Every connection, and which way it points.

The Chat Completions dialect, and the reusable core every OpenAI-compatible upstream composes on — OpenRouter, vLLM, LiteLLM and Azure-style gateways are all built from this one adapter. Two behaviours here are governance requirements rather than API conveniences: stream_options.include_usage is sent on every stream whatever the client asked for, because metering must not depend on client behaviour, and tool-call arguments that do not parse are a hard failure rather than an empty object, because policy argument matchers read those arguments and substituting an empty object would walk an unparseable call straight past a rule written to stop it.

Inbound client headers are forwarded from an allowlist of three — openai-organization, openai-project and openai-beta — because reflecting arbitrary headers at an upstream you hold credentials for is a request-smuggling primitive.

The Messages dialect, with the version header pinned at 2023-06-01 and feature gating left to anthropic-beta. max_tokens is required upstream, so a request that omits it is defaulted to 4,096 here rather than refused — that figure matches what LiteLLM injects, so an OpenAI-shaped client that never sets a cap behaves the same through this gateway as through the proxies operators are migrating from. Cache tokens are reported alongside input tokens rather than inside them, so usage is normalised into the mutually exclusive buckets the cost engine needs before it reaches the ledger.

The Generative Language API spoken natively rather than through a compatibility shim, because the differences are structural: the model is in the URL, there is no system role and no assistant role, consecutive same-role turns are rejected so turns are merged on the way out, and tool schemas are an OpenAPI subset that 400s the whole request on a keyword it does not know, so a definition authored for another vendor is stripped before egress. A refused prompt arrives as a 200 carrying a block reason and no candidates, and it is classified as a content-policy refusal so typed failover does not replay it at another vendor and launder a refusal into a success.

A candidateCount other than 1, cachedContent, opaque file references, built-in Google tools, thought state and non-text response modalities are all rejected before egress. Inline a cached turn as text instead.

Azure OpenAI, now branded Azure AI Foundry Models, speaks the OpenAI dialect, so only three deltas need their own code. The URL names a deployment rather than a model, and a deployment is an operator’s private name — two deployments of one model routinely have different quotas and regions — so the mapping is explicit and configurable, and identity is used only where no map is configured at all. Authentication is the api-key header rather than a bearer, since sending both puts the credential on the wire twice and invites the endpoint to validate it as an Entra token and fail.

The api-version is pinned rather than tracked, and deliberately not the newest: Azure changes response shapes between versions, and a gateway that silently followed latest would change its metering behaviour without a deploy. A resource needing a later contract sets one, which is a visible operator decision.

Bedrock matters out of proportion to its traffic share, and the source says why: regulated buyers already hold an AWS data-processing agreement and committed spend, and for many of them it is the only route to a frontier model procurement will sign. Requests are SigV4-signed rather than bearer-authenticated, so the secret never reaches the wire. The signing region is taken from the endpoint host wherever that host proves one, and a contradictory environment value is treated as a configuration failure rather than an override, because the alternative signs for one region while sending prompts to another. The base URL may be omitted and derived from the region, so a VPC or FIPS endpoint stays expressible by stating it.

One API fronts several model families with incompatible body shapes, and only the Anthropic-on-Bedrock shape is spoken; any other family is refused with a named reason rather than posted as a body the endpoint cannot parse. The two CRC32 checksums in each event-stream message are parsed past rather than verified, on the reasoning that transport integrity is TLS’s job and a corrupted frame still fails the length and JSON checks that are enforced.

The OpenAI dialect plus three deltas, and the one that matters to governance is cost. OpenRouter is the only upstream here that returns an authoritative USD figure inline, so when it is present the ledger uses it verbatim instead of pricing token counts against the local table — an aggregator’s blended price cannot be derived from a per-model price table, and the figure is honoured on the streamed path as well as the buffered one, because the transport a client picked must not decide whether the ledger agrees with the invoice. The attribution headers identify the gateway and never the agent or the end user.

The caller-controlled routing fields — models, provider, route, plugins, transforms and web_search_options — are rejected before egress, as are retained :online, :nitro, :floor and :exacto route targets, because each delegates model choice, processing, search egress or charges outside governance. Configure fallbacks and provider selection on route rules instead.

A provider row of kind openai with its base URL pointed at your own endpoint: vLLM, an internal inference gateway, a Bedrock VPC endpoint or an Azure AI Foundry resource. This is the air-gapped path as well as the self-hosted-model one, since a prebuilt image has no runtime dependency on a vendor service or CDN and the dashboard bundles its own assets.

The host must be named in the provider host allowlist — the shipped default contains only vendor endpoints, so name every regional or self-hosted host explicitly before upgrading — and the credential’s environment variable must match an allowed prefix. HTTPS is required, and plain HTTP is accepted only for a literal loopback host.

