Runnable Examples
Captured 2026-09-07T02:00:36.854Z, from the actual runnable files against the local SDK candidate. Credential values and resource identifiers are redacted. Tenant inventories are intentionally not published. These results are not a claim that every service operation or the complete Portkey API passes. See published-package examples for subsequent registry-install verification.
Latest execution results
All 21 documentation scripts were executed in the primary batch: 18 passed and 3 failed. Three additional real scan-response captures bring the example suite to 21/24 passing checks. A successful walkthrough is not an operation-level guarantee: Red Team's optional quota/statistics calls may report unavailability; their independent checks remain visible in the complete live results.
| Script | Backend | Result | Workflow |
|---|---|---|---|
profiles-get-validation.ts | mock | PASS | Mock profile lookup and pagination |
profiles-crud-validation.ts | mock | PASS | Mock profile CRUD and force-delete behavior |
oauth-lifecycle-validation.ts | mock | PASS | Mock token timing, refresh, callbacks and auth retry |
red-team-mgmt-validation.ts | mock | PASS | Mock/schema target and custom-attack validation |
basic-scan.ts | live | PASS | Synchronous scan |
async-scan.ts | live | PASS | Two-item asynchronous batch with bounded polling |
query-results.ts | live | PASS | Real scan IDs and report IDs from the preceding scan |
mgmt-auth.ts | live | PASS | OAuth authentication, profile list and standalone refresh/cache lifecycle |
mgmt-profiles.ts | live | PASS | Owned profile lifecycle, including revision cleanup |
mgmt-topics.ts | live | PASS | Owned custom-topic lifecycle, including revision cleanup |
mgmt-dashboard.ts | live | PASS | Application and violation dashboard reads |
mgmt-dlp-data-filtering-profiles.ts | live | PASS | Data filtering profile reads |
mgmt-dlp-data-patterns.ts | live | PASS | Owned pattern create/get/patch/delete |
mgmt-dlp-data-profiles.ts | live | FAIL: HTTP 500 | Advanced data profile lifecycle attempt |
mgmt-dlp-dictionaries.ts | live | FAIL: HTTP 400 | Multipart dictionary lifecycle attempt |
model-security-scans.ts | live | PASS | Existing ML scan evaluations/files and policy reads |
red-team-scans.ts | live | PASS | Job/category/target reads; quota and statistics are optional |
red-team-targets.ts | live | PASS | Target details and custom prompt-set reads |
red-team-network-broker.ts | live | FAIL: HTTP 403 | Channel reads and owned draft create/update attempt |
gateway-model-pricing.ts | live | PASS | Unauthenticated public catalog rates for the two required models |
gateway-inference.ts | live | PASS | Real gateway chat, 32-dimensional embeddings and read-only fine-tuning job listing |
Setup
Additional SCM dashboard validation (SDK 0.26.0)
On 2026-09-07T16:33:27.854Z, mgmt-dashboard-sessions.ts --include-content passed
against the SCM host using fresh service-account OAuth. This is a later, SDK-only extension;
it does not revise the historical batch totals above or claim the installed CLI has changed.
The SCM dashboard guide documents all eleven verified routes, query
differences, pagination limits, and privacy requirements.
{ rankedApps: 4, trendBuckets: 10, sessionBuckets: 10,
returnedApps: 25, sessionPageItems: 25, totalSessions: 705 }
{ sessionActions: 1, transactionStatus: 'passed', tokens: 13 }
{ contentAvailable: true }
The script prints only counters and content availability, never stored prompts/responses.
Omit --include-content to avoid fetching scan text. The separate read-only session E2E
script walked all 705 observed entries; this short example intentionally reads only one page.
The independently fetched chart reported 706 sessions, a discrepancy retained in the guide.
The final session E2E rerun at 2026-09-07T16:39:04.187Z passed stricter pagination checks: 698 unique entries across 28 pages, an unchanged reported inventory total throughout, and an exact terminal count. One fresh OAuth token served 40 HTTP 200 reads. The separate chart showed 699 sessions and 90 violating sessions; transaction and protected scan-content retrieval passed again. These later measurements do not alter the earlier example capture above.
Running examples
Run from the repository root. The root TypeScript configuration resolves the package import to this checkout's source; examples do not silently exercise a globally installed SDK.
npm ci
cp .env.example .env
npx tsx --env-file=.env docs-site/examples/basic-scan.ts
Scan examples need PANW_AI_SEC_API_KEY and PANW_AI_SEC_PROFILE_NAME. Management and DLP use PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, and PANW_MGMT_TSG_ID; Model Security and Red Team support the documented service-specific overrides with management fallback. Runtime gateway inference instead requires an explicit PANW_AI_GW_INFERENCE_ENDPOINT and PANW_AI_GW_INFERENCE_API_KEY; it never derives a runtime key from OAuth credentials.
Node's --env-file flag requires Node 20.6+ and an existing file. On Node 18, export variables in the shell. Never commit credential files. Mock scripts need neither a credential file nor live credentials.
The September 7 live rerun uses a disclosed test-workspace DNS accommodation: fully qualified service-host lookups and the gateway's existing LAN ingress address verified through its configured secondary resolver. Original HTTPS URLs/SNI, certificate verification and gateway authentication remain intact; no system DNS or infrastructure was changed. Earlier DNS-failed attempts are retained, and the public WAN path is not certified. See the network verification details.
Public model pricing
This example calls the spec-declared public Portkey catalog, not the Prisma runtime or SCM. No credentials or workspace settings are read or sent. The endpoint is explicit and has no /v1 prefix. Prices below are actual catalog values captured at the page timestamp, in USD cents per token; they are not a price quote, effective tenant billing or the result of executing a formula. Unknown catalog fields are preserved by the SDK but are outside this small output projection.
npx tsx docs-site/examples/gateway-model-pricing.ts
[
{
"provider": "openai",
"model": "gpt-5.6-terra",
"currency": "USD",
"units": "USD cents per token",
"request_token": {
"price": 0.0002
},
"response_token": {
"price": 0.0012
}
},
{
"provider": "openai",
"model": "text-embedding-3-small",
"currency": "USD",
"units": "USD cents per token",
"request_token": {
"price": 0.000002
},
"response_token": {
"price": 0
}
}
]
Live scan output
The security profile's actual decisions are shown below; another profile may produce different decisions. The three full sanitized response bodies are on the Scan API page.
