chore: update OpenAPI spec from monorepo

.speakeasy/in.openapi.yaml

@@ -6908,6 +6908,18 @@ components:
         name: 'Production OpenAI Key'
         provider: 'openai'
       properties:
+        allowed_api_key_hashes:
+          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` means no restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.'
+          example:
+            - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943'
+          items:
+            pattern: '^[a-f0-9]{64}$'
+            type: 'string'
+          maxItems: 100
+          minItems: 1
+          type:
+            - 'array'
+            - 'null'
         allowed_models:
           description: 'Optional allowlist of model slugs this credential may be used for. `null` means no restriction.'
           example: null
@@ -24785,6 +24797,18 @@ components:
         disabled: false
         name: 'Updated OpenAI Key'
       properties:
+        allowed_api_key_hashes:
+          description: 'Optional allowlist of OpenRouter API key hashes (`api_keys.hash`) that may use this credential. `null` clears the restriction. Must contain at least one hash if provided. Hashes that do not belong to your account return a 400.'
+          example:
+            - 'f01d52606dc8f0a8303a7b5cc3fa07109c2e346cec7c0a16b40de462992ce943'
+          items:
+            pattern: '^[a-f0-9]{64}$'
+            type: 'string'
+          maxItems: 100
+          minItems: 1
+          type:
+            - 'array'
+            - 'null'
         allowed_models:
           description: 'Optional allowlist of model slugs this credential may be used for. `null` means no restriction.'
           example: null
@@ -28004,7 +28028,7 @@ paths:
           results: '$.data'
         type: 'offsetLimit'
     post:
-      description: 'Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'Create a new bring-your-own-key (BYOK) provider credential. The raw key is encrypted at rest and never returned in API responses. When `workspace_id` is omitted, the credential is created in the default workspace; if that default has been deleted, the request returns a 400 and you must pass `workspace_id` explicitly. Treat the raw key as write-only; it is never returned after creation. Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys. [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'createBYOKKey'
       requestBody:
         content:
@@ -28207,7 +28231,7 @@ paths:
         - 'BYOK'
       x-speakeasy-name-override: 'get'
     patch:
-      description: 'Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). [Management key](/docs/guides/overview/auth/management-api-keys) required.'
+      description: 'Update an existing bring-your-own-key (BYOK) provider credential by its `id`. Include the `key` field to rotate the raw provider API key in-place (the previous key material is overwritten). Use `allowed_api_key_hashes` to restrict the credential to specific OpenRouter API keys (`null` clears the restriction). [Management key](/docs/guides/overview/auth/management-api-keys) required.'
       operationId: 'updateBYOKKey'
       parameters:
         - description: 'The BYOK credential ID (UUID).'