Gateway API

The gateway is an OpenAI‑compatible HTTP API that also serves Anthropic’s Messages API. Point any OpenAI SDK at https://gateway.worksi.ai/v1, or an Anthropic SDK at https://gateway.worksi.ai, with an aiw_sk_… key and every call is authenticated, checked against your plan and policies, forwarded to the provider you chose, priced and traced. Providers & routing explains how a call finds its provider.

Send the key as Authorization: Bearer, as x-api-key (what the Anthropic SDKs send) or as api-key (Azure‑style clients).

Endpoints#

Request headers#

All optional. The SDKs set them for you from the current run and step.

Response headers#

What happens on every request#

1. The body size is checked (10 MiB).
2. The key is resolved to its organization, workspace and environment.
3. The model is resolved through your model registry, by id or alias, or by its route prefix, and its provider must serve the endpoint.
4. Operator controls apply: a paused agent or workflow gets 423, a stopped run gets 409.
5. Plan and policy checks: your subscription status and monthly quota, then your policies (model allow and deny lists, spend, token and rate limits, model-access approvals, declared tools and end‑user quotas).
6. The key’s own rate limit applies.
7. The call goes to your provider, with timeouts and up to two retries with backoff on connection errors, 429 and 5xx, then the model’s fallbacks. There is never a retry or a fallback after the first streamed byte.
8. Tokens and cost are computed in USD from your registry prices (or the catalog’s, for an unregistered model of a preset credential) and the call is recorded as a span. Telemetry is asynchronous: it never fails or delays the request.

Errors#

Errors use the OpenAI error shape plus the gateway request id. On /v1/messages they use Anthropic’s error shape instead, with the gateway code in error.aiw_code, so the Anthropic SDKs raise their own typed errors.

{"error": {"message": "agent \"triage-agent\" is paused: investigating INC-12", "type": "…",           "code": "agent_paused", "param": null, "aiw_request_id": "req_…"}}

Provider 4xx responses, such as a content-policy refusal, are passed through unchanged. Every refusal by the gateway itself is still recorded as a span with status=blocked, so blocked traffic stays visible and can raise a policy-violation incident.

Providers#

The presets, their route prefixes and what each one serves are listed in Providers & routing.

The gateway refuses private network addresses unless they are explicitly allowed for your deployment, and it never follows redirects.

Simulator and fault injection#

When the resolved provider is the simulator, the X-AIW-Simulate header injects faults, so you can test your error handling and your alerting without breaking anything. Faults apply to the first call only, never to fallback models. Separate directives with ;.

More examples#

curl -sN https://gateway.worksi.ai/v1/chat/completions \  -H "Authorization: Bearer $AIW_API_KEY" \  -H "Content-Type: application/json" \  -d '{"model": "gpt-5-mini", "stream": true, "messages":       [{"role": "user", "content": "Count to five"}]}'

curl -s https://gateway.worksi.ai/v1/embeddings \  -H "Authorization: Bearer $AIW_API_KEY" \  -H "Content-Type: application/json" \  -d '{"model": "text-embedding-3-small",       "input": "refund policy"}'

curl -s https://gateway.worksi.ai/v1/models \  -H "Authorization: Bearer $AIW_API_KEY"