Use Daybreak in the Responses API

Use access_programs.cyber to select a cybersecurity access program for a Responses API request. The Daybreak Blue and Daybreak Red programs provide approved access for cybersecurity work. Other API cybersecurity safeguards continue to apply.

Before using Daybreak, complete organization approval and project setup. Your project needs access to both the program and the model. Use an API key from that project. The request parameter selects behavior within your approved access; it doesn’t grant access.

All Daybreak Red organizations must require SSO for the API organization that holds Cyber access and enforce MFA through your identity provider. If you use a separate Cyber organization, verify its domain and test SSO there.

Choose the model and access program

The model field selects the model. The access_programs.cyber field selects a supported access program for that request: standard, daybreak_blue, or daybreak_red.

Match the request value to the model, not your organization’s approval level. For example, when using gpt-6-sol with Daybreak, send daybreak_blue even if your organization has Daybreak Red approval. Sending daybreak_red with this model returns invalid_access_program.

Send a request

To get started with Daybreak Blue approval, explicitly select daybreak_blue with a Daybreak-eligible model, such as gpt-6-sol:

1
2
3
4
5
6
7
8
9
10curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-6-sol",
    "input": "Explain how to validate a security patch in a test environment.",
    "access_programs": {
      "cyber": "daybreak_blue"
    }
  }'

If your organization has Daybreak Red approval and access is enabled for your project, you can also use gpt-6.1-sol. The request still selects daybreak_blue:

1
2
3
4
5
6
7
8
9
10curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-6.1-sol",
    "input": "Explain how to validate a security patch in a test environment.",
    "access_programs": {
      "cyber": "daybreak_blue"
    }
  }'

Both access_programs and cyber are optional, but neither accepts null in a request. An empty access_programs object leaves the selection unspecified.

Understand defaults when omitted

Starting with gpt-6.1-terra, omitting the access_programs.cyber parameter results in standard request treatment instead of defaulting to the highest available Daybreak tier.

For the models listed below, omitting access_programs.cyber uses the following defaults:

• Mainline models such as gpt-6-sol: Daybreak Blue treatment when your organization and project have the required access; otherwise, standard safeguards.
• Red models such as gpt-5.6-cyber: The API selects daybreak_red. The request fails if the required access is missing.
• gpt-6-astra and gpt-6.1-sol: Reduced refusals for eligible callers with Daybreak Red access enabled for their project; otherwise, standard safeguards.

Model permissions still apply. To turn Daybreak off and request standard safeguards on a compatible model, set access_programs.cyber to standard, even if you have Daybreak access. An explicit Daybreak selection fails if it’s incompatible with the model or you don’t have the required access.

Check the response

When available, access_programs.cyber records the selected program. This partial response shows Daybreak Blue for the gpt-6.1-sol request:

1
2
3
4
5
6{
  "model": "gpt-6.1-sol",
  "access_programs": {
    "cyber": "daybreak_blue"
  }
}

When no program is specified and the request uses standard safeguards, access_programs is null. For a -latest alias, inspect model to see which model served the request. Alias resolution can change and depends on your approved access.

Set up GPT-6-Cyber

Confirm with your account team that your organization has Daybreak Red access and approval for GPT-6-Cyber.

Project access. Ask an organization owner to enable Daybreak Red for the project that will send requests. With project-level controls, use a non-default project and a key from that project.

IP allowlisting. To use GPT-6-Cyber through the API, configure an IP allowlist for the public IPs your application sends requests from. If you have received approval to embed the model in a product, end users without direct model access don’t need to allowlist their own IPs.

Zero Data Retention. If the project uses ZDR, configure Private Safety Processing (PSP). Check that storage shows “Validated” and that the project’s retention policy is “Zero Data Retention with Private Safety Processing.” PSP applies to all API traffic in that project.

Send a GPT-6-Cyber request

Set OPENAI_API_KEY to a key from the approved project. Replace the sample safety identifier with a stable, pseudonymous identifier for the user making the request.

123456789curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-6-cyber",
    "access_programs": {"cyber": "daybreak_red"},
    "safety_identifier": "user_a17f",
    "input": "Suggest a regression test for a path traversal fix."
  }'

If the request fails, check the project associated with the key, the active allowlist, and the project’s retention policy. See Daybreak API errors.

Handle errors

Unknown fields, invalid values, and request-side null values fail validation. Model permissions are checked separately. A selected Daybreak program doesn’t guarantee that every safety check or prompt will succeed. For more help, see Daybreak troubleshooting.