Connect a relay bridge (WebSocket)

curl --request GET \
  --url https://api.enkryptai.com/redteam/relay/v1/relay/bridge \
  --header 'Upgrade: <upgrade>' \
  --header 'apikey: <api-key>' \
  --header 'x-enkrypt-relay-bridge-id: <x-enkrypt-relay-bridge-id>'

import requests

url = "https://api.enkryptai.com/redteam/relay/v1/relay/bridge"

headers = {
    "Upgrade": "<upgrade>",
    "x-enkrypt-relay-bridge-id": "<x-enkrypt-relay-bridge-id>",
    "apikey": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {
    Upgrade: '<upgrade>',
    'x-enkrypt-relay-bridge-id': '<x-enkrypt-relay-bridge-id>',
    apikey: '<api-key>'
  }
};

fetch('https://api.enkryptai.com/redteam/relay/v1/relay/bridge', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.enkryptai.com/redteam/relay/v1/relay/bridge",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Upgrade: <upgrade>",
    "apikey: <api-key>",
    "x-enkrypt-relay-bridge-id: <x-enkrypt-relay-bridge-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.enkryptai.com/redteam/relay/v1/relay/bridge"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Upgrade", "<upgrade>")
	req.Header.Add("x-enkrypt-relay-bridge-id", "<x-enkrypt-relay-bridge-id>")
	req.Header.Add("apikey", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.enkryptai.com/redteam/relay/v1/relay/bridge")
  .header("Upgrade", "<upgrade>")
  .header("x-enkrypt-relay-bridge-id", "<x-enkrypt-relay-bridge-id>")
  .header("apikey", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.enkryptai.com/redteam/relay/v1/relay/bridge")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Upgrade"] = '<upgrade>'
request["x-enkrypt-relay-bridge-id"] = '<x-enkrypt-relay-bridge-id>'
request["apikey"] = '<api-key>'

response = http.request(request)
puts response.read_body

🔴 Red Team API

Connect a relay bridge (WebSocket)

The socket a relay bridge opens to Enkrypt so that a model with no inbound network exposure can still be red-teamed. See target.connect_via_relay on POST /rt/redteam for the request side.

This is a WebSocket upgrade, not a request/response GET - it is listed here so the address and its headers are documented in one place. There is deliberately no Try-it control on this page, because an HTTP request cannot exercise a WebSocket upgrade. Dial it with wss:// from a WebSocket client, or just run the enkryptai-relay console script that ships in the Python SDK, which does all of this for you. The end-to-end walkthrough is Red Teaming Through the Relay Bridge.

The connection is outbound only and bridge-initiated: your firewall sees one long-lived HTTPS connection on port 443 and never has to accept an inbound one. Enkrypt pushes OpenAI-shaped chat.completions requests down that socket, the bridge calls your own LLM over your intranet, and the response returns the same way.

You do not send a user id. Authentication is your apikey alone; the gateway resolves the owning account from it and stamps that identity on both this socket and on the runs you submit, which is how a run finds your bridge. Two customers can therefore both name a bridge customer-bridge-1 without colliding.

If the upgrade is refused, the WebSocket close code says why: 4400 no x-enkrypt-relay-bridge-id header, 4401 the API key was not accepted, 4403 the gateway could not resolve an owning account for the key. The socket is otherwise held open indefinitely and the bridge heartbeats over it.

Connect a relay bridge (WebSocket)

curl --request GET \
  --url https://api.enkryptai.com/redteam/relay/v1/relay/bridge \
  --header 'Upgrade: <upgrade>' \
  --header 'apikey: <api-key>' \
  --header 'x-enkrypt-relay-bridge-id: <x-enkrypt-relay-bridge-id>'

import requests

url = "https://api.enkryptai.com/redteam/relay/v1/relay/bridge"

headers = {
    "Upgrade": "<upgrade>",
    "x-enkrypt-relay-bridge-id": "<x-enkrypt-relay-bridge-id>",
    "apikey": "<api-key>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {
    Upgrade: '<upgrade>',
    'x-enkrypt-relay-bridge-id': '<x-enkrypt-relay-bridge-id>',
    apikey: '<api-key>'
  }
};

fetch('https://api.enkryptai.com/redteam/relay/v1/relay/bridge', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.enkryptai.com/redteam/relay/v1/relay/bridge",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Upgrade: <upgrade>",
    "apikey: <api-key>",
    "x-enkrypt-relay-bridge-id: <x-enkrypt-relay-bridge-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.enkryptai.com/redteam/relay/v1/relay/bridge"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Upgrade", "<upgrade>")
	req.Header.Add("x-enkrypt-relay-bridge-id", "<x-enkrypt-relay-bridge-id>")
	req.Header.Add("apikey", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.enkryptai.com/redteam/relay/v1/relay/bridge")
  .header("Upgrade", "<upgrade>")
  .header("x-enkrypt-relay-bridge-id", "<x-enkrypt-relay-bridge-id>")
  .header("apikey", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.enkryptai.com/redteam/relay/v1/relay/bridge")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Upgrade"] = '<upgrade>'
request["x-enkrypt-relay-bridge-id"] = '<x-enkrypt-relay-bridge-id>'
request["apikey"] = '<api-key>'

response = http.request(request)
puts response.read_body

There is no Try-it control on this page, on purpose. This address is a WebSocket upgrade, not a request/response GET, so it cannot be exercised over HTTP — the playground is suppressed rather than offered and left to fail. Dial it with wss:// from a WebSocket client, or run the enkryptai-relay console script that ships in the Python SDK, which does all of this for you.For the end-to-end walkthrough — running the bridge, confirming it is connected, and pointing a run at it — see Red Teaming Through the Relay Bridge.

Authorizations

apikey

string

header

required

Headers

Upgrade

string

required

Must be websocket. Sent for you by any WebSocket client library.

Example:

"websocket"

x-enkrypt-relay-bridge-id

string

required

The identifier this bridge registers under. Free text you choose, and the one value both sides must agree on: it has to equal target.metadata.relay.bridge_id on the runs you want routed here, and it is what RELAY_BRIDGE_ID sets on the SDK bridge. Scoped to your account, so it only has to be unique within it.

Example:

"customer-bridge-1"

Response

Switching Protocols - the bridge is registered and will now receive relayed requests on this socket.