API reference · AI Gateway

Everything the AI Gateway does is available over a REST API and a thin SDK. Use it to sanitize prompts, call models, capture documents, and manage policies from your own code. This page covers the endpoints most integrations need; for platform-wide concepts see the Developers space.

Base URL & authentication

Base URL:  https://api.intsignal.com/ai-gateway/v1
Auth:      Authorization: Bearer <GATEWAY_KEY>

Create a project-scoped key in AI Gateway → Settings → Keys. The key identifies a project, which determines the active policy and available models.

Keep the Gateway key server-side

The Gateway key can send prompts and read redaction results — treat it like any model key. Keep it in a secrets manager or server environment variable, never in client code or source control.

Chat — sanitize, call a model, inspect

POST /chat — the main endpoint. It redacts the input, calls the selected model, and checks the response.

curl https://api.intsignal.com/ai-gateway/v1/chat \
  -H "Authorization: Bearer $GATEWAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "project": "support-assistant",
    "model": "gpt-4o",
    "messages": [
      { "role": "user", "content": "Refund Jordan Rivera, SSN 123-45-6789." }
    ]
  }'

{
  "output": "I've queued a refund for the customer and confirmed the account.",
  "model": "gpt-4o",
  "redactions": [
    { "type": "name", "action": "redact" },
    { "type": "ssn", "action": "redact" }
  ],
  "blocked": false,
  "request_id": "req_9c1f..."
}

Sanitize only

POST /sanitize — redact and policy-check text without calling a model. Useful when you call the model yourself but still want the Gateway's protection.

{
  "project": "support-assistant",
  "text": "Card 4485 1234 5678 9012, reset link https://acme.com/reset?token=..."
}

The response returns the sanitized text, the list of redactions, and whether any block rule fired.

Documents — scan to text / form

POST /documents — upload a scan, PDF, or photo for capture. Returns extracted text, structured fields (redacted per policy), and an optional CRM/webhook destination.

Policies

Method & path	Purpose
`GET /policies`	List policies and versions.
`GET /policies/{id}`	Retrieve a policy.
`POST /policies/{id}/test`	Test a policy against sample text before publishing.
`GET /projects/{id}/proposals`	Fetch automatic-policy proposals.

Logs

GET /logs — page through audit records (input, sanitized output, redactions, policy version, model, timestamp). Filter by project, date, or entity type, and stream the same records to a SIEM. See Privacy & compliance.

Webhooks

Subscribe to events to react in real time:

redaction.applied — a request was sanitized (with the entity summary).
request.blocked — a block rule fired.
policy.proposed — Automatic mode proposed a rule change.
document.captured — a document was extracted and filed.

Register endpoints in Settings → Webhooks; payloads are signed so you can verify them. See webhook signing in the Developers space.

SDK

import { Gateway } from "@intsignal/ai-gateway";

const gateway = new Gateway({ apiKey: process.env.INTSIGNAL_GATEWAY_KEY });

const res = await gateway.chat({
  project: "support-assistant",
  model: "claude-sonnet",
  messages: [{ role: "user", content: userText }],
});

Errors & limits

Standard HTTP status codes apply — 401 (bad key), 403 (key not scoped to the project), 422 (a block rule refused the request), and 429 (rate limited). Error bodies include a request_id you can quote to support and match to the logs.