openai 0.95.0 → 0.97.0

data/rbi/openai/models/beta/agents/vaults/credential_update_params.rbi

@@ -30,14 +30,36 @@ module OpenAI
             # Replacement values for the credential's existing authentication method.
             sig {
               returns(
-                T.any(
-                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth,
-                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer,
-                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable
+                T.nilable(
+                  T.any(
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth,
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer,
+                    OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable
+                  )
                 )
               )
             }
-            attr_accessor :auth
+            attr_reader :auth
+
+            sig {
+              params(
+                auth: T.any(
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::McpOauth::OrHash,
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer::OrHash,
+                  OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable::OrHash
+                )
+              )
+                .void
+            }
+            attr_writer :auth
+
+            # Replaces all metadata. Omit to preserve it, or pass {} to clear it. Up to 16
+            # string key-value pairs, with keys up to 64 and values up to 512 characters.
+            sig { returns(T.nilable(T::Hash[Symbol, String])) }
+            attr_reader :metadata
+
+            sig { params(metadata: T::Hash[Symbol, String]).void }
+            attr_writer :metadata
 
             sig do
               params(
@@ -52,6 +74,8 @@ module OpenAI
                   OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable::OrHash
                 ),
 
+                metadata: T::Hash[Symbol, String],
+
                 request_options: OpenAI::RequestOptions::OrHash
               )
                 .returns(T.attached_class)
@@ -63,7 +87,11 @@ module OpenAI
               credential_id:,
 
               # Replacement values for the credential's existing authentication method.
-              auth:,
+              auth: nil,
+
+              # Replaces all metadata. Omit to preserve it, or pass {} to clear it. Up to 16
+              # string key-value pairs, with keys up to 64 and values up to 512 characters.
+              metadata: nil,
 
               request_options: {}
             )
@@ -79,6 +107,7 @@ module OpenAI
                     OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::StaticBearer,
                     OpenAI::Beta::Agents::Vaults::CredentialAuthRotateParam::EnvironmentVariable
                   ),
+                  metadata: T::Hash[Symbol, String],
                   request_options: OpenAI::RequestOptions
                 }
               )

data/rbi/openai/models/beta/beta_response.rbi

@@ -20,6 +20,12 @@ module OpenAI
         sig { returns(String) }
         attr_accessor :id
 
+        sig { returns(T.nilable(OpenAI::Beta::BetaResponse::AccessPrograms)) }
+        attr_reader :access_programs
+
+        sig { params(access_programs: T.nilable(OpenAI::Beta::BetaResponse::AccessPrograms::OrHash)).void }
+        attr_writer :access_programs
+
         # Unix timestamp (in seconds) of when this Response was created.
         sig { returns(Float) }
         attr_accessor :created_at
@@ -335,6 +341,8 @@ module OpenAI
 
             id: String,
 
+            access_programs: T.nilable(OpenAI::Beta::BetaResponse::AccessPrograms::OrHash),
+
             created_at: Float,
 
             error: T.nilable(OpenAI::Beta::BetaResponseError::OrHash),
@@ -478,6 +486,8 @@ module OpenAI
           # Unique identifier for this Response.
           id:,
 
+          access_programs:,
+
           # Unix timestamp (in seconds) of when this Response was created.
           created_at:,
 
@@ -715,6 +725,7 @@ module OpenAI
           override.returns(
             {
               id: String,
+              access_programs: T.nilable(OpenAI::Beta::BetaResponse::AccessPrograms),
               created_at: Float,
               error: T.nilable(OpenAI::Beta::BetaResponseError),
               incomplete_details: T.nilable(OpenAI::Beta::BetaResponse::IncompleteDetails),
@@ -755,6 +766,58 @@ module OpenAI
         def to_hash
         end
 
