What you can do here

Everything below uses the public management API. Pick a region, paste a management key, and every action shows the request it sends.

UsageRequests, tokens and spend by day, week or month, per app, model, provider, user or key.MonitoringGuardrail activity, provider health, and why one request was routed, blocked or failed over.UsersWho uses the gateway: app access, personal keys, last activity and usage.Apps and credentialsCreate apps, change settings, attach providers, issue and revoke gateway keys.Providers and quota poolsConfigure shared providers, test models and discover what an upstream offers.BudgetsReview spend, adjust limits and grant temporary headroom.Routing and failoverRoutes, weighted destinations, failover and constraints, with dry runs, history and restore.Rate limitsRequest and token limits, request guards, temporary raises and effective limits.IncidentsMark a provider down during an outage, check it applied, then restore it.Bootstrap accessNo management key yet? Enable management and issue one with a tenant-admin token.API ExplorerBrowse every operation with its schema, then send it and copy cURL, Python or JavaScript.

Scopes

Management keys carry explicit scopes. No scope implies another.

Scope	Allows
read	Capabilities and the spec, app, provider, quota pool and key metadata, prompts, history, audit, catalogs, operation status, usage, guardrail activity, provider health, request explanations, users and new-model reviews.
config:write	App settings and availability, provider attachments and conversion, prompts, configuration rollback, operation recovery, and new-model decisions for providers an app holds with its own keys.
providers:write	Create, update, enable, disable and delete shared providers, manage quota pools, run provider tests and model discovery, and approve or reject new models of shared providers.
credentials:write	Issue gateway keys, change their expiry and revoke them. Creating an app needs this and config:write.
credentials:read	Reveal the secret of one active gateway key, on explicit request.
budgets:read	Budgets, usage, subjects, grants, pricing, exemptions, alerts and budget events.
budgets:policy	Budget, pricing and exemption edits (each publishes a policy revision) and alert destinations.
budgets:grant	Create, change and revoke time-boxed budget grants.
routing:read	Routes, destinations, failover, routing constraints, model access, provider references, revision history and rollout, and the routing diagnostics. Does not need read.
routing:write	Change routes, destinations, failover profiles, rules and default, and model access (each write publishes a policy revision).
routing:constraints	Change routing constraints.
limits:read	Rate limits, request guards, model limits, exemptions, limit responses, live usage, grants and effective limits. Does not need read.
limits:write	Change rate limits, request guards, model limits, exemptions and limit responses (each write publishes a policy revision).
limits:grant	Issue and revoke temporary rate limit raises.
incidents:read	Read incident mark-downs and status (read or incidents:write also allow these reads).
incidents:write	Mark providers down, preview, restore, reset cooldowns and drop session pins. Never a policy revision.

Operations by area

Counts exclude alias routes. Open the API Explorer for the full list.

Area	Operations	Your key can call
Reference	2	-
Apps	8	-
Providers	14	-
Quota pools	5	-
Credentials	6	-
Prompts	4	-
Budgets	27	-
Routing	48	-
Limits	31	-
Incidents	8	-
Catalogs	4	-
History	6	-
Administration	6	Tenant-admin token
Usage	1	-
Monitoring	3	-
Users	2	-