Overview
What you can do here
You're signed in as . Owners and admins set providers, spend caps, MCP servers and guardrails; their rules apply to you too.
Needs attention
This month at each checkpoint
Rate limit, Replay and Inspect have no per-request count. Refusals are under Requests, Refused.
Get set up
Every call checked before it runs.
Recent requests
All requests| Time | Model | Latency | Cost | Outcome |
|---|
The last 50 requests, kept up to 7 days.
Providers
ManagePlayground
Send a prompt through policy, cache, routing and guardrails. Type @ to attach an MCP tool.
MCP tool execution is off, so attached tools won't be used. An owner or admin can turn it on under Guardrails & policy.
Documents (PDF, Word, Excel, CSV, text, Markdown, JSON, YAML, logs) up to 10 MB each. Images (PNG, JPEG, GIF, WebP) up to 5 MB, when your organization allows them.
A forced tier skips the caches and is left out of savings.
The answer appears here.
Routing receipt
API keys
Keys your applications use to call the gateway.
Keys
| Key | Last used | Limits | Status | Actions |
|---|
A key is shown once. If one is lost, rotate it.
Connect an application
Works with any OpenAI-compatible SDK or tool. RouterX picks the provider and model.
Endpoints: /chat/completions, /responses, /embeddings, and /mcp/execute for MCP tools.
- X-Session-Id
- One id per conversation (up to 128 letters, digits, . _ : -). With session features on (Settings > Auto-routing), its turns keep one tier and provider, so prompt caches stay warm.
- X-Trace-Id
- One id per agent task; its requests and tool calls are grouped under Requests > Agent tasks.
Providers
The providers this organization routes to, with your own keys. Keys are encrypted at rest and never sent back to the browser.
Active providers
The next provider is tried if one fails.
Read-only: owners and admins add, change and remove providers.
| Priority | Provider | Region | Status | Actions |
|---|
Models RouterX knows
Every model with a price, which an API key or a routing rule may name. Prices per million tokens.
| Model | Tier | Input | Output |
|---|
MCP servers
Tool servers models can call. Every call is checked and logged.
Owners and admins set up MCP servers. If one of them needs your own account, connect it below.
Servers
Type @ in the Playground to attach one of these to a prompt.
OAuth providers
Apps people sign in through to link their own accounts.
My OAuth connections
Your accounts, for MCP servers that act as you.
Guardrails & policy
Organization controls, routing rules, the policy and shadow evaluation. Saved changes apply to the next request.
The rules in force
What every request here is held to, yours included. Owners and admins change them; you're signed in as .
Organization controls
Read-only: changing these controls requires the owner or admin role.
Password sign-ins also need an authenticator code (single sign-on doesn't). Set yours up first, in Settings.
Lets requests carry images (PNG, JPEG, GIF, WebP). PII redaction reads text only, so images reach the provider unscanned, and only models that see images get them.
Lets models call tools on this organization's MCP servers, within the guardrails.
Comma-separated, e.g. support_tickets, orders. Empty: none; *: all. Use schema.table outside the default schema.
Empty: any public https host. When set, hosted servers and tool URLs must match, e.g. api.githubcopilot.com, *.example.com (wildcards match public hosts only). An internal server must be listed exactly; tool URLs can never be internal.
Only for an internal provider (e.g. Ollama) or sign-in server (OAuth, SSO) on your network, listed exactly, e.g. localhost. Public https needs no listing; separate from the MCP list.
Only providers in the ticked regions are used. None ticked: any.
The policy YAML also requires (routing.require_data_residency); a provider must meet both.
Danger area
Pausing refuses every chat request with HTTP 503 until traffic is resumed.
Routing rules
Send matching requests to a model you choose, ahead of auto-routing. Key rules come first, then member, then organization.
| Applies to | When | Sends to | Priority | Matched | Actions |
|---|
Policy
Cost cap, routing and privacy, as a form or YAML (one policy, saved together). Once this month's spend plus in-flight requests reach the cap, requests get HTTP 402.
