Models
Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry…
Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry callbacks cloud BUILDS but cannot INSTALL.
| Base URL | https://api.hanzo.ai |
| Operations | 4 |
| Auth | Authorization: Bearer $HANZO_API_KEY |
models
GET /v1/models/{model}/access
Returns the caller's own standing for a gated model: "granted", "requested", or empty when they have never asked.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
model | path | string | yes |
POST /v1/models/{model}/access
Records the caller's waitlist request for a gated model and answers their new standing. Authed, idempotent, and self-scoped: the row is keyed to the caller's own org and identity, never to a body-supplied owner.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
model | path | string | yes |
GET /v1/models/providers
Public, secret-free list of the providers serving the models that GET /v1/models lists — the same source, projected. Safe unauthenticated: no keys, URLs, or config are returned, and it reports a SET of names, never which provider serves which model.
GET /v1/models
Returns the list of available models from the routing table.
PUBLIC BY DESIGN, AND IT DOES NOT AUTHENTICATE — that is the whole contract, so it is stated here rather than left to be inferred. The catalogue is the same for everyone (listAvailableModels takes no principal), docs.hanzo.ai fetches it from the browser, and every policy layer around it already says so out loud: the authz filter lists "models" as public, filter_balance refuses to gate it (a 402 here was a console-wide outage), the rate limiter excludes it, and cloud's spend.Reachable carries /v1/models/ as "the model catalog the shell reads for discovery".
SO THE Authorization HEADER IS NOT AN ADMISSION CHECK HERE. It is read for ONE thing — annotating gated SKUs with the caller's own access standing — and annotation degrades to nothing when there is no verified principal.
It used to hold a "require authentication" gate that authenticated nobody: it
rejected an ABSENT credential and a MALFORMED one, then accepted any string that
merely looked like a key. Bearer sk- followed by 36 zeroes returned 200 in
production; so did a JWT three days expired. It was a shape check wearing an auth
check's clothes, and its cost was diagnostic: /v1/models is the natural "is my auth
working?" probe, and answering 200 to a dead credential sent people debugging the
wrong system. A public endpoint must not appear to validate. Either check the
credential or ignore it — this one ignores it, deliberately and visibly.
Removing that gate discloses nothing new: the catalogue was already reachable by anyone willing to type three characters, so there is no confidentiality delta, only an honesty one.
How is this guide?