"""Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT."""

from .basesdk import BaseSDK
from jsonpath import JSONPath
from openrouter import components, errors, operations, utils
from openrouter._hooks import HookContext
from openrouter.types import OptionalNullable, UNSET
from openrouter.utils import get_security_from_env
from openrouter.utils.unmarshal_json_response import unmarshal_json_response
from typing import Any, Awaitable, Dict, List, Mapping, Optional, Union


class Byok(BaseSDK):
    r"""BYOK endpoints"""

    def list(
        self,
        *,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        offset: Optional[int] = None,
        limit: Optional[int] = None,
        workspace_id: Optional[str] = None,
        provider: Optional[operations.Provider] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> Optional[operations.ListBYOKKeysResponse]:
        r"""List BYOK provider credentials

        List the bring-your-own-key (BYOK) provider credentials for the authenticated entity's default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace, or the `provider` query parameter to filter by upstream provider. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param offset: Number of records to skip for pagination
        :param limit: Maximum number of records to return (max 100)
        :param workspace_id: Optional workspace ID to filter by. Defaults to the authenticated entity's default workspace.
        :param provider: Optional provider slug to filter by (e.g. `openai`, `anthropic`, `amazon-bedrock`).
        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.ListBYOKKeysRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            offset=offset,
            limit=limit,
            workspace_id=workspace_id,
            provider=provider,
        )

        req = self._build_request(
            method="GET",
            path="/byok",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=False,
            request_has_path_params=False,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.ListBYOKKeysGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = self.do_request(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="listBYOKKeys",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["401", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        def next_func() -> Optional[operations.ListBYOKKeysResponse]:
            body = utils.unmarshal_json(http_res.text, Union[Dict[Any, Any], List[Any]])

            offset = request.offset if not request.offset is None else 0

            if not http_res.text:
                return None
            results = JSONPath("$.data").parse(body)
            if len(results) == 0 or len(results[0]) == 0:
                return None
            limit = request.limit if not request.limit is None else 0
            if len(results[0]) < limit:
                return None
            next_offset = offset + len(results[0])

            return self.list(
                http_referer=http_referer,
                x_open_router_title=x_open_router_title,
                x_open_router_categories=x_open_router_categories,
                offset=next_offset,
                limit=limit,
                workspace_id=workspace_id,
                provider=provider,
                retries=retries,
            )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return operations.ListBYOKKeysResponse(
                result=unmarshal_json_response(
                    components.ListBYOKKeysResponse, http_res
                ),
                next=next_func,
            )
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    async def list_async(
        self,
        *,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        offset: Optional[int] = None,
        limit: Optional[int] = None,
        workspace_id: Optional[str] = None,
        provider: Optional[operations.Provider] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> Optional[operations.ListBYOKKeysResponse]:
        r"""List BYOK provider credentials

        List the bring-your-own-key (BYOK) provider credentials for the authenticated entity's default workspace. Use the `workspace_id` query parameter to scope the result to a different workspace, or the `provider` query parameter to filter by upstream provider. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param offset: Number of records to skip for pagination
        :param limit: Maximum number of records to return (max 100)
        :param workspace_id: Optional workspace ID to filter by. Defaults to the authenticated entity's default workspace.
        :param provider: Optional provider slug to filter by (e.g. `openai`, `anthropic`, `amazon-bedrock`).
        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.ListBYOKKeysRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            offset=offset,
            limit=limit,
            workspace_id=workspace_id,
            provider=provider,
        )

        req = self._build_request_async(
            method="GET",
            path="/byok",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=False,
            request_has_path_params=False,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.ListBYOKKeysGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = await self.do_request_async(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="listBYOKKeys",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["401", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        def next_func() -> Awaitable[Optional[operations.ListBYOKKeysResponse]]:
            body = utils.unmarshal_json(http_res.text, Union[Dict[Any, Any], List[Any]])