Synchronous scan
Category: benign
Action: allow
Scan ID: <resource-id>
Report ID: <resource-id>
Asynchronous scan
The script submits once and polls at most 20 times, 1.5 seconds apart. It fails if both submitted request IDs do not complete. A caller can query the returned batch ID again later without resubmitting the batch.
Received: 2026-09-07T01:59:13.980398547Z
Batch scan ID: <resource-id>
<resource-id>:1 pending allow
<resource-id>:2 pending allow
Query results and detector reports
Set SCAN_IDS and REPORT_IDS to real IDs from your own scan. Placeholders below are redactions, not runnable identifiers.
Scan <resource-id>, request 0: status=complete
category=benign action=allow
Report <resource-id>, request 0:
agent_security: benign -> allow
dlp: benign -> allow
pi: benign -> allow
source_code: benign -> allow
tc: benign -> allow
uf: benign -> allow
dbs: benign -> allow
dlp: benign -> allow
source_code: benign -> allow
tc: benign -> allow
uf: benign -> allow
malicious_code: benign -> allow
malicious_code: benign -> allow
Management and DLP
Mutation examples default to read-only. Pass --writes deliberately for unique sdk-example-* fixtures. Profile/topic cleanup includes revisions created by updates; pattern/dictionary cleanup runs in finally. DLP advanced profiles have no DELETE operation in the supplied contract: the example attempts status-based retirement, and any retirement failure remains a failure in the cleanup audit. Do not run repeated DLP profile creation while that cleanup path is failing.
npx tsx --env-file=.env docs-site/examples/mgmt-auth.ts
npx tsx --env-file=.env docs-site/examples/mgmt-profiles.ts --writes
npx tsx --env-file=.env docs-site/examples/mgmt-topics.ts --writes
npx tsx --env-file=.env docs-site/examples/mgmt-dlp-data-patterns.ts --writes
Dictionaries use PANW_DLP_DICTIONARY_REGION when set, otherwise a region observed in the tenant dictionary inventory. Do not substitute an AWS region without checking the service's region vocabulary. Advanced profiles reference a real basic-profile ID; a regex leaf without a pattern ID is not an executable policy.
OAuth authentication
Authenticated successfully
Profiles found: 100
Standalone OAuth lifecycle: {"concurrentRefreshDeduplicated":true,"explicitRefreshSucceeded":true,"refreshCallbacks":2,"tokenValid":true}
The standalone checks above exercise successful live refresh deduplication, explicit local-cache clearing and refresh callbacks; no token is printed. Separately, the SDK's 16 failing-first timeout regressions and packed ESM/CommonJS fault-injection checks prove that a stalled token fetch/body cannot hold callers indefinitely or cache a late token. The fixed 30-second token deadline is independent of the pre-expiry buffer and service-request timeout. See bounded OAuth refresh.
Profile lifecycle
Profiles returned: 5
Created owned profile
Updated owned profile
Deleted owned profile revisions: 2
Custom-topic lifecycle
Topics returned: 5
Created owned topic
Updated owned topic
Deleted owned topic revisions: 1
Model Security and Red Team
npx tsx --env-file=.env docs-site/examples/model-security-scans.ts
npx tsx --env-file=.env docs-site/examples/red-team-scans.ts
npx tsx --env-file=.env docs-site/examples/red-team-targets.ts
npx tsx --env-file=.env docs-site/examples/red-team-network-broker.ts
The Model Security walkthrough uses an existing scan, not a new proprietary-engine scan. Set MODEL_SECURITY_SCAN_ID to choose one explicitly. Its default selection excludes synthetic SDK/CLI test groups. Network-broker reads are non-mutating; --writes requests a draft create/update and leaves an auditable draft because the API has no delete operation. The live draft creates succeeded; their subsequent updates returned HTTP 403. Three disconnected drafts are journaled, and repeat validation reuses one rather than creating more. A failed update is not a completed lifecycle.
Secret-reference management lifecycle
The separate repository E2E example passed 7/7 at 2026-09-06T19:40:18.695Z. This admin-plane CRUD workflow uses SCM OAuth, not a runtime gateway key. It creates an unbound reference with invalid synthetic AWS credentials, limits its allowed workspace to dev, exercises filtered listing and slug retrieval, then deletes it and confirms HTTP 404. It does not test secret resolution or a live AWS/Azure/Vault integration. It is additional lifecycle evidence, not another script in the 21-script table.
npx tsx scripts/e2e-gateway-secret-references.ts --writes
Actual SDK lifecycle output, projected to non-secret fields. Owned identifiers replaced; auth_config omitted in full. Invalid synthetic AWS credentials only. No integration binding or external secret resolution was attempted.
{
"created": {
"id": "<owned-reference-id>",
"slug": "<owned-reference-slug>",
"object": "secret-reference"
},
"retrieved": {
"manager_type": "aws_sm",
"allow_all_workspaces": false,
"secret_key": null,
"auth_config": "[REDACTED]"
},
"filtered": {
"object": "list",
"total": 1
},
"updated": {},
"deleted": {},
"confirmedNotFound": true
}
Use gw.secretReferences.list({ current_page: 0, page_size: 20 }) for read-only listing. Do not add workspace_id: that unsupported filter caused HTTP 403 during discovery and is rejected locally. All auth_config subtrees are secret-bearing and omitted from SDK debug bodies. See secret-reference management.
Verified request-chart filters
The read-only typed SDK check passed 3/3 at 2026-09-06T21:21:10.314Z. It reused already journaled synthetic records: the exact known trace selects one request, and a nonexistent trace selects none. Known metadata matches and nonexistent metadata selects none. An earlier raw diagnostic found that upstream snake-case trace_id is ignored by SCM; that check remains a failure in the live-results table. An HTTP 200 alone is not filter verification.
npx tsx scripts/e2e-gateway-analytics-request-filters.ts
const selected = await gw.telemetry.requests({
workspaceSlug: 'ws-develo-71f8d8',
days: 1,
traceId: ownedTraceId, // a trace your application already recorded
});
const tagged = await gw.telemetry.requests({
workspaceSlug: 'ws-develo-71f8d8',
days: 1,
metadata: { sdk_e2e: ownedTestTag },
});
Read-only typed SDK calls against previously journaled synthetic records. Known trace totals and absent-filter totals are actual values; known metadata counts are projected to a boolean. No tenant-wide counts or resource identifiers are published. Only request-count chart filters are verified, not equivalence across all analytics operations.
