Skip to Content
GatewayAPI ReferenceGateway API Reference

Gateway API Reference

Complete reference documentation for the Curate-Me AI Gateway API. The gateway is a reverse proxy that sits between your application and LLM providers, applying governance policies, tracking costs, and providing full observability with zero code changes.

Base URL

EnvironmentBase URL
Productionhttps://api.curate-me.ai
Local developmenthttp://localhost:8002

Authentication

All proxy endpoints require a Curate-Me API key (X-CM-API-Key header) and a provider API key (via X-Provider-Key header, Authorization: Bearer, or stored secrets). See Authentication for details.

Endpoint overview

Proxy endpoints

These endpoints accept requests in the same format as the upstream provider and proxy them through the governance chain.

MethodEndpointProviderDescription
POST/v1/chat/completionsOpenAIOpenAI-compatible chat completions
POST/v1/messagesAnthropicAnthropic-compatible messages
POST/v1/google/chat/completionsGoogle GeminiGemini via OpenAI-compatible format
POST/v1/deepseek/chat/completionsDeepSeekDeepSeek via OpenAI-compatible format
GET/v1/modelsAllList available models

Health and monitoring endpoints

MethodEndpointAuthDescription
GET/healthNoneLiveness probe (always 200)
GET/v1/healthNoneHealth check with component status
GET/v1/health/detailedNoneComprehensive health with metrics and alerts
GET/v1/providers/healthNonePer-provider circuit breaker status

HITL approval endpoints

MethodEndpointAuthDescription
GET/v1/approvals/{id}/statusAPI KeyPoll approval status
GET/gateway/admin/approvalsAdminList pending approvals
POST/gateway/admin/approvals/{id}/approveAdminApprove a pending request
POST/gateway/admin/approvals/{id}/rejectAdminReject a pending request

Admin endpoints

MethodEndpointAuthDescription
GET/gateway/admin/policiesAdminList governance policies
POST/gateway/admin/policiesAdminCreate or update a policy
DELETE/gateway/admin/policies/{org_id}AdminDelete a policy
GET/gateway/admin/usageAdminGet usage statistics
GET/gateway/admin/usage/dailyAdminDaily cost breakdown
GET/gateway/admin/usage/exportAdminExport usage as CSV
POST/gateway/admin/secretsAdminStore a provider secret
GET/gateway/admin/secretsAdminList stored secrets (metadata only)
POST/gateway/admin/secrets/rotateAdminRotate a provider secret
DELETE/gateway/admin/secrets/{provider}AdminRevoke a provider secret
GET/gateway/admin/billing/summaryAdminMonthly billing summary
POST/gateway/admin/model-aliasesAdminCreate a model alias
GET/gateway/admin/model-aliasesAdminList model aliases
POST/gateway/admin/provider-targetsAdminCreate a provider target
GET/gateway/admin/provider-targetsAdminList provider targets

Request format

All requests and responses use JSON. Set the Content-Type header on requests with a body:

Content-Type: application/json

Response headers

Every proxied response includes governance metadata headers:

HeaderDescription
X-CM-Request-IDUnique request identifier for tracing
X-CM-CostEstimated cost for this request (USD)
X-CM-Daily-CostCumulative daily spend for the organization (USD)
X-CM-Daily-BudgetDaily budget limit for the organization (USD)
X-RateLimit-LimitMaximum requests allowed per minute
X-RateLimit-RemainingRequests remaining in the current window
X-RateLimit-ResetUnix timestamp when the rate limit window resets
X-Request-IDRequest ID (same as X-CM-Request-ID)
X-Gateway-OrgOrganization ID associated with the API key
X-Idempotency-KeyIdempotency key for retry-safe calls
X-Process-TimeServer-side processing time in seconds

Conditional headers

These headers appear only when applicable:

HeaderConditionDescription
X-CM-Approval-IDHITL triggeredApproval ID for polling
X-CM-Key-DeprecatedKey rotated"true" when using a deprecated key
X-CM-Grace-Remaining-HoursKey rotatedHours remaining in the grace period
X-CM-Suggested-ModelModel deprecatedRecommended replacement model
X-CM-Version-WarningModel deprecatedHuman-readable deprecation warning
DeprecationModel deprecatedRFC 8594 deprecation date
SunsetModel deprecatedRFC 8594 sunset date
X-Gateway-Retry-AttemptsUpstream retriedNumber of retry attempts
X-Gateway-Retry-Delay-MsUpstream retriedTotal retry delay in milliseconds
Retry-AfterRate limitedSeconds until the rate limit resets
API-VersionAlwaysAPI version negotiated for this request

Error format

All errors follow the OpenAI-compatible error format:

{ "error": { "message": "Human-readable error description", "type": "error_type", "param": null, "code": "error_code" } }

See the Error Reference for a complete list of error types and codes.

Rate limits

Rate limits are enforced per organization. Default limits vary by subscription tier:

TierRequests per minute
Free10
Starter60
Pro300
Team1,000
Enterprise5,000

SDKs

The gateway is compatible with any standard LLM SDK. Just change the base URL:

# Python (OpenAI SDK) from openai import OpenAI client = OpenAI( base_url="https://api.curate-me.ai/v1/openai", default_headers={"X-CM-API-Key": "cm_sk_xxx"}, )
// TypeScript (OpenAI SDK) import OpenAI from 'openai'; const client = new OpenAI({ baseURL: 'https://api.curate-me.ai/v1/openai', defaultHeaders: { 'X-CM-API-Key': 'cm_sk_xxx' }, });

See also the dedicated Python SDK and TypeScript SDK pages for the curate-me and @curate-me/sdk packages.

Interactive documentation

The gateway exposes auto-generated OpenAPI documentation:

  • Swagger UI: https://api.curate-me.ai/docs
  • ReDoc: https://api.curate-me.ai/redoc

For local development, use http://localhost:8002/docs.