Overview

The gateway is an OpenAI- and Anthropic-compatible proxy that runs enabled Integrity controls inline on your LLM traffic and applies your project’s runtime policy. Point a supported client at the gateway and add the Integrity project key; no per-classifier SDK call is required.

How it works#

Your app calls the gateway’s OpenAI-compatible /v1/chat/completions or /v1/responses route, or the Anthropic-compatible /v1/messages route. It authenticates the request, runs the runtime policy, forwards requests that are not blocked to your upstream provider, screens the response, and returns it. The gateway attempts to persist a trace with its decisions and span timeline. Trace writes are best-effort and never delay the request path.

The base-URL swap#

Point your client’s base_url at the gateway. Your provider API key stays in the standard Authorization header. Your Integrity key goes in x-triage-api-key.

from openai import OpenAI

client = OpenAI(
    base_url="https://integrity.triage-sec.com/v1",
    api_key="sk-...",  # your OpenAI key, forwarded upstream
    default_headers={
        "x-triage-api-key": "tsk_...",     # your Integrity project key
        "x-triage-session-id": "sess_abc", # optional, groups traces
    },
)

resp = client.chat.completions.create(
    model="gpt-5.6",
    messages=[{"role": "user", "content": "Summarize today's incidents"}],
)

Codex and Claude Code#

Both CLIs can route through Integrity when you control their endpoint configuration. Keep the Integrity key and provider credential in environment variables; do not commit either secret. Codex custom providers must be configured in the user-level ~/.codex/config.toml, not a repository’s .codex/config.toml. Save the matching project upstream in the dashboard before using a non-default x-triage-provider; the gateway fails closed when the request hint and stored provider differ.

Codex with an API key#

Select the OpenAI (or a compatible/Azure) upstream for the project. Export both keys, then merge this provider into your existing user config:

export OPENAI_API_KEY="sk-..."
export TRIAGE_API_KEY="tsk_..."

codex -m gpt-5.6-sol

For Azure or another compatible endpoint, replace the provider hint with the exact stored provider (azure-openai or openai-compatible). For Azure, the request model is the Azure deployment name. Codex remote compaction uses /v1/responses/compact automatically and is authenticated and traced metadata-only; it does not rerun tool/output enforcement.

Codex with ChatGPT login#

First save the ChatGPT-authenticated Codex project preset. It is fixed to the ChatGPT Codex backend and supports Responses only. Complete the ordinary Codex login, export the Integrity key, and merge this separate provider into your user config:

export TRIAGE_API_KEY="tsk_..."
codex login
codex -m gpt-5.6-sol

The ChatGPT bearer token is forwarded transiently to the fixed Codex endpoint. It is not stored in project policy or included in Integrity traces. Consumer ChatGPT web/desktop conversations cannot be redirected through this configuration.

Claude Code#

Save the Anthropic (or anthropic-compatible) upstream first. Claude Code appends/v1/messages and /v1/messages/count_tokens itself, so its base URL must omit /v1:

export ANTHROPIC_BASE_URL="https://integrity.triage-sec.com"
export ANTHROPIC_API_KEY="$ANTHROPIC_PROVIDER_API_KEY"
export TRIAGE_API_KEY="tsk_..."
export ANTHROPIC_CUSTOM_HEADERS="x-triage-api-key: ${TRIAGE_API_KEY}
x-triage-provider: anthropic"

claude

In the Claude Code form, ANTHROPIC_API_KEY remains the provider credential and ANTHROPIC_CUSTOM_HEADERS carries the separate Integrity key and provider hint. The older API-key/auth-token dual-header form remains accepted for compatibility, but new configurations should use the explicit custom headers. Restart Claude Code after changing these environment variables so the child process inherits them.