+        class AccessPrograms < OpenAI::Internal::Type::BaseModel
+          OrHash = T.type_alias do
+            T.any(
+              OpenAI::Beta::BetaResponse::AccessPrograms,
+              OpenAI::Internal::AnyHash
+            )
+          end
+
+          # The effective Cyber access program used for this response.
+          sig { returns(OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::TaggedSymbol) }
+          attr_accessor :cyber
+
+          sig do
+            params(
+
+              cyber: OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::OrSymbol
+            )
+              .returns(T.attached_class)
+          end
+          def self.new(
+
+            # The effective Cyber access program used for this response.
+
+            cyber:
+          )
+          end
+
+          sig do
+            override.returns(
+              {cyber: OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::TaggedSymbol}
+            )
+          end
+          def to_hash
+          end
+
+          # The effective Cyber access program used for this response.
+          module Cyber
+            extend OpenAI::Internal::Type::Enum
+
+            TaggedSymbol = T.type_alias { T.all(Symbol, OpenAI::Beta::BetaResponse::AccessPrograms::Cyber) }
+            OrSymbol = T.type_alias { T.any(Symbol, String) }
+
+            STANDARD = T.let(:standard, OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::TaggedSymbol)
+            DAYBREAK_BLUE = T.let(:daybreak_blue, OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::TaggedSymbol)
+            DAYBREAK_RED = T.let(:daybreak_red, OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::TaggedSymbol)
+
+            sig { override.returns(T::Array[OpenAI::Beta::BetaResponse::AccessPrograms::Cyber::TaggedSymbol]) }
+            def self.values
+            end
+          end
+        end
+
         class IncompleteDetails < OpenAI::Internal::Type::BaseModel
           OrHash = T.type_alias do
             T.any(
@@ -863,6 +926,7 @@ module OpenAI
           OrSymbol = T.type_alias { T.any(Symbol, String) }
 
           GPT_6_ASTRA = T.let(:"gpt-6-astra", OpenAI::Beta::BetaResponse::Model::TaggedSymbol)
+          GPT_6_1_SOL = T.let(:"gpt-6.1-sol", OpenAI::Beta::BetaResponse::Model::TaggedSymbol)
           GPT_6_SOL = T.let(:"gpt-6-sol", OpenAI::Beta::BetaResponse::Model::TaggedSymbol)
           GPT_6_LUNA = T.let(:"gpt-6-luna", OpenAI::Beta::BetaResponse::Model::TaggedSymbol)
           GPT_5_6_SOL = T.let(:"gpt-5.6-sol", OpenAI::Beta::BetaResponse::Model::TaggedSymbol)

data/rbi/openai/models/beta/beta_responses_client_event.rbi

@@ -31,6 +31,15 @@ module OpenAI
           sig { returns(Symbol) }
           attr_accessor :type
 
+          # Domain-specific access programs to use for this request.
+          sig { returns(T.nilable(OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms)) }
+          attr_reader :access_programs
+
+          sig {
+            params(access_programs: OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::OrHash).void
+          }
+          attr_writer :access_programs
+
           # Whether to run the model response in the background.
           # [Learn more](https://developers.openai.com/api/docs/guides/background).
           sig { returns(T.nilable(T::Boolean)) }
@@ -484,6 +493,8 @@ module OpenAI
           sig do
             params(
 
+              access_programs: OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::OrHash,
+
               background: T.nilable(T::Boolean),
 
               context_management: T.nilable(
@@ -589,6 +600,9 @@ module OpenAI
           end
           def self.new(
 
+            # Domain-specific access programs to use for this request.
+            access_programs: nil,
+
             # Whether to run the model response in the background.
             # [Learn more](https://developers.openai.com/api/docs/guides/background).
             background: nil,
@@ -862,6 +876,7 @@ module OpenAI
             override.returns(
               {
                 type: Symbol,
+                access_programs: T.nilable(OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms),
                 background: T.nilable(T::Boolean),
                 context_management: T.nilable(
                   T::Array[OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::ContextManagement]
@@ -940,6 +955,115 @@ module OpenAI
           def to_hash
           end
 
