OpenAI Responses API

Server-side web search on /v1/responses via the tools array, with OpenAI’s native tools_options.web_search.filters.include_domains allow list.

POST /v1/responses

Web search is a tool entry in the tools array. Per-request allow lists use OpenAI’s native tools_options.web_search.filters.

Request

from openai import OpenAI

client = OpenAI(base_url="https://api.abliteration.ai/v1", api_key=os.environ["ABLIT_KEY"])

resp = client.responses.create(
    model="abliterated-model",
    input="Latest SEC filings for NVDA",
    tools=[{"type": "web_search"}],
)

Accepted type aliases: web_search, web_search_preview, web_search_2025_08_26, web_search_preview_2025_03_11.

With an allow list (OpenAI native shape)

resp = client.responses.create(
    model="abliterated-model",
    input="Latest SEC filings for NVDA",
    tools=[{"type": "web_search"}],
    extra_body={
        "tools_options": {
            "web_search": {
                "filters": {
                    "include_domains": ["sec.gov", "nvidia.com"],
                }
            }
        }
    },
)

Up to 100 domains. Omit http:// / https:// prefixes.

Filter	OpenAI native	Honored by abliteration.ai
tools_options.web_search.filters.include_domains	Yes	Yes
Block list (exclude_domains)	Not in OpenAI spec	Only via Policy Gateway project-level

Forced search and lifecycle events

When combined with tool_choice={"type": "required"}, the search fires before the model starts. The stream emits five lifecycle events up front:

response.output_item.added        (web_search_call, status: in_progress)
response.web_search_call.in_progress
response.web_search_call.searching
response.web_search_call.completed
response.output_item.done

Then the model stream begins.

Project-level enforcement

Project-level allow/block lists configured via Policy Gateway cap the request:

• Allow: request include_domains ⊆ project allowed_domains. A request asking for a domain outside the project list returns 400.
• Block: project blocked_domains always applied (OpenAI has no per-request block shape; the project list is the only way to exclude domains on this surface).

If the project has neither list configured, per-request filters pass through unchanged.