GenAI.mil

[TingTung93]

GenAI has an API now.

Swagger API spec

{"openapi":"3.1.0","info":{"title":"STARK API","description":"Secure Trusted API Resource Kit - API Gateway for managing LLM access across multiple organizations.\n\nSTARK provides:\n- **Authentication**: scoped API keys\n- **Multi-tenant hierarchy**: Organizations → Teams → Users\n- **Rate limiting**: Token and request-based limits\n- **LLM Proxy**: OpenAI and Anthropic-compatible endpoints\n\n## Authentication\n\nEndpoints require authentication via:\n- **API Key**: Scoped API key in format {PREFIX}_{random_64_chars}\n\n## Rate Limiting\n\nLLM proxy endpoints are rate-limited based on:\n- Token usage per time window\n- Requests per minute\n\nRate limit headers are included in responses:\n- X-RateLimit-Limit-Tokens: Token limit\n- X-RateLimit-Remaining-Tokens: Remaining tokens\n- X-RateLimit-Limit-Requests: Request limit\n- X-RateLimit-Remaining-Requests: Remaining requests\n","contact":{"name":"STARK API Support"},"license":{"name":"MIT","url":"https://opensource.org/licenses/MIT"},"version":"0.1.0"},"servers":[{"url":"/","description":"Current server"}],"paths":{"/portal/v1/keys/auth/complete":{"get":{"tags":["Portal"],"summary":"Retrieve a newly created API key using a one-time token.","description":"The token is generated during the PKCE callback and stored in Redis\nwith a 60-second TTL. It can only be consumed once.","operationId":"complete_auth","parameters":[{"name":"token","in":"query","description":"One-time retrieval token from callback redirect","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Created API key","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiKeyCreatedResponse"}}}},"404":{"description":"Token not found or expired"}}}},"/v1/chat/completions":{"post":{"tags":["LLM"],"summary":"Create chat completion","description":"Generates a chat completion response for the given messages.\nThis endpoint is OpenAI-compatible and supports streaming.\n\n**Rate Limited**: This endpoint consumes tokens from your quota.","operationId":"proxy_completions","requestBody":{"description":"Chat completion request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChatCompletionRequest"}}},"required":true},"responses":{"200":{"description":"Chat completion response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ChatCompletionResponse"}}}},"400":{"description":"Bad request - invalid request body"},"401":{"description":"Unauthorized - missing or invalid authentication"},"403":{"description":"Forbidden - insufficient scope for requested model"},"404":{"description":"Model not found or not enabled"},"429":{"description":"Rate limit exceeded"},"502":{"description":"Bad gateway - upstream LLM error"}}}},"/v1/models":{"get":{"tags":["LLM"],"summary":"List available LLM models","description":"Returns a list of all active LLM models available through the proxy.\nThis endpoint is OpenAI-compatible.","operationId":"list_models","responses":{"200":{"description":"List of available models","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ModelsListResponse"}}}},"401":{"description":"Unauthorized - missing or invalid authentication"},"500":{"description":"Internal server error"}}}}},"components":{"schemas":{"ApiKeyCreatedResponse":{"type":"object","description":"API key creation response (includes the secret key)","required":["id","key","name","scopes","status"],"properties":{"expires_at":{"type":["string","null"],"format":"date-time","description":"When the key expires (if set)"},"id":{"type":"string","format":"uuid","description":"API key ID"},"key":{"type":"string","description":"The full API key - ONLY SHOWN ONCE","example":"STARK_a1b2c3d4e5f6..."},"name":{"type":"string","description":"Human-readable name for the key","example":"My API Key"},"scopes":{"type":"array","items":{"type":"string"},"description":"Scopes granted to this key"},"status":{"type":"string","description":"Key status","example":"active"}}},"ChatChoice":{"type":"object","description":"Chat completion choice","required":["index","message"],"properties":{"finish_reason":{"type":["string","null"],"description":"Reason for finishing","example":"stop"},"index":{"type":"integer","format":"int32","description":"Index of this choice","example":0},"message":{"$ref":"#/components/schemas/ChatMessage","description":"The generated message"}}},"ChatCompletionRequest":{"type":"object","description":"Chat completion request (OpenAI-compatible)","required":["model","messages"],"properties":{"max_tokens":{"type":["integer","null"],"format":"int32","description":"Maximum tokens to generate","example":1000},"messages":{"type":"array","items":{"$ref":"#/components/schemas/ChatMessage"},"description":"Messages in the conversation"},"model":{"type":"string","description":"Model to use for completion","example":"gpt-4"},"stream":{"type":["boolean","null"],"description":"Whether to stream the response","example":false},"temperature":{"type":["number","null"],"format":"float","description":"Sampling temperature (0-2)","example":0.7}}},"ChatCompletionResponse":{"type":"object","description":"Chat completion response (OpenAI-compatible)","required":["id","object","created","model","choices"],"properties":{"choices":{"type":"array","items":{"$ref":"#/components/schemas/ChatChoice"},"description":"Completion choices"},"created":{"type":"integer","format":"int64","description":"Unix timestamp of creation","example":1686935002},"id":{"type":"string","description":"Unique identifier for the completion","example":"chatcmpl-abc123"},"model":{"type":"string","description":"Model used","example":"gpt-4"},"object":{"type":"string","description":"Object type","example":"chat.completion"},"usage":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/Usage","description":"Token usage statistics"}]}}},"ChatMessage":{"type":"object","description":"Chat message","required":["role","content"],"properties":{"content":{"type":"string","description":"Content of the message","example":"Hello, how are you?"},"role":{"type":"string","description":"Role of the message sender","example":"user"}}},"ModelObject":{"type":"object","description":"Model object in the models list","required":["id","object","created","owned_by"],"properties":{"created":{"type":"integer","format":"int64","description":"Unix timestamp of model creation","example":1686935002},"id":{"type":"string","description":"Model identifier","example":"gpt-4"},"object":{"type":"string","description":"Object type (always \"model\")","example":"model"},"owned_by":{"type":"string","description":"Owner of the model","example":"stark-proxy"}}},"ModelsListResponse":{"type":"object","description":"OpenAI-compatible models list response","required":["object","data"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/ModelObject"},"description":"List of available models"},"object":{"type":"string","description":"Object type (always \"list\")","example":"list"}}},"Usage":{"type":"object","description":"Token usage statistics","required":["prompt_tokens","completion_tokens","total_tokens"],"properties":{"completion_tokens":{"type":"integer","format":"int32","description":"Tokens used in the completion","example":50},"prompt_tokens":{"type":"integer","format":"int32","description":"Tokens used in the prompt","example":10},"total_tokens":{"type":"integer","format":"int32","description":"Total tokens used","example":60}}}}},"tags":[{"name":"LLM","description":"LLM proxy endpoints - OpenAI and Anthropic compatible"},{"name":"Portal","description":"User self-service portal for managing API keys and viewing usage"}]}

