API routing policy

API keys carry a minimum provider execution environment (E-class floor) and a data-sensitivity default and floor (D-class). Completions then evaluate the same D×E routing matrix as web chat, after the concrete provider is resolved and before request content is stored or sent to a model.

Environment classes

Ordering is strict: E0 < E1 < E2 < E3 < E4 < E5.

Data sensitivity on the key

When you create an API key in Settings → API Keys, you choose:

• Minimum provider environment: the key cannot use a weaker provider, even if the matrix would allow it.
• Minimum data sensitivity: a request cannot declare a class below this floor.
• Default data sensitivity: used when the request does not raise sensitivity. Must be at or above the minimum.

Standard Chat Completions needs no extra body field. A missing declaration uses the key default.

In organizations, only owners and admins can create API keys.

Optional upward declaration

Advanced callers may raise sensitivity with the request header:

X-Steinkauz-Data-Sensitivity: D2_CONFIDENTIAL

Short forms D0–D4 are accepted. Official OpenAI Python, OpenAI Node, and AI SDK OpenAI-compatible clients support custom headers. A value below the key floor returns 400 invalid_request_error. Do not put the class in OpenAI metadata.

Provider matching

Each enabled inference provider in Settings → Providers has its own execution environment. For a completion or model list:

• The backing provider must be at or above the API key’s minimum environment (403 / provider_not_permitted otherwise).
• Effective data sensitivity × that provider environment must be allowed on the organization’s matrix (403 / routing_policy_violation otherwise).
• GET /v1/models omits providers the key default class cannot route to.

Decision headers

Successful completions (and matrix denials) include:

Recommendations

• Create a dedicated API key per integration so default D-class matches that workload.
• Raise sensitivity per request only when that call is more sensitive than the key default.
• For the highest sensitivity workloads, prefer BYOK providers you control and mark them with the appropriate environment class in provider settings.