Vercel: permissions can now return "read-write:ai-gateway-byok-credentials", "read:ai-gateway-byok-credentials"

Vercel added two new values to the permissions array on its UserEvent object: "read-write:ai-gateway-byok-credentials" and "read:ai-gateway-byok-credentials", affecting payload.permissions[] reachable from one Vercel operation. Vercel called the change additive, but it breaks exhaustive switches, strict parsers and generated client enums that read UserEvent objects. The new values sit alongside existing AI Gateway permissions such as read-write:ai-gateway-api-key, read-write:ai-gateway-budgets and read-write:ai-gateway-guardrails.

What changed Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums. Affects payload.permissions on UserEvent reachable from 1 operation. New values: read-write:ai-gateway-byok-credentials , read:ai-gateway-byok-credentials . can now return "read-write:ai-gateway-byok-credentials", "read:ai-gateway-byok-credentials" Who is affected Code that reads Vercel's UserEvent objects, used by 1 Vercel operation. Before and after | Where | Before | After | |---|---|---| | UserEvent.payload.permissions | " ", "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:user", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway", "use:github" | " ", "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-byok-credentials", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-byok-credentials", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:user", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway", "use:github" | | UserEvent.payload.nextPermissions | " ", "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:user", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway", "use:github" | " ", "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-byok-credentials", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-byok-credentials", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:user", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway", "use:github" | | UserEvent.payload.after.permissions | "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway" | "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-byok-credentials", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-byok-credentials", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway" | | UserEvent.payload.before.permissions | "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway" | "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-byok-credentials", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-byok-credentials", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway" | | UserEvent.payload.permissions | "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway" | "manage:speed-insights", "manage:web-analytics", "read-write:access-group", "read-write:ai-gateway-api-key", "read-write:ai-gateway-budgets", "read-write:ai-gateway-byok-credentials", "read-write:ai-gateway-guardrails", "read-write:ai-gateway-private-models", "read-write:ai-gateway-rules", "read-write:ai-gateway-virtual-model-configs", "read-write:alerts", "read-write:automations", "read-write:billing", "read-write:blob", "read-write:connect", "read-write:deployment", "read-write:domain", "read-write:domain-registrar", "read-write:drains", "read-write:edge-cache", "read-write:edge-config", "read-write:firewall", "read-write:integration-configuration", "read-write:integration-resource", "read-write:kms", "read-write:messageboard", "read-write:project", "read-write:project-env-vars", "read-write:project-env-vars-non-production", "read-write:project-env-vars-production", "read-write:project-flags-non-production", "read-write:project-flags-production", "read-write:project-members", "read-write:project-protection-bypass", "read-write:project-trusted-sources", "read-write:remote-cache", "read-write:sandbox", "read-write:schedule", "read-write:team-members", "read-write:vcr", "read-write:webhooks", "read:access-group", "read:ai-gateway-budgets", "read:ai-gateway-byok-credentials", "read:ai-gateway-guardrails", "read:ai-gateway-private-models", "read:ai-gateway-rules", "read:ai-gateway-virtual-model-configs", "read:alerts", "read:audit-log", "read:automations", "read:billing", "read:connect", "read:deployment", "read:domain", "read:event", "read:firewall", "read:integration-configuration", "read:integration-resource", "read:kms", "read:messageboard", "read:monitoring", "read:project", "read:project-env-vars-non-production", "read:project-env-vars-production", "read:project-flags", "read:project-members", "read:project-trusted-sources", "read:remote-cache", "read:sandbox", "read:schedule", "read:speed-insights", "read:team", "read:vcr", "read:web-analytics", "read:webhooks", "use:ai-gateway" | Code that breaks switch response.payload.permissions 0 { // existing branches … // no branch for "read-write:ai-gateway-byok-credentials" // no branch for "read:ai-gateway-byok-credentials" default: throw new Error "unexpected permissions" ; } Based on Vercel’s published API specification. How severity is decided https://driftwatch.et/method .