{
"traceId": {
"knownTotal": 1,
"absentTotal": 0
},
"metadata": {
"knownMatched": true,
"absentTotal": 0
}
}
The preceding result is the original request-only checkpoint. SDK 0.23.0 extends the same filters to cost, token and latency charts, using AIGatewayChartOptions and preserving the original request-options interface. The additional read-only check passes 13/13 at 2026-09-07T07:28:54.307Z, using installed-sdk version 0.23.0. Its actual captured output follows. Positive controls are existing, journaled inference traffic with matching owned key and metadata, not the zero-token synthetic log-ingestion fixtures. No inference, runtime key or log was created in this run.
npx tsx scripts/e2e-gateway-analytics-chart-filters.ts --sdk
Read-only checks of existing owned traffic. Positive/empty cohort booleans and actual absent aggregate zero/null are retained, not tenant counts, trace IDs, metadata values or tokens. Combined filters match a known trace and known metadata, then require an empty result for the same known trace with nonexistent metadata. These do not establish upstream operation equivalence.
[
{
"metric": "requests",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "combined",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "combined",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "combined",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "latency",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "combined",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
}
]
Empty latency period aggregates are genuinely null; the SDK now preserves them while time buckets remain numeric zero. The first raw run exposed the previous schema rejection, which a failing-first regression reproduced. Known/nonexistent trace and metadata filters pass separately and together after correction. Invalid dates, non-finite/reversed windows, unknown query fields, unsupported grouping dimensions/columns and malformed filters still fail locally before authentication. Other chart/group methods do not gain unverified filters. All 22 analytics operations remain partially adapted and outside 138/242 direct coverage. See telemetry contracts.
Verified chart query contracts
The SDK 0.24.0 installed-package check passes 53/53 at 2026-09-07T08:56:03.088Z, using installed-sdk version 0.24.0. Its sanitized captured output follows. These checks cover status/API-key/provider-model singleton and CSV-OR filters, inclusive token/cost bounds, exact ranges and combined-filter intersections on requests, cost, tokens and latency. The telemetry guide lists every SDK-to-SCM query mapping and the cents unit.
npx tsx scripts/e2e-gateway-analytics-query-contracts.ts --sdk
Existing owned positive traffic only. Inclusive bounds, singleton/CSV-OR alternatives and combined filters are checked on each chart with an empty negative cohort. No trace IDs, keys, metadata values or tenant counts are published. This does not establish full upstream analytics equivalence.
[
{
"metric": "requests",
"filter": "statusCodes.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "statusCodes.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "aiOrgModels.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "aiOrgModels.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "requests",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "statusCodes.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "statusCodes.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "aiOrgModels.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "aiOrgModels.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "cost",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "statusCodes.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "statusCodes.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "aiOrgModels.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "aiOrgModels.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "tokens",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": 0,
"respected": true
},
{
"metric": "latency",
"filter": "statusCodes.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "statusCodes.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "aiOrgModels.single",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "aiOrgModels.csv-or",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
},
{
"metric": "latency",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"absentAggregate": null,
"respected": true
}
]
The first discovery run compared upstream snake-case names with SCM camel-case names. It retained 11 passing / 14 failing checks across controls and 22 hypotheses; it is not an all-green API suite. Upstream names were ignored, and several prompt/completion-token bounds failed their known/absent controls. Only the seven additional options verified by the full 53-check contract run are exposed. This adds no directly matched upstream operation: 138/242, the 22 partial analytics adaptations and the other live failures remain unchanged. This is separate from the 21 primary runnable examples and the realtime example above. No CLI filter flags are implied.
Verified grouped analytics filters
The SDK 0.25.0 installed-package check passes 102/102 at 2026-09-07T11:52:02.500Z, using installed-sdk. The independent raw SCM run passes 102/102 at 2026-09-07T11:10:38.954Z. Both use existing owned positive traffic, with no new inference, keys, logs or configuration changes. These are installed-package checks; registry publication is a separate release gate.
All six group endpoints verify trace and metadata filters, singleton/CSV-OR lists, inclusive token/cost bounds, equal-bound ranges and intersections. The five non-user groups additionally check that filtered cost and total-token columns match the owned source record. The user endpoint retains its distinct response envelope and does not gain column options. The raw and SDK runs produce the same sanitized result matrix below.
npx tsx scripts/e2e-gateway-analytics-group-filters.ts
E2E_ANALYTICS_SDK_ENTRY=/absolute/installed/package/dist/index.js npx tsx scripts/e2e-gateway-analytics-group-filters.ts --sdk
const grouped = await gw.telemetry.groupBy('model', {
workspaceSlug: 'ws-develo-71f8d8',
days: 1,
traceId: ownedTraceId, // a trace already recorded by your application
statusCodes: [200, 446],
columns: ['cost', 'total_tokens'],
costMax: 1, // cents
});
console.log(grouped.data);
Read-only discovery on existing owned traffic. Every filter requires both a known positive and an empty absent cohort. No tenant identifiers, trace IDs, key IDs, metadata values or tenant counts are published. This is not full upstream analytics equivalence.
[
{
"dimension": "ai_service",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "trace-and-metadata.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "statusCode.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "statusCode.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "aiOrgModel.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "aiOrgModel.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "ai_service",
"filter": "all.with-columns",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "trace-and-metadata.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "statusCode.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "statusCode.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "aiOrgModel.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "aiOrgModel.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "model",
"filter": "all.with-columns",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "trace-and-metadata.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "statusCode.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "statusCode.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "aiOrgModel.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "aiOrgModel.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "api_key",
"filter": "all.with-columns",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "trace-and-metadata.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "statusCode.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "statusCode.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "aiOrgModel.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "aiOrgModel.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "provider",
"filter": "all.with-columns",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "trace-and-metadata.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "statusCode.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "statusCode.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "aiOrgModel.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "aiOrgModel.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "status_code",
"filter": "all.with-columns",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "traceId",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "metadata",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "trace-and-metadata.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "statusCode.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "statusCode.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "apiKeyIds.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "apiKeyIds.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "aiOrgModel.single",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "aiOrgModel.csv-or",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "totalUnitsMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "totalUnitsMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "costMin.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "costMax.inclusive",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "totalUnits.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "cost.exact-range",
"knownPositive": true,
"absentEmpty": true,
"respected": true
},
{
"dimension": "users",
"filter": "all.intersection",
"knownPositive": true,
"absentEmpty": true,
"respected": true
}
]
The independently source-hashed user/model/provider fixtures retain all declared upstream query names. The provider specification omits trace_id; verified SCM traceId is recorded as an SCM-only extension, not invented upstream coverage. This remains partial adaptation: direct gateway coverage stays 138/242, and all 22 partial analytics operations and earlier failed workflows remain visible. See the group contract.
