List models accessible to the caller

With a key: every model the key can invoke, filtered by key scope and your workspace policy. Without a key: the public catalogue — the models a workspace with no policy of its own is offered — at 60 requests a minute per IP, so an OpenRouter-style client that lists models without sending the key still fills its model picker. A key that is sent is always checked: a bad one is a 401, never the anonymous list. Drop-in for the OpenAI SDK's client.models.list(), and each item carries OpenRouter's name and architecture fields.

Query parameters

• output_modalitiesstring

  Comma-separated. Keeps the models with one of these among architecture.output_modalities: text, audio, embeddings, rerank. all or no value lists every model.

Header parameters

• X-Stav-Runs-Instring

  Where this request may run, as a header: eu, eea, one ISO 3166 alpha-2 country code, or a comma-separated list of codes (NO, SE). The same values and the same meaning as the provider.runs_in body field, for clients that can set fixed headers but not body fields (an SDK's default_headers). It filters the Provider Endpoints that may serve and every failover; when none passes, the request is refused (403 endpoint_not_admissible) and nothing is sent.

  It only ever narrows. Sent together with provider.runs_in, both must hold: X-Stav-Runs-In: eea with "runs_in": "NO" runs in Norway; X-Stav-Runs-In: eu with "runs_in": "NO" or "US" has no country in common and is 400 invalid_value. It never widens your workspace policy. A value Stav cannot read, an empty one, or two header lines with different values is 400 invalid_value with param X-Stav-Runs-In; the same value sent twice counts once. The request log shows the region with its source.

  GET /v1/models lists only models with an endpoint inside it, and a Router or auto only when at least one of its candidates has one (without a key, auto is not listed under the header); GET /v1/models/{model_id}/endpoints lists only those endpoints. /v1/messages/count_tokens reads it too: when the provider's own counter is outside it, the count is a local estimate and the prompt is never sent. The response header X-Stav-Token-Count says exact or estimate. Reading or cancelling a stored response (GET /v1/responses/{id}, /input_items, /cancel) held by an endpoint outside it is refused with 403 endpoint_not_admissible; DELETE is not refused, so data held outside the region can always be erased.

Errors

Every error code, what it means and what to do: Errors.