openai 0.108.0 → 0.109.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbaffc5b480678a26851b73b6b49f9f63419801d8bbec633d6ed4f3765fe4717
-  data.tar.gz: 127b19570f47781df5644f2217d9405e1ea0e82279b319a7683c59b567cbbd72
+  metadata.gz: 54cd64155cb1af2bb57a7c61bc15355979a7c0d9e50951ce7e893911fcfe473b
+  data.tar.gz: 29101b3385b4be69545f1bd5516c90329c34d1e6f0bf303f28b5ea379b36fde8
 SHA512:
-  metadata.gz: ffe2a7748064e0cb03c1eb2482670a4f581323b02a0275fd9654e1f97ecaf85f9128e064f22b5075af7d615d0e9d4fee73144d57f07ceaa9dcde25a419f7b066
-  data.tar.gz: c531be809fb0b7dd69d4cb089eea59680a01dbcc258265e47ef6b16052ffd78eeba8f2ccf094ffaa694cdd2dca602b9ebceffa65e362de1427f51e04219a6192
+  metadata.gz: b3d15cf0ee35ec3f58df82ea2f7249b62e63c02c1ee5351d0d6e95f50d1929c707a458225ee71e8568f816149a7c8346788286b22ba9ec38faeb42d3e511746c
+  data.tar.gz: b0e8720cecf2f4f600f7ac05226a8cbbba2eae974a81e0312b9d8ac88bef0bc7e4883a591ec2ac0fa2e9b30de13a79607a23b4a904f03f945fc10a79bb4a3913

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.109.0](https://github.com/openai/openai-ruby/compare/v0.108.0...v0.109.0) (2026-10-21)
+
+
+### Features
+
+* add Vertex AI support for the Responses API ([#952](https://github.com/openai/openai-ruby/issues/952)) ([98f5359](https://github.com/openai/openai-ruby/commit/98f5359e3ad2133abc5e914610fe7bbd2a058f8d))
+
 ## [0.108.0](https://github.com/openai/openai-ruby/compare/v0.107.0...v0.108.0) (2026-10-21)
 
 

data/README.md

@@ -15,7 +15,7 @@ To use this gem, install via Bundler by adding the following to your application
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "openai", "~> 0.108.0"
+gem "openai", "~> 0.109.0"
 ```
 
 <!-- x-release-please-end -->
@@ -556,6 +556,12 @@ client = OpenAI::Client.new(
 
 See [bedrock.md](bedrock.md) for authentication precedence, static and refreshable credentials, endpoint configuration, and SigV4 request constraints.
 
+## Google Vertex AI
+
+Use `OpenAI::Providers.vertex` with the Responses API. See [vertex.md](vertex.md)
+for setup with Google Application Default Credentials, a credentials object, or
+an access-token callback.
+
 ## Workload Identity Authentication
 
 For secure, automated environments like cloud-managed Kubernetes, Azure, and GCP, you can use workload identity authentication with short-lived tokens from cloud identity providers instead of long-lived API keys.

data/lib/openai/helpers/client_runtime.rb

@@ -101,6 +101,17 @@ module OpenAI
 
     # @api private
     private def send_request(request, redirect_count:, retry_count:, send_retry_header:)
+      if (wrapper = @provider_runtime&.wrap_request)
+        return wrapper.call(request, request_replayable?(request), retry_count) do |attempt, attempt_retry_count|
+          super(
+            attempt,
+            redirect_count: redirect_count,
+            retry_count: attempt_retry_count,
+            send_retry_header: send_retry_header
+          )
+        end
+      end
+
       if @workload_identity_auth && x509_transport?(@requester)
         canonical_headers = @requester.validate_api_request!(
           url: request.fetch(:url),

data/lib/openai/internal/provider.rb

@@ -11,6 +11,7 @@ module OpenAI
         :name,
         :base_url,
         :prepare_request,
+        :wrap_request,
         :authentication_headers,
         keyword_init: true
       )

data/lib/openai/providers/vertex.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+require "timeout"
+
+module OpenAI
+  module Providers
+    # @api private
+    module Vertex
+      SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+      AUTH_MARKER = :openai_vertex_bearer
+
+      class Definition
+        def initialize(base_url:, token_provider:, credentials:)
+          @base_url = base_url.freeze
+          @token_provider = token_provider
+          @credentials = credentials
+          @credentials_mutex = Mutex.new
+        end
+
+        def name = "vertex"
+
+        def configure
+          token_provider = @token_provider
+          credentials = @credentials
+          unless token_provider || credentials
+            begin
+              require "googleauth"
+
+            rescue LoadError => e
+              raise LoadError.new("Vertex ADC requires optional gem \"googleauth\"; add it to your Gemfile."), cause: e
+            end
+
+            begin
+              credentials = Google::Auth.get_application_default(SCOPE)
+            rescue StandardError => e
+              raise OpenAI::Errors::Error.new("Vertex could not load Google Application Default Credentials."), cause: e
+            end
+          end
+
+          if credentials
+            # googleauth apply! refreshes expired tokens. Serialize just this
+            # cache/refresh step across all clients using this provider.
