Pass-through
Provider responses up to 4 MiB return to the caller. Larger responses are rejected safely. Tollgate adds response headers such as x-tollgate-provider, x-tollgate-cost-status, and x-tollgate-call-id.
API / V1
Four fixed request formats. One usage record.
Tollgate accepts JSON POST requests on the paths below. Streaming and every unlisted endpoint are rejected.
01 / Endpoints
Supported provider routes.
| Provider | Path | Request format |
|---|---|---|
| OpenAI | /p/{projectId}/providers/openai/v1/chat/completions | Chat Completions, non-streaming only |
| OpenRouter | /p/{projectId}/providers/openrouter/api/v1/chat/completions | Chat Completions, non-streaming only |
| Anthropic | /p/{projectId}/providers/anthropic/v1/messages | Messages, non-streaming only |
| Gemini | /p/{projectId}/providers/gemini/v1beta/models/{model}:generateContent | GenerateContent, non-streaming only |
02 / Headers
Required request identity.
| Header | Required | Meaning |
|---|---|---|
| X-Tollgate-Key | Yes | Matching test or live write key. |
| X-Tollgate-Idempotency-Key | Yes | Stable safe ID for retries of one exact request. Reusing it with changed content or settings returns a conflict. |
| X-Tollgate-Customer | Recommended | External customer ID using 1–80 letters, numbers, dots, underscores, colons, or dashes. A missing header becomes unattributed. |
| Authorization / provider key | Yes | OpenAI/OpenRouter use Authorization, Anthropic uses x-api-key, and Gemini uses x-goog-api-key. |
| X-Tollgate-Task-Id | No | Safe trace ID using letters, numbers, dot, underscore, colon, or dash. |
03 / Response
Provider body, Tollgate evidence.
Cost states
reported comes from the provider, estimated comes from a verified built-in price or exact rate card, and unavailable is never changed to zero.
04 / Errors
Rejected before spend where possible.
| Status | Condition |
|---|---|
| 400 | Invalid JSON, unsafe IDs, missing retry ID, streaming, or invalid model ID. |
| 401 | Missing, invalid, or rotated Tollgate write key; missing provider credential. |
| 404 | Unknown project, provider, or unsupported provider endpoint. |
| 409 | Duplicate retry ID or the same retry ID used for a different request. |
| 502 | The selected provider could not be reached. |