SCM dashboard executable examples
The two new dashboard scripts were executed separately from the historical primary batch, against this source checkout: 2/2 passed at 2026-09-07T20:44:15.796Z. Each capture is bound to the exact example's SHA-256. OAuth credentials were loaded from the read-only CLI config; no browser bearer token, system DNS change, mutation or scan-content read was used. This is first-page discovery and one transaction drill-down, not an exhaustive inventory. The independently installed CLI's complete pagination/report evidence is linked in the dashboard guide.
Actual JSON-line output from the runnable scripts (separate requests need not share a snapshot):
mgmt-dashboard-overview.ts
{"receivedItems":6,"pagination":{"limit":25,"skip":0,"total_items":6}}
{"typedItems":6}
mgmt-dashboard-sessions.ts
{"rankedApps":4,"trendBuckets":10,"sessionBuckets":10,"returnedApps":25,"sessionPageItems":25,"totalSessions":892}
{"sessionActions":2,"transactionStatus":"passed","tokens":72}
Reproduce from the SDK checkout with node --import tsx scripts/e2e-dashboard-examples.ts.
The runner bounds each process to 90 seconds, validates an explicit non-sensitive output shape,
and preserves failed runs. Stored content requires a separate explicit opt-in and is not fetched here.
Administration route availability
The bounded GET-only revalidation finished at 2026-09-07T20:34:56.105Z: 2 authentication controls passed; all 24 route probes failed with OPA-denied HTTP 403. Both Prisma planes can read the designated dev workspace with the same credential source. The additional probes supply virtual-key pagination, preserve camel-case user/invitation pagination, and compare upstream admin prefixes with Prisma's verified workspace-prefix pattern. Neither path variant establishes a usable member-list contract.
These results do not prove the features are absent or that a permission change would enable them. Palo Alto Networks documents SCM-managed access; it does not make these Portkey path hypotheses verified Prisma APIs. No users, invitations, memberships, SCIM mappings or keys were changed. Response bodies were cancelled without retaining member identities or secrets. Credentials remained unchanged.
Actual status/header projection from all 24 requests (workspace IDs are represented only by path templates):
All administration availability results
[
{
"plane": "data",
"name": "collections",
"sourcePath": "/collections",
"pathTemplate": "/collections",
"queryNames": [
"current_page",
"page_size",
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "labels",
"sourcePath": "/labels",
"pathTemplate": "/labels",
"queryNames": [
"current_page",
"page_size",
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "prompts",
"sourcePath": "/prompts",
"pathTemplate": "/prompts",
"queryNames": [
"current_page",
"page_size",
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "partials",
"sourcePath": "/prompts/partials",
"pathTemplate": "/prompts/partials",
"queryNames": [],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "virtual-keys",
"sourcePath": "/virtual-keys",
"pathTemplate": "/virtual-keys",
"queryNames": [
"current_page",
"page_size"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "users.scm-prefix",
"sourcePath": "/admin/users",
"pathTemplate": "/users",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "users.upstream-prefix",
"sourcePath": "/admin/users",
"pathTemplate": "/admin/users",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "invites.scm-prefix",
"sourcePath": "/admin/users/invites",
"pathTemplate": "/users/invites",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "invites.upstream-prefix",
"sourcePath": "/admin/users/invites",
"pathTemplate": "/admin/users/invites",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "members.scm-prefix",
"sourcePath": "/admin/workspaces/{workspaceId}/users",
"pathTemplate": "/workspaces/{workspaceId}/users",
"queryNames": [
"current_page",
"page_size"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "members.upstream-prefix",
"sourcePath": "/admin/workspaces/{workspaceId}/users",
"pathTemplate": "/admin/workspaces/{workspaceId}/users",
"queryNames": [
"current_page",
"page_size"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "data",
"name": "scim",
"sourcePath": "/scim/workspaces",
"pathTemplate": "/scim/workspaces",
"queryNames": [
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "collections",
"sourcePath": "/collections",
"pathTemplate": "/collections",
"queryNames": [
"current_page",
"page_size",
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "labels",
"sourcePath": "/labels",
"pathTemplate": "/labels",
"queryNames": [
"current_page",
"page_size",
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "prompts",
"sourcePath": "/prompts",
"pathTemplate": "/prompts",
"queryNames": [
"current_page",
"page_size",
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "partials",
"sourcePath": "/prompts/partials",
"pathTemplate": "/prompts/partials",
"queryNames": [],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "virtual-keys",
"sourcePath": "/virtual-keys",
"pathTemplate": "/virtual-keys",
"queryNames": [
"current_page",
"page_size"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "users.scm-prefix",
"sourcePath": "/admin/users",
"pathTemplate": "/users",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "users.upstream-prefix",
"sourcePath": "/admin/users",
"pathTemplate": "/admin/users",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "invites.scm-prefix",
"sourcePath": "/admin/users/invites",
"pathTemplate": "/users/invites",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "invites.upstream-prefix",
"sourcePath": "/admin/users/invites",
"pathTemplate": "/admin/users/invites",
"queryNames": [
"currentPage",
"pageSize"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "members.scm-prefix",
"sourcePath": "/admin/workspaces/{workspaceId}/users",
"pathTemplate": "/workspaces/{workspaceId}/users",
"queryNames": [
"current_page",
"page_size"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "members.upstream-prefix",
"sourcePath": "/admin/workspaces/{workspaceId}/users",
"pathTemplate": "/admin/workspaces/{workspaceId}/users",
"queryNames": [
"current_page",
"page_size"
],
"status": 403,
"opaDenied": true,
"available": false
},
{
"plane": "admin",
"name": "scim",
"sourcePath": "/scim/workspaces",
"pathTemplate": "/scim/workspaces",
"queryNames": [
"workspace_id"
],
"status": 403,
"opaDenied": true,
"available": false
}
]
Reproduce with npx tsx scripts/e2e-gateway-administration-availability.ts using the documented process-only service DNS accommodation. The command exits nonzero for these failures. No speculative production SDK method is added from a denied response; direct Gateway coverage remains 138/242 (57.02%) and the full-scope assessment remains 5/10.
MCP prompt, resource and template verification
Captured 2026-09-07T13:43:30.660Z: 18 pass / 2 fail / 0 skip, with unchanged credentials. This source-checkout test uses one disposable dev-only integration/server and service key. The World Monitor upstream allows anonymous metadata discovery; no upstream account, identity forwarding, model call, tool execution, prompt retrieval or resource-content read is involved.
