API reference — routing, credentials and request policy

This reference is generated from the gateway’s OpenAPI specification, and it documents the gateway itself: routing, authentication, and which credentials get injected or stripped. Request and response schemas belong to the upstreams — their own documentation defines those.

How to read it

Most routes are transparent proxies:

Build the upstream’s own request — path, query, body — then add your bearer token and leave the upstream’s key out.
A 200 and its body are whatever the upstream returned, verbatim. Examples shown here are representative; exact field definitions live in the provider’s docs.

Three kinds of routes deviate from that pattern. Browserless, Steel, Mistral and LlamaParse are policed, narrowly: closed allow-sets of query parameters and body fields run before a request reaches their fixed actions, everything else rejected with a 400 — no model catalog behind any of them. Mistral and LlamaParse add one wrinkle the other two don’t have: their cost scales per page rather than per call, so the price of a request is checked against your balance before the upstream call, and a job that doesn’t fit gets a 402 instead of being forwarded. LlamaParse goes one step further, being asynchronous: a parse is a job you poll, jobs belong to the account that created them, and the create-time price is a reservation that settles to the upstream’s own exact reported usage once that usage is reported — standing as the charge itself while the exact figure is outstanding, or if it never arrives. The four model-inference routes — OpenAI, Anthropic, Grok, Hugging Face — are policed more heavily: a model allowlist and a request-field policy run before anything reaches the upstream, though the response body is still relayed as-is once a request clears them. /inference goes further and normalizes: it fronts those same four providers behind one OpenAI-shaped request and response contract, rewriting model and translating Anthropic’s native shape rather than relaying it untouched.

Authentication

All endpoints expect Authorization: Bearer <token>; an unknown token answers 401. Details: Authentication.

curl -X POST "https://api.nativeport.ai/serper" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"q": "apple inc"}'

Base URL

https://api.nativeport.ai

Local development runs against http://localhost:8787.

Common responses

Status	Meaning
`401`	The bearer token is missing, unknown, or revoked. JSON body: `{ "error": "Unauthorized." }`.
`402`	The credit balance is empty. Requests keep answering `402` until credits are added — never a silently degraded response. On the routes that price a request before running it (Mistral, LlamaParse, `/inference`, and the native LLM routes OpenAI, Anthropic, Grok, and Hugging Face), a `402` can also mean that one request’s own cost exceeds the remaining balance; the message says which.
`404`	No route matched, or the matched route doesn’t accept that method (an unlisted `/serper/<endpoint>`, for example).
other	The upstream’s own status, passed through untouched.

The API Explorer fires real requests: authenticate with a live bearer token, and expect calls to credit-spending upstreams to count against the account’s usage.