openai.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Example provider profile. OpenShell does not load it; import it explicitly:
#   openshell provider profile lint   -f providers/openai.yaml
#   openshell provider profile import -f providers/openai.yaml --global
#
# Copy and edit this file rather than importing it unchanged. `binaries` is the
# least-privilege control that decides which processes may reach the endpoints
# below, so it has to name the paths in *your* image.
#
# Client binaries:   curl.
# Reference layout:  curl at /usr/bin/curl or /usr/local/bin/curl. Add the SDK
#                    interpreter if the workload calls the API through a library.
# Credential scope:  OPENAI_API_KEY, sent as a bearer authorization header to
#                    api.openai.com and nowhere else. For an OpenAI-compatible
#                    service on another host, import a separate profile naming
#                    that host — do not repoint this one.
# Endpoint access:   api.openai.com, read-write, L7 enforced.
# Smoke test:        openshell sandbox create --provider <name> -- \
#                      curl -sS https://api.openai.com/v1/models

id: openai
display_name: OpenAI
description: OpenAI inference API
category: inference
inference_capable: true
credentials:
  - name: api_key
    description: OpenAI API key
    env_vars: [OPENAI_API_KEY]
    required: true
    auth_style: bearer
    header_name: authorization
discovery:
  credentials: [api_key]
endpoints:
  - host: api.openai.com
    port: 443
    protocol: rest
    access: read-write
    enforcement: enforce
binaries: [/usr/bin/curl, /usr/local/bin/curl]