+          class AccessPrograms < OpenAI::Internal::Type::BaseModel
+            OrHash = T.type_alias do
+              T.any(
+                OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms,
+                OpenAI::Internal::AnyHash
+              )
+            end
+
+            # The Cyber access program to use for this request. Supported values are
+            # `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves
+            # the program from the model's Cyber tier and your organization and project
+            # access, subject to model-specific eligibility restrictions. By default, models
+            # without a Cyber tier use Standard. Blue-tier models use Daybreak Blue when
+            # authorized; otherwise they fall back to Standard unless the model requires
+            # Daybreak access. Red-tier models use Daybreak Red and require authorization.
+            # Requests that require unavailable Daybreak access return 403. An implicit
+            # Standard fallback is represented by null in the response's access_programs
+            # field, rather than an explicit Standard selection.
+            sig {
+              returns(
+                T.nilable(OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::OrSymbol)
+              )
+            }
+            attr_reader :cyber
+
+            sig {
+              params(cyber: OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::OrSymbol)
+                .void
+            }
+            attr_writer :cyber
+
+            # Domain-specific access programs to use for this request.
+            sig do
+              params(
+
+                cyber: OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::OrSymbol
+              )
+                .returns(T.attached_class)
+            end
+            def self.new(
+
+              # The Cyber access program to use for this request. Supported values are
+              # `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves
+              # the program from the model's Cyber tier and your organization and project
+              # access, subject to model-specific eligibility restrictions. By default, models
+              # without a Cyber tier use Standard. Blue-tier models use Daybreak Blue when
+              # authorized; otherwise they fall back to Standard unless the model requires
+              # Daybreak access. Red-tier models use Daybreak Red and require authorization.
+              # Requests that require unavailable Daybreak access return 403. An implicit
+              # Standard fallback is represented by null in the response's access_programs
+              # field, rather than an explicit Standard selection.
+
+              cyber: nil
+            )
+            end
+
+            sig do
+              override.returns(
+                {
+                  cyber: T.nilable(
+                    OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::OrSymbol
+                  )
+                }
+              )
+            end
+            def to_hash
+            end
+
+            # The Cyber access program to use for this request. Supported values are
+            # `standard`, `daybreak_blue`, and `daybreak_red`. If omitted, the API resolves
+            # the program from the model's Cyber tier and your organization and project
+            # access, subject to model-specific eligibility restrictions. By default, models
+            # without a Cyber tier use Standard. Blue-tier models use Daybreak Blue when
+            # authorized; otherwise they fall back to Standard unless the model requires
+            # Daybreak access. Red-tier models use Daybreak Red and require authorization.
+            # Requests that require unavailable Daybreak access return 403. An implicit
+            # Standard fallback is represented by null in the response's access_programs
+            # field, rather than an explicit Standard selection.
+            module Cyber
+              extend OpenAI::Internal::Type::Enum
+
+              TaggedSymbol = T.type_alias {
+                T.all(Symbol, OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber)
+              }
+              OrSymbol = T.type_alias { T.any(Symbol, String) }
+
+              STANDARD = T.let(
+                :standard,
+                OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::TaggedSymbol
+              )
+              DAYBREAK_BLUE = T.let(
+                :daybreak_blue,
+                OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::TaggedSymbol
+              )
+              DAYBREAK_RED = T.let(
+                :daybreak_red,
+                OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::TaggedSymbol
+              )
+
+              sig {
+                override.returns(
+                  T::Array[OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::AccessPrograms::Cyber::TaggedSymbol]
+                )
+              }
+              def self.values
+              end
+            end
+          end
+
           class ContextManagement < OpenAI::Internal::Type::BaseModel
             OrHash = T.type_alias do
               T.any(
@@ -1049,6 +1173,10 @@ module OpenAI
               :"gpt-6-astra",
               OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::Model::TaggedSymbol
             )
+            GPT_6_1_SOL = T.let(
+              :"gpt-6.1-sol",
+              OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::Model::TaggedSymbol
+            )
             GPT_6_SOL = T.let(:"gpt-6-sol", OpenAI::Beta::BetaResponsesClientEvent::ResponseCreate::Model::TaggedSymbol)
             GPT_6_LUNA = T.let(
               :"gpt-6-luna",

data/rbi/openai/models/beta/beta_web_search_preview_tool.rbi

@@ -38,7 +38,9 @@ module OpenAI
         sig { params(search_context_size: OpenAI::Beta::BetaWebSearchPreviewTool::SearchContextSize::OrSymbol).void }
         attr_writer :search_context_size
 
