---
title: "egress"
description: "The egress namespace — the engine's Luau API reference for egress."
section: "API Reference"
slug: "api-egress"
canonical: "https://origozero.ai/docs/api-egress"
updated: "2026-09-05T23:13:46.369722222+00:00"
tags: ["api", "reference"]
---

# egress

The `egress` namespace — 12 functions.

## globals/egress/credentialNames {#globals-egress-credentialnames}

```lua
egress.credentialNames() -> { string }
```

List the names of configured credentials. Names only — secret
values are never exposed to Luau.

**Returns** `{ string }` — Array of configured credential names.

```lua
for _, n in ipairs(egress.credentialNames()) do print(n) end
```

## globals/egress/fetch {#globals-egress-fetch}

```lua
egress.fetch(name: string, method: string, url: string, headers: Headers?, body: JsonBody?, response: EgressResponseType?) -> string?
```

Perform an HTTP request with a named credential injected
server-side (in Rust). Returns a promise handle for
`task.await()`, or nil when the credential is unknown or `url`
is outside the credential's allowed `base_url`. The secret is
never exposed to Luau. This is the seam that production points
at the ZeroMind egress endpoint.

**Parameters**

- `name` `string` — Credential name registered by the trusted VM.
- `method` `string` — HTTP method, e.g. "GET" or "POST".
- `url` `string` — Request URL (must start with the credential's `base_url`).
- `headers` `Headers` _(optional)_ — Extra header key-value pairs.
- `body` `JsonBody` _(optional)_ — JSON body (encoded automatically).
- `response` `EgressResponseType` _(optional)_ — `"json"` (default) or `"bytes"`.

**Returns** `string?` — Promise handle for `task.await()`, or nil if refused.

```lua
local h = egress.fetch("meshy", "POST", url, nil, { prompt = p })
```

## globals/egress/hasCredential {#globals-egress-hascredential}

```lua
egress.hasCredential(name: string) -> boolean
```

Whether a named credential is configured. Returns only a
boolean — never the value. Service handlers use this to fail
with a clear "not configured" message.

**Parameters**

- `name` `string` — Credential name.

**Returns** `boolean` — True if configured.

```lua
if not egress.hasCredential("meshy") then error("set MESHY_API_KEY") end
```

## modules/egress/README {#modules-egress-readme}

```lua
require("@builtin/modules/api/engine/egress") -- egress (also available as global 'egress')
```

Credential-injecting HTTP for BYO-key world egress (Mechanism B). Public Luau surface over the `__egress` Internal FFI namespace.

Usage: local egress = require("@builtin/modules/api/engine/egress")
Also available as global: egress

## modules/egress/clearCredential {#modules-egress-clearcredential}

```lua
clearCredential(name: string): boolean
```

TRUSTED ONLY. Remove a named credential.

**Parameters**

- `name` `string` — Credential name.

```lua
egress.clearCredential("meshy")
```

## modules/egress/credentialNames {#modules-egress-credentialnames}

```lua
credentialNames(): { string }
```

List the names of configured credentials. Names only — secret
values are never exposed to Luau.

```lua
for _, n in ipairs(egress.credentialNames()) do print(n) end
```

## modules/egress/fetch {#modules-egress-fetch}

```lua
fetch(name: string, method: string, url: string,
```

Perform an HTTP request with a named credential injected
server-side (in Rust). Returns a promise handle for
`task.await()`, or nil when the credential is unknown or `url`
is outside the credential's allowed `base_url`. The secret is
never exposed to Luau. This is the seam that production points
at the ZeroMind egress endpoint.

```lua
local h = egress.fetch("meshy", "POST", url, nil, { prompt = p })
```

## modules/egress/hasCredential {#modules-egress-hascredential}

```lua
hasCredential(name: string): boolean
```

Whether a named credential is configured. Returns only a
boolean — never the value. Service handlers use this to fail
with a clear "not configured" message.

**Parameters**

- `name` `string` — Credential name.

```lua
if not egress.hasCredential("meshy") then error("set MESHY_API_KEY") end
```

## modules/egress/setCredential {#modules-egress-setcredential}

```lua
setCredential(name: string, base_url: string,
```

TRUSTED ONLY. Register a named credential whose header is
injected into matching `egress.fetch` calls. The value is held
in Rust and never returned to Luau.

```lua
egress.setCredential("meshy", "https://api.meshy.ai/", "Authorization", "Bearer " .. key)
```

## typed/builtin//modules/api/engine/egress/egress/credentialNames {#typed-builtin-modules-api-engine-egress-egress-credentialnames}

```lua
egress.credentialNames() -> { string }
```

List the names of configured credentials. Names only — secret
values are never exposed to Luau.

**Returns** `{ string }` — Array of configured credential names.

```lua
for _, n in ipairs(egress.credentialNames()) do print(n) end
```

## typed/builtin//modules/api/engine/egress/egress/fetch {#typed-builtin-modules-api-engine-egress-egress-fetch}

```lua
egress.fetch(name: string, method: string, url: string, headers: Headers?, body: JsonBody?, response: EgressResponseType?) -> string?
```

Perform an HTTP request with a named credential injected
server-side (in Rust). Returns a promise handle for
`task.await()`, or nil when the credential is unknown or `url`
is outside the credential's allowed `base_url`. The secret is
never exposed to Luau. This is the seam that production points
at the ZeroMind egress endpoint.

**Parameters**

- `name` `string` — Credential name registered by the trusted VM.
- `method` `string` — HTTP method, e.g. "GET" or "POST".
- `url` `string` — Request URL (must start with the credential's `base_url`).
- `headers` `Headers` _(optional)_ — Extra header key-value pairs.
- `body` `JsonBody` _(optional)_ — JSON body (encoded automatically).
- `response` `EgressResponseType` _(optional)_ — `"json"` (default) or `"bytes"`.

**Returns** `string?` — Promise handle for `task.await()`, or nil if refused.

```lua
local h = egress.fetch("meshy", "POST", url, nil, { prompt = p })
```

## typed/builtin//modules/api/engine/egress/egress/hasCredential {#typed-builtin-modules-api-engine-egress-egress-hascredential}

```lua
egress.hasCredential(name: string) -> boolean
```

Whether a named credential is configured. Returns only a
boolean — never the value. Service handlers use this to fail
with a clear "not configured" message.

**Parameters**

- `name` `string` — Credential name.

**Returns** `boolean` — True if configured.

```lua
if not egress.hasCredential("meshy") then error("set MESHY_API_KEY") end
```