Prompt capability updates pass: SCM and runtime both observe disable/re-enable, with 6 → 5 → 6 visible prompts and unrelated prompts preserved. The test allows the Gateway's natural cache expiry rather than flushing shared caches. Resource discovery fails official MCP validation because all eleven returned resources lack their required name; SCM separately contains eleven resource capabilities. All three resource templates are visible at runtime, but SCM remains empty after ten bounded inventory reads. Neither resource variant is live-certified.
A read-only inspection of both deployed 2.20.0 replicas ties these observations to the same hashed bundle: the resource-filter response mapping removes name, and template discovery directly forwards upstream without the capability synchronization used for prompts/resources. No gateway image, policy, cache or infrastructure configuration was changed. The SDK does not fabricate missing names or infer template-update support from a successful list response.
The anonymous upstream returns HTTP 405 for session DELETE. That is allowed by the MCP session-management specification; the report records server-controlled retirement, not confirmed deletion. The first preflight incorrectly required 2xx and stopped before loading SCM credentials; that failed attempt is retained. Local transports are closed. Gateway-owned fixture cleanup and the later independent 23/23 inventory audit pass, including prior public/synthetic/metadata attempts and implicit servers.
Actual MCP metadata results and field-level diagnostics
{
"finishedAt": "2026-09-07T13:43:30.660Z",
"passed": 18,
"failed": 2,
"skipped": 0,
"credentialsUnchanged": true,
"anonymousPreflight": {
"finishedAt": "2026-09-07T13:41:47.901Z",
"prompt": 6,
"resource": 11,
"resource_template": 3,
"sessionTerminationStatus": 405,
"sessionRetirement": "server-controlled"
},
"discovery": {
"prompt": {
"runtimeCount": 6,
"scmTotal": 6,
"scmAttempts": 1
},
"resource": {
"validationIssues": [
{
"path": [
"resources",
0,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
1,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
2,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
3,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
4,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
5,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
6,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
7,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
8,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
9,
"name"
],
"code": "invalid_type",
"expected": "string"
},
{
"path": [
"resources",
10,
"name"
],
"code": "invalid_type",
"expected": "string"
}
],
"scmTotal": 11
},
"resource_template": {
"runtimeCount": 3,
"scmTotal": 0,
"scmAttempts": 10
}
},
"selectedKinds": [
"prompt"
],
"variants": {
"prompt": {
"runtimeBaseline": 6,
"scmTotal": 6,
"scmStates": [
false,
true
],
"runtimeStates": [
false,
true
],
"runtimeCounts": [
6,
5,
6
]
}
},
"toolsInvoked": 0,
"promptsRetrieved": 0,
"resourcesRead": 0,
"independentFixtureAudit": {
"finishedAt": "2026-09-07T13:45:12.107Z",
"passed": 23,
"failed": 0
},
"runtimeDiagnosis": {
"checkedAt": "2026-09-07T13:45:19.841Z",
"mutations": false,
"credentialsLoaded": false,
"rawSourceRetained": false,
"replicas": [
{
"replica": 1,
"imageVersion": "2.20.0",
"sha256": "b2710c4f6a580a5a1bb525695f942175e4698d61a0c90ba066c48f93490f6331",
"resourceFilterReplacesNameWithUri": true,
"resourceResultRemovesName": true,
"resourceTemplateDirectPassthrough": true,
"resourceTemplateSyncTypeLiteralPresent": false
},
{
"replica": 2,
"imageVersion": "2.20.0",
"sha256": "b2710c4f6a580a5a1bb525695f942175e4698d61a0c90ba066c48f93490f6331",
"resourceFilterReplacesNameWithUri": true,
"resourceResultRemovesName": true,
"resourceTemplateDirectPassthrough": true,
"resourceTemplateSyncTypeLiteralPresent": false
}
]
}
}
Reproduce with npx tsx scripts/e2e-gateway-mcp-metadata.ts --writes, followed by npx tsx scripts/e2e-gateway-mcp-fixture-audit.ts, using the documented process-only DNS accommodation. The metadata command exits nonzero for the two failures. scripts/e2e-gateway-mcp-runtime-diagnostics.ts performs the hash-bound, read-only deployment inspection. These are verification tools, not new OpenAPI operations; SDK 0.25.0, CLI 4.4.0, direct Gateway 138/242 and the full-scope 5/10 assessment are unchanged.
AI Gateway inference output
Runtime feedback and log ingestion
The additional typed SDK observability example passed 5/5 at 2026-09-06T19:59:34.826Z. It uses the explicit runtime endpoint and a short-lived runtime key, not SCM OAuth. The designated inference model generates one owned trace; feedback has zero value/weight and logs contain synthetic data only. Single and array log submissions preserve the gateway's plain-text acknowledgement. An independent SCM read audit confirms the retained records; the pinned API has no deletion operation. This is separate from the 21 primary scripts above. Feedback update and log-detail retrieval are now experimental typed methods; their live storage failures remain visible below and are not passing workflows.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-runtime-observability.ts --writes --sdk
npx tsx scripts/e2e-gateway-observability-audit.ts
{
"feedback": {
"status": "success",
"message": "Feedback successfully saved",
"feedback_ids": [
"<owned-feedback-id>"
]
},
"singleLogAcknowledgement": "ok",
"batchLogAcknowledgement": "ok"
}
Latest runtime diagnostics: failures remain visible
The following JSON is a sanitized projection of the actual result records, not successful model output. Positive-score feedback updates, an omitted-metadata variant and restoration to zero all returned HTTP 500 on the same synthetic record. A subsequent read-only SCM audit confirmed its value and weight remain zero. Legacy completion returned HTTP 404 for the prescribed @openai/gpt-5.6-terra model, while model lookup/authentication passed; streaming was skipped after that prerequisite failure. No alternate model was used. Temporary runtime-key deletion passed in every suite that created a key and was checked independently in the aggregate audit.
