Every AI request, tested before it ships.

// Riddle: GCP project config extraction
{
  "gate_domain": "cloud_infrastructure",
  "difficulty": "standard",
  "prompt": "PROJECT_ID=acme-prod\nREGION=us-central1\nBUCKET=acme-prod-data",
  "expected_outputs": [
    { "field_name": "project_id", "expected_value": "acme-prod",    "match_type": "exact"    },
    { "field_name": "region",     "expected_value": "us-central1",  "match_type": "exact"    },
    { "field_name": "bucket",     "expected_value": "acme-prod",    "match_type": "contains" }
  ]
}

CREATE TABLE firewall_events (
    event_id     UUID      PRIMARY KEY,
    org_id       UUID      NOT NULL REFERENCES organizations,
    event_type   VARCHAR   -- riddle.passed / proxy.blocked / firewall.allow ...
    agent_id     VARCHAR,
    api_key_id   UUID,
    gate_domain  VARCHAR,
    riddle_id    UUID,
    outcome      VARCHAR   -- passed / failed / speed_pass / no_riddle / blocked
    model        VARCHAR,  -- gpt-4o, claude-3-5-sonnet, ...
    provider     VARCHAR,  -- openai / anthropic / groq / google / xai
    elapsed_ms   INTEGER,
    payload      JSONB,    -- full enriched event (agent, dept, asset, feedback)
    created_at   TIMESTAMPTZ DEFAULT NOW()
);

from openai import OpenAI

# BEFORE — going direct to OpenAI
# client = OpenAI(api_key="sk-...")

# AFTER — same SDK, firewalled traffic
client = OpenAI(
    api_key="oaai-sk-...",                              # your OnlyAllowAI key
    base_url="https://api.onlyallow.ai/v1",            # <— one line changed
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "…"}],
    stream=True,
    extra_body={"oaai_answer": {"project_id": "acme-prod"}},  # riddle answer
)

for chunk in response:
    print(chunk.choices[0].delta.content or "", end="")

event: firewall.allow
data: {
  "event_id":        "emo-1063",
  "org_id":          "a1b2c3…",
  "user_id":         "u-456",
  "user_email":      "ops@acme.com",
  "agent_id":        "agent-llama-70b",
  "api_key_id":      "k-789",
  "api_key_name":    "prod-llama-key",
  "api_key_prefix":  "oaai-sk-aBc1",
  "domain":          "analytics",
  "provider":        "ollama",
  "provider_bound":  "ollama",
  "model":           "llama-3.1-70b",
  "department":      "dept-001",
  "department_name": "Analytics",
  "asset":           "asset-022",
  "asset_name":      "looker-dashboards",
  "riddle_id":       "r-555",
  "module_type":     "human",         // human-bound vs ai-assigned
  "outcome":         "speed_pass",    // passed / failed / speed_pass / no_riddle / blocked
  "elapsed_ms":      1,
  "created_at":      "2026-05-17T12:39:48Z"
}

curl -N https://api.onlyallow.ai/v1/chat/completions \
  -H "Authorization: Bearer oaai-sk-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "stream": true,
    "messages": [{"role":"user","content":"Summarise the project."}],
    "oaai_answer": {"project_id":"acme-prod","region":"us-central1"}
  }'

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.OAAI_KEY,
  baseURL: "https://api.onlyallow.ai/v1",
});

const stream = await client.chat.completions.create({
  model: "claude-3-5-sonnet",
  stream: true,
  messages: [{ role: "user", content: "…" }],
  oaai_answer: { project_id: "acme-prod" },          // riddle answer
});

for await (const chunk of stream) {
  process.stdout.write(chunk.choices[0].delta.content ?? "");
}

import httpx, json

async with httpx.AsyncClient(timeout=None) as c:
    async with c.stream(
        "GET",
        "https://api.onlyallow.ai/v1/events/stream",
        headers={"Authorization": f"Bearer {OAAI_KEY}"},
    ) as r:
        async for line in r.aiter_lines():
            if line.startswith("data: "):
                evt = json.loads(line[6:])
                if evt["outcome"] == "blocked":
                    alert_siem(evt)

package main

import ("bytes"; "net/http")

func killKey(adminToken, keyID string) error {
    body := []byte(`{"disabled": true}`)
    req, _ := http.NewRequest(
        "PATCH",
        "https://api.onlyallow.ai/v1/keys/"+keyID,
        bytes.NewReader(body),
    )
    req.Header.Set("Authorization", "Bearer "+adminToken)
    req.Header.Set("Content-Type", "application/json")
    _, err := http.DefaultClient.Do(req)
    return err  // effective on the very next request to that key, globally
}

# 1. Clone
git clone https://github.com/onlyallowai/onlyallowai.git
cd onlyallowai

# 2. Boot Postgres + Redis + API
docker compose up -d

# 3. Apply migrations
docker compose exec api alembic upgrade head

# 4. Health check
curl http://localhost:8000/health
# → {"status":"ok"}

# 5. Issue your first OAAI key (admin token from .env)
curl -X POST http://localhost:8000/v1/keys/oaai/ \
  -H "Authorization: Bearer $ADMIN" \
  -d '{"name":"prod-key","provider":"openai"}'