The Routes module defines the HTTP endpoints exposed by AI Gateway. These endpoints receive requests from your applications and forward them to an associated LLM Provider. Each route maps a public path to a registered provider and a specific HTTP method. You can optionally override the provider endpoint, configure a timeout, and require scopes in the access token.
NOTETo create a route, you must have at least one registered LLM Provider. Policies are applied per route. A route without a policy processes requests without guardrails, rate limiting, or prompt enrichment.
Learn how to:
The Routes page lists registered routes with pagination. You can filter by:
Use Search to apply the filter and Clear to reset it.
Columns shown in the table:
Provider / Model / Pn (for example, OpenAI / gpt-4o / P1). Shows No LLM provider. when empty.- when not configured).Fill in the Create Route form fields (see Form fields). The LLM Provider field is a searchable select. Type part of the identifier to filter the list.
In the Actions column of the row you want, click the View icon. This opens the read-only Route details screen, with the following fields:
No field is editable on this screen. An empty field shows —, with two exceptions that keep the dedicated text already used in the listing: LLM Provider shows No LLM provider configured. when the route has no configured provider, and LLM provider not found. when the referenced provider cannot be resolved; Scopes shows No scopes assigned. when the list is empty.
Editing lives inside the details screen. Open the route through the View icon (see View Route) and, on Route details, click the Edit button at the top of the section. The Update Route form opens with the current data. Change the required fields and click Save.
In the Actions column of the row you want, click the Delete icon. Confirm the operation in the "Do you want to delete route [routeId]?" dialog.
IMPORTANTDeletion is permanent and cannot be undone. Policies associated with the route also become orphaned. Review and remove dependent policies before deleting the route.
Creating, editing, or deleting a route generates a queryable record in the Access Control Audit Log, with the date, the author, the outcome of the operation, and the content of the object. Viewing, listing, or opening a route's details does not generate a record: only write operations are audited.
A request refused right at the entry point (for example, a missing required field, a method outside the accepted values, a value above the allowed size, or more than 100 scopes) generates no record. From the moment the operation is processed, both success and failure generate a record: the route not existing, the LLM Provider or a scope not existing, or a malformed scope id all show up in the trail as a failure, with the refusal reason and the attempted configuration. On deletion, when the route cannot be read before removal, the record carries only the route identifier.
A creation recorded as a failure may have created the route anyway, and the record carries no identifier for it. Before creating another one, look up the route on the Routes screen by the method and the exposed endpoint you sent, so you do not end up with two routes pointing at the same place. An update or a deletion recorded as a failure may also have been applied: check the route on the Routes screen (for a deletion, whether it still exists) before repeating the operation.
A success record with an empty scope list indicates the route requires no scopes and accepts any authenticated token; in a create or update failure record, the list shows what was requested; in a delete failure, it is the route's state read before removal. See Form fields.
The Audit Log Name column shows the route identifier. On a creation recorded as a failure the field stays empty, and the method and the exposed endpoint stay in the record's content.
Querying the Audit Log uses the Audit List and Audit View permissions, which already govern that screen.
The table below covers all fields in the creation and edit forms.
Field | Type | Required | Rules |
|---|---|---|---|
| LLM Provider | Searchable select | Yes | Lists registered LLM Providers. The identifier has at most 253 characters. |
| HTTP method | Select (enum) | Yes | Values: GET, POST, PUT, PATCH, DELETE. |
| Exposed endpoint | Text | Yes | Minimum 1 character and maximum 1024. Public path exposed by the gateway (for example, /v1/chat/completions). |
| Provider endpoint | Text | No | When provided, overrides the default endpoint of the associated provider. Minimum 1 character and maximum 1024. |
| Provider timeout (seconds) | Integer | No | When provided, must be a positive integer. |
| Scopes | Multi-select | No | List of scope IDs from the Scopes catalog required in the request access token. Select up to 100 scopes, each with at most 253 characters. An empty list means any authenticated token can access the route. |
TIPAn empty Scopes list means any authenticated token can access the route. To restrict access, register the relevant scopes in Scopes, select one or more here, and make sure the presented token contains those scope IDs.
Access to each action in the Routes journey depends on its own permission. Without the corresponding permission, the screen element does not appear — the interface never shows an unavailable action as disabled.
Permissions are granted in Access Control, on the Roles screen, under the AI Gateway product. The table below lists each one exactly as Access Control displays it.
Permission | Group in AC | Description in AC | Identifier |
|---|---|---|---|
| List Routes | routes | Allows listing Routes | ai-gateway.routes.list |
| View Route | routes | Allows viewing a Route | ai-gateway.routes.view |
| Create and Update Routes | routes | Allows creating and editing Routes | ai-gateway.routes.create-update |
| Delete Routes | routes | Allows deleting Routes | ai-gateway.routes.delete |
| List LLM Providers | llm-providers | Allows listing LLM Providers | ai-gateway.llm-providers.list |
The last one belongs to another journey and is required by specific Routes actions, shown in the next table.
Action | What it unlocks | Required permissions |
|---|---|---|
| List | Routes item in the sidebar menu; listing with table and pagination | List Routes |
| Filter by LLM Provider | LLM Provider filter field on the listing | List Routes + List LLM Providers |
| View | View icon on the row and the Route details screen | List Routes + View Route |
| Create | Create Route button | List Routes + Create and Update Routes + List LLM Providers |
| Edit | Edit button inside Route details | List Routes + View Route + Create and Update Routes + List LLM Providers |
| Delete | Delete icon on the row | List Routes + Delete Routes |
Create and Edit: List LLM Providers is what feeds the form's LLM Provider field, required in both.
Filter: without List LLM Providers, the LLM Provider filter is hidden; the other filters, the table and pagination remain available.
A control without its permission is not rendered; a route reached directly by URL without its permission lands on the AI Gateway's own access denied screen, not on Access Control's.
EDITING REQUIRES VIEWINGThe Edit button only exists inside the Route details screen. Because of that, a user holding Create and Update Routes but not View Route has no path to edit an existing route. This is expected platform behavior, not a bug.
We use cookies to enhance your experience on our site. By continuing to browse, you agree to our use of cookies.Learn more