OpenAI Responses API Request Workflow

Prepare the request boundary

Set OPENAI_API_KEY in the process environment or an approved secret manager and set PROJECT42_OPENAI_MODEL to a reviewed model ID. Do not print, commit, paste into source, or send the key as model input. Define the purpose, approved input, token budget, timeout, storage policy, and expected response before sending.

Keep application state and authorization outside the model. When continuing a conversation, decide explicitly what prior content may be sent and retained. Treat generated output and tool arguments as untrusted until application validation and policy checks pass.

Send a minimal Responses request

This dependency-free Node.js example reads only environment configuration. Replace the bracketed input at runtime with approved, non-secret content.

const apiKey = process.env.OPENAI_API_KEY;
const model = process.env.PROJECT42_OPENAI_MODEL;
if (!apiKey || !model) throw new Error("Missing OPENAI_API_KEY or PROJECT42_OPENAI_MODEL");

const response = await fetch("https://api.openai.com/v1/responses", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    authorization: `Bearer ${apiKey}`,
  },
  body: JSON.stringify({ model, input: "[INPUT_TEXT]", max_output_tokens: 300 }),
  signal: AbortSignal.timeout(30_000),
});
const requestId = response.headers.get("x-request-id");
const body = await response.json();
if (!response.ok) throw new Error(`OpenAI request failed (${response.status}, request ${requestId ?? "unknown"})`);
const text = body.output
  ?.flatMap((item) => item.type === "message" ? item.content ?? [] : [])
  .find((part) => part.type === "output_text")?.text;
if (body.status !== "completed" || typeof text !== "string") throw new Error("Unexpected completion shape");
console.log({ requestId, responseId: body.id, text });

Expected evidence and verification

Expected output is an HTTP success with a response ID, completed status, typed output items, usage, and an x-request-id header. Verify status, output item and content types, incomplete details, length, safety policy, and domain rules before display or storage. Record request and response IDs, model, latency, usage, and a redacted outcome—not credentials or sensitive input.

Correct authentication and invalid-request failures instead of retrying. Retry only classified transient failures with bounded exponential backoff and jitter, and preserve operation identity. This read-only example has no external side effect, so rollback means discard the unaccepted response and restore the last verified application state. Add idempotency and tested compensation before connecting output to mutations.