+            mutex = @credentials_mutex
+            rejected_token = nil
+            token_provider = lambda do
+              headers = {}
+              mutex.synchronize do
+                credentials.apply!(headers)
+                token = headers.fetch(:authorization) { headers.fetch("authorization") }.delete_prefix("Bearer ")
+                if token == rejected_token && credentials.respond_to?(:fetch_access_token!)
+                  credentials.fetch_access_token!
+                  credentials.apply!(headers)
+                  token = headers.fetch(:authorization) { headers.fetch("authorization") }.delete_prefix("Bearer ")
+                  rejected_token = nil
+                end
+
+                token
+              end
+            end
+          end
+
+          # Share the replay allowance and retry count, but reset the deadline
+          # for each ordinary transport retry. A 401 replay keeps its deadline.
+          # Refresh itself happens in prepare_request, under its timeout and mutex.
+          if credentials.respond_to?(:fetch_access_token!)
+            wrapper = lambda do |request, replayable, retry_count, &send_request|
+              context = request[:vertex_auth_context] || {replayed: false}
+              context[:retry_count] = retry_count
+              context[:deadline] = request[:timeout]&.then { OpenAI::Internal::Util.monotonic_secs + _1 }
+              request = request.merge(vertex_auth_context: context)
+              begin
+                send_request.call(request, context[:retry_count])
+              rescue OpenAI::Errors::AuthenticationError
+                remaining = context[:deadline] && (context[:deadline] - OpenAI::Internal::Util.monotonic_secs)
+                if remaining && remaining <= 0
+                  raise OpenAI::Errors::APITimeoutError.new(url: request.fetch(:url))
+                end
+
+                begin
+                  Timeout.timeout(remaining) { mutex.synchronize { rejected_token = context[:token] } }
+                rescue Timeout::Error
+                  raise OpenAI::Errors::APITimeoutError.new(url: request.fetch(:url)), cause: nil
+                end
+
+                raise if context[:replayed] || !replayable || context[:retry_count] >= request.fetch(:max_retries)
+
+                context[:replayed] = true
+                context[:retry_count] += 1
+                retry
+              end
+            end
+          end
+
+          base = URI(@base_url)
+          OpenAI::Internal::Provider::Runtime.new(
+            name: name,
+            base_url: @base_url,
+            authentication_headers: %w[authorization],
+            wrap_request: wrapper,
+            prepare_request: lambda do |request|
+              url = request.fetch(:url)
+              unless OpenAI::Internal::Util.uri_origin(url) == OpenAI::Internal::Util.uri_origin(base)
+                raise OpenAI::Errors::Error, "Vertex refuses credentials for an origin other than the configured URL."
+              end
+
+              headers = request.fetch(:headers).dup
+              if request[:provider_auth] == AUTH_MARKER
+                headers.delete("authorization")
+              elsif headers.key?("authorization")
+                raise(
+                  OpenAI::Errors::Error,
+                  "Vertex authentication cannot be combined with a custom Authorization header."
+                )
+              end
+
+              if headers.key?("api-key")
+                raise OpenAI::Errors::Error, "Vertex authentication cannot be combined with a custom api-key header."
+              end
+              # The outer Google API version differs for stored Responses.
+              # Do not change other gateway layouts.