[TingTung93]

Could not connect.
Can't reach the server. Check your internet connection, make sure you're on the right network (VPN if required), and try again.

Show technical details
GenAI.mil GET https://api.genai.mil/v1/models failed: Failed to fetch. Confirm the STARK gateway URL, network access, API key, and browser CORS policy.
Things to try: Check that your API key is correct, make sure you're on the right network (VPN if needed), and try again. If it still doesn't work, click the button below to run detailed connection tests.

Run connection tests
Diagnostics
Tests your connection to the AI service and shows detailed results below. Your API key is sent only to the server URL above and is hidden in the output.

Run connection tests
✗ list models (GET /models) — 105ms
URL: https://api.genai.mil/v1/models
Status: (no response)
CONNECTION ERROR: TypeError: Failed to fetch

The browser could not reach the server. Common causes:
• The server blocked this request due to security settings
• Network unreachable (firewall, VPN, or proxy issue)
• Server address could not be found
• Browser security policy when running from a local file
• Certificate or secure-connection issue
Visible response headers (0) — most are hidden by browser security
(none visible to JavaScript)
Request details
GET https://api.genai.mil/v1/models
Authorization:

[TingTung93]

Quick Start
This API provides OpenAI-compatible and Anthropic-compatible endpoints for accessing various LLM providers. Use your API key in the Authorization header to authenticate requests.

import OpenAI from 'openai';

const client = new OpenAI({
baseURL: 'https://api.genai.mil/v1',
apiKey: 'YOUR_API_KEY',
});

const response = await client.chat.completions.create({
model: 'gemini-2.5-flash',
messages: [
{ role: 'user', content: 'Hello, how are you?' }
],
});

console.log(response.choices[0].message.content);
Key Locking
As a security measure, API keys are automatically locked every 8 hours. When your key is locked, API requests will return a 401 Unauthorized response with an unlock URL:

{
"error": {
"type": "unauthorized",
"message": "API key locked - visit the unlock URL to re-enable your key",
"unlock_url": "https://.../unlock/"
}
}
How to unlock your key
Visit the unlock_url from the error response — this will automatically re-enable your key

Or go to the API Keys page and click the unlock button

API Reference
POST /v1/chat/completions

Creates a chat completion for the given messages. Compatible with OpenAI's Chat Completions API.

