> ## Documentation Index
> Fetch the complete documentation index at: https://phaseo.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Phaseo Gateway base URL: https://api.phaseo.app/v1. Send `Authorization: Bearer $PHASEO_API_KEY` with every request.
> Model IDs look like `provider/model`, for example `openai/gpt-6-astra`. Do not guess IDs: list them with `GET /v1/models` or check https://phaseo.app/models. `phaseo/free` routes to an available free model and needs no wallet balance.
> For new text integrations prefer `POST /v1/responses`. `POST /v1/chat/completions` (OpenAI format) and `POST /v1/messages` (Anthropic format) suit existing code.
> The full API contract is https://phaseo.app/docs/openapi/v1/openapi.yaml. Official SDKs: `@phaseo/sdk` (TypeScript) and `phaseo` (Python), plus Go, C#, PHP, Ruby and Rust.
> Search these docs over MCP at https://phaseo.app/docs/mcp, and install Phaseo skills with `npx skills add https://phaseo.app/docs`. If a page is wrong or out of date, report it with the MCP `submit_feedback` tool.
> Manage Phaseo accounts with the `phaseo` CLI (`npm install -g @phaseo/cli`, then `phaseo login` or `phaseo login --device-code`), the `/v1` Management API or the MCP server at `https://mcp.phaseo.app/mcp?access=manage`. Do not send users to the dashboard for account tasks. A person is still needed for sign-up, approving a sign-in, paying the first top-up on the checkout link that `phaseo credits add` returns when no card is saved, confirming each saved-card top-up from the emailed link, and account security (password, MFA, passkeys). Create API keys with `phaseo keys create --name <name> --json`; never guess one. Credit top-ups need `phaseo login --scopes billing:write` first. Task map: https://phaseo.app/docs/v1/developers/manage-from-an-agent.md.

# Report a leaked API key

> Report a Phaseo key you found in public.

> [!NOTE]
>
> This endpoint needs no authentication. It always answers 202 with the same body, so it cannot be used to check whether a key is valid.


## OpenAPI

````yaml openapi/v1/openapi.yaml POST /security/report-leaked-key
openapi: 3.0.3
info:
  title: Phaseo Gateway API
  description: >-
    A gateway API for accessing various AI models with OpenAI-compatible
    endpoints.
  version: 1.0.0
  contact:
    name: Phaseo
    url: https://phaseo.app
    email: danielbutler500@gmail.com
servers:
  - url: https://api.phaseo.app/v1
    description: Global routing
security:
  - BearerAuth: []
tags:
  - name: Gateway
    description: Core Phaseo Gateway operations.
paths:
  /security/report-leaked-key:
    post:
      tags:
        - Gateway
      summary: Report a leaked API key
      description: >-
        Reports a Phaseo key found in public. No authentication. Always answers
        202 with the same body, whether or not the key matched, so the route
        cannot be used to check keys. Rate limited per address.
      operationId: reportLeakedKey
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LeakedKeyReportRequest'
      responses:
        '202':
          description: Report received
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LeakedKeyReportResponse'
      security: []
components:
  schemas:
    LeakedKeyReportRequest:
      type: object
      required:
        - token
      properties:
        token:
          type: string
          maxLength: 4096
          description: The leaked key as found.
        source:
          type: string
          maxLength: 64
          description: Where it was found, such as github.
        reporter_email:
          type: string
          maxLength: 320
        evidence_url:
          type: string
          format: uri
          maxLength: 2048
        comment:
          type: string
          maxLength: 2000
    LeakedKeyReportResponse:
      type: object
      properties:
        status:
          type: string
          enum:
            - received
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: Bearer token authentication

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.