Streamable HTTP: a POST carries exactly one JSON-RPC message, a GET opens the server-to-client event stream, and a DELETE ends the session. Initialisation negotiates the protocol version and issues a session id, but authority is re-derived from the bearer token on every request and sessions carry no permissions at all, so a session opened by one subject and presented with another’s token is refused rather than honoured. Refusals arrive as structured metadata beside model-readable text, carrying the typed code, whether it is retryable and any approval id.

Batching is refused outright: it was removed from the specification in the 2025-06-18 revision and this gateway never accepted it. A request whose Origin header is neither the gateway’s own host nor a loopback name is rejected, which is what stops a page on another origin driving a locally bound gateway.

Each upstream is a row holding a name, a destination and the name of an environment variable containing its Authorization header — never the credential itself, which is resolved at call time, never stored on the row and never logged. On every response the stored URL is shown as an origin only, with its userinfo, path, query and fragment write-only, so reading the registry never returns a destination that carried a secret in it.

This is the weakest of the four credential namespaces and the documentation says so: the named variable’s value is sent raw as an Authorization header, the row is writable at operator rank rather than admin, and the outbound call is triggered by any viewer listing that server’s tools. The host allowlist defaults to loopback only, because the shipped demo upstream runs there — set it before go-live.

One catalogue per process, deliberately, because it owns the long-lived upstream sessions and a second one would double every handshake. It is cached for sixty seconds, refreshed concurrently so that one slow or dead upstream cannot hide another server’s tools, and polled in the background only while somebody is actually listening, since an idle refresh is upstream load with nobody to tell. Each descriptor’s name, description and input schema is hashed at approval and re-checked here, so an upstream that quietly rewrites what a tool claims to do is quarantined rather than served.

A failed refresh serves the last known catalogue and makes the staleness visible — but that fallback is forbidden when durable authority has changed, and the read then fails closed, because it is not possible to know whether another process has just narrowed what this agent may do.

Thirteen event types are subscribable, spanning approvals requested and resolved, policies blocking and flagging, budget warnings and breaches, an agent suspended, a kill switch engaged and released, a radar finding, a scan summary, a rejected connector delivery and a tool descriptor drifting from its pin. The durable delivery row is opened before any network egress, so a failed write means no HTTP request is made, and a webhook with delivery evidence cannot be deleted — only disabled — so its configuration and history stay attributable. Health is decided by the most recent attempt rather than a success ratio: a receiver that worked all last month and has failed since Tuesday is failing, however good the ratio looks.

never_attempted is its own health state and is not folded into a healthy one, because a receiver nothing has been sent to is not a working receiver. Slack, Teams, Discord and any query-bearing destination must name an environment variable holding the complete write-only URL, and production is default-deny when the webhook host allowlist is absent, since a receiver is always third-party and no external host is safe to assume.

Eight documented steps, against the account rather than the zone, because Gateway logs are account-scoped. The Gateway HTTP dataset goes to an HTTP destination with the credential in a header. The mapping needs a timestamp, a device name or source address, a host or SNI, and request and response sizes; selecting more fields is harmless, because nothing unmapped is stored. Keep the job at or below 10,000 records and 30 seconds or more between uploads — Cloudflare’s defaults sit inside both.

Nine steps: an HTTPS forwarding profile posting a JSON array or newline-delimited JSON, with the credential in a header. Strata sends every number as a string, which is expected and coerced, and timestamps are read whether they arrive as RFC 3339 or as an epoch at any scale. Filter to outbound sessions — that is a volume decision rather than a correctness one, since internal flows are ignored but still spend the delivery budget.

Forward Traffic and URL Filtering only. Threat and System carry no source, destination and bytes triple, so every record would be dropped as unmappable — and the raw and Common Event Format payload options are refused loudly rather than misread.

Seven steps, and three shippers all work: a Filebeat http output, a Logstash http output, or an Elasticsearch watcher webhook action. Documents must be ECS, and the fields read are the timestamp, the host name or source address, the destination or URL domain, and either total network bytes or the source and destination byte pair — nested or dotted alike, because documents are flattened before mapping. The same connector feeds the IDE stream from endpoint documents carrying host, user and process names, where an absent URL is read as the vendor default, which is exactly what the IDE detector already means by an empty base URL.

Six steps, and the preferred of the two Splunk routes because the sender can set a header. The collector path is served exactly as real clients hardcode it, the token may arrive as Splunk or as Bearer, and the response is the standard success envelope and code table. What is mapped is the CIM Network Traffic fields inside the event object; a saved search emitting a different shape is refused with the field names it saw rather than guessed at.

