> ## Documentation Index
> Fetch the complete documentation index at: https://docs.knoxcall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Providers & Day-Zero Models

> Supported upstreams (Anthropic, OpenAI, Gemini, Cohere, Azure OpenAI, Ollama) and the runbook for adding a new model the day it ships — a manifest update, no remote config fetch.

# Providers & Day-Zero Models

## Supported providers

Create an agent against any of these upstreams. Each agent gets its own route
with the provider key injected from a KnoxCall secret — your app never holds it.

| Provider                 | Upstream                            | Auth header             | Streaming redaction         |
| ------------------------ | ----------------------------------- | ----------------------- | --------------------------- |
| **Anthropic**            | `api.anthropic.com`                 | `x-api-key`             | ✅ mid-stream (holdback FSM) |
| **OpenAI**               | `api.openai.com`                    | `Authorization: Bearer` | ✅ mid-stream                |
| **Gemini**               | `generativelanguage.googleapis.com` | `x-goog-api-key`        | ✅ mid-stream                |
| **Cohere**               | `api.cohere.com`                    | `Authorization: Bearer` | buffered (non-streaming)    |
| **Azure OpenAI**         | your `*.openai.azure.com` resource  | `api-key`               | ✅ mid-stream (OpenAI shape) |
| **Ollama** (self-hosted) | your Ollama URL                     | optional Bearer         | ✅ mid-stream (OpenAI shape) |

Azure OpenAI and Ollama are tenant-specific, so you supply the **upstream base
URL** when creating the agent. Bedrock is on the roadmap (it needs SigV4 egress
signing — a separate change).

<Note>
  Gemini and Cohere use their own native request/response shapes — send Gemini
  requests in Gemini's format and Cohere in Cohere's. The gateway proxies them
  through unchanged; [PII redaction](/ai-gateway/pii-redaction),
  [firewall](/ai-gateway/firewall), [budgets](/ai-gateway/budgets-finops), and
  usage attribution all still apply. OpenAI ↔ Anthropic shape translation is
  automatic on the buffered path for those two.
</Note>

## Day-zero models — the runbook

When a provider ships a new model, you don't wait on a KnoxCall release. Two
steps, no remote config fetch (a deliberate post-supply-chain-compromise choice
— the gateway never pulls config from a third party at runtime):

1. **Use it immediately.** Set the new model id in your request (or as the
   agent's default model). The gateway proxies any model the upstream accepts —
   there is no allowlist unless you add one.
2. **Price it (for budgets/chargeback).** Add a row to the relevant
   `packs/ai-gateway-pricebook/{provider}.json` manifest with the list price and
   a dated `effective_from`, then reseed. Until then the call still succeeds and
   is recorded with `cost_source = 'unpriced'` (never silently \$0), and the
   weekly pricebook-drift check raises an alertable `ai_gateway.unpriced_model`
   event so you know to add it. See [Budgets & FinOps](/ai-gateway/budgets-finops).

That's the whole loop: a new model works on day zero; adding one manifest row
makes its cost exact.

## Model allow/deny

Optionally constrain which models an agent may call via its model allowlist /
denylist (Models tab, or `model_allowlist` on the agent). A request for a model
outside the allowlist is rejected before it reaches the upstream.