Send a request from the API reference

Use the request panel on a Data Plane operation page to test the DVARA AI governance platform without writing a client first. The panel sends a real browser request to the DVARA deployment you select and shows the HTTP response.

Individual operations can have narrower distribution or configuration requirements; each reference page states that boundary.

Choose the DVARA deployment

Open an operation under Data Plane specifications, then expand Base URL in the Request panel. The OpenAPI definition starts with these values:

Variable	Default	Change it when
protocol	http	The deployment terminates TLS; use https
host	localhost	DVARA runs on another host or ingress
port	8080	The deployment exposes a different port

Together, the defaults produce http://localhost:8080. They match the local gateway port in the Quickstart; they are not a production recommendation.

The explorer holds edited form values in the current browser session. Confirm the Base URL whenever you open or reload a reference page so a test never goes to the wrong environment.

Add a workspace API key

Expand Authentication and paste the complete workspace key. The explorer sends it as:

Authorization: Bearer <your-dvara-api-key>

Every /v1 operation requires a valid key. A scoped key also needs the scope for that endpoint family: completions:write for Chat Completions, Responses, and legacy completions; embeddings:write for embeddings. A key with no scopes is unrestricted.

Treat the explorer like any browser client. Do not paste a production key into a shared browser profile, screen recording, or untrusted copy of the docs. See Authenticate data-plane calls for key creation, scope, rotation, and error behavior.

Send and inspect the request

1. Fill the required path, query, header, and body fields.
2. Check the generated code sample before sending. Use its Copy control when you want to run the same request from a terminal.
3. Select Send API Request.
4. Inspect the status, response headers, and body in the Response panel.

For Chat Completions, start with a small non-streaming request:

{
  "model": "gpt-4o",
  "messages": [
    {
      "role": "user",
      "content": "Reply with: governed"
    }
  ],
  "max_tokens": 10
}

Replace gpt-4o when your deployment exposes a different model. A successful response is HTTP 200 and includes an X-Trace-ID header. When audit storage is configured, use that value to find the completed GATEWAY_RESPONSE event in Flightdeck or your audit output.

Know what the browser can change

The explorer is a browser client, not a privileged path around DVARA:

• The target must be reachable from your browser, not only from the machine or cluster that hosts this documentation.
• The target or its ingress must allow the documentation origin through CORS. DVARA does not infer a safe production origin for you.
• A page loaded over HTTPS can be prevented from calling an HTTP target by browser security rules. Use an HTTPS test endpoint or copy the generated request to a terminal.
• A self-signed certificate must already be trusted by the browser. Do not disable certificate validation for a production test.

If the browser blocks a request, the generated cURL sample separates a browser policy problem from a DVARA API problem.

Test streaming and file operations from a client

The explorer can send stream: true, but its response view is not a token-by-token application UI. Use an SDK or curl -N to verify SSE framing, disconnect handling, finish reasons, and the configured streaming governance posture. Follow Stream Chat Completions end to end for complete consumers.

The generated explorer can render multipart fields for file operations. For a repeatable Batch API test, use the reference page's generated cURL as the starting point and keep the JSONL fixture in source control. That makes the uploaded bytes and response easier to review than a one-off browser selection.

Diagnose a failed request

Result	Meaning	Next check
Browser connection or CORS error	The request did not produce a readable DVARA response	Verify Base URL, TLS, network reachability, and the ingress CORS policy; then run the generated cURL
HTTP 401	The key is missing, invalid, revoked, or expired	Use the response's exact error.code and replace or rotate the key
HTTP 403 with api_key_scope	The key is valid but lacks the endpoint family's scope	Issue a replacement key with the required scope
HTTP 400 with invalid_path	The /v1 path is not canonical	Use the path shown on the operation page without encoded or duplicate separators
HTTP 400, 402, or 403 with another DVARA code	A validation or configured governance control refused the call	Keep the trace_id and follow the code in Error handling
HTTP 502 or 503	No eligible provider completed the request	Check registered providers, credentials, model support, health, retries, and fallback conditions

Do not diagnose every 403 as a policy denial. Authentication scope, policy, guardrail, and other controls have distinct error codes and can use different status codes.