Security models, one API call away.

Quickstart

From approval to your first answer in about five minutes.

1. 1

   Get access

   Request API access with your work email. Once we approve your organization, you get an email and the console opens Projects, API keys and Billing.

2. 2

   Add credits and create a key

   In the console, add credits (card, bank, PayPal, crypto or wire), then API keys, Create API key. Copy the secret: it's shown once. Keep it in an environment variable, never in your code.

   TerminalCopy

   export UNBREACH_API_KEY="ubk_live_..."

3. 3

   Make a request

   With the OpenAI SDK, only the base URL and the key change.

# pip install openai
from openai import OpenAI
import os

client = OpenAI(
    base_url="https://api.unbreach.io/v1",
    api_key=os.environ["UNBREACH_API_KEY"],
)

resp = client.chat.completions.create(
    model="rampart-1",
    messages=[
        {"role": "system", "content": "You are a SOC analyst. Answer with a verdict and next steps."},
        {"role": "user", "content": "3 failed SSH logins for root from 185.220.101.4, then a success for svc-backup."},
    ],
)
print(resp.choices[0].message.content)
print(resp.usage)  # prompt_tokens, completion_tokens: what you're billed for

// npm install openai
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.unbreach.io/v1",
  apiKey: process.env.UNBREACH_API_KEY,
});

const resp = await client.chat.completions.create({
  model: "rampart-1",
  messages: [
    { role: "system", content: "You are a SOC analyst. Answer with a verdict and next steps." },
    { role: "user", content: "3 failed SSH logins for root from 185.220.101.4, then a success for svc-backup." },
  ],
});
console.log(resp.choices[0].message.content);
console.log(resp.usage); // prompt_tokens, completion_tokens: what you're billed for

curl https://api.unbreach.io/v1/chat/completions \
  -H "Authorization: Bearer $UNBREACH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "rampart-1",
    "messages": [
      {"role": "system", "content": "You are a SOC analyst. Answer with a verdict and next steps."},
      {"role": "user", "content": "3 failed SSH logins for root from 185.220.101.4, then a success for svc-backup."}
    ]
  }'

{
  "id": "chatcmpl-8f2c41",
  "object": "chat.completion",
  "created": 1793638800,
  "model": "rampart-1",
  "choices": [{
    "index": 0,
    "message": {
      "role": "assistant",
      "content": "Verdict: likely credential compromise. 185.220.101.4 is a Tor exit..."
    },
    "finish_reason": "stop"
  }],
  "usage": { "prompt_tokens": 41, "completion_tokens": 63, "total_tokens": 104 }
}

Authentication

Send your key in the Authorization header of every request. x-api-key: ubk_live_… works too, for tools that can't set a bearer token.

Authorization: Bearer ubk_live_4cYq…40 characters

Keys start with ubk_live_ followed by 40 random characters. We store only a hash of each secret: if you lose it, roll the key or create a new one.

What a key can do

Each key belongs to a project of your organization. In the console you can narrow it down:

• Models. All models, or only the ones you list. Projects can restrict models too.
• Monthly spend limit. The key stops at this amount until the 1st of next month.
• IP ranges. Requests from other addresses are refused, in addition to your organization's allowlist.
• Expiry date. After it, the key answers expired_api_key.
• Service accounts. Keys that don't belong to a person and survive team changes.

Rolling a key

Roll secret gives you a new secret right away. The previous one keeps working for 24 hours, so you can deploy without downtime. Revoking a key stops it at once.

Chat completions

Sends a conversation to a model and returns its answer. Same request and response as OpenAI's chat completions, so existing code and SDKs work unchanged.

Request body

Bodies can be up to 16 MB. The context window of each model limits how much of it the model reads.

Response

A chat.completion object. model is always the public ID you asked for, and usage holds the token counts you're billed for.

Response headers

Streaming

With "stream": true, the answer arrives as server-sent events: one chat.completion.chunk per piece of text, then data: [DONE]. Show text to your analysts as it's written, or stop reading early: you pay for what was generated.

stream = client.chat.completions.create(
    model="bastion-1",
    messages=[{"role": "user", "content": "Reconstruct the attack chain from these logs: ..."}],
    stream=True,
    stream_options={"include_usage": True},
)
for chunk in stream:
    if chunk.choices:
        print(chunk.choices[0].delta.content or "", end="", flush=True)
    if chunk.usage:
        print("\n", chunk.usage)

const stream = await client.chat.completions.create({
  model: "bastion-1",
  messages: [{ role: "user", content: "Reconstruct the attack chain from these logs: ..." }],
  stream: true,
  stream_options: { include_usage: true },
});
for await (const chunk of stream) {
  process.stdout.write(chunk.choices[0]?.delta?.content ?? "");
  if (chunk.usage) console.log("\n", chunk.usage);
}

curl -N https://api.unbreach.io/v1/chat/completions \
  -H "Authorization: Bearer $UNBREACH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "bastion-1", "stream": true, "stream_options": {"include_usage": true},
       "messages": [{"role": "user", "content": "Reconstruct the attack chain from these logs: ..."}]}'

data: {"object":"chat.completion.chunk","model":"bastion-1","choices":[{"index":0,"delta":{"content":"The attack "}}]}

data: {"object":"chat.completion.chunk","model":"bastion-1","choices":[{"index":0,"delta":{"content":"chain is: "}}]}

data: {"object":"chat.completion.chunk","model":"bastion-1","choices":[{"index":0,"delta":{},"finish_reason":"stop"}]}

data: {"object":"chat.completion.chunk","model":"bastion-1","choices":[],"usage":{"prompt_tokens":812,"completion_tokens":356,"total_tokens":1168}}

data: [DONE]

