Skip to main content

​
Providers & Day-Zero Models

​
Supported providers

Create an agent against any of these upstreams. Each agent gets its own route with the provider key injected from a KnoxCall secret — your app never holds it. Azure OpenAI and Ollama are tenant-specific, so you supply the upstream base URL when creating the agent. Bedrock is on the roadmap (it needs SigV4 egress signing — a separate change).
Gemini and Cohere use their own native request/response shapes — send Gemini requests in Gemini’s format and Cohere in Cohere’s. The gateway proxies them through unchanged; PII redaction, firewall, budgets, and usage attribution all still apply. OpenAI ↔ Anthropic shape translation is automatic on the buffered path for those two.

​
Day-zero models — the runbook

When a provider ships a new model, you don’t wait on a KnoxCall release. Two steps, no remote config fetch (a deliberate post-supply-chain-compromise choice — the gateway never pulls config from a third party at runtime):
  1. Use it immediately. Set the new model id in your request (or as the agent’s default model). The gateway proxies any model the upstream accepts — there is no allowlist unless you add one.
  2. Price it (for budgets/chargeback). Add a row to the relevant packs/ai-gateway-pricebook/{provider}.json manifest with the list price and a dated effective_from, then reseed. Until then the call still succeeds and is recorded with cost_source = 'unpriced' (never silently $0), and the weekly pricebook-drift check raises an alertable ai_gateway.unpriced_model event so you know to add it. See Budgets & FinOps.
That’s the whole loop: a new model works on day zero; adding one manifest row makes its cost exact.

​
Model allow/deny

Optionally constrain which models an agent may call via its model allowlist / denylist (Models tab, or model_allowlist on the agent). A request for a model outside the allowlist is rejected before it reaches the upstream.