-        # The user's location.
+        # The approximate location of the user. If omitted or null, defaults to the United
+        # States. To avoid this fallback, pass `{"type": "approximate"}` without location
+        # fields. To localize results, provide the relevant location fields.
         sig { returns(T.nilable(OpenAI::Beta::BetaWebSearchPreviewTool::UserLocation)) }
         attr_reader :user_location
 
@@ -73,7 +75,9 @@ module OpenAI
           # search. One of `low`, `medium`, or `high`. `medium` is the default.
           search_context_size: nil,
 
-          # The user's location.
+          # The approximate location of the user. If omitted or null, defaults to the United
+          # States. To avoid this fallback, pass `{"type": "approximate"}` without location
+          # fields. To localize results, provide the relevant location fields.
 
           user_location: nil
         )
@@ -172,7 +176,9 @@ module OpenAI
           sig { returns(T.nilable(String)) }
           attr_accessor :timezone
 
-          # The user's location.
+          # The approximate location of the user. If omitted or null, defaults to the United
+          # States. To avoid this fallback, pass `{"type": "approximate"}` without location
+          # fields. To localize results, provide the relevant location fields.
           sig do
             params(
 

data/rbi/openai/models/beta/beta_web_search_tool.rbi

@@ -44,7 +44,9 @@ module OpenAI
         sig { params(search_context_size: OpenAI::Beta::BetaWebSearchTool::SearchContextSize::OrSymbol).void }
         attr_writer :search_context_size
 
-        # The approximate location of the user.
+        # The approximate location of the user. If omitted or null, defaults to the United
+        # States. To avoid this fallback, pass `{"type": "approximate"}` without location
+        # fields. To localize results, provide the relevant location fields.
         sig { returns(T.nilable(OpenAI::Beta::BetaWebSearchTool::UserLocation)) }
         attr_reader :user_location
 
@@ -85,7 +87,9 @@ module OpenAI
           # search. One of `low`, `medium`, or `high`. `medium` is the default.
           search_context_size: nil,
 
-          # The approximate location of the user.
+          # The approximate location of the user. If omitted or null, defaults to the United
+          # States. To avoid this fallback, pass `{"type": "approximate"}` without location
+          # fields. To localize results, provide the relevant location fields.
 
           user_location: nil
         )
@@ -214,7 +218,9 @@ module OpenAI
           sig { params(type: OpenAI::Beta::BetaWebSearchTool::UserLocation::Type::OrSymbol).void }
           attr_writer :type
 
-          # The approximate location of the user.
+          # The approximate location of the user. If omitted or null, defaults to the United
+          # States. To avoid this fallback, pass `{"type": "approximate"}` without location
+          # fields. To localize results, provide the relevant location fields.
           sig do
             params(
 

data/rbi/openai/models/beta/environment.rbi

@@ -102,6 +102,13 @@ module OpenAI
           sig { returns(Symbol) }
           attr_accessor :type
 
+          # The effective desktop configuration.
+          sig { returns(T.nilable(OpenAI::Beta::Environment::OpenAIHosted::Desktop)) }
+          attr_reader :desktop
+
+          sig { params(desktop: OpenAI::Beta::Environment::OpenAIHosted::Desktop::OrHash).void }
+          attr_writer :desktop
+
           # An environment hosted by OpenAI.
           sig do
             params(
@@ -127,6 +134,8 @@ module OpenAI
                 T.any(OpenAI::Beta::HostedSkillReference::OrHash, OpenAI::Beta::HostedSkill::Inline::OrHash)
               ],
 
+              desktop: OpenAI::Beta::Environment::OpenAIHosted::Desktop::OrHash,
+
               type: Symbol
             )
               .returns(T.attached_class)
@@ -154,6 +163,9 @@ module OpenAI
             # Skills installed in the environment, excluding their archive contents.
             skills:,
 