Seven steps, and it exists because Splunk’s built-in webhook has no header authentication: it posts JSON to a URL you type and offers nowhere to put a credential. So the credential has to survive being in a URL, and the answer is to make it a narrow, separate, watchable secret rather than to pretend a URL is a safe place for one. It is a different secret from the ingest token, it cannot be presented as a bearer anywhere — not by a rule but by shape, since it resolves only against one table no other resolver reads — it is never wider than the key it hangs off, it is separately revocable, and it dies automatically when its parent is revoked or expires.

This is containment rather than protection. Its use count and last use are reported, which is the compensating control for a secret that cannot be kept secret: you cannot stop the URL being copied out of your proxy logs, but you can see it being used. Prefer the header form wherever the sending product supports one.

Six steps and no vendor code at all: if it can write a file and make an authenticated POST, it is a connector. CSV needs a header row, every value may be a string, and common alternative spellings are accepted. Billing needs a provider, a month and an amount; seats needs a vendor, a user email, a month and an amount; service accounts needs a provider, an account id, a key id and a creation time; the IDE stream needs a host, a user, a tool and a timestamp; egress needs a source host, a destination host, a byte count and a timestamp. A 202 means it landed, and a 200 saying duplicate means you had already sent that window and nothing was double-counted — and it still refreshed the freshness clock, because a retry is proof your exporter ran.

A column that cannot be found is a refusal rather than a default. A byte count quietly defaulted to zero produces a row every detector accepts and none ever fires on, which is worse than no feed at all.

Seven values are accepted — generic, cloudflare, paloalto, zscaler, netskope, elastic and splunk — and the mappings exist only where a vendor really publishes that stream. All seven map egress; elastic and splunk also map the IDE stream; and billing, seats and service accounts are generic only, because no egress product publishes an invoice, a seat spend or a key listing. Where the vendor is omitted it is inferred from fields only one product emits, and inference refuses rather than guesses, because the wrong mapping produces rows that parse, land, and describe flows that never happened.

The stream is required, and several vendors’ consoles cannot add a query string — GitHub audit-log streaming takes only a domain, a port and a token. Where that is true, scope the credential to exactly one stream and the credential carries the stream instead.

The endpoint that takes this product’s own row shapes, validated by the detectors’ own parsers — the same code path a manual scan uses, so a row refused at one door is refused at the other with the same message rather than landing through a side entrance.

No vendor emits these shapes, so using this endpoint means somebody writes and owns a transform between the SIEM and here. That script is real work, nobody owns it, and when it breaks the console shows a clean estate — which is the whole reason the vendor-shaped receivers exist.

A GitHub App with exactly one organisation permission, Administration with read access, which is what the usage report requires and nothing more. The private key never leaves its environment variable: it signs a nine-minute assertion, that is exchanged for a one-hour installation token, and only the token goes on the report request — and where the report comes back as a download link, the link is followed without the token. The sweep runs six-hourly into the seats stream.

This is one of the two rows the no-credential claim excludes: Token Observe holds a GitHub App private key you supplied and reaches into your organisation with it. Off by default behind ACP_CONNECTORS_ENABLED, and it has never met a live tenant: every assertion in its test suite runs against recorded-shape fixtures behind an injected HTTP boundary. If a vendor’s field names or endpoint paths differ from those fixtures the run fails with ACP_CONNECTOR_SCHEMA and the connector shows as failing, which is the intended outcome rather than a silent partial result.

A Reporting-scope, read-only API key and secret. Not a management or admin key — nothing here needs one, and a reporting key cannot change your policy, which is the point of naming the scope in the setup steps rather than leaving it to judgement. The connector runs hourly, collecting the previous hour and folding events into rows keyed on identity, destination and hour, into the egress stream.

The second row the no-credential claim excludes, and it is a credential into a security product: off by default behind ACP_CONNECTORS_ENABLED, carrying the same unproven-against-a-live-tenant caveat as the Copilot connector. Both read credentials live in a namespace of their own, bounded by its own host allowlist — defaulting to api.github.com, *.githubusercontent.com and api.umbrella.com and nothing else — and the variable each connector reads is a constant on its definition rather than a field an operator types, so there is no row to point at an arbitrary variable. The namespace exists because a vendor admin credential is far more powerful than a model key: an Anthropic Console admin key has no selectable scopes at all, so the key that reads your spend can set every API key in the organisation to inactive.

Rows of host, user, tool and timestamp, with an optional base URL, posted on your own schedule. This is the feed that names every workstation running agent tooling against a vendor endpoint instead of yours, so you can size the exposure and convert what is convertible. An absent base URL is read as the vendor default, which is exactly what the IDE detector already means by an empty base URL.