Request Body
{
"model": "gemini-2.5-flash", // Required: Model ID
"messages": [ // Required: Array of messages
{
"role": "system", // system, user, or assistant
"content": "You are helpful"
},
{
"role": "user",
"content": "Hello!"
}
],
"temperature": 0.7, // Optional: 0-2, default 1
"max_tokens": 1000, // Optional: Max response tokens
"stream": false // Optional: Enable streaming
}
GET /v1/models

Lists all available models. Returns a list of model objects that describe the models available to use.

Streaming responses are supported using Server-Sent Events (SSE). Set stream: true in your request to enable streaming.

curl -X POST https://api.genai.mil/v1/chat/completions
-H "Authorization: Bearer YOUR_API_KEY"
-H "Content-Type: application/json"
-d '{
"model": "gemini-2.5-flash",
"messages": [{"role": "user", "content": "Write a story"}],
"stream": true
}'
The response will be a stream of SSE events, each containing a delta of the response.

Rate limits are enforced based on your team configuration. When rate limited, you'll receive a 429 status code with information about when you can retry.

Rate Limit Response
HTTP/1.1 429 Too Many Requests
Retry-After: 3600

{
"error": {
"type": "rate_limit_exceeded",
"message": "Token limit exceeded: 1050000/1000000 used",
"retry_after_seconds": 3600
}
}
The API uses standard HTTP status codes to indicate the success or failure of requests.

400 Bad Request - Invalid request body or parameters

401 Unauthorized - Invalid or missing API key

403 Forbidden - API key doesn't have permission for this endpoint

404 Not Found - Resource does not exist (e.g., model not enabled)

429 Too Many Requests - Rate limit exceeded

500 Internal Server Error - Server error

502 Bad Gateway - Upstream LLM backend failure

[TingTung93]

PS C:\Users\1527558480.MIL> curl.exe -i https://api.genai.mil/v1/models `

-H "Authorization: Bearer #####"
HTTP/1.1 200 OK
content-type: application/json
x-request-id: 6d3b18ca-cb7d-4e31-a8e6-43366b91e2a0
content-length: 481
date: Tue, 28 Jul 2026 16:33:50 GMT
x-envoy-upstream-service-time: 41
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self'; connect-src 'self' auth.genai.mil api.genai.mil; font-src 'self' fonts.gstatic.com fonts.googleapis.com data:; img-src 'self' data: genai.mil *.genai.mil; script-src 'self' 'unsafe-inline' auth.genai.mil; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self' auth.genai.mil login.microsoftonline.us accounts.google.com; manifest-src 'self' auth.genai.mil; frame-src genai.mil *.genai.mil; frame-ancestors 'self'; upgrade-insecure-requests;
via: 1.1 google

{"data":[{"created":1773961838,"id":"gemini-2.5-flash","object":"model","owned_by":"stark-proxy"},{"created":1773961678,"id":"gemini-2.5-pro","object":"model","owned_by":"stark-proxy"},{"created":1776178166,"id":"gemini-3.1-pro-preview","object":"model","owned_by":"stark-proxy"},{"created":1779901849,"id":"gemini-3.5-flash","object":"model","owned_by":"stark-proxy"},{"created":1776178365,"id":"gemini-3-flash-preview","object":"model","owned_by":"stark-proxy"}],"object":"list"}

[TingTung93]

Thanks—additional testing confirms the API key is unlocked, the application is running on a GFE connected to the DoW network, and the same failure occurs when serving the app through both npm run preview and Python’s HTTP server. This rules out the original file:// origin as the sole cause.

The browser still reports:

TypeError: Failed to fetch

with no HTTP response or visible headers. The most likely cause is that the STARK gateway does not permit browser CORS requests. Because authentication uses the Authorization: Bearer header, the browser sends an OPTIONS preflight request before GET /v1/models. STARK must allow the application origin, the GET and POST methods, and the Authorization and Content-Type headers.

