Skip to content
GET/api/v1/gateway/proxy/{path+}

Forward GET to LLM provider

Transparent reverse-proxy to the configured LLM provider (OpenAI, Anthropic, Google, Bedrock, custom base URL, etc.). Adds: org/project resolution from the EvalGuard key, the `gateway:proxy` scope check, per-key and per-team budget enforcement (402 when a hard cap is hit), managed-BYOK credential injection (ADR-0008) when the caller forwards no upstream key, semantic-cache lookup, firewall/egress policy checks, and a fire-and-forget request trace into `gateway_proxy_logs` (model, provider, path, status, latency, tokens, cost). An `Idempotency-Key` header is forwarded verbatim to the upstream provider — EvalGuard does NOT cache or replay responses on this path (ADR-0024 explicitly excludes proxy paths). Authentication: your `eg_` API key in the `X-EvalGuard-Key` header (the GatewayKey scheme), NOT the document-level `Authorization: Bearer` form — on this path `Authorization` and `x-api-key` carry the upstream provider's credential and are forwarded to that provider, so an EvalGuard key sent there is disclosed and still authenticates nothing. It is the same key and the same scopes, so the published `x-required-scopes` is enforced.

Authentication

EvalGuard API key, in a different header. Send your eg_ key in the X-EvalGuard-Key header (X-Api-Key-Evalguard is also accepted).

Do NOT use the Authorization header here. On this path Authorization and x-api-key carry the UPSTREAM PROVIDER's credential and are forwarded to that provider unchanged — an eg_ key sent there is disclosed to the provider and still authenticates nothing. Same key, same scopes: gateway:proxy is enforced.

Parameters

path+ in pathrequired

Wildcard suffix — the full upstream-API path to forward (e.g. `chat/completions`, `messages`, `models`). The gateway maps it to the right provider via the project's gateway config.

string

Response

200 example

{}

All status codes

200Provider response.
400(no description)
401(no description)
402Payment Required — per-key budget exceeded (hard_cap=true).
403Forbidden.
413Payload Too Large.
429(no description)
451Unavailable For Legal Reasons.
502Bad Gateway — upstream provider error.
503Service Unavailable.

Code samples

cURL

# {path+} is shown with an EXAMPLE value — replace it with real values.
curl -X GET \
  https://evalguard.ai/api/v1/gateway/proxy/chat/completions \
  -H "Authorization: Bearer $EVALGUARD_API_KEY"

TypeScript

// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
// {path+} is shown with an EXAMPLE value — replace it with real values.

const res = await fetch("https://evalguard.ai/api/v1/gateway/proxy/chat/completions", {
  method: "GET",
  headers: { Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}` },
});
console.log(res.status, await res.json());

Python

# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
# {path+} is shown with an EXAMPLE value — replace it with real values.

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}

response = requests.request("GET", "https://evalguard.ai/api/v1/gateway/proxy/chat/completions", headers=headers)
print(response.status_code, response.json())

Go

package main

import (
	"context"
	"fmt"
	"net/http"
	"os"
)

// {path+} is shown with an EXAMPLE value — replace it with real values.
func main() {
	req, _ := http.NewRequestWithContext(context.Background(), "GET", "https://evalguard.ai/api/v1/gateway/proxy/chat/completions", nil)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
	resp, err := http.DefaultClient.Do(req)
	if err != nil { panic(err) }
	defer resp.Body.Close()
	fmt.Println(resp.Status)
}

Errors

400401402403413429451502503

Other Gateway endpoints