Shadow evaluation
Re-ask a sample of answered requests one tier down (or up) and let a judge model compare the answers. Results are under Spend & savings > Savings.
Shadow evaluation is off on this server, so jobs record nothing. Set SHADOW_EVAL_ENABLED=1 and restart the gateway to use it.
| Job | Judge | Spend | Status | Actions |
|---|
Spend & savings
What the gateway spends, and what routing and the cache save.
Only your API keys' spend this month.
Spend by API key, this month
Since the 1st (UTC), the window each key's budget is enforced in. Console requests have no key.
| Key | Requests | Tokens | Spend | Budget |
|---|
–
–
–
–
By prompt optimization and cache
Where spend goes
Last 30 days| Model | Spend | Share |
|---|
No spend in the last 30 days.
Spend by model
All time.
| Model | Requests | Spend |
|---|
Saved by routing, last 30 days
–
vs ·
–
Every request on that model
–
Savings opportunities
Costliest prompts
Requests sent to a chosen model where a cheaper one would have done. Open one for details.
| Prompt | Task | Model used → cheaper | Avoidable |
|---|
Shadow evaluation
Would a cheaper (or stronger) tier have done as well? A judge compares sampled answers; set jobs up under Guardrails & policy.
Loading…
Response cache
Answers kept to serve a repeated prompt, exact and semantic.
Loading…
Reliability
Provider health, single-provider risk and the routing engine.
The outage simulator is off on this server. Set RESILIENCE_SIMULATION_ENABLED=1 and restart the gateway to use it.
Provider reliability
Every provider tried, failed tries included.
| Provider · model | Answered | Failures | Cut off | Median time |
|---|
Held back now
| Provider · model | Why | Time left | Actions |
|---|
Learning from results
Provider dependency
How much traffic rests on one provider, and what an outage would hit.
Share of traffic
Applications on one provider
If the top provider goes down
Routing engine
Whether your traffic supports switching to routing v2. Each check needs 50 requests.
| Check | State | What the traffic shows |
|---|
Requests
The last 50 requests, kept up to 7 days. Every request is in the Full log.
Only requests made with your API keys.
Full log
Every answered request, from the database.
| When | Model | Tokens | Cost | Latency | Task ID |
|---|
Refused requests
Requests turned down by a spend cap or key budget, a model rule, data residency, no provider, the context window, or a pause. Rate-limited ones are counted, not listed.
| When | Reason | What the caller was told | Task ID |
|---|
Agent tasks
One row per agent task: the requests and tool calls tagged with the same X-Trace-Id.
| Task ID | AI requests | Tool calls | Cost | Last activity | Actions |
|---|
Members
Who can sign in, and with which role. Invite with a one-time link; change a role or remove someone at any time.
People
Owners manage everything. Admins manage everything except owners. Developers also create their own API keys. Viewers use the Playground and read.
| Role | Joined | Actions |
|---|
Removing someone signs them out and deletes their keys; their activity stays in the logs.
Invitations
| Role | Status | Actions |
|---|
A link works once and expires after 7 days.
Single sign-on
Loading…
Compliance
Evidence for auditors, residency refusals and erasing prompts.
Evidence pack
Routing decisions, tool calls, the audit trail and residency refusals for the days chosen, as one hash chain. Check it with scripts/verify_evidence_pack.py.
Residency refusals
Requests refused because no provider was in a required region, each with a signed receipt.
| When | Who | Required | Receipt |
|---|
Erase prompts
Removes the stored prompt text from the requests named. Their cost and usage stay, and the audit log records the erasure.
Settings
Your account.
Account
Password
Two-step verification
After your password, a 6-digit code from an authenticator app (Google or Microsoft Authenticator, 1Password and others).
Auto-routing
Routing features this gateway runs. Set in the gateway's .env; read-only here.