            async def empty_result():
                return None

            offset = request.offset if not request.offset is None else 0

            if not http_res.text:
                return empty_result()
            results = JSONPath("$.data").parse(body)
            if len(results) == 0 or len(results[0]) == 0:
                return empty_result()
            limit = request.limit if not request.limit is None else 0
            if len(results[0]) < limit:
                return empty_result()
            next_offset = offset + len(results[0])

            return self.list_async(
                http_referer=http_referer,
                x_open_router_title=x_open_router_title,
                x_open_router_categories=x_open_router_categories,
                offset=next_offset,
                limit=limit,
                workspace_id=workspace_id,
                provider=provider,
                retries=retries,
            )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return operations.ListBYOKKeysResponse(
                result=unmarshal_json_response(
                    components.ListBYOKKeysResponse, http_res
                ),
                next=next_func,
            )
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    def create(
        self,
        *,
        key: str,
        provider: components.BYOKProviderSlug,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        allowed_models: OptionalNullable[List[str]] = UNSET,
        allowed_user_ids: OptionalNullable[List[str]] = UNSET,
        disabled: Optional[bool] = None,
        is_fallback: Optional[bool] = None,
        name: OptionalNullable[str] = UNSET,
        workspace_id: Optional[str] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.CreateBYOKKeyResponse:
        r"""Create a BYOK provider credential

        Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. Defaults to the authenticated entity's default workspace; use the `workspace_id` body field to scope to a different workspace. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param key: The raw provider API key or credential. This value is encrypted at rest and never returned in API responses.
        :param provider: The upstream provider this credential authenticates against, as a lowercase slug (e.g. `openai`, `anthropic`, `amazon-bedrock`).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param allowed_models: Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
        :param allowed_user_ids: Optional allowlist of user IDs that may use this credential. `null` means no restriction.
        :param disabled: Whether this credential should be created in a disabled state.
        :param is_fallback: Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
        :param name: Optional human-readable name for the credential.
        :param workspace_id: Optional workspace ID. Defaults to the authenticated entity's default workspace.
        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.CreateBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            create_byok_key_request=components.CreateBYOKKeyRequest(
                allowed_models=allowed_models,
                allowed_user_ids=allowed_user_ids,
                disabled=disabled,
                is_fallback=is_fallback,
                key=key,
                name=name,
                provider=provider,
                workspace_id=workspace_id,
            ),
        )

        req = self._build_request(
            method="POST",
            path="/byok",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=True,
            request_has_path_params=False,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.CreateBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            get_serialized_body=lambda: utils.serialize_request_body(
                request.create_byok_key_request,
                False,
                False,
                "json",
                components.CreateBYOKKeyRequest,
            ),
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = self.do_request(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="createBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["400", "401", "403", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "201", "application/json"):
            return unmarshal_json_response(components.CreateBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "400", "application/json"):
            response_data = unmarshal_json_response(
                errors.BadRequestResponseErrorData, http_res
            )
            raise errors.BadRequestResponseError(response_data, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "403", "application/json"):
            response_data = unmarshal_json_response(
                errors.ForbiddenResponseErrorData, http_res
            )
            raise errors.ForbiddenResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    async def create_async(
        self,
        *,
        key: str,
        provider: components.BYOKProviderSlug,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        allowed_models: OptionalNullable[List[str]] = UNSET,
        allowed_user_ids: OptionalNullable[List[str]] = UNSET,
        disabled: Optional[bool] = None,
        is_fallback: Optional[bool] = None,
        name: OptionalNullable[str] = UNSET,
        workspace_id: Optional[str] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.CreateBYOKKeyResponse:
        r"""Create a BYOK provider credential

        Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. Defaults to the authenticated entity's default workspace; use the `workspace_id` body field to scope to a different workspace. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param key: The raw provider API key or credential. This value is encrypted at rest and never returned in API responses.
        :param provider: The upstream provider this credential authenticates against, as a lowercase slug (e.g. `openai`, `anthropic`, `amazon-bedrock`).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param allowed_models: Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
        :param allowed_user_ids: Optional allowlist of user IDs that may use this credential. `null` means no restriction.
        :param disabled: Whether this credential should be created in a disabled state.
        :param is_fallback: Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
        :param name: Optional human-readable name for the credential.
        :param workspace_id: Optional workspace ID. Defaults to the authenticated entity's default workspace.
        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.CreateBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            create_byok_key_request=components.CreateBYOKKeyRequest(
                allowed_models=allowed_models,
                allowed_user_ids=allowed_user_ids,
                disabled=disabled,
                is_fallback=is_fallback,
                key=key,
                name=name,
                provider=provider,
                workspace_id=workspace_id,
            ),
        )

        req = self._build_request_async(
            method="POST",
            path="/byok",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=True,
            request_has_path_params=False,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.CreateBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            get_serialized_body=lambda: utils.serialize_request_body(
                request.create_byok_key_request,
                False,
                False,
                "json",
                components.CreateBYOKKeyRequest,
            ),
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = await self.do_request_async(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="createBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["400", "401", "403", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "201", "application/json"):
            return unmarshal_json_response(components.CreateBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "400", "application/json"):
            response_data = unmarshal_json_response(
                errors.BadRequestResponseErrorData, http_res
            )
            raise errors.BadRequestResponseError(response_data, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "403", "application/json"):
            response_data = unmarshal_json_response(
                errors.ForbiddenResponseErrorData, http_res
            )
            raise errors.ForbiddenResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    def delete(
        self,
        *,
        id: str,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.DeleteBYOKKeyResponse:
        r"""Delete a BYOK provider credential

        Delete (soft-delete) a bring-your-own-key (BYOK) provider credential by its `id`. The encrypted key material is wiped and the record is marked as deleted. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param id: The BYOK credential ID (UUID).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.DeleteBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            id=id,
        )

        req = self._build_request(
            method="DELETE",
            path="/byok/{id}",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=False,
            request_has_path_params=True,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.DeleteBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = self.do_request(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="deleteBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["401", "404", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return unmarshal_json_response(components.DeleteBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "404", "application/json"):
            response_data = unmarshal_json_response(
                errors.NotFoundResponseErrorData, http_res
            )
            raise errors.NotFoundResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    async def delete_async(
        self,
        *,
        id: str,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.DeleteBYOKKeyResponse:
        r"""Delete a BYOK provider credential

        Delete (soft-delete) a bring-your-own-key (BYOK) provider credential by its `id`. The encrypted key material is wiped and the record is marked as deleted. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param id: The BYOK credential ID (UUID).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.DeleteBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            id=id,
        )

        req = self._build_request_async(
            method="DELETE",
            path="/byok/{id}",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=False,
            request_has_path_params=True,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.DeleteBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = await self.do_request_async(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="deleteBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["401", "404", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return unmarshal_json_response(components.DeleteBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "404", "application/json"):
            response_data = unmarshal_json_response(
                errors.NotFoundResponseErrorData, http_res
            )
            raise errors.NotFoundResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    def get(
        self,
        *,
        id: str,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.GetBYOKKeyResponse:
        r"""Get a BYOK provider credential

        Get a single bring-your-own-key (BYOK) provider credential by its `id`. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param id: The BYOK credential ID (UUID).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.GetBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            id=id,
        )

        req = self._build_request(
            method="GET",
            path="/byok/{id}",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=False,
            request_has_path_params=True,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.GetBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = self.do_request(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="getBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["401", "404", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return unmarshal_json_response(components.GetBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "404", "application/json"):
            response_data = unmarshal_json_response(
                errors.NotFoundResponseErrorData, http_res
            )
            raise errors.NotFoundResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    async def get_async(
        self,
        *,
        id: str,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.GetBYOKKeyResponse:
        r"""Get a BYOK provider credential