+            # The effective desktop configuration.
+            desktop: nil,
+
             # The type of the object. Always `openai_hosted`.
 
             type: :openai_hosted
@@ -170,7 +182,8 @@ module OpenAI
                 packages: OpenAI::Beta::Environment::OpenAIHosted::Packages,
                 plugins: T::Array[OpenAI::Beta::HostedPlugin],
                 skills: T::Array[OpenAI::Beta::HostedSkill::Variants],
-                type: Symbol
+                type: Symbol,
+                desktop: OpenAI::Beta::Environment::OpenAIHosted::Desktop
               }
             )
           end
@@ -238,7 +251,7 @@ module OpenAI
               # Disables network access.
               DISABLED = T.let(:disabled, OpenAI::Beta::Environment::OpenAIHosted::Network::Access::TaggedSymbol)
 
-              # Allows access only to configured domains.
+              # Applies the configured domain restrictions.
               RESTRICTED = T.let(:restricted, OpenAI::Beta::Environment::OpenAIHosted::Network::Access::TaggedSymbol)
 
               sig {
@@ -304,6 +317,44 @@ module OpenAI
             end
 
           end
+
+          class Desktop < OpenAI::Internal::Type::BaseModel
+            OrHash = T.type_alias do
+              T.any(
+                OpenAI::Beta::Environment::OpenAIHosted::Desktop,
+                OpenAI::Internal::AnyHash
+              )
+            end
+
+            # Whether the environment provisions a desktop and browser proxy.
+            sig { returns(T::Boolean) }
+            attr_accessor :enabled
+
+            # The effective desktop configuration.
+            sig do
+              params(
+
+                enabled: T::Boolean
+              )
+                .returns(T.attached_class)
+            end
+            def self.new(
+
+              # Whether the environment provisions a desktop and browser proxy.
+
+              enabled:
+            )
+            end
+
+            sig do
+              override.returns(
+                {enabled: T::Boolean}
+              )
+            end
+            def to_hash
+            end
+
+          end
         end
 
         class SelfHosted < OpenAI::Internal::Type::BaseModel

data/rbi/openai/models/beta/environment_param.rbi

@@ -72,6 +72,14 @@ module OpenAI
           sig { returns(T.nilable(T::Array[String])) }
           attr_accessor :capability_directories
 
+          # Desktop provisioning. Omission or null inherits the template setting, or
+          # defaults to disabled.
+          sig { returns(T.nilable(OpenAI::Beta::EnvironmentParam::OpenAIHosted::Desktop)) }
+          attr_reader :desktop
+
+          sig { params(desktop: T.nilable(OpenAI::Beta::EnvironmentParam::OpenAIHosted::Desktop::OrHash)).void }
+          attr_writer :desktop
+
           # Environment variables made available to the agent.
           sig { returns(T.nilable(T::Hash[Symbol, String])) }
           attr_accessor :env
@@ -100,7 +108,7 @@ module OpenAI
           attr_accessor :files
 
           # Network access policy for the environment. Defaults to disabled for GA requests
-          # and enabled for alpha/beta requests.
+          # and enabled for beta requests.
           sig { returns(T.nilable(OpenAI::Beta::EnvironmentParam::OpenAIHosted::Network)) }
           attr_reader :network
 
@@ -140,6 +148,8 @@ module OpenAI
 
               capability_directories: T.nilable(T::Array[String]),
 
+              desktop: T.nilable(OpenAI::Beta::EnvironmentParam::OpenAIHosted::Desktop::OrHash),
+
               env: T.nilable(T::Hash[Symbol, String]),
 
               environment_template_id: String,
@@ -180,6 +190,10 @@ module OpenAI
             # list.
             capability_directories: nil,
 
+            # Desktop provisioning. Omission or null inherits the template setting, or
+            # defaults to disabled.
+            desktop: nil,
+
             # Environment variables made available to the agent.
             env: nil,
 
