API reference
Administration differs by distribution: DVARA Open Source uses gateway.yaml and a restart. The Enterprise platform adds Flightdeck and GitOps import. Open Source has no equivalent for centrally managed workspaces, users, budgets, or fleet history.
DVARA is an AI governance platform with separate HTTP surfaces for model calls, tool calls, agent-to-agent calls, and operations. Start with the surface your client calls. Availability and authentication are different for each one.
Which API does your client need?
| Surface | Base path | Where it runs | Authentication | Reference |
|---|---|---|---|---|
| DVARA LLM Gateway | /v1 on the gateway, normally port 8080 | Open Source distribution and Enterprise platform | Workspace bearer key, always required | Govern model calls |
| DVARA MCP Gateway | /mcp and /mcp/{serverId} on the gateway | Enterprise platform, with or without a licence | Workspace bearer key by default; OAuth tokens when enabled | MCP Gateway API |
| DVARA A2A Gateway | /a2a/{agentId} on the gateway | Enterprise platform, with or without a licence | Workspace bearer key, always required | Govern agent-to-agent calls |
| Operator endpoints | /actuator on each application | Every distribution that exposes the named endpoint | Depends on the endpoint; see operator endpoints | Observability |
The Open Source distribution does not include Flightdeck, the MCP Gateway, or the A2A Gateway. The Enterprise platform includes Flightdeck and both planes. See Capability availability for the complete boundary.
How do you govern a model call?
The LLM Gateway exposes OpenAI-compatible operations for chat, Responses, legacy completions, embeddings, files, batches, and model discovery. The Enterprise platform also exposes a budget-estimate operation.
Start with the LLM Gateway overview. It gives you a copy-runnable request, a realistic response, the observable audit result, and the exact 1.8 operation list. The generated API specifications document the operations currently present in the committed OpenAPI contract.
OpenAI compatibility describes the request shape, not identical feature coverage. The overview identifies the narrower behavior of Responses, completions, embeddings, batches, and streaming before you integrate them.
How do you govern tool and agent calls?
Use the native /mcp endpoint when an MCP client supports Streamable HTTP. The
legacy /mcp/{serverId}/... operations remain available for direct tool,
resource, and prompt calls. Both paths use a workspace API key by default and
also accept OAuth tokens when MCP OAuth is enabled. They run only in the
Enterprise platform; from 1.8.2 they need no licence.
Use /a2a/{agentId}/... for agent messages, task state, cancellation,
resubscription, push-notification configuration, and agent cards. The A2A
Gateway has the same Enterprise Production and workspace-key requirements.
The three gateway planes share workspace identity and governance evidence, but
they do not share one protocol or one base path. Do not send MCP or A2A
operations to /v1.
How do you authenticate gateway calls?
Send a DVARA workspace API key as a bearer token:
Authorization: Bearer gw_<your-key>
The LLM and A2A Gateways require a workspace key. The MCP Gateway requires one by default; when MCP OAuth is enabled it also accepts validated access tokens. Missing, invalid, revoked, and expired credentials are refused before the governed operation runs.
An API key with no scopes is unrestricted. A scoped key can call only the
operation families named by its scopes. An MCP OAuth token needs mcp:read or
mcp:call when scope enforcement is enabled, which is the default. See
Authentication for the API-key scope map and
MCP OAuth 2.1 for token validation.
How do you administer DVARA?
Use DVARA Flightdeck for workspaces, keys, providers, routes, policies, budgets, MCP servers, users, and audit evidence. Use its GitOps export and import for bulk configuration.
The Automation API was removed in 1.7.0. Do not send workspace, route, policy,
budget, or credential CRUD requests to /v1/admin/**; those routes return
404. See Operate DVARA with Flightdeck for
the supported workflows and export and import
configuration for bulk changes.
One narrow operational route remains for the signed configuration bundle:
GET /v1/admin/config/bundle/signing-key. It returns only the public key used
to verify signed configuration bundles. It is not an administration API.
How do you monitor an application?
| Endpoint | Authentication | What it tells you |
|---|---|---|
GET /actuator/health | None | Overall health without component details |
GET /actuator/health/liveness | None | Whether the process should be restarted |
GET /actuator/health/readiness | None | Whether the process should receive traffic |
GET /actuator/info | None | Build and version information |
GET /actuator/gateway-status | DVARA_ACTUATOR_API_KEY | Gateway runtime, provider, route, region, and configuration status |
GET /actuator/license | DVARA_ACTUATOR_API_KEY | Enterprise posture and licence status; absent from the Open Source distribution |
GET /actuator/prometheus | DVARA_ACTUATOR_METRICS_API_KEY | Prometheus metrics, using a separate credential |
If either actuator credential is empty, its protected endpoint fails closed. Keep the general operator key and metrics key different so a scraper cannot read broader runtime status.