The complete flow
- Choose an AI provider.
- Add a provider credential.
- Create a gateway in a project.
- Attach the credential and select one or more exact models from its live catalog.
- Create a gateway token.
- Point your provider client at the returned data-plane URL.
- Inspect logs, usage and key access.
List providers
model_pricing remains the pricing SSOT. A single daily cron refreshes it from bounded first-party
public sources without provider API keys: Groq models,
Novita models,
Atlas models, and
xAI pricing. Numeric token rates are USD per one million
tokens. displayText preserves explicit provider policies such as reported zero pricing, while
rateCard carries context tiers. A malformed or unavailable source fails only that provider and keeps
the last valid snapshot; it never invents a replacement price.
MCP tool used:
list_providersAdd a provider credential
The credential value is accepted for validation and encrypted storage. It is never returned by list or read operations. SDK:AIRCTRL_MCP_KEY_* environment variable and pass only that variable’s name.
MCP tool used:
add_provider_keyCreate a gateway
create_gateway for a bare gateway. Use setup_gateway when the same operation must validate a provider key, bind every requested live-catalog model through one credential, create the gateway, mint a token, and return connection information.
MCP tool used:
create_gatewayCreate a gateway token
Gateway token plaintext is returned once.CLI command:
gateway token-createStore the returned value before leaving the response. Listing tokens later returns metadata only.MCP tool used:
create_gateway_tokenConnect an AI client
Use the gateway token with the URLs returned byget_connection_config or setup_gateway.
The data plane speaks each provider’s normal protocol. It is not wrapped in separate SDK methods.
HiTheo request paths
Bind each model before using it. Every request must name that exact model either in the OpenAI-compatible body or as themodel query parameter on a HiTheo-native path.
Native vision uses HiTheo’s documented
attachments items (image_url or image_base64), not an
invented Chat Completions shape. Video and research are asynchronous; poll no faster than once per second
and handle queued, active, completed, and failed.
MCP tool used:
get_connection_configRouting and settings
UseupdateGateway, updateGatewaySettings, attachGatewayCredential, and detachGatewayCredential in the SDK.
Gateway settings can control:
- Spend limit and period.
- Requests per minute.
- Request logging and optional body logging.
- Allowed models.
- Guardrail mode.
- Cache state and lifetime.
gateway update, settings, credential-attach, and credential-detach.
MCP tool used:
set_gateway_settingsLogs and usage
- Gateway logs show requests for one gateway.
- Project usage combines gateways in one project.
- A gateway opens on a dashboard whose KPIs, time series, latency percentiles, spend, models, and principals are all constrained to that gateway.
- Key access shows whether granted, denied, or failed to retrieve a provider credential.
- Log-body reads require
usage:read-bodiesbecause prompts and responses can contain sensitive data. - Full-text search also requires
usage:read-bodies. It searches request metadata plus only the redacted request/response bodies that were captured for the selected gateway. - Spend reads require
usage:read-spend.
rate_limit_per_min = null means no gateway rate cap. Any positive integer, including 500
or higher, is accepted. Per-token and per-principal caps can still narrow that gateway-level value.
The top-level Gateways → Overview uses one account-scoped BFF aggregate for the active
organization. The BFF first resolves projects where the human has gateways:list, then returns the
filtered gateway inventory, request series, provider/model/project/
status breakdowns, and control coverage in one response; the browser does not fan out one metrics
request per project or gateway. Gateways → Gateways retains the existing project-scoped CRUD
list. The main Dashboard and Telemetry reuse the same project metrics component, while a gateway’s
first tab fixes those metrics to one gatewayId.
SDK methods include listGatewayLogs, getGatewayLogDetail, listGatewayKeyAccess, listUsageLogs, getUsageLogDetail, getUsageSpend, and getUsageMetrics.
Gateway, project, and provider-key access log lists use stable keyset pagination ordered by timestamp plus their unique event ID. Send limit on the first request, then pass the returned pagination.next_cursor as cursor without changing the scope or filters. Cursors are opaque and bound to the exact since, provider, model, status, status class, search, outcome, and optional gateway filters used by that endpoint. offset remains a legacy compatibility option and cannot be combined with cursor.
OpenTelemetry
UsegetGatewayOtelExport and updateGatewayOtelExport to configure metrics, traces and optional request/response bodies. Request events are always sent while OpenTelemetry export is enabled. Stored header values are write-only and are never returned.
Request/response bodies are explicit opt-in. They can be exported only when gateway logging and Log bodies are enabled. sends the same sanitized/redacted representation used by its own log storage; inline binary media is replaced with safe metadata. Streaming responses remain unbuffered and therefore have no response body.
appends /v1/traces, /v1/metrics and /v1/logs to the configured OTLP/HTTP base URL. Internal request logs and OTel consume one CanonicalGatewayLogEvent and differ only in storage/OTLP envelopes and explicit body/cost visibility policy. Log rows expose account, project, gateway, token, principal, request, trace and span identifiers plus operation, bytes and guardrail outcomes. Derivable IDs are resolved through existing relationships instead of duplicated in metadata. Historical rows retain relational identifiers; trace_id and span_id are null when the original request predates trace correlation.
CLI commands: gateway otel, gateway otel-update
MCP tool used:
get_otel_exportCommon failures
403 plan_limit_reached: the account plan cannot create another gateway.404 gateway_not_found: the gateway is unavailable in the active account.400: a provider credential belongs to another account or a setting is invalid.429: API rate limit, gateway rate limit, or spend limit. Read the error code before retrying.