Recommended verification from PowerShell on the same GFE:

curl.exe -i https://api.genai.mil/v1/models `
  -H "Authorization: Bearer YOUR_API_KEY"

Then test the browser preflight:

curl.exe -i -X OPTIONS https://api.genai.mil/v1/models `
  -H "Origin: http://localhost:4173" `
  -H "Access-Control-Request-Method: GET" `
  -H "Access-Control-Request-Headers: authorization"

If the authenticated request returns 200 but the preflight does not return the required Access-Control-Allow-* headers, STARK needs a server-side CORS configuration change. A browser-only application cannot bypass that restriction; the alternatives would be enabling CORS on STARK or adding a local/backend proxy.

[TingTung93]

PS C:\Users\1527558480.MIL\OneDrive - militaryhealth\Documents\ASKSageDocumentWriter> curl.exe -i -X OPTIONS https://api.genai.mil/v1/models `

-H "Origin: http://localhost:4173" -H "Access-Control-Request-Method: GET"
-H "Access-Control-Request-Headers: authorization"
HTTP/1.1 401 Unauthorized
content-type: application/json
x-request-id: fe9e14b0-bb1d-4cad-8763-a323b4b4939c
allow: GET,HEAD
content-length: 151
date: Tue, 28 Jul 2026 16:37:10 GMT
x-envoy-upstream-service-time: 0
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self'; connect-src 'self' auth.genai.mil api.genai.mil; font-src 'self' fonts.gstatic.com fonts.googleapis.com data:; img-src 'self' data: genai.mil *.genai.mil; script-src 'self' 'unsafe-inline' auth.genai.mil; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self' auth.genai.mil login.microsoftonline.us accounts.google.com; manifest-src 'self' auth.genai.mil; frame-src genai.mil *.genai.mil; frame-ancestors 'self'; upgrade-insecure-requests;
via: 1.1 google

{"error":{"type":"unauthorized","message":"Missing authorization. Provide an API key via the Authorization header: 'Authorization: Bearer STARK_...'"}}

[TingTung93]

This confirms the root cause is STARK's server-side CORS/preflight handling.

The evidence is definitive:

• Authenticated GET /v1/models succeeds with HTTP 200 and returns the available models, so the GFE network path and API key are valid.
• The browser preflight OPTIONS /v1/models is rejected with HTTP 401 because STARK requires authentication on the preflight request.
• The preflight response contains no Access-Control-Allow-Origin, Access-Control-Allow-Methods, or Access-Control-Allow-Headers headers.

Browsers intentionally do not include the bearer credential in the CORS preflight. STARK must allow unauthenticated OPTIONS requests and return appropriate CORS headers before it applies bearer authentication to the actual GET or POST request.

At minimum, STARK should return something equivalent to:

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: http://localhost:4173
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type

The approved production origin should be used instead of—or in addition to—localhost. The same behavior is required for /v1/chat/completions because its Authorization and Content-Type: application/json headers also trigger a preflight.

No browser-side change in this zero-backend SPA can bypass a rejected preflight. The available resolutions are:

1. Fix CORS middleware/order on the STARK gateway so OPTIONS is handled before authentication; or
2. Introduce a trusted same-origin backend/local proxy that makes the STARK request outside the browser.

The first option is the correct fix for an API intended to support browser clients.

[TingTung93]

PS C:\Users\1527558480.MIL\OneDrive - militaryhealth\Documents\ASKSageDocumentWriter> curl.exe -i -X OPTIONS https://api.genai.mil/v1/models `

-H "Authorization: Bearer #####" -H "Origin: http://localhost:4173"
-H "Access-Control-Request-Method: GET" `
-H "Access-Control-Request-Headers: authorization"
HTTP/1.1 405 Method Not Allowed
x-request-id: d15e7754-1565-44ee-8549-50e3d435b586
allow: GET,HEAD
content-length: 0
date: Tue, 28 Jul 2026 16:39:05 GMT
x-envoy-upstream-service-time: 54
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self'; connect-src 'self' auth.genai.mil api.genai.mil; font-src 'self' fonts.gstatic.com fonts.googleapis.com data:; img-src 'self' data: genai.mil *.genai.mil; script-src 'self' 'unsafe-inline' auth.genai.mil; style-src 'self' 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self' auth.genai.mil login.microsoftonline.us accounts.google.com; manifest-src 'self' auth.genai.mil; frame-src genai.mil *.genai.mil; frame-ancestors 'self'; upgrade-insecure-requests;
via: 1.1 google