Ana içeriğe geç

AI Gateway API

Overview​

Every AI Gateway configuration asset is manageable through APIops. Endpoints follow the standard APIops conventions:

  • Name-based references (project, asset). Runtime IDs are never required in the path.
  • Secret masking on read — apiKey/apiSecret/bearerToken/credential references are returned as boolean presence flags only; plaintext/ciphertext secrets are never disclosed.
  • Save = encrypt + deploy — write operations encrypt @SecretData fields and push to the workers through the owning service; delete undeploys.
  • Upsert — POST /{name}/ creates the asset, or updates it in place if the name already exists.

Project-scoped resources​

Base path: /apiops/projects/{projectName}/... — authenticated with AI_DEVELOPMENT (VIEW for reads, MANAGE for writes).

LLM Providers — /llm-providers​

GET / · GET /{providerName}/ · POST /{providerName}/ · PUT /{providerName}/ · DELETE /{providerName}/

The provider types are a read-only list shipped with Apinizer — they have no APIops endpoint. To connect a provider outside that list, create an LLM Provider (POST /llm-providers/{providerName}/) with providerType: OTHER and set the wire protocol / path fields directly on the connection. The models of a provider are part of the provider payload (supportedModels); there is no separate model endpoint.

VectorDB Connections — /vector-dbs​

GET / · GET /{vectorDbName}/ · POST /{vectorDbName}/ · PUT /{vectorDbName}/ · DELETE /{vectorDbName}/

  • POST /{vectorDbName}/test-connection/ — validates connectivity against the target vector store (in-process manager test), returns a deployment result.

Knowledge Bases — /knowledge-bases​

GET / · GET /{name}/ · POST /{name}/ · PUT /{name}/ · DELETE /{name}/

  • POST /{name}/reindex/ — rebuilds the vector index for the knowledge base.

Knowledge Base connection refs​

A knowledge base stores its connections as ids (vectorDbRef and embeddingProviderRef), but a write can name them instead: send vectorDbName and embeddingProviderName. The names are looked up in the project, then in the admin project, and a name that finds nothing returns HTTP 400. A read returns both the ids and the names.

Knowledge Base Documents — /knowledge-bases/{kbName}/documents​

  • POST / — upload a document (multipart/form-data, file part). Chunked + embedded on ingest.
  • GET / — list documents in the knowledge base.
  • GET /{documentId}/ — get a single document. (Documents are referenced by id — filenames are not unique.)
  • DELETE /{documentId}/ — remove a document and its vectors.
  • POST /{documentId}/reindex/ — reindex a single document.

MCP / A2A / AI Gateway Proxies — apiProxies/ai · apiProxies/mcp · apiProxies/a2a · apiProxies/{apiProxyName}/ai-routing · mcp-routing · a2a-routing​

Inbound MCP servers and A2A agents are not standalone resources — they live as API proxies (type=MCP / type=A2A) managed through the standard API Proxies APIops surface (deploy/undeploy, deploy history). Outbound MCP servers and A2A agents aren't standalone resources either — /mcp-connections and /a2a-connections are retired; a server/agent is now configured inline, wherever it's used (a Passthrough proxy's own routing config, or an MCP Call (LLM) / MCP Call (Fixed) / A2A Call (LLM) / A2A Call (Fixed) policy). A package from an older release that still carries a standalone MCP/A2A connection object is rejected on import with an explanatory error. For the inline server/agent contract on the policy side — required fields, secret masking, allow-list behaviour — see MCP Call Policy and A2A Call Policy.

(permission: API_MANAGEMENT × MANAGE or AI_DEVELOPMENT × MANAGE, like Update AI Routing):

  • POST /apiops/projects/{projectName}/apiProxies/ai/{apiProxyName}/ — creates an AI proxy in one call (details).
  • PUT /apiops/projects/{projectName}/apiProxies/{apiProxyName}/ai-routing/ — replaces the AiRouting config of an AI proxy, including primary provider/model, failover, and load balancing (details).
  • POST /apiops/projects/{projectName}/apiProxies/mcp/{apiProxyName}/ — creates an MCP proxy in one call; routingMode is required, with no implicit default (details).
  • POST /apiops/projects/{projectName}/apiProxies/a2a/{apiProxyName}/ — creates an A2A proxy in one call; routingMode defaults to AGENT_EXPOSE when omitted (details).
  • PUT /apiops/projects/{projectName}/apiProxies/{apiProxyName}/mcp-routing/ — replaces the McpRouting config of an MCP proxy, including its inline backendServers (details).
  • PUT /apiops/projects/{projectName}/apiProxies/{apiProxyName}/a2a-routing/ — replaces the A2aRouting config of an A2A proxy, including its inline backendServers (details).
  • POST /apiops/projects/{projectName}/apiProxies/{apiProxyName}/mcp-gateway/ — generates a new MCP proxy that exposes the endpoints of an existing REST or SOAP proxy as tools (details).
  • POST /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/parse-tools/ — preview-only tools/list discovery for an existing policy's inline mcpServer (details).
  • POST /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/parse-skills/ — preview-only AgentCard discovery for an existing policy's inline a2aAgent (details).

