火山托管版 privacy-configs API 返回 ApiBlocked，隐私配置功能不可用

[liqichen]

问题

使用火山引擎 VikingDB 托管版时，ov privacy 相关命令全部返回 ApiBlocked 错误，隐私配置 API 不可用。

环境

• 部署方式：火山引擎 VikingDB 托管版（api.vikingdb.cn-beijing.volces.com/openviking）
• CLI 版本：ov v0.3.25

现象

ov privacy categories
# ApiBlocked: /api/v1/privacy-configs API is currently unavailable due to access restrictions.

ov privacy upsert api_keys my_key --values-json '{"k":"v"}'
# ApiBlocked: /api/v1/privacy-configs/api_keys/my_key API is currently unavailable due to access restrictions.

ApiBlocked 这个错误码在开源仓库里搜不到，应该是托管版网关层的拦截。

同时 ov write 也无法直接写入 viking://user/default/privacy/ 路径（"write only supports memory or resource files under user scope"）。

临时绕过

先用 ov add-resource 传到 viking://resources/，再 ov mv 挪到 privacy/ 目录，文件可以正常写入并读取。但这只是绕开了写入限制，privacy-configs API 的版本化管理、占位符自动还原等功能完全用不了。

想确认

1. 托管版 privacy-configs API 是暂时未开放，还是永久不支持？
2. 如果不支持，托管版用户管理 skill 密钥等敏感配置，官方推荐什么方式？
3. 有没有 roadmap 可以参考？

提前感谢~

[now-ing]

A data point from the self-hosted side, since this thread has no replies yet and ApiBlocked is easy to misread as "the feature doesn't exist in OSS":

• On our self-hosted instance (open-source, recent main): GET /api/v1/privacy-configs returns 200 {"status":"ok","result":[],"error":null} and ov privacy categories returns an empty list — endpoint and CLI both work. So this matches your read: ApiBlocked looks like a hosted-gateway restriction, not a missing capability.

One caution on the workaround, though: parking sensitive values in viking://resources/ via ov add-resource + ov mv stores them as ordinary resources — exactly the "second store outside the privacy framework" pattern we flagged in the privacy RFC (#1465): no placeholder restoration, no versioned lifecycle, and the content becomes subject to normal resource recall/retention instead of privacy governance. If you need to run this way before the API opens, consider storing only references (e.g. a secret-manager key) rather than plaintext in the bypassed location, and plan a migration once privacy-configs goes live.

Also worth linking for the maintainers: #1465 is still at framework-design stage with open questions around extraction-side leakage — which suggests privacy-configs on the hosted tier is "not yet" rather than "never", but the roadmap question is yours to confirm. cc @txfang @baojun-zhang