Skip to main content

​
2026-11-02

Account commands for hasp login credentials.

​
New endpoints

  • GET /v1/me — Return the calling credential’s own identity: its organization, the person it belongs to (developer credentials only), and its label, last four characters and scopes. Needs no scope. See Identity.

​
Changed

  • GET /v1/usage now has a scope field. A developer credential (hasp login) can call it and sees only its own engineer’s usage (scope: user). API keys and agent credentials still see the org’s totals (scope: organization), so their responses only gain the new field.
  • Developer credentials can now call GET /v1/models, GET /v1/models/{modelId} and GET /v1/model-access. They still can’t change model access or read the org budget.

​
2026-10-31

Every model on the AI API now runs through Amazon Bedrock.

​
Inference route change

  • HASP runs every language model through Amazon Bedrock under its Business Associate Agreement with Amazon Web Services, so prompts and outputs stay inside the AWS boundary and are never sent to Anthropic or OpenAI.
  • Amazon Web Services, Inc. (Amazon Bedrock) is now the business associate for inference, under the AWS Business Associate Addendum. Anthropic and OpenAI author the models but are not sub-processors on this route. See BAA Structure.
  • Retention: Anthropic (Claude) models run with Bedrock data-retention mode none (zero retention). For OpenAI (GPT) models, AWS retains classifier-flagged traffic for up to 30 days, inside the AWS boundary, for automated abuse detection. Bedrock model-invocation logging is off.
  • Region: inference runs in AWS United States and Canada regions (US geographic inference profiles).
  • What reaches the model is still governed by your organization’s PHI mode: allow (eligible organizations only) sends PHI under the AWS BAA, redact de-identifies it first in HASP’s own pipeline, and block refuses the request.

​
2026-07-31

Deterministic constraint solving (staff scheduling, coverage rostering, resource allocation) is now reachable directly — not just from a solve workflow step.

​
New endpoints

  • POST /v1/solve — Solve a literal constraint-satisfaction / assignment spec against HASP’s self-hosted CP-SAT solver (scope control:workflows). optimal/feasible/infeasible all return 200 — infeasible carries the conflicting-constraint subset, never an error. See Constraint Solving.

​
2026-07-12

BYO-Tool custom_http integration credential and binding management has shipped — an API-only agent builder can register their own tool endpoint and submit its secret programmatically.

​
New endpoints

  • GET /v1/integrations and POST /v1/integrations — List and register custom_http integration credentials (scope control:integrations).
  • GET /v1/integrations/{integrationId} — Retrieve a single integration credential’s metadata. Never returns the stored secret.
  • POST /v1/integrations/{integrationId}/rotate-secret — Replace a credential’s secret without changing its id, name, or bindings.
  • DELETE /v1/integrations/{integrationId} — Revoke a credential. The row and its bindings persist; a revoked credential resolves to a stale state at dispatch time rather than being removed.
  • GET /v1/integrations/{integrationId}/bindings and POST /v1/integrations/{integrationId}/bindings — List and create project-scoped bindings for an integration credential.
  • DELETE /v1/integrations/{integrationId}/bindings/{bindingId} — Remove a binding without affecting the underlying credential.
Credential registration, rotation, and revocation require the API key’s delegating user to be an organization admin. Binding management does not carry that requirement — it follows the same authorization as every other integration.write action: the key’s granted scope.

​
2026-05-27

OpenAI is now a supported provider, and the agent registry, budget, provider-status, and end-user export endpoints have shipped.

​
New provider: OpenAI

The AI API now supports OpenAI models alongside Anthropic. OpenAI models pass through the same Gateway compliance checks as every other model — BAA enforcement, credit accounting, and PHI policy. BAA coverage is hasp_openai_baa_2026.

