Skip to content
Arbitex Docs

Gateway API overview

The Arbitex Gateway API is the data-plane developer interface. It exposes an OpenAI-compatible endpoint that sits in front of any AI provider: you send requests in the standard OpenAI format, and the gateway handles provider routing, 5-tier DLP inspection, policy enforcement, and audit logging transparently before forwarding to the upstream provider.

This section is the single, consolidated reference for that data-plane API. Admin and control-plane configuration (managing policies, DLP rules, providers, users) lives in the Admin Guide, not here.

Base URL

Section titled “Base URL”

All API requests go to:

https://api.arbitex.ai/v1

The /v1 prefix matches the OpenAI API namespace, so any SDK or tool that supports a configurable base URL works without modification.

Authentication

Section titled “Authentication”

Every request must include a valid Arbitex API key. Two header formats are accepted and are equivalent:

Authorization: Bearer arb_live_your-api-key-here
X-API-Key: arb_live_your-api-key-here

Use Authorization: Bearer if you are configuring the OpenAI SDK — it passes credentials in this format by default. API keys are scoped to an organization and carry the user identity of the key owner, so Policy Engine rules that target specific users or groups apply based on that identity.

Full authentication detail — API keys, RS256/JWT, and OAuth M2M — is covered in the Authentication guide.

Rate limiting

Section titled “Rate limiting”

The gateway enforces rate limits at the organization level and, optionally, at the user level. Every response carries:

Header Type Description
X-RateLimit-Limit integer Maximum requests permitted in the current window
X-RateLimit-Remaining integer Requests remaining in the current window
X-RateLimit-Reset integer Unix timestamp (seconds) when the current window resets

Exceeding the limit returns 429 with a quota_exceeded error code. See the Rate limits guide.

Policy response headers

Section titled “Policy response headers”

After policy evaluation, the gateway attaches decision metadata to every response:

Header Values Description
X-Policy-Action ALLOW, BLOCK, CANCEL, REDACT, ROUTE_TO The terminal action taken by the Policy Engine. Present on all responses.
X-Matched-Rule rule ID string, or absent The ID of the rule that matched. Omitted when the action is ALLOW.

See Policy decisions for the full decision model.

Error codes

Section titled “Error codes”

The gateway uses standard HTTP status codes alongside a JSON error body with a machine-readable code field. The common codes:

Code HTTP status Retry? Description
invalid_api_key 401 No API key not found, revoked, or malformed
policy_block 403 No The Policy Engine’s terminal action was BLOCK
model_not_found 404 No The requested provider/model-id is not recognized or unavailable
context_length_exceeded 400 No Request exceeds the model’s context window
invalid_request 400 No Malformed request body
quota_exceeded 429 Backoff Rate limit or token budget exceeded
provider_unavailable 503 Backoff All providers in the routing chain are unavailable

The full error catalog and status-code reference is in the Errors & status codes guide.

OpenAI API compatibility

Section titled “OpenAI API compatibility”

The Arbitex Gateway API is a superset of the OpenAI API. Any client, SDK, or tool that targets OpenAI works against the gateway with only a base-URL and API-key change. The model field uses the provider/model-id format to specify provider and model explicitly:

"model": "anthropic/claude-sonnet-4-20250514"
"model": "openai/gpt-4o"
"model": "google/gemini-2.0-flash"

Arbitex extends the standard response format with policy headers (X-Policy-Action, X-Matched-Rule) and DLP streaming events (dlp_correction, output_blocked). All other fields are identical to the OpenAI format.

Endpoint reference

Section titled “Endpoint reference”

Capability-grouped reference for every data-plane endpoint:

Page Description
Chat completions POST /v1/chat/completions — streaming, DLP events, request/response fields
Embeddings POST /v1/embeddings — OpenAI-compatible embedding generation
Models GET /v1/models — model listing, provider/model-id format, routing
DLP results Inline DLP behavior + DLP events read-back API
Policy decisions Policy headers, decision semantics, 403 policy_block
Audit events GET /v1/audit/events — audit read-back with cursor pagination
Usage & cost Usage records, stats, and cost attribution read-back

Developer guides

Section titled “Developer guides”

Narrative walkthroughs for getting started: