SDK & Framework Integrations

DVARA is an AI governance platform — Policy-as-Code, tamper-evident audit, PII redaction, agentic governance, and cost attribution under one control plane — with a fully OpenAI API-compatible data plane. Any SDK or framework that supports the OpenAI chat completions API works with DVARA by pointing at the gateway's base URL. No custom SDK required, and governance kicks in on the first request.

Pick your language

Jump to the integration guide for your stack — every page shows the full round-trip (request + response + observable effect in the DVARA Flightdeck):

• Python SDKs — OpenAI, Anthropic, AWS Bedrock, Google GenAI, LiteLLM, LangChain, Pydantic AI
• JavaScript / TypeScript SDKs — OpenAI JS, Anthropic JS, Vercel AI SDK
• Java SDKs — OpenAI Java SDK, Spring AI, LangChain4j
• Additional OpenAI-compatible providers — long-tail providers that aren't built in as first-class translators: Fireworks AI, Together AI, Perplexity, vLLM hosts, ERNIE / Wenxin, and any future OpenAI-compatible upstream. (Qwen, DeepSeek, Moonshot, ChatGLM, and Grok are first-class — see the full provider list on the additional-providers page.)
• DVARA-specific headers — X-Trace-ID, X-Session-Id for correlation across SDKs
• Migration guide — moving from direct provider access or another gateway
• Troubleshooting — common 4xx / 5xx errors and their fixes
• Spring Boot governance engines — call DVARA's Open Source policy, PII, and guardrail engines from your application without adding routes
• Embedded Spring Boot Gateway — serve DVARA's OpenAI-compatible /v1 API from your application
• Claude Code — point Claude Code at DVARA's Anthropic Messages API (/v1/messages, from 1.8.5) so every model call it makes is governed

Quick reference

The only change any of these SDKs need is the base URL. Everything else — the request shape, streaming semantics, tool-calling, structured output — stays the same.

SDK / Framework	Language	Config change
OpenAI SDK	Python	base_url
OpenAI SDK	JavaScript / TS	baseURL
OpenAI SDK	Java	.baseUrl() on the client builder
Anthropic SDK	Python	base_url + model prefix
Anthropic SDK	JavaScript / TS	baseURL + model prefix
AWS Bedrock SDK	Python	Switch to OpenAI SDK
Google GenAI SDK	Python	Switch to OpenAI SDK
LiteLLM	Python	api_base
LangChain	Python	openai_api_base
Pydantic AI	Python	base_url on OpenAI provider
Vercel AI SDK	JavaScript / TS	baseURL on createOpenAI()
Spring AI	Java	spring.ai.openai.base-url
LangChain4j	Java	.baseUrl()
Additional providers	any	Register a custom provider + OpenAI SDK base_url
DVARA engine starter	Java	Add governance engines without HTTP routes
DVARA Gateway starter	Java	Add the governed /v1 API to the host application
Claude Code	CLI	ANTHROPIC_BASE_URL + a DVARA key, from 1.8.5

Prerequisites

All examples on the language pages assume:

• DVARA is running at http://localhost:8080
• A workspace and API key have been created (see Quickstart)
• The target provider is configured in DVARA (e.g. OPENAI_API_KEY set)

Replace your-dvara-api-key with your actual DVARA API key throughout.

Supported endpoints

Every request from every SDK ultimately lands on one of these public Data Plane paths. The OpenAI-compatible shape means any SDK that speaks POST /v1/chat/completions on the vendor endpoint works against DVARA without change.

Endpoint	Purpose
POST /v1/chat/completions	Chat (all models, streaming, tools, structured output)
POST /v1/completions	Legacy text completion (wraps chat internally)
POST /v1/messages	Anthropic Messages API, from 1.8.5, for Claude Code and the Anthropic SDKs. Governed like chat. POST /v1/messages/count_tokens counts tokens without calling a model. See Claude Code.
POST /v1/embeddings	Embeddings — used by RAG pipelines and semantic search
GET /v1/models	Best-effort model discovery with provider-declared capabilities; see Provider Setup
POST /v1/budget/estimate	Enterprise pre-flight check for a model and max_tokens. Returns estimated output cost, current remaining budget, and would_exceed_budget without calling a provider.
POST /v1/webhooks/actions/{action}	Approval-gate callback for MCP human-in-the-loop flows. Not called from the OpenAI SDK — receives a signed token from an approver clicking through a webhook link. Listed here for completeness.

Full request and response schemas, along with a Try it panel that executes real calls against a DVARA instance, live in the Data Plane API reference. Manage workspaces, routes, policies, budgets, and credentials in the DVARA Flightdeck. For reviewed bulk changes, use GitOps export and import. The former Automation API was removed in 1.7.0, so Terraform and CI jobs must not call /v1/admin/** CRUD routes.

Observability endpoints

These are separate from the request path. Every DVARA instance exposes them so your monitoring stack can scrape health and metrics:

• GET /actuator/health — Liveness summary (anonymous; good for liveness from any SDK). Sub-paths /actuator/health/liveness and /actuator/health/readiness are also anonymous, intended for Kubernetes probes.
• GET /actuator/info — Build info (app.*, build.*); also anonymous, useful for version discovery.
• GET /actuator/gateway-status — Gateway runtime status, providers, routes, limits, region, and warnings. Requires Authorization: Bearer $DVARA_ACTUATOR_API_KEY; it does not return licence or posture fields.
• GET /actuator/license — Enterprise Gateway posture and licence health. Requires the same operator bearer and is absent from the Open Source distribution.
• GET /actuator/prometheus — Prometheus scrape endpoint. Requires Authorization: Bearer $DVARA_ACTUATOR_METRICS_API_KEY, which must differ from the operator key.

Why route through DVARA

Drop-in OpenAI compatibility means governance kicks in on call one — point any OpenAI SDK at DVARA and every request is:

• Policy-evaluated — YAML-defined policies run before the upstream call (see Routes & Policies)
• Audited — every request and response writes to the tamper-evident, HMAC-signed audit trail
• PII-protected — sensitive spans can be blocked, removed irreversibly, or tokenized for controlled recovery before leaving the perimeter; LOG is the default and changes nothing
• Cost-attributed — per-workspace, per-model, per-API-key spend tracked for chargeback
• Routed — multi-provider failover, latency-aware routing, cost-aware routing
• Cached — semantic cache for repeated queries

All of this is transparent to your SDK code. You change one line.