        Get a single bring-your-own-key (BYOK) provider credential by its `id`. [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param id: The BYOK credential ID (UUID).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.GetBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            id=id,
        )

        req = self._build_request_async(
            method="GET",
            path="/byok/{id}",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=False,
            request_has_path_params=True,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.GetBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = await self.do_request_async(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="getBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["401", "404", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return unmarshal_json_response(components.GetBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "404", "application/json"):
            response_data = unmarshal_json_response(
                errors.NotFoundResponseErrorData, http_res
            )
            raise errors.NotFoundResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    def update(
        self,
        *,
        id: str,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        allowed_models: OptionalNullable[List[str]] = UNSET,
        allowed_user_ids: OptionalNullable[List[str]] = UNSET,
        disabled: Optional[bool] = None,
        is_fallback: Optional[bool] = None,
        key: Optional[str] = None,
        name: OptionalNullable[str] = UNSET,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.UpdateBYOKKeyResponse:
        r"""Update a BYOK provider credential

        Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param id: The BYOK credential ID (UUID).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param allowed_models: Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
        :param allowed_user_ids: Optional allowlist of user IDs that may use this credential. `null` means no restriction.
        :param disabled: Whether this credential is disabled.
        :param is_fallback: Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
        :param key: A new raw provider API key to rotate the credential in-place. The previous key material is overwritten and the masked label is regenerated. Encrypted at rest and never returned in API responses.
        :param name: Optional human-readable name for the credential.
        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.UpdateBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            id=id,
            update_byok_key_request=components.UpdateBYOKKeyRequest(
                allowed_models=allowed_models,
                allowed_user_ids=allowed_user_ids,
                disabled=disabled,
                is_fallback=is_fallback,
                key=key,
                name=name,
            ),
        )

        req = self._build_request(
            method="PATCH",
            path="/byok/{id}",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=True,
            request_has_path_params=True,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.UpdateBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            get_serialized_body=lambda: utils.serialize_request_body(
                request.update_byok_key_request,
                False,
                False,
                "json",
                components.UpdateBYOKKeyRequest,
            ),
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = self.do_request(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="updateBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["400", "401", "404", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return unmarshal_json_response(components.UpdateBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "400", "application/json"):
            response_data = unmarshal_json_response(
                errors.BadRequestResponseErrorData, http_res
            )
            raise errors.BadRequestResponseError(response_data, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "404", "application/json"):
            response_data = unmarshal_json_response(
                errors.NotFoundResponseErrorData, http_res
            )
            raise errors.NotFoundResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = utils.stream_to_text(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)

    async def update_async(
        self,
        *,
        id: str,
        http_referer: Optional[str] = None,
        x_open_router_title: Optional[str] = None,
        x_open_router_categories: Optional[str] = None,
        allowed_models: OptionalNullable[List[str]] = UNSET,
        allowed_user_ids: OptionalNullable[List[str]] = UNSET,
        disabled: Optional[bool] = None,
        is_fallback: Optional[bool] = None,
        key: Optional[str] = None,
        name: OptionalNullable[str] = UNSET,
        retries: OptionalNullable[utils.RetryConfig] = UNSET,
        server_url: Optional[str] = None,
        timeout_ms: Optional[int] = None,
        http_headers: Optional[Mapping[str, str]] = None,
    ) -> components.UpdateBYOKKeyResponse:
        r"""Update a BYOK provider credential

        Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.

        :param id: The BYOK credential ID (UUID).
        :param http_referer: The app identifier should be your app's URL and is used as the primary identifier for rankings.
            This is used to track API usage per application.

        :param x_open_router_title: The app display name allows you to customize how your app appears in OpenRouter's dashboard.

        :param x_open_router_categories: Comma-separated list of app categories (e.g. \"cli-agent,cloud-agent\"). Used for marketplace rankings.

        :param allowed_models: Optional allowlist of model slugs this credential may be used for. `null` means no restriction.
        :param allowed_user_ids: Optional allowlist of user IDs that may use this credential. `null` means no restriction.
        :param disabled: Whether this credential is disabled.
        :param is_fallback: Whether this credential is treated as a fallback — used only after non-fallback keys for the same provider have been tried.
        :param key: A new raw provider API key to rotate the credential in-place. The previous key material is overwritten and the masked label is regenerated. Encrypted at rest and never returned in API responses.
        :param name: Optional human-readable name for the credential.
        :param retries: Override the default retry configuration for this method
        :param server_url: Override the default server URL for this method
        :param timeout_ms: Override the default request timeout configuration for this method in milliseconds
        :param http_headers: Additional headers to set or replace on requests.
        """
        base_url = None
        url_variables = None
        if timeout_ms is None:
            timeout_ms = self.sdk_configuration.timeout_ms

