Tools

Anthropic

Claude’s Messages API — policed, mirroring the OpenAI route’s shape

View as Markdown

Fronts Anthropic’s Claude API. Like the OpenAI route, this is a policed pass-through, not a transparent one: requests are checked against a model allowlist and a request-field policy before they reach Anthropic.

GET|POST|DELETE /anthropic/<api path>   → https://api.anthropic.com/<api path>

This route ships behind a kill switch that defaults to off, plus a per-account pilot allowlist — the same current-availability caveat as the other model-inference routes. A request can 404 here even with a funded, valid key until this route is enabled for your deployment.

Endpoints

EndpointNotes
POST v1/messagesThe Messages API — the model must be one of the four cataloged Claude models
POST v1/messages/count_tokensFree — no ledger charge, protected by rate-limiting alone
GET v1/models, GET v1/models/{id}Answered locally from the gateway’s catalog — Anthropic’s upstream model list is never proxied
v1/files (and {id}, {id}/content)Create/read/delete, ownership-tracked per account
v1/messages/batches (and {id}, {id}/cancel)Create/read/cancel, ownership-tracked per account

Claude has no fine-tuning or vector-store surface, so only files and message batches are ownership-tracked here — narrower than the OpenAI route’s four resource kinds.

Request policy

  • Both client credential channels are closed: the Claude API accepts a key via either x-api-key or Authorization: Bearer, and both are overwritten unconditionally — a request can’t smuggle a foreign key through whichever one it left alone.
  • Always pinned to a single fixed value: the anthropic-version header — whatever you send there is ignored.
  • A fail-closed allowlist: the anthropic-beta header — if any flag isn’t on the allowed list, the whole request is rejected with a 400, not silently dropped.
  • Checked item-by-item: each tools[] entry without a type field is a client-defined tool, validated structurally; an entry with a type is a server tool, checked against an allowed-prefix list (web_search_, web_fetch_, computer_) — types outside that list, including any code-execution tool, are rejected.
  • Always rejected: the mcp_servers field — it would relay a client-supplied credential to a client-supplied URL, a risk this gateway doesn’t take on.
  • Always overwritten: metadata.user_id is replaced with a per-tenant identifier, so upstream abuse enforcement lands on your account specifically rather than the shared key.

Stateful resources

Files and message batches you create are tracked per account; an id belonging to another account answers the same 404 an unknown id would. GET v1/files and GET v1/messages/batches (the bare list forms) are answered locally from this ownership record. Batches settle their real cost on a recurring poll rather than a completion webhook — Anthropic doesn’t offer one for batches.

Billing

Metered per token from each response’s own usage, reading Anthropic’s cache-tiered rates (5-minute cache, 1-hour cache, cache read) directly rather than re-deriving them. An account can register its own Claude API key; while that’s active, calls bill to that key directly instead of metering through the gateway balance.

Examples

$curl -X POST "$GATEWAY/anthropic/v1/messages" \
>  -H "Authorization: Bearer $TOKEN" \
>  -H "Content-Type: application/json" \
>  -d '{
>    "model": "claude-sonnet-5",
>    "max_tokens": 1024,
>    "messages": [{"role": "user", "content": "Summarize this page in one sentence."}]
>  }'

Responses arrive as Anthropic’s JSON, untouched once a request clears the checks above. Field-level request and response detail lives in Anthropic’s documentation.