@@ -191,7 +205,7 @@ module OpenAI
             files: nil,
 
             # Network access policy for the environment. Defaults to disabled for GA requests
-            # and enabled for alpha/beta requests.
+            # and enabled for beta requests.
             network: nil,
 
             # Packages to install in the environment. Defaults to empty package lists.
@@ -218,6 +232,7 @@ module OpenAI
               {
                 type: Symbol,
                 capability_directories: T.nilable(T::Array[String]),
+                desktop: T.nilable(OpenAI::Beta::EnvironmentParam::OpenAIHosted::Desktop),
                 env: T.nilable(T::Hash[Symbol, String]),
                 environment_template_id: String,
                 files: T.nilable(
@@ -243,6 +258,45 @@ module OpenAI
           def to_hash
           end
 
+          class Desktop < OpenAI::Internal::Type::BaseModel
+            OrHash = T.type_alias do
+              T.any(
+                OpenAI::Beta::EnvironmentParam::OpenAIHosted::Desktop,
+                OpenAI::Internal::AnyHash
+              )
+            end
+
+            # Whether to provision the desktop and its browser proxy.
+            sig { returns(T::Boolean) }
+            attr_accessor :enabled
+
+            # Desktop provisioning. Omission or null inherits the template setting, or
+            # defaults to disabled.
+            sig do
+              params(
+
+                enabled: T::Boolean
+              )
+                .returns(T.attached_class)
+            end
+            def self.new(
+
+              # Whether to provision the desktop and its browser proxy.
+
+              enabled:
+            )
+            end
+
+            sig do
+              override.returns(
+                {enabled: T::Boolean}
+              )
+            end
+            def to_hash
+            end
+
+          end
+
           class Network < OpenAI::Internal::Type::BaseModel
             OrHash = T.type_alias do
               T.any(
@@ -259,14 +313,22 @@ module OpenAI
             sig { returns(T.nilable(T::Array[String])) }
             attr_accessor :allowed_domains
 
+            # Domains blocked for both executor and browser when access is restricted. A
+            # nonempty list requires `access: restricted` and cannot be combined with nonempty
+            # `allowed_domains`. Wildcard domains are not supported.
+            sig { returns(T.nilable(T::Array[String])) }
+            attr_accessor :blocked_domains
+
             # Network access policy for the environment. Defaults to disabled for GA requests
-            # and enabled for alpha/beta requests.
+            # and enabled for beta requests.
             sig do
               params(
 
                 access: OpenAI::Beta::EnvironmentParam::OpenAIHosted::Network::Access::OrSymbol,
 
-                allowed_domains: T.nilable(T::Array[String])
+                allowed_domains: T.nilable(T::Array[String]),
+
+                blocked_domains: T.nilable(T::Array[String])
               )
                 .returns(T.attached_class)
             end
@@ -276,8 +338,13 @@ module OpenAI
               access:,
 
               # Domains the environment may access when network access is restricted.
+              allowed_domains: nil,
+
+              # Domains blocked for both executor and browser when access is restricted. A
+              # nonempty list requires `access: restricted` and cannot be combined with nonempty
+              # `allowed_domains`. Wildcard domains are not supported.
 
-              allowed_domains: nil
+              blocked_domains: nil
             )
             end
 
@@ -285,7 +352,8 @@ module OpenAI
               override.returns(
                 {
                   access: OpenAI::Beta::EnvironmentParam::OpenAIHosted::Network::Access::OrSymbol,
-                  allowed_domains: T.nilable(T::Array[String])
+                  allowed_domains: T.nilable(T::Array[String]),
+                  blocked_domains: T.nilable(T::Array[String])
                 }
               )
             end
@@ -307,7 +375,7 @@ module OpenAI
               # Disables network access.
               DISABLED = T.let(:disabled, OpenAI::Beta::EnvironmentParam::OpenAIHosted::Network::Access::TaggedSymbol)
 
-              # Allows access only to configured domains.
+              # Applies the configured domain restrictions.
               RESTRICTED = T.let(
                 :restricted,
                 OpenAI::Beta::EnvironmentParam::OpenAIHosted::Network::Access::TaggedSymbol