+              prefix = "#{base.path.delete_suffix("/")}/responses/"
+              if [:get, :delete].include?(request[:method]) &&
+                  url.path.start_with?(prefix) &&
+                  base.path.start_with?("/v1/projects/")
+                url = url.dup
+                url.path = url.path.sub(%r{\A/v1/}, "/v1beta1/")
+              end
+
+              headers.delete("openai-organization")
+              headers.delete("openai-project")
+              timeout = request[:timeout]
+              context = request[:vertex_auth_context]
+              timeout = context[:deadline] - OpenAI::Internal::Util.monotonic_secs if context&.dig(:deadline)
+              if timeout && timeout <= 0
+                raise OpenAI::Errors::APITimeoutError.new(url: url, message: "Vertex credential lookup timed out")
+              end
+
+              started = OpenAI::Internal::Util.monotonic_secs
+              token = begin
+                Timeout.timeout(timeout) { token_provider.call }
+              rescue Timeout::Error => e
+                raise(
+                  OpenAI::Errors::APITimeoutError.new(url: url, message: "Vertex credential lookup timed out"),
+                  cause: e
+                )
+              rescue StandardError => e
+                raise OpenAI::Errors::Error.new("Vertex failed to resolve Google credentials."), cause: e
+              end
+
+              remaining = timeout && (timeout - (OpenAI::Internal::Util.monotonic_secs - started))
+              if remaining && remaining <= 0
+                raise OpenAI::Errors::APITimeoutError.new(url: url, message: "Vertex credential lookup timed out")
+              end
+
+              if credentials.respond_to?(:quota_project_id) && (quota = credentials.quota_project_id)
+                headers["x-goog-user-project"] = quota
+              end
+
+              unless token.is_a?(String) && !token.strip.empty?
+                raise OpenAI::Errors::Error, "Vertex token_provider must return a non-empty access token string."
+              end
+
+              context[:token] = token if context
+
+              request.merge(
+                url: url,
+                timeout: remaining,
+                headers: headers.merge("authorization" => "Bearer #{token}"),
+                provider_auth: AUTH_MARKER,
+                follow_redirects: false
+              )
+            end
+          )
+        end
+      end
+    end
+
+    class << self
+      # Use Google Application Default Credentials with the regular Responses
+      # client. Supply token_provider: -> { ... } for application-managed credentials.
+      # It is called per attempt and should cache/refresh tokens as needed.
+      #
+      # Base URL is the complete trusted provider URL before /responses. When
+      # omitted, project and location are required. OpenAI environment defaults
+      # and top-level auth/base_url options are ignored/rejected by Client.
+      def vertex(project: nil, location: nil, base_url: nil, token_provider: nil, credentials: nil)
+        if credentials && token_provider
+          raise ArgumentError, "Vertex credentials and token_provider are mutually exclusive."
+        end
+
+        if credentials && !credentials.respond_to?(:apply!)
+          raise ArgumentError, "Vertex credentials must provide Google's apply! method."
+        end
+
+        unless token_provider.nil? || token_provider.respond_to?(:call)
+          raise ArgumentError, "Vertex token_provider must respond to call."
+        end
+
+        if base_url.nil?
+          project_segment = /\A[a-zA-Z0-9][a-zA-Z0-9_.:-]*\z/
+          location_segment = /\A[a-zA-Z0-9][a-zA-Z0-9_-]*\z/
+          unless project.is_a?(String) &&
+              location.is_a?(String) &&
+              project_segment.match?(project) &&
+              location_segment.match?(location)
+            raise ArgumentError, "Vertex project and location are required and must be single path segments."
+          end
+
+          host = location == "global" ? "aiplatform.googleapis.com" : "#{location}-aiplatform.googleapis.com"
+          base_url = "https://#{host}/v1/projects/#{project}/locations/#{location}/publishers/openai/v1"
+        end
+
+        begin
+          uri = URI(base_url.to_s)
+          unless %w[http https].include?(uri.scheme) && uri.host && !uri.userinfo && !uri.query && !uri.fragment
+            raise URI::InvalidURIError
+          end
+
+        rescue URI::InvalidURIError
+          raise ArgumentError, "Vertex base_url must be an absolute HTTP(S) URL without credentials, query or fragment."
