AI Gateway endpoints reference

The AI Gateway serves model inference, model discovery, and health checks on one HTTP listener. It has no separate management API. Virtual API keys, budgets, pricing, and model sets are managed in the console and through the Enterprise Manager API. See AI Gateway for configuration guides. For the legacy AI Gateway's management API, see the legacy gateway API reference.

Base URL

The chart creates a ClusterIP Service named <RELEASE_NAME>-ai-gateway-v2 in the platform namespace, on port 8080. When the release name already contains ai-gateway-v2, the Service is named <RELEASE_NAME>. These pages use <RELEASE_NAME>-ai-gateway-v2 throughout. The in-cluster base URL is:

http://<RELEASE_NAME>-ai-gateway-v2.<NAMESPACE>.svc:8080

Clients outside the cluster use the hostname you publish through the shared Gateway. See Publish the endpoint. For the base URL each client expects, see Client endpoints.

Inference endpoints

Each endpoint serves the models whose provider speaks that API. The gateway forwards the request body in the API format the client sent, changing it only when PII redaction replaces matched text, and relays the provider's response, including streamed responses.

Method and path	API	Served by provider kinds
POST /v1/chat/completions	OpenAI Chat Completions	openai, openrouter
POST /v1/responses	OpenAI Responses	openai, openrouter
POST /v1/messages	Anthropic Messages	anthropic, bedrock-anthropic
POST /anthropic/v1/messages	Anthropic Messages	anthropic, bedrock-anthropic
POST /v1beta/models/<MODEL>:generateContent	Gemini	gemini-aistudio, vertex
POST /v1beta/models/<MODEL>:streamGenerateContent	Gemini streaming	gemini-aistudio, vertex

The /anthropic prefix serves clients that append the API path to a configured base URL, such as Claude Code with ANTHROPIC_BASE_URL set to https://<AI_GATEWAY_HOST>/anthropic.

The gateway reads up to 10 MiB of a request body.

Model discovery endpoints

Clients list models with GET /v1/models, GET /anthropic/v1/models, and GET /v1beta/models. For the response shape of each and how model access filters them, see Discover models.

Health endpoints

The health endpoints require no credential and stay available while the gateway is disconnected.

Method and path	Meaning	Response
GET /healthz	The process can serve HTTP	200
GET /readyz	The replica should receive traffic	200, or 503 while the replica shuts down

Metrics are served on a separate port, which the Service does not expose. See Collect gateway telemetry.

Authentication

Every inference and discovery request carries one credential. The gateway reads it from the first of these that is present:

1. Authorization: Bearer <CREDENTIAL>
2. x-api-key: <CREDENTIAL>
3. x-goog-api-key: <CREDENTIAL>
4. The key query parameter

A credential shaped like a JWT is validated against the trusted identity providers configured in auth.issuers. Any other credential is treated as a virtual API key and validated against the directory.

Errors

Errors the gateway generates use this body:

{ "error": { "message": "<MESSAGE>" } }

A provider's own error response, such as a 429 rate limit, is relayed to the client unchanged.