Errors & fail-closed behavior

Fail-closed principles

• Unknown or unsupported chat fields are rejected; see the OpenAPI reference for supported fields.
• Capability-gated modalities (tools, vision, etc.) reject when the selected offer cannot satisfy them.
• Insufficient prepaid wallet → 402 with wallet_insufficient / wallet_frozen rather than silent provider charge against your org.
• Governance deny returns an explanation header when applicable — not a soft allow.

Error shape

Errors follow the OpenAI-shaped {"error":{"message":…,"type":…}} envelope on public inference routes. Always check status code + body; never invent retryable semantics from a marketing page.

# Example: unsupported field
curl -sS -o /tmp/err.json -w "%{http_code}\n" \
  https://api.cybertronic.dev/v1/chat/completions \
  -H "Authorization: Bearer $DAROUTER_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"model":"auto","messages":[{"role":"user","content":"hi"}],"not_a_real_field":true}'

Operational status

Host health: /status. No published p95/SLA on public pages until ops evidence exists.

OpenAPI operations

Contract: /v1/openapi.json documents status semantics per operation. Fail-closed examples start at:

• POST /v1/chat/completions — unsupported fields / capability misses fail closed
• GET /v1/optimizer/decisions/{decision_id} — 404 for unknown/cross-tenant ids