The usage chunk comes only when you ask for it with include_usage. If the connection drops, we bill the tokens generated until then.

List models

The models your key can use, with their context window. Models in preview or being retired say so.

curl https://api.unbreach.io/v1/models -H "Authorization: Bearer $UNBREACH_API_KEY"

{
  "object": "list",
  "data": [
    { "id": "sentry-1", "object": "model", "owned_by": "unbreach", "context_window": 32000 },
    { "id": "rampart-1", "object": "model", "owned_by": "unbreach", "context_window": 128000,
      "status": "deprecated", "retires_at": "2027-03-01T00:00:00.000Z", "replacement": "rampart-2" },
    { "id": "rampart-2", "object": "model", "owned_by": "unbreach", "context_window": 256000, "status": "preview" }
  ]
}

An example: status, retires_at and replacement appear only when they apply.

Errors

Errors use the OpenAI format, with an HTTP status and a stable code you can branch on. The message is written for people and can change.

{
  "error": {
    "message": "Rate limit reached. Retry in 12 seconds.",
    "type": "rate_limit_error",
    "code": "rate_limit_exceeded",
    "param": null
  }
}

When the model itself refuses a request (a prompt longer than its context window, for example), you get its status and message as they are.

Models

Three sizes of the same security training. Start with rampart-1; move high-volume filtering to sentry-1 and hard investigations to bastion-1.

Prices in USD per million tokens, before tax. This table shows today's prices.

Deprecations

Models move through four stages. We email the owners and admins of organizations that used a model in the last 30 days before it's retired.

To catch deprecations early, log a warning when a response carries the deprecation header.

Rate limits

Limits count requests per minute, per model, for your whole organization. Your usage tier sets them; the console shows yours in Limits. A project can also have its own limit, lower than the organization's.

Requests per minute. New organizations start at tier 1. Need more? Use Request higher limits in the console.

Over the limit, you get 429 rate_limit_exceeded with a retry-after header. See Retries.

Pricing and usage

You pay per token, input and output, at the price of the model. No subscription and no minimum.

• Counted by the model. We bill the usage the model reports in each response. In the rare case it reports none, we estimate about 4 characters per token.
• Failed requests are free. Errors before or from the model aren't billed.
• Volume discount. Monthly spend above $1,000 costs 20% less, automatically.
• Two ways to pay. Prepaid credits by default: requests stop when the balance is empty, and auto-recharge tops it up. Established companies can switch to a monthly invoice with net terms.

Usage shows in the console within seconds: per day, model, key, project and member, with a CSV export.

Spend controls

Set limits at every level, so one runaway script can't spend your month.

Every limit resets on the 1st of the month, in UTC.

Data and security

Read the privacy policy for the details, or ask for our security documentation.

Retries

Retry 429 and 5xx answers, waiting longer each time and honoring retry-after. Never retry other 4xx errors: the request itself needs fixing. The OpenAI SDKs already retry twice; raise it for batch jobs.

client = OpenAI(
    base_url="https://api.unbreach.io/v1",
    api_key=os.environ["UNBREACH_API_KEY"],
    max_retries=5,   # 429 and 5xx, with backoff and retry-after
    timeout=120,
)

const client = new OpenAI({
  baseURL: "https://api.unbreach.io/v1",
  apiKey: process.env.UNBREACH_API_KEY,
  maxRetries: 5, // 429 and 5xx, with backoff and retry-after
  timeout: 120_000,
});

# curl retries 429 and 5xx, and honors Retry-After
curl --retry 5 --retry-max-time 120 https://api.unbreach.io/v1/chat/completions \
  -H "Authorization: Bearer $UNBREACH_API_KEY" -H "Content-Type: application/json" \
  -d '{"model": "sentry-1", "messages": [{"role": "user", "content": "..."}]}'

Going to production

• One key per service and environment, in its own project, so you can see and cap each one.
• Keys in a secret manager, never in code or front ends. Restrict them by IP when your servers have fixed addresses.
• Budgets and alerts on the organization and on each project.
• Auto-recharge, or monthly invoicing, so production never stops on an empty balance.
• Retries on 429 and 5xx, and a timeout that fits your longest answers.
• Log x-request-id with your own request IDs, and watch for the deprecation header.