LLM Gateway API

The gateway injects the operator's connected provider credential at the boundary. It validates the request, Passport, and service scope before the call. Enforced mode also requires Intent approval. A Passport with Mission references must match an active Mission.

Provider routes

• POST /v1/llm/anthropic/messages
• POST /v1/llm/openai/chat/completions
• POST /v1/llm/openrouter/chat/completions

curl -X POST https://api.getstack.run/v1/llm/openai/chat/completions \
  -H "Authorization: Bearer $STACK_TOKEN" \
  -H "X-Passport-Token: $STACK_PASSPORT" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5-mini","messages":[{"role":"user","content":"Summarize this"}],"max_completion_tokens":300}'

Enforced mode also requires X-Intent-Approval-Id. Streaming requests use the provider's normal stream: true body. STACK scans each complete server-sent event before it writes those bytes downstream.

Processing order

• Validate the provider request and verify the Passport.
• Check service scope and data-flow rules. Enforced mode checks Intent approval. Mission-linked Passports also check Mission state.
• Scan inbound content, redact configured PII, then add the STACK system context.
• Reserve the maximum gateway fee, inject the provider credential, and call the provider.
• Scan output before release, settle exact cost, and record the audit and Intent outcome.

LLM usage

• GET /v1/llm/usage - cursor-paginated call records. Filter by provider, Passport, Mission, agent, surface, payer, and time.
• GET /v1/llm/usage/summary - daily buckets by surface, payer, provider, and optional model.

Provider cost, STACK fee, wallet hold, and payer are separate fields. Provider cost is not the same as STACK wallet spend. See Usage API.