[
{
"suite": "gateway-observability-details-sdk",
"finishedAt": "2026-09-07T01:57:45.366Z",
"passed": 3,
"failed": 2,
"skipped": 0,
"total": 5,
"results": [
{
"name": "observability-sdk.owned-log-control",
"status": "PASS"
},
{
"name": "observability-sdk.runtime-model-auth-control",
"status": "PASS"
},
{
"name": "observability-sdk.log-detail",
"status": "FAIL",
"statusCode": 500
},
{
"name": "observability-sdk.feedback-update-neutral",
"status": "FAIL",
"statusCode": 500
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-feedback-scores",
"finishedAt": "2026-09-06T20:24:57.217Z",
"passed": 2,
"failed": 3,
"skipped": 0,
"total": 5,
"results": [
{
"name": "observability-details.owned-log-control",
"status": "PASS"
},
{
"name": "observability-details.feedback.positive-score-zero-weight",
"status": "FAIL",
"statusCode": 500
},
{
"name": "observability-details.feedback.positive-score-minimal-metadata",
"status": "FAIL",
"statusCode": 500
},
{
"name": "observability-details.feedback.restore-neutral",
"status": "FAIL",
"statusCode": 500
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-legacy-completions",
"finishedAt": "2026-09-06T20:32:34.213Z",
"passed": 2,
"failed": 1,
"skipped": 1,
"total": 4,
"results": [
{
"name": "legacy-completions.model-auth-control",
"status": "PASS"
},
{
"name": "legacy-completions.create",
"status": "FAIL",
"statusCode": 404
},
{
"name": "legacy-completions.stream",
"status": "SKIP"
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-legacy-completions-sdk",
"finishedAt": "2026-09-06T22:37:14.653Z",
"passed": 2,
"failed": 1,
"skipped": 1,
"total": 4,
"results": [
{
"name": "legacy-completions.model-auth-control",
"status": "PASS"
},
{
"name": "legacy-completions.create",
"status": "FAIL",
"statusCode": 404
},
{
"name": "legacy-completions.stream",
"status": "SKIP"
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-prompt-runtime",
"finishedAt": "2026-09-06T22:37:15.237Z",
"passed": 2,
"failed": 2,
"skipped": 0,
"total": 4,
"results": [
{
"name": "prompt-runtime.model-auth-control",
"status": "PASS"
},
{
"name": "prompt-runtime.render.unprovisioned-template",
"status": "FAIL",
"statusCode": 404
},
{
"name": "prompt-runtime.completions.unprovisioned-template",
"status": "FAIL",
"statusCode": 404
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-prompt-runtime-sdk",
"finishedAt": "2026-09-06T22:38:18.128Z",
"passed": 2,
"failed": 2,
"skipped": 0,
"total": 4,
"results": [
{
"name": "prompt-runtime.model-auth-control",
"status": "PASS"
},
{
"name": "prompt-runtime.render.unprovisioned-template",
"status": "FAIL",
"statusCode": 404
},
{
"name": "prompt-runtime.completions.unprovisioned-template",
"status": "FAIL",
"statusCode": 404
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-realtime",
"finishedAt": "2026-09-07T05:46:31.074Z",
"passed": 3,
"failed": 1,
"skipped": 0,
"total": 4,
"transport": {
"outcome": "server-error",
"upgraded": true,
"statusCode": 101,
"sessionCreated": false,
"closed": true,
"eventTypes": [
"error"
],
"clientEventsSent": 0,
"errorCode": "invalid_model",
"modelErrorReported": true
},
"results": [
{
"name": "realtime.model-auth-control",
"status": "PASS"
},
{
"name": "realtime.connect-and-session",
"status": "FAIL",
"statusCode": 101
},
{
"name": "realtime.socket-cleanup",
"status": "PASS"
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-realtime-sdk",
"finishedAt": "2026-09-07T06:04:42.282Z",
"passed": 4,
"failed": 1,
"skipped": 0,
"total": 5,
"transport": {
"statusCode": 101,
"sessionCreated": false,
"socketClosed": true,
"eventTypes": [
"error"
],
"clientEventsSent": 0,
"errorCode": "invalid_model"
},
"results": [
{
"name": "realtime-sdk.model-auth-control",
"status": "PASS"
},
{
"name": "realtime-sdk.typed-upgrade",
"status": "PASS"
},
{
"name": "realtime-sdk.provider-session",
"status": "FAIL",
"statusCode": 101
},
{
"name": "cleanup.realtime-sdk.socket-retired",
"status": "PASS"
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-runtime-authoring",
"finishedAt": "2026-09-07T00:58:15.702Z",
"passed": 2,
"failed": 13,
"skipped": 0,
"total": 15,
"transport": {
"observedAt": "2026-09-07T00:58:13.568Z",
"withoutProvider": {
"requests": 9,
"httpStatus": 400,
"missingProviderOrConfig": true
},
"withPrescribedProvider": {
"requests": 4,
"httpStatus": 404,
"successful": 0
},
"authoringAvailabilityEstablished": false
},
"results": [
{
"name": "runtime-authoring.model-auth-control",
"status": "PASS"
},
{
"name": "runtime-authoring.collections.id",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.collections.slug",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.collections.provider-boundary",
"status": "FAIL",
"statusCode": 404
},
{
"name": "runtime-authoring.labels.id",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.labels.slug",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.labels.none",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.labels.provider-boundary",
"status": "FAIL",
"statusCode": 404
},
{
"name": "runtime-authoring.prompts.id",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.prompts.slug",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.prompts.none",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.prompts.provider-boundary",
"status": "FAIL",
"statusCode": 404
},
{
"name": "runtime-authoring.prompts.partials.none",
"status": "FAIL",
"statusCode": 400
},
{
"name": "runtime-authoring.prompts.partials.provider-boundary",
"status": "FAIL",
"statusCode": 404
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-provider-http",
"finishedAt": "2026-09-06T22:06:39.937Z",
"passed": 2,
"failed": 9,
"skipped": 0,
"total": 11,
"results": [
{
"name": "provider-http.model-auth-control",
"status": "PASS"
},
{
"name": "provider-http.images.generations",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.images.edits",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.images.variations",
"status": "FAIL",
"statusCode": 404
},
{
"name": "provider-http.audio.speech",
"status": "FAIL",
"statusCode": 404
},
{
"name": "provider-http.audio.transcriptions",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.audio.translations",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.moderations",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.rerank",
"status": "FAIL",
"statusCode": 500
},
{
"name": "provider-http.ocr",
"status": "FAIL",
"statusCode": 500
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-provider-http-sdk",
"finishedAt": "2026-09-06T22:07:31.983Z",
"passed": 2,
"failed": 9,
"skipped": 0,
"total": 11,
"results": [
{
"name": "provider-http.model-auth-control",
"status": "PASS"
},
{
"name": "provider-http.images.generations",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.images.edits",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.images.variations",
"status": "FAIL",
"statusCode": 404
},
{
"name": "provider-http.audio.speech",
"status": "FAIL",
"statusCode": 404
},
{
"name": "provider-http.audio.transcriptions",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.audio.translations",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.moderations",
"status": "FAIL",
"statusCode": 400
},
{
"name": "provider-http.rerank",
"status": "FAIL",
"statusCode": 500
},
{
"name": "provider-http.ocr",
"status": "FAIL",
"statusCode": 500
