Skip to main content

Class: AIGatewayClient

Defined in: src/ai-gateway/client.ts:94

Client for the Prisma AIRS AI Gateway, managed through Strata Cloud Manager.

Spans two planes over one credential set: the data plane (/ai_gw/v2) for runtime telemetry and workspace-scoped config, and the admin plane (/ai_gw/admin/v2) for organisation-level config.

Remarks​

The two planes authorize against different SCM role scopes. Verified tenant workflows use grants at both scopes; authorization still depends on the requested operation:

  • an admin role at tenant root scope → /ai_gw/admin/v2/*
  • view_only_admin or higher on the main_airs_workspace_<TSG> scope → /ai_gw/v2/*

Both can coexist on one account, but SCM's Access Management UI edits an existing role row by default — use Add Role to add the second, or you will move the first instead of adding to it. errorCode: "AB03" indicates application authorization rejection; check the requested workspace and plane. 403 with x-opa-decision: false indicates SCM policy denial, not proof of a missing tenant-root grant or an available endpoint. Verified workspace reads can succeed on both planes while candidate routes remain denied. Compare a known-good read on the same plane and verify the route/query contract before considering permission changes.

Example​

import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';

// Reads PANW_AI_GW_* (falling back to PANW_MGMT_*) env vars.
const gw = new AIGatewayClient();

const cost = await gw.telemetry.cost({ workspaceSlug: 'ws-main-a-349e0e', days: 7 });
console.log(`$${(cost.data.total / 100).toFixed(2)}`); // cost is in cents

Constructors​

Constructor​

new AIGatewayClient(opts?): AIGatewayClient;

Defined in: src/ai-gateway/client.ts:143

Parameters​

ParameterType
optsAIGatewayClientOptions

Returns​

AIGatewayClient

Properties​

telemetry​

readonly telemetry: AIGatewayTelemetryClient;

Defined in: src/ai-gateway/client.ts:104

Runtime telemetry: charts, group-bys, and raw request logs.

workspaces​

readonly workspaces: AIGatewayWorkspacesClient;

Defined in: src/ai-gateway/client.ts:106

Workspace reads (data plane), writes (admin plane), and scope-first provision().

iamScopes​

readonly iamScopes: IamScopesClient;

Defined in: src/ai-gateway/client.ts:111

SCM IAM scopes (/iam/v1/scopes) — the objects a workspace's scope_name points at. A scope must exist before workspaces.create() and is bound to the workspace slug afterwards.

configs​

readonly configs: AIGatewayConfigsClient;

Defined in: src/ai-gateway/client.ts:113

Gateway routing configs.

guardrails​

readonly guardrails: AIGatewayGuardrailsClient;

Defined in: src/ai-gateway/client.ts:115

Workspace guardrails.

providers​

readonly providers: AIGatewayProvidersClient;

Defined in: src/ai-gateway/client.ts:117

Workspace-scoped provider bindings.

apiKeys​

readonly apiKeys: AIGatewayApiKeysClient;

Defined in: src/ai-gateway/client.ts:119

Service and user API keys.

integrations​

readonly integrations: AIGatewayIntegrationsClient;

Defined in: src/ai-gateway/client.ts:121

Organisation-level provider integrations (admin plane).

mcpIntegrations​

readonly mcpIntegrations: AIGatewayMcpIntegrationsClient;

Defined in: src/ai-gateway/client.ts:123

MCP server integrations (admin plane).

deployments​

readonly deployments: AIGatewayDeploymentsClient;

Defined in: src/ai-gateway/client.ts:125

Gateway deployments (admin plane).

plugins​

readonly plugins: AIGatewayPluginsClient;

Defined in: src/ai-gateway/client.ts:127

Plugin bindings such as the Prisma AIRS scanner (admin plane).

organisations​

readonly organisations: AIGatewayOrganisationsClient;

Defined in: src/ai-gateway/client.ts:129

Organisation and auth settings (admin plane).

auditLogs​

readonly auditLogs: AIGatewayAuditLogsClient;

Defined in: src/ai-gateway/client.ts:131

Organisation audit logs (admin plane).

mcpServers​

readonly mcpServers: AIGatewayMcpServersClient;

Defined in: src/ai-gateway/client.ts:133

Workspace MCP servers, capabilities, user access, and connections.

usageLimits​

readonly usageLimits: AIGatewayUsageLimitsClient;

Defined in: src/ai-gateway/client.ts:135

Workspace cost/token usage-limit policies. Deletion archives a policy.

rateLimits​

readonly rateLimits: AIGatewayRateLimitsClient;

Defined in: src/ai-gateway/client.ts:137

Workspace request/token rate-limit policies.

logExports​

readonly logExports: AIGatewayLogExportsClient;

Defined in: src/ai-gateway/client.ts:139

Asynchronous request-log exports. Downloads return a signed URL, not fetched log content.

secretReferences​

readonly secretReferences: AIGatewaySecretReferencesClient;

Defined in: src/ai-gateway/client.ts:141

External secret-manager references (admin plane). CRUD does not resolve the referenced secret.

Accessors​

inference​

Get Signature​

get inference(): AIGatewayInferenceClient;

Defined in: src/ai-gateway/client.ts:100

Runtime gateway-key client; never sends management OAuth credentials to the runtime host.

Example​
`const result = await gw.inference.createEmbedding({ model: '@provider/embedding', input: 'Hello' });`
Returns​

AIGatewayInferenceClient