There is no longer a dedicated ai-global-policies resource — AI global policies are plain Policy documents (global=true) managed the same way as every other global policy, through the Manager UI's Global Policies list rather than a standalone screen or APIOps endpoint group.

AI limits​

The /ai-budgets endpoints were removed in version 2026.10.0. Set AI limits with Limit Plans and the Token Rate Limit policy. For what has been consumed against them, see the Usage Reports API.

Admin (global) resources​

Base path: /apiops/settings/... — these are platform-level catalogs/settings and require an ADMIN API token (sysAdmin), matching the classic UI. A project-scoped AI_DEVELOPMENT token is NOT sufficient.

AI Gateway Settings — /apiops/settings/ai-gateway (no trailing slash — unlike the other Admin resources on this page)​

  • GET — read the singleton AI Gateway settings.
  • PUT — update the settings (timeouts, retry, response-body caps, maxToolTurns, defaultConnectionPoolSize, defaultIdleConnectionTimeoutSeconds).

AI Privacy (PII) Presets — /apiops/settings/ai-privacy-presets​

GET / · GET /{presetName}/ · POST /{presetName}/ · PUT /{presetName}/ · DELETE /{presetName}/

  • Optional ?projectId= selects the scope (default admin/global).
  • The same preset family is also available under /apiops/projects/{projectName}/ai-privacy-presets/ (project AI_DEVELOPMENT; see AI Privacy Presets).
  • Seeded presets (builtIn: true) are editable/deletable on this APIops surface; deleting one is permanent unless a future release re-seeds it.

AI Prompt-Guard Presets — /apiops/settings/ai-prompt-guard-presets​

GET / · GET /{presetName}/ · POST /{presetName}/ · PUT /{presetName}/ · DELETE /{presetName}/

  • Same scope rules as privacy presets, including the project-scoped mirror under /apiops/projects/{projectName}/ai-prompt-guard-presets/.

AI DLP Presets — /apiops/settings/ai-dlp-presets​

GET / · GET /{presetName}/ · POST /{presetName}/ · PUT /{presetName}/ · DELETE /{presetName}/

  • Secret/credential regex presets. Project mirror: /apiops/projects/{projectName}/ai-dlp-presets/.

AI Prompt-Decorator Presets — /apiops/settings/ai-prompt-decorator-presets​

GET / · GET /{presetName}/ · POST /{presetName}/ · PUT /{presetName}/ · DELETE /{presetName}/

  • Project mirror: /apiops/projects/{projectName}/ai-prompt-decorator-presets/.

AI Content-Safety Categories — /apiops/settings/ai-topic-category-presets​

GET / · GET /{entryName}/ · POST /{entryName}/ · PUT /{entryName}/ · DELETE /{entryName}/

  • Project mirror: /apiops/projects/{projectName}/ai-topic-category-presets/.

AI Prompt Templates — /apiops/settings/ai-prompt-templates​

GET / · GET /{entryName}/ · POST /{entryName}/ · PUT /{entryName}/ · DELETE /{entryName}/

  • Project mirror: /apiops/projects/{projectName}/ai-prompt-templates/.

Authentication​

All endpoints require authentication using a Personal API Access Token (Authorization: Bearer {token} or apinizer-token: {token}). JHipster JWTs do not work on APIops.

Permissions​

Resource groupPermission
LLM Providers (with their models) / VectorDB / Knowledge BasesAI_DEVELOPMENT (VIEW / MANAGE)
AI/MCP/A2A proxy create, MCP gateway generation, ai-routing/mcp-routing/a2a-routing, policy-embedded parse-tools/parse-skillsAPI_MANAGEMENT × MANAGE or AI_DEVELOPMENT × MANAGE (see Update AI Routing)
Presets & Gateway SettingsAdmin only (sysAdmin)

APIops never widens the privilege surface relative to the UI: presets and gateway settings require system-admin exactly as they do in the Manager UI; A2A private-network egress remains admin-gated.

En son tarihinde güncellendi