},
{
"name": "cleanup.runtime-key.retired",
"status": "PASS"
}
]
},
{
"suite": "gateway-deployment-diagnostics",
"finishedAt": "2026-09-07T00:57:51.238Z",
"passed": 5,
"failed": 0,
"skipped": 0,
"total": 5,
"results": [
{
"name": "deployment-diagnostics.health",
"status": "PASS"
},
{
"name": "deployment-diagnostics.target-isolation",
"status": "PASS"
},
{
"name": "deployment-diagnostics.replica-1.storage-reproduction",
"status": "PASS"
},
{
"name": "deployment-diagnostics.replica-2.storage-reproduction",
"status": "PASS"
},
{
"name": "deployment-diagnostics.configuration-unchanged",
"status": "PASS"
}
]
}
]
The typed observability-detail run finished at 2026-09-07T01:57:45.366Z with 3 pass / 2 fail / 5 total. It calls inference.getLog() with the owned log's real path format and ISO creation timestamp, and inference.updateFeedback() with the exact neutral synthetic feedback UUID. Both return HTTP 500; ownership, same-key model lookup and key retirement pass. No new log or feedback is created. These are experimental direct contracts backed by 63 focused tests and independently generated OpenAPI fixtures, not successful detail/update certification. TypeScript and pre-authentication validation enforce the v2 timestamp requirement; debug logs omit sensitive bodies.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-observability-details-sdk.ts --writes
The runtime-authoring recheck finished at 2026-09-07T00:58:15.702Z. Nine read-only list requests for collections, labels, prompts and partials returned HTTP 400 with the exact missing-provider/config message. Four additional requests with the prescribed @openai provider header passed that boundary but returned HTTP 404. Model/authentication and key retirement pass; all 13 authoring checks fail. The JSON projection above records the observed header/error distinction without raw error bodies or credentials. No authoring or IAM resource was changed.
Both hash-pinned deployed replicas register a generic GET provider-proxy fallback and no explicit GET handlers for these four authoring collections. A synthetic replay of the reviewed header-validation function returns the same missing-header 400 before invoking its continuation; adding a valid provider reaches only the synthetic continuation, never a network client. This explains the missing-header responses and does not establish a usable authoring API. Sending a provider header is not a replacement for a verified SCM/Portkey control-plane authoring endpoint. Prompt rendering/completion remain separately registered routes.
The new typed legacy-completion suite reproduces the prescribed model's 404; streaming remains skipped after that prerequisite fails. The raw and typed prompt-runtime runs use random unprovisioned template IDs, required variables and root-level parameter overrides. Both rendering and completion return 404 in both runs. These failures diagnose an unavailable owned-template workflow; they are not successful prompt examples and do not establish that the registered routes are absent. No existing template was executed or changed, and no alternative model was selected.
Both exact deployed replicas register legacy completion, prompt completion and prompt rendering. Their prompt-completion route dispatches to the ordinary chat/legacy handlers. The SDK now models all three as experimental, including strict flattened inputs, native/wrapped JSON results and bounded native SSE. Deployed-code route evidence and passing offline fixtures are not live template certification.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-legacy-completions.ts --writes --sdk
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-prompt-runtime.ts --writes
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-prompt-runtime.ts --writes --sdk
The experimental typed inference.connectRealtime() run finishes at 2026-09-07T06:04:42.282Z with 4 pass / 1 fail. The HTTP 101 upgrade passes, but the prescribed model returns invalid_model before session.created. Same-key authentication and socket/key cleanup pass. No audio, client event or generation request was sent. The actual sanitized events are in the diagnostic JSON above. Passing transport contracts are not successful provider-session certification.
The new runnable realtime example was executed separately from the earlier 21-script batch, at 2026-09-07T06:12:26.528Z, against the source checkout, as resolved by the repository TypeScript configuration. Its actual failed output is below; no successful transcript is substituted. This brings the executed script inventory to 22, with timestamps kept separate. An independent read-only audit at 2026-09-07T06:13:23.127Z passes 6/6 key-absence checks across all journaled realtime attempts, including earlier failures.
{
"script": "gateway-realtime.ts",
"model": "@openai/gpt-5.6-terra",
"clientEventsSent": 0,
"exitCode": 1,
"stderr": "Example failed: Error",
"finishedAt": "2026-09-07T06:12:26.528Z"
}
Use the experimental realtime guide for the explicit Node adapter, authentication, event and cancellation boundaries. The SDK adds no production dependency; ws is development-only here and an explicit dependency in the caller's application.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-realtime.ts --writes
The provider HTTP runs below use the same synthetic inputs through raw HTTP and the nine new experimental SDK methods: image generation/edit/variation, speech, transcription/translation, moderation, rerank and OCR. Both runs use only @openai/gpt-5.6-terra. Model lookup and key cleanup pass; all nine provider operations fail with the same HTTP statuses in both runs. These are failed live integrations, not successful examples. The corrected one-pixel PNG is checksum/decompression-tested and the 0.1-second silent WAV has validated PCM headers. Earlier probes with an invalid image checksum, and attempts stopped by this host's DNS issue, are retained as historical diagnostics; they are not used to certify media compatibility. No specialized model or alternate provider was substituted.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-provider-http.ts --writes
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-provider-http.ts --writes --sdk
The deployment diagnostic's five passing checks reproduce service limitations; they are not five successful SDK operations. At 2026-09-07T00:57:51.238Z, both exact Deployment-owned gateway replicas ran gateway_enterprise:2.20.0, bundle SHA-256 b2710c4f6a580a5a1bb525695f942175e4698d61a0c90ba066c48f93490f6331. Their configured log and analytics stores are control_plane. Evaluating two reviewed, hash-pinned pure functions with synthetic dependencies reproduced ClickHouse client not initialized for feedback lookup and Invalid Log Storage for log detail. The deployed handlers map these paths to HTTP 500. A separate synthetic reproduction verifies that the realtime upstream-open wait has no rejection handler; this is a potential stalled-handshake path, not the cause of the observed run, which upgraded successfully and received invalid_model. No server bundle was started, no database/network client was called by the reproductions, and deployment configuration was unchanged. Switching storage backends would alter production data handling and is not an SDK fix.
See all timestamped results and deployment findings. Diagnostics alone do not add implemented or live-verified operations; the two new detail methods count as experimental implementations because their typed clients and independent contracts now exist, not because an HTTP error passed a diagnostic.
Inference walkthrough
The executable example used the dev workspace (ws-develo-71f8d8), https://airs.cdot.io/v1, @openai/gpt-5.6-terra, and @openai/text-embedding-3-small. The E2E runner creates and deletes its own short-lived SCM service key; secrets never appear in transcripts.
npx tsx --env-file=.env docs-site/examples/gateway-inference.ts
{
"model": "gpt-5.6-terra",
"content": "READY",
"usage": {
"completion_tokens": 4,
"prompt_tokens": 10,
"total_tokens": 14,
"completion_tokens_details": {
"reasoning_tokens": 0,
"accepted_prediction_tokens": 0,
"rejected_prediction_tokens": 0,
"audio_tokens": 0
},
"prompt_tokens_details": {
"cached_tokens": 0,
"cache_write_tokens": 0,
"audio_tokens": 0
}
},
"embeddingCount": 1,
"dimensions": 32,
"fineTuningJobCount": 0,
"fineTuningHasMore": false
}
For JSON/SSE Responses and CLI commands, see gateway inference. The separate repo-root examples/ai-gateway.ts is a management-plane walkthrough; its methods are covered by the canonical gateway read suite and it is outside the documentation-script denominator here.
Validated batch inference output
Captured 2026-09-06T18:51:22.545Z by the separate batch E2E workflow, which passed 9/9 checks. This is additional runtime evidence, not an extra script in the 21-script table above.
Actual output from one synthetic gpt-5.6-terra batch request through the dev gateway. Resource and request IDs are redacted. Input/output files and the temporary key were deleted; the terminal batch audit record has no deletion API.
{
"id": "<redacted-id>",
"custom_id": "<redacted-id>",
"response": {
"status_code": 200,
"request_id": "<redacted-id>",
"body": {
"id": "<redacted-id>",
"object": "chat.completion",
"created": 1788720671,
"model": "gpt-5.6-terra",
"choices": [
{
"index": 0,
"message": {
"role": "assistant",
"content": "READY",
"refusal": null,
"annotations": []
},
"finish_reason": "stop"
}
],
"usage": {
"prompt_tokens": 11,
"completion_tokens": 4,
"total_tokens": 15,
"prompt_tokens_details": {
"cached_tokens": 0,
"cache_write_tokens": 0,
"audio_tokens": 0
},
"completion_tokens_details": {
"reasoning_tokens": 0,
"audio_tokens": 0,
"accepted_prediction_tokens": 0,
"rejected_prediction_tokens": 0
}
},
"service_tier": "default",
"system_fingerprint": null
}
},
"error": null
}
The workflow validates creation, retrieval, terminal completion, the gateway output endpoint, native file download and cleanup. It sends one synthetic request capped at 128 completion tokens using the designated model. The separate cancellation suite verifies the terminal cancelled state. Native batch completion has a 24-hour SLA; this test waits at most 30 minutes before requesting cancellation, then allows up to 11 minutes for cancellation cleanup. A local test deadline is not an upstream SLA violation.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-batches.ts --writes
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-gateway-batches.ts --writes --cancel
The sanitized capture is artifacts/examples/gateway-batch.json; counters are checked against artifacts/e2e/gateway-batches.json before this page is generated.
Mock-backed validation output
These transcripts come from local synthetic servers and schema checks, not the AIRS tenant. The final eight nonempty lines of each captured run are reproduced below; the complete OAuth transcript is on the token lifecycle page.
profiles-get-validation
npx tsx docs-site/examples/profiles-get-validation.ts
[T+ 0.0s] API GET /v1/mgmt/profiles/tsg/123?offset=0&limit=100
[T+ 0.0s] PASS ✓ Threw AISecSDKException
[T+ 0.0s] PASS ✓ Message contains "Profile not found" (got: AISEC_USER_REQUEST_PAYLOAD_ERROR:Profile not found: nonexistent-profile)
═══════════════════════════════════════════════════════════════
Validation Complete
Duration: 0.0s
Result: ALL PASSED
═══════════════════════════════════════════════════════════════
profiles-crud-validation
npx tsx docs-site/examples/profiles-crud-validation.ts
[T+ 0.1s] PASS ✓ Force-delete returned message: "Profile force-deleted successfully"
[T+ 0.1s] PASS ✓ Threw AISecSDKException for invalid UUID on force-delete
════════════════════════════════════════════════════════════
Validation Complete
Duration: 0.1s
Passed: 33 | Failed: 0
Result: ALL PASSED
════════════════════════════════════════════════════════════
oauth-lifecycle-validation
npx tsx docs-site/examples/oauth-lifecycle-validation.ts
[T+ 8.3s] PASS ✓ Callback #4: expiresInMs=5000
═══════════════════════════════════════════════════════════════
Validation Complete
Total token fetches: 7 (standalone 4, managed 3)
Total callbacks: 4
Duration: 8.3s
Result: ALL PASSED
═══════════════════════════════════════════════════════════════
red-team-mgmt-validation
npx tsx docs-site/examples/red-team-mgmt-validation.ts
✅ create() omits validate param when not specified
✅ uploadPromptsCsv returns parsed response
✅ uploadPromptsCsv hits correct endpoint
✅ uploadPromptsCsv passes prompt_set_uuid query param
✅ uploadPromptsCsv sends multipart/form-data
════════════════════════════════════════════════════════════
Total: 37 | Passed: 37 | Failed: 0
════════════════════════════════════════════════════════════
Reproduce this evidence
The internal runner reads ~/.prisma-airs/config.json without modifying it, requires --writes, keeps fixture journals, and records actual script exit codes. It intentionally exits nonzero if any example fails.
E2E_GATEWAY_IPV4_ONLY=1 npx tsx scripts/e2e-doc-examples.ts --writes
The IPv4 override is a disclosed, process-only workaround for this test host's gateway DNS lookup; it does not disable TLS verification or change SDK defaults. The source reports are artifacts/examples/latest.json and artifacts/e2e/doc-examples.json; public pages are generated with scripts/e2e/generate-example-docs.ts. See live results, contract coverage, and the gateway gap ledger.