Published · 1h agoSecurity1 min read
A $7.5B Router Price We Cannot Source, and an Audit Trail That Is Off by Default
Nothing in the supplied material names a buyer, a price or OpenRouter's ownership. What it does document is the routing record an acquirer would inherit, and where that record goes missing.
Not a builder's beat, but builders have a standing stake in it.See today for builders
What happened
- OpenRouter documents an openrouter_metadata field added to successful responses, capturing exactly what the router did, intended for debugging routing decisions, attributing latency or cost, and auditing pipeline behaviour.
- Router metadata is opt-in per request via the X-OpenRouter-Metadata header set to enabled; any other value, including misspellings and empty strings, falls back to disabled, and the default when the header is absent is disabled.
- The metadata is wired into every public completion route: /api/v1/chat/completions, /api/v1/messages, /api/v1/responses and legacy /api/v1/completions.
- Cache hits never include openrouter_metadata; both streaming and non-streaming cache replays strip the field so clients cannot pin behaviour on stale routing data that may not reflect the routing that produced the cached payload.
- Responses with a 500 status are scrubbed to a generic message and openrouter_metadata is omitted by design, because OpenRouter does not surface internal routing details on errors whose cause is already hidden; 502, 503, 504 and 529 still include the metadata when the client opted in.
Compiled by The WatchSomething wrong?How this is made
Why it matters
Count the failure paths and the shape of the asset gets clearer. Of the five 5xx classes the documentation names, four return the routing snapshot to a client that opted in. The 500 does not, because those responses are scrubbed to a generic message and OpenRouter says it will not surface internal routing detail when the cause is already hidden [6][15].
The field that earns the opt-in is the attempt counter. Zero means the request never reached a provider, typically because a filter such as provider.only or a max-price rule excluded the last candidate. One or higher means every provider tried failed and the fallbacks were exhausted. On a failure, no endpoint is marked selected [17]. That is the difference between a policy that blocked the call and a provider that was down, and it exists only if the header went out with the request.
Which leaves the contract. Under the EDPB's guide, the controller is whoever decides the purposes and means of processing [9], and the standard clauses require deletion or return of all personal data at the controller's choice once the service ends, with transfers outside the EEA made only on the controller's instruction [18]. Those clauses, not the cap table, are where a customer's leverage over a routing intermediary sits, whoever ends up owning it.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
OpenRouter documents an openrouter_metadata field added to successful responses, capturing exactly what the router did, intended for debugging routing decisions, attributing latency or cost, and auditing pipeline behaviour.
ReportedView cited source - [2]
Router metadata is opt-in per request via the X-OpenRouter-Metadata header set to enabled; any other value, including misspellings and empty strings, falls back to disabled, and the default when the header is absent is disabled.
ReportedView cited source - [3]
The metadata is wired into every public completion route: /api/v1/chat/completions, /api/v1/messages, /api/v1/responses and legacy /api/v1/completions.
ReportedView cited source - [5]
Cache hits never include openrouter_metadata; both streaming and non-streaming cache replays strip the field so clients cannot pin behaviour on stale routing data that may not reflect the routing that produced the cached payload.
ReportedView cited source - [6]
Responses with a 500 status are scrubbed to a generic message and openrouter_metadata is omitted by design, because OpenRouter does not surface internal routing details on errors whose cause is already hidden; 502, 503, 504 and 529 still include the metadata when the client opted in.
ReportedView cited source - [7]
Authentication and rate-limit failures, and other errors firing before the router has usable routing state such as validation rejections at the API edge, do not include the metadata field.
ReportedView cited source
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- openrouter.ai1h agoRouter Metadata - Inspect Routing Decisions on Every Response