+        end
+
+        OpenAI::Internal::Provider.create(
+          Vertex::Definition.new(base_url: uri.to_s, token_provider: token_provider, credentials: credentials)
+        )
+      end
+    end
+  end
+end

data/lib/openai/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OpenAI
-  VERSION = "0.108.0"
+  VERSION = "0.109.0"
 end

data/lib/openai.rb

@@ -69,6 +69,7 @@ require_relative "openai/provider"
 require_relative "openai/internal/provider"
 require_relative "openai/providers/azure"
 require_relative "openai/providers/bedrock"
+require_relative "openai/providers/vertex"
 require_relative "openai/internal/transport/request_body_merge"
 require_relative "openai/internal/transport/base_client"
 require_relative "openai/helpers/client_options"

data/rbi/openai/internal/provider.rbi

@@ -25,6 +25,9 @@ module OpenAI
 
         attr_accessor :prepare_request
 
+        sig { returns(T.nilable(Proc)) }
+        attr_accessor :wrap_request
+
         sig { returns(T::Array[String]) }
         attr_accessor :authentication_headers
       end

data/rbi/openai/providers.rbi

@@ -14,6 +14,19 @@ module OpenAI
       def azure(endpoint: nil, api_key: nil, token_provider: nil)
       end
 
+      sig do
+        params(
+          project: T.nilable(String),
+          location: T.nilable(String),
+          base_url: T.nilable(String),
+          token_provider: T.nilable(T.proc.returns(String)),
+          credentials: T.untyped
+        )
+          .returns(OpenAI::Provider)
+      end
+      def vertex(project: nil, location: nil, base_url: nil, token_provider: nil, credentials: nil)
+      end
+
       sig do
         params(
           endpoint: T.nilable(T.any(String, Symbol)),

data/sig/openai/internal/provider.rbs

@@ -8,6 +8,7 @@ module OpenAI
           OpenAI::Internal::Transport::BaseClient::request_input
         ) -> OpenAI::Internal::Transport::BaseClient::request_input)?
         attr_accessor authentication_headers: Array[String]
+        attr_accessor wrap_request: Proc?
 
         def initialize: (
           name: String,
@@ -15,7 +16,8 @@ module OpenAI
           prepare_request: (^(
             OpenAI::Internal::Transport::BaseClient::request_input
           ) -> OpenAI::Internal::Transport::BaseClient::request_input)?,
-          authentication_headers: Array[String]
+          authentication_headers: Array[String],
+          ?wrap_request: Proc?
         ) -> void
       end
 

data/sig/openai/providers.rbs

@@ -6,6 +6,14 @@ module OpenAI
       ?token_provider: (^-> String)?
     ) -> OpenAI::Provider
 
+    def self.vertex: (
+      ?project: String?,
+      ?location: String?,
+      ?base_url: String?,
+      ?token_provider: (^-> String)?,
+      ?credentials: untyped
+    ) -> OpenAI::Provider
+
     def self.bedrock: (
       ?endpoint: (:mantle | :runtime | "mantle" | "runtime")?,
       ?region: String?,

data/vertex.md

@@ -0,0 +1,29 @@
+# Google Vertex AI
+
+Configure the standard `OpenAI::Client` to use the Responses API through Vertex AI. For Google Application Default Credentials (ADC), add the optional `googleauth` gem to your application's Gemfile and run `bundle install`:
+
+```ruby
+gem "googleauth", "~> 1"
+```
+
+Configure ADC in your environment, then create a client:
+
+```ruby
+require "openai"
+
+client = OpenAI::Client.new(
+  provider: OpenAI::Providers.vertex(
+    project: "your-project-id",
+    location: "your-vertex-location"
+  )
+)
+
+response = client.responses.create(model: "your-enabled-model", input: "Say hello!")
+puts(response.output_text)
+```
+
+Use a model enabled for your project and location. Vertex AI determines which Responses features are available.
+
+To manage credentials in your application, pass either `credentials:` with a Google credentials object or `token_provider:` with a callback that returns a current access token. The callback runs once per request attempt, including retries; cache and refresh tokens as needed. The `googleauth` gem is not required when using `token_provider:`.
+
+To use a test server or trusted gateway, set `base_url:` to the full API root before `/responses`. The configured origin receives your bearer token. HTTP test roots are supported; use HTTPS in production.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: openai
 version: !ruby/object:Gem::Version
-  version: 0.108.0
+  version: 0.109.0
 platform: ruby
 authors:
 - OpenAI
@@ -49,6 +49,7 @@ extra_rdoc_files:
 - local-audio.md
 - realtime.md
 - responses-websocket.md
+- vertex.md
 files:
 - ".ignore"
 - CHANGELOG.md
@@ -1648,6 +1649,7 @@ files:
 - lib/openai/provider.rb
 - lib/openai/providers/azure.rb
 - lib/openai/providers/bedrock.rb
+- lib/openai/providers/vertex.rb
 - lib/openai/request_options.rb
 - lib/openai/resources/admin.rb
 - lib/openai/resources/admin/organization.rb
@@ -5093,6 +5095,7 @@ files:
 - sig/openai/response_carrier.rbs
 - sig/openai/streaming.rbs
 - sig/openai/version.rbs
+- vertex.md
 homepage: https://gemdocs.org/gems/openai
 licenses:
 - Apache-2.0