
-      end
-
-      if (context = request[:x509_request_context])
-        context[:issuer_retries] = previous_issuer_retries + attempts
-        context[:token] = token.dup.freeze
-        context.freeze
-      end
-
-      updated_headers = request[:headers].merge("authorization" => "Bearer #{token}")
-      updated_request = request
-        .except(:workload_identity_deadline, :x509_request_context, :x509_auth_max_retries)
-        .merge(headers: updated_headers)
-      if context
-        updated_request = updated_request.merge(
-          max_retries: [context.fetch(:api_max_retries) - context.fetch(:issuer_retries), 0].max
-        )
-      end
-
-      request_with_remaining_timeout(
-        updated_request,
-        deadline
-      )
-    rescue Timeout::Error => e
-      raise if x509_transport?(@requester)
-
-      url = request.fetch(:url).dup
-      url.query = nil
-      url.fragment = nil
-      raise OpenAI::Errors::APITimeoutError.new(url: url, message: e.message)
-    end
-
-    # @api private
-    private def request_with_remaining_timeout(request, deadline)
-      return request if deadline.nil?
-
-      remaining = deadline - OpenAI::Internal::Util.monotonic_secs
-      unless remaining.positive?
-        raise Timeout::Error, "request timed out during workload identity authentication"
-      end
-
-      request.merge(timeout: remaining)
-    end
-
-    # Returns a new client of the same class with the supplied constructor options overridden.
-    # Other settings and the HTTP transport are inherited. The original client
-    # is unchanged. Header overrides are merged; nil removes an individual
-    # header, and default_headers: nil clears all custom default headers.
-    # Subclasses with incompatible constructors or a private .new must override
-    # this method if they need to support copying.
-    #
-    # @example Select a regional endpoint for a call
-    #   client.with_options(base_url: "https://eu.api.openai.com/v1").responses.create(...)
-    # @param overrides [Hash{Symbol=>Object}] Options accepted by {#initialize}.
-    # @return [self]
-    def with_options(**overrides)
-      if overrides.key?(:workload_identity) && !overrides.key?(:http_client)
-        selected_identity = overrides.fetch(:workload_identity)
-        if x509_identity?(selected_identity) && (configured_transport = selected_identity.transport)
-          overrides = overrides.merge(http_client: configured_transport)
-        end
-      end
-
-      previous_transport = @copy_options.fetch(:http_client)
-      transport = overrides.fetch(:http_client, previous_transport)
-      if overrides[:data_residency] && x509_transport?(transport)
-        residency = overrides.fetch(:data_residency)
-        options = OpenAI::Internal::ClientOptions.copy(@copy_options, overrides.except(:data_residency))
-        options.delete(:base_url) unless overrides.key?(:base_url)
-        return copy_with_workload_identity_auth(options.merge(data_residency: residency))
-      end
-
-      options = OpenAI::Internal::ClientOptions.copy(@copy_options, overrides)
-      adopted_identity = x509_identity?(options.fetch(:workload_identity)) &&
-        !x509_identity?(@copy_options.fetch(:workload_identity))
-      previous_origin = previous_transport.api_origin if x509_transport?(previous_transport)
-      selected_origin = transport.api_origin if x509_transport?(transport)
-      if adopted_identity && selected_origin
-        inherited_origin = OpenAI::Internal::Util.uri_origin(URI(options.fetch(:base_url).to_s))
-        adopted_identity = !inherited_origin.casecmp?(selected_origin)
-      end
-
-      if (adopted_identity || previous_origin != selected_origin) &&
-          !overrides.key?(:base_url) &&
-          !overrides[:data_residency]
-        options.delete(:base_url)
-      end
-
-      copy_with_workload_identity_auth(options)
-    end
-
-    # @api private
-    private def copy_with_workload_identity_auth(options)
-      copied = self.class.new(**options)
-      identity = @copy_options.fetch(:workload_identity)
-      if x509_identity?(identity) &&
-          identity.equal?(options.fetch(:workload_identity)) &&
-          copied.requester.equal?(@requester)
-        copied.adopt_workload_identity_auth!(@workload_identity_auth)
-      end
-
-      copied
-    end
-
-    # @api private
-    def adopt_workload_identity_auth!(authenticator)
-      identity = @copy_options.fetch(:workload_identity)
-      unless x509_identity?(identity) &&
-          x509_transport?(@requester) &&
-          OpenAI::Auth::X509Transport.exact_instance?(authenticator, OpenAI::Auth::WorkloadIdentityAuth) &&
-          authenticator.bound_to?(identity, transport: @requester)
-        raise ArgumentError, "X.509 authenticator must match its workload identity and attested transport"
-      end
-
-      @workload_identity_auth = authenticator
-    end
-
     # Creates and returns a new client for interacting with the API.
     #
     # @param api_key [String, nil] Defaults to `ENV["OPENAI_API_KEY"]`.
@@ -815,6 +431,7 @@ module OpenAI
         on_retry: self.on_retry()
       )
 
+      # Initialize generated resources.
       @decisions = OpenAI::Resources::Decisions.new(client: self)
       @completions = OpenAI::Resources::Completions.new(client: self)
       @chat = OpenAI::Resources::Chat.new(client: self)

data/lib/openai/helpers/admin/organization/projects/api_keys.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require_relative "../../../../resources/admin/organization/projects/api_keys"
+
+module OpenAI
+  module Resources
+    class Admin
+      class Organization
+        class Projects
+          class APIKeys
+            # Replace an API key's scope restrictions without changing its expiration.
+            # Requires permission to write project API keys; expired keys cannot be updated.
+            # An empty array removes key restrictions (All permissions), subject to the
+            # owner's effective access. This does not change roles or grant admin permissions.
+            # Changes follow the same authentication-cache propagation as dashboard edits.
+            # To update the expiration in the same request, pass
+            # `request_options: {extra_body: {expires_in_seconds: seconds}}`.
+            #
+            # @param api_key_id [String]
+            # @param project_id [String]
+            # @param scopes [Array<String>] Use ["api.all.read"] for read-only access.
+            # @param request_options [OpenAI::RequestOptions, Hash{Symbol=>Object}]
+            # @return [OpenAI::Models::Admin::Organization::Projects::ProjectAPIKey]
+            def update_scopes(api_key_id, project_id:, scopes:, request_options: {})
+              parsed, options = OpenAI::Admin::Organization::Projects::APIKeyUpdateScopesParams.dump_request(
+                {scopes: scopes, request_options: request_options}
+              )
+              @client.request(
+                method: :post,
+                path: ["organization/projects/%1$s/api_keys/%2$s", project_id, api_key_id],
+                body: parsed,
+                model: OpenAI::Admin::Organization::Projects::ProjectAPIKey,
+                security: {admin_api_key_auth: true},
+                options: options
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end