        if server_url is not None:
            base_url = server_url
        else:
            base_url = self._get_url(base_url, url_variables)

        request = operations.UpdateBYOKKeyRequest(
            http_referer=http_referer,
            x_open_router_title=x_open_router_title,
            x_open_router_categories=x_open_router_categories,
            id=id,
            update_byok_key_request=components.UpdateBYOKKeyRequest(
                allowed_models=allowed_models,
                allowed_user_ids=allowed_user_ids,
                disabled=disabled,
                is_fallback=is_fallback,
                key=key,
                name=name,
            ),
        )

        req = self._build_request_async(
            method="PATCH",
            path="/byok/{id}",
            base_url=base_url,
            url_variables=url_variables,
            request=request,
            request_body_required=True,
            request_has_path_params=True,
            request_has_query_params=True,
            user_agent_header="user-agent",
            accept_header_value="application/json",
            http_headers=http_headers,
            _globals=operations.UpdateBYOKKeyGlobals(
                http_referer=self.sdk_configuration.globals.http_referer,
                x_open_router_title=self.sdk_configuration.globals.x_open_router_title,
                x_open_router_categories=self.sdk_configuration.globals.x_open_router_categories,
            ),
            security=self.sdk_configuration.security,
            get_serialized_body=lambda: utils.serialize_request_body(
                request.update_byok_key_request,
                False,
                False,
                "json",
                components.UpdateBYOKKeyRequest,
            ),
            allow_empty_value=None,
            timeout_ms=timeout_ms,
        )

        if retries == UNSET:
            if self.sdk_configuration.retry_config is not UNSET:
                retries = self.sdk_configuration.retry_config
            else:
                retries = utils.RetryConfig(
                    "backoff", utils.BackoffStrategy(500, 60000, 1.5, 3600000), True
                )

        retry_config = None
        if isinstance(retries, utils.RetryConfig):
            retry_config = (retries, ["5XX"])

        http_res = await self.do_request_async(
            hook_ctx=HookContext(
                config=self.sdk_configuration,
                base_url=base_url or "",
                operation_id="updateBYOKKey",
                oauth2_scopes=None,
                security_source=get_security_from_env(
                    self.sdk_configuration.security, components.Security
                ),
            ),
            request=req,
            error_status_codes=["400", "401", "404", "4XX", "500", "5XX"],
            retry_config=retry_config,
        )

        response_data: Any = None
        if utils.match_response(http_res, "200", "application/json"):
            return unmarshal_json_response(components.UpdateBYOKKeyResponse, http_res)
        if utils.match_response(http_res, "400", "application/json"):
            response_data = unmarshal_json_response(
                errors.BadRequestResponseErrorData, http_res
            )
            raise errors.BadRequestResponseError(response_data, http_res)
        if utils.match_response(http_res, "401", "application/json"):
            response_data = unmarshal_json_response(
                errors.UnauthorizedResponseErrorData, http_res
            )
            raise errors.UnauthorizedResponseError(response_data, http_res)
        if utils.match_response(http_res, "404", "application/json"):
            response_data = unmarshal_json_response(
                errors.NotFoundResponseErrorData, http_res
            )
            raise errors.NotFoundResponseError(response_data, http_res)
        if utils.match_response(http_res, "500", "application/json"):
            response_data = unmarshal_json_response(
                errors.InternalServerResponseErrorData, http_res
            )
            raise errors.InternalServerResponseError(response_data, http_res)
        if utils.match_response(http_res, "4XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )
        if utils.match_response(http_res, "5XX", "*"):
            http_res_text = await utils.stream_to_text_async(http_res)
            raise errors.OpenRouterDefaultError(
                "API error occurred", http_res, http_res_text
            )

        raise errors.OpenRouterDefaultError("Unexpected response received", http_res)