Agent-client nuances#

• Buffered streaming. Responses and Messages are fully buffered and screened, then replayed as provider-native SSE. Protocol events and terminal usage are preserved, but time to first token is not true upstream streaming.
• Tool boundary. Client-executed tools surface for INT-Tooling before local execution. Anthropic server-side tools such as web_search, web_fetch, and code_execution run at Anthropic before a response exists, so Enforce rejects those declarations before the provider call; Observe forwards them and records the limitation.
• Behavioral scope, not code scanning. Tool names, arguments, and command text are evaluated for alignment with user intent and policy. Integrity does not parse or execute source code, detect malware/dependency vulnerabilities, or certify scripts, binaries, packages, and artifacts as safe.
• Reasoning signal. OpenAI uses exposed reasoning summaries and Anthropic uses thinking blocks. INT-CoT is default-off, conjunction-only, and cannot block independently. Current GPT-5.6 Sol and Claude Opus thresholds are explicit family proxies, not exact per-model enforcement calibration.
• Auxiliary routes. Codex compaction and Claude token counting are authenticated provider passthroughs with metadata-only tracing; no tool or output enforcement runs on those auxiliary calls.
• Out-of-band actions. Browser, shell, MCP, and tool traffic is outside the gateway unless it returns through a supported model protocol. Keep least privilege, sandboxing, egress controls, and ordinary approval boundaries.

Gateway paths#

Responses and Messages streaming are served as buffered, policy-checked SSE. The gateway synthesizes provider-native events after it has screened the buffered upstream result, including complete output-item lifecycles, tool calls, reasoning summaries or thinking blocks, and terminal usage. This preserves client protocol behavior but is not genuine incremental upstream streaming.

Headers#

Classifier layers#

The four Integrity layers are organized in the natural order of inference below. INT-Input runs before the provider call. After a successful buffered response, enabled reasoning, tooling, and output guards run concurrently, so the Timeline reflects their actual start and finish times rather than a fixed display order:

• INT-Input. User input before the model sees it.
• INT-CoT. Reasoning summaries or traces, when the upstream response exposes them. Default-off and conjunction-only.
• INT-Tooling. Function calls and tool decisions before action.
• INT-Output. Assistant messages before delivery.

Policy controls such as the pre-provider custom blocklist, context splicing, prompt armoring, tool-result quarantine, argument sanitization, informed retry, sampling constriction, and model escalation run around these layers. Material, rising INT-CoT risk can escalate an already-flagged tool or output result, but cannot block independently. Which steps run, and whether they block or only log, is set by your runtime policy and enforcement mode. When an eligible steering control succeeds, it can preserve non-suspicious Chat history or the Responses chain and avoid application-level recovery from a policy block. Terminal policy decisions still block, and every continued provider call still performs normal inference.

Providers#

On the OpenAI-compatible routes, x-triage-provider accepts openai (default), openai-chatgpt, openai-compatible, and azure-openai; on /v1/messages it accepts anthropic (default) and anthropic-compatible. Other values return a PROVIDER_UNSUPPORTED error. The upstream base URL comes from deployment configuration or from your project’s stored proxy_runtime.upstream policy (validated, HTTPS-only); the request header never supplies an arbitrary provider endpoint. Per-project upstreams support OpenAI-compatible endpoints, Azure OpenAI (deployment paths, api-version, and api-key or Entra bearer auth), and Anthropic-compatible endpoints. The gateway forwards your provider credential; it holds no provider keys, so the hosted gateway does not currently translate Bedrock SigV4 or Vertex GCP OAuth credentials. The customer-controlled AWS/GovCloud topology is under development; do not configure sensitive or regulated workloads against it until Triage provisions and validates that deployment for your tenant. Standard OpenAI, Anthropic, and Azure OpenAI hosts are approved by default; compatible/custom hosts must match the operator-configured PROXY_UPSTREAM_ALLOWED_HOSTS exact-host or wildcard list in the dashboard/backend and gateway deployments. Custom entries remain disabled unless both deployments set PROXY_CUSTOM_UPSTREAM_EGRESS_POLICY_ENFORCED=true after enforcing outbound policy that denies private, link-local, and metadata destinations. Custom upstreams must use HTTPS port 443, and the gateway also rejects non-public DNS answers immediately before each request.

openai-chatgpt is an explicit Codex-only preset. It is fixed to https://chatgpt.com/backend-api/codex, accepts bearer authorization, and serves only /v1/responses. The ChatGPT login token is forwarded transiently and is not stored, logged, or included in traces. Consumer ChatGPT web and desktop conversations cannot be redirected and remain out of scope.

Production resources#

Before moving gateway traffic to Enforce, review the deployment and operating boundaries that apply to the request path: