Class: AIGatewayClient

Defined in: src/ai-gateway/client.ts:72

Client for the Prisma AIRS AI Gateway, managed through Strata Cloud Manager.

Spans two planes over one credential set: the data plane (/ai_gw/v2) for runtime telemetry and workspace-scoped config, and the admin plane (/ai_gw/admin/v2) for organisation-level config.

Remarks

The two planes authorize against different SCM role scopes, and the service account needs both grants or half the API returns 403:

• an admin role at tenant root scope → /ai_gw/admin/v2/*
• view_only_admin or higher on the main_airs_workspace_<TSG> scope → /ai_gw/v2/*

Both can coexist on one account, but SCM's Access Management UI edits an existing role row by default — use Add Role to add the second, or you will move the first instead of adding to it. A 403 whose body carries errorCode: "AB03" means the workspace-scope grant is missing; a 403 carrying x-opa-decision: false means the tenant-root grant is.

Example

import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';

// Reads PANW_AI_GW_* (falling back to PANW_MGMT_*) env vars.
const gw = new AIGatewayClient();

const cost = await gw.telemetry.cost({ workspaceSlug: 'ws-main-a-349e0e', days: 7 });
console.log(`$${(cost.data.total / 100).toFixed(2)}`); // cost is in cents

Constructors

Constructor

new AIGatewayClient(opts?): AIGatewayClient;

Defined in: src/ai-gateway/client.ts:98

Parameters

Parameter	Type
opts	AIGatewayClientOptions

Returns

AIGatewayClient

Properties

telemetry

readonly telemetry: AIGatewayTelemetryClient;

Defined in: src/ai-gateway/client.ts:74

Runtime telemetry: charts, group-bys, and raw request logs.

---

workspaces

readonly workspaces: AIGatewayWorkspacesClient;

Defined in: src/ai-gateway/client.ts:76

Workspace reads (data plane).

---

configs

readonly configs: AIGatewayConfigsClient;

Defined in: src/ai-gateway/client.ts:78

Gateway routing configs.

---

guardrails

readonly guardrails: AIGatewayGuardrailsClient;

Defined in: src/ai-gateway/client.ts:80

Workspace guardrails.

---

providers

readonly providers: AIGatewayProvidersClient;

Defined in: src/ai-gateway/client.ts:82

Workspace-scoped provider bindings.

---

apiKeys

readonly apiKeys: AIGatewayApiKeysClient;

Defined in: src/ai-gateway/client.ts:84

Service and user API keys.

---

integrations

readonly integrations: AIGatewayIntegrationsClient;

Defined in: src/ai-gateway/client.ts:86

Organisation-level provider integrations (admin plane).

---

mcpIntegrations

readonly mcpIntegrations: AIGatewayMcpIntegrationsClient;

Defined in: src/ai-gateway/client.ts:88

MCP server integrations (admin plane).

---

deployments

readonly deployments: AIGatewayDeploymentsClient;

Defined in: src/ai-gateway/client.ts:90

Gateway deployments (admin plane).

---

plugins

readonly plugins: AIGatewayPluginsClient;

Defined in: src/ai-gateway/client.ts:92

Plugin bindings such as the Prisma AIRS scanner (admin plane).

---

organisations

readonly organisations: AIGatewayOrganisationsClient;

Defined in: src/ai-gateway/client.ts:94

Organisation and auth settings (admin plane).

---

auditLogs

readonly auditLogs: AIGatewayAuditLogsClient;

Defined in: src/ai-gateway/client.ts:96

Organisation audit logs (admin plane).