​
New endpoints

  • GET /v1/provider-status — Upstream AI provider health.
  • POST /v1/agents/{agentId}/credentials/{credentialId}/revoke — Revoke an agent credential.
  • POST /v1/webhooks/deliveries/bulk-replay — Replay webhook deliveries.
  • GET /v1/orgs/{organization}/end-users/{runtimeUser}/export — GDPR Art. 20 end-user data export (scope org.end_users.read).
  • GET /v1/agents and POST /v1/agents — List and register agents in the agent registry.
  • GET /v1/agents/{agentId} and PATCH /v1/agents/{agentId} — Retrieve and update an agent.
  • POST /v1/agents/{agentId}/archive — Archive an agent.
  • POST /v1/agents/{agentId}/reactivate — Reactivate an archived agent.
  • GET /v1/agents/{agentId}/credentials and POST /v1/agents/{agentId}/credentials — List and issue agent credentials.

​
Models available since launch

  • claude-opus-4-7 — Claude Opus 4.7. Anthropic. Most capable. 1,000,000-token context window with extended thinking. premium tier — requires explicit opt-in per organization.
  • gpt-5.5 — GPT-5.5. OpenAI. High capability with vision. 1,050,000-token context window. premium tier — requires explicit opt-in per organization.
  • gpt-5.5-pro — GPT-5.5 Pro. OpenAI. Highest capability with extended thinking — the highest-cost model in the catalog. 1,050,000-token context window. premium tier — requires explicit opt-in per organization.
  • gpt-5.4 — GPT-5.4. OpenAI. Fast and capable. 1,050,000-token context window. standard tier — available to all plans.
  • gpt-5.4-mini — GPT-5.4 mini. OpenAI. Fast and efficient. 400,000-token context window. standard tier — available to all plans.
  • gpt-5.3-codex — GPT-5.3 Codex. OpenAI. Code-optimized (agentic-coding tuned; usable as a Studio backing model). 400,000-token context window. standard tier — available to all plans.

​
2026-04-01

Initial public release of the HASP AI API V1.

​
New endpoints

  • POST /v1/ai/chat — Native HASP AI inference. Supports streaming and non-streaming. Full HASP event taxonomy, PHI metadata in responses, meta.request_id on every response.
  • POST /v1/messages — Anthropic-compatible inference. Drop-in for @anthropic-ai/sdk — change baseURL only. Same compliance checks as native surface.
  • GET /v1/ai/messages/{id} — Retrieve a stored inference record by request_id. Returns original messages, token usage, model, stop reason, PHI metadata, and audit trail reference.
  • GET /v1/api_keys — List API keys for your organization.
  • POST /v1/api_keys — Create a new API key with specified scopes.
  • DELETE /v1/api_keys/{keyId} — Revoke an API key.
  • GET /v1/usage — Current billing period usage summary (credits used, credits remaining).
  • GET /v1/usage/budget — Current spend cap configuration.
  • PATCH /v1/usage/budget — Update monthly credit cap.
  • GET /v1/compliance/baa — Current BAA status and template for your organization.
  • GET /v1/compliance/baa/acceptances — List BAA acceptances (signed versions).
  • GET /v1/compliance/baa/acceptances/{id} — Retrieve a specific BAA acceptance.
  • GET /v1/compliance/baa/acceptances/{id}/download — Download a signed BAA PDF.
  • GET /v1/audit — Query the audit log for your organization.
  • GET /v1/webhooks — List webhook endpoints.
  • POST /v1/webhooks — Register a new webhook endpoint.
  • DELETE /v1/webhooks/{endpointId} — Remove a webhook endpoint.

​
Models available at launch

  • claude-haiku-4-5 — Fast, low-cost. Available to all plans.
  • claude-sonnet-4-6 — Balanced. Available to all plans. Recommended default.
  • claude-opus-4-6 — Highest capability. Requires explicit opt-in per organization.

​
Authentication

API keys use the hasp_api_live_<32-char-alphanumeric> format. The ai:chat scope is required for inference endpoints. The control:read scope is required for control-plane read endpoints. The control:webhooks scope is required for webhook management endpoints.

​
PHI handling

PHI scanning and redaction (powered by Microsoft Presidio) runs on every inference request. The compliance substrate is HASP-owned — it runs inside the HASP platform before any content reaches the upstream model provider. See PHI Guard for details.