API reference

Administration differs by distribution: DVARA Open Source uses gateway.yaml and a restart. The Enterprise platform adds Flightdeck and GitOps import. Open Source has no equivalent for centrally managed workspaces, users, budgets, or fleet history.

DVARA is an AI gateway that governs model, tool and agent-to-agent calls, with separate HTTP surfaces for model calls, tool calls, agent-to-agent calls, and operations. Start with the surface your client calls. Availability and authentication are different for each one.

Which API does your client need?

Surface	Base path	Where it runs	Authentication	Reference
DVARA LLM Gateway	/v1 on the gateway, normally port 8080	Open Source distribution and Enterprise platform	Workspace bearer key, always required	Govern model calls
DVARA MCP Gateway	/mcp and /mcp/{serverId} on the gateway	Enterprise platform, with or without a licence	Workspace bearer key by default; OAuth tokens when enabled	MCP Gateway API
DVARA A2A Gateway	/a2a/{agentId} on the gateway	Enterprise platform, with or without a licence	Workspace bearer key, required for every agent operation (the card-signing key set and the peer push-notification callback are keyless)	Govern agent-to-agent calls
Operator endpoints	/actuator on each application	Every distribution that exposes the named endpoint	Depends on the endpoint; see operator endpoints	Observability

The Open Source distribution does not include Flightdeck, the MCP Gateway, or the A2A Gateway. The Enterprise platform includes Flightdeck and both planes. See Capability availability for the complete boundary.

How do you govern a model call?

The LLM Gateway exposes OpenAI-compatible operations for chat, Responses, legacy completions, embeddings, files, batches, and model discovery. It also serves the Anthropic Messages API, Gemini's generateContent API, a token-count operation and a base URL for Cursor. The Enterprise platform also exposes a budget-estimate operation.

Start with the LLM Gateway overview. It gives you a copy-runnable request, a realistic response, the observable audit result, and the full operation list. The generated API specifications document every /v1 model operation except Gemini's generateContent API under /v1/gemini. That API is served by one catch-all route, and its model names can contain /, which an OpenAPI path cannot express, so the Gemini generateContent API page is its reference.

OpenAI compatibility describes the request shape, not identical feature coverage. The overview identifies the narrower behavior of Responses, completions, embeddings, batches, and streaming before you integrate them.

How do you govern tool and agent calls?

Use the native /mcp endpoint when an MCP client supports Streamable HTTP. The legacy /mcp/{serverId}/... operations remain available for direct tool, resource, and prompt calls. Both paths use a workspace API key by default and also accept OAuth tokens when MCP OAuth is enabled. They run only in the Enterprise platform; from 1.8.2 they need no licence.

Use /a2a/{agentId}/... for agent messages, task state, cancellation, resubscription, push-notification configuration, and agent cards. The A2A Gateway runs only in the Enterprise platform and needs no licence. Every agent operation needs a workspace key. Two paths take none: the card-signing key set (GET /a2a/.well-known/jwks.json) and the callback a peer agent posts push notifications to, where the peer proves itself with the sealed callback address and its notification token.

The three gateway planes share workspace identity and governance evidence, but they do not share one protocol or one base path. Do not send MCP or A2A operations to /v1.

How do you authenticate gateway calls?

Send a DVARA workspace API key as a bearer token:

Authorization: Bearer gw_<your-key>

The LLM Gateway and every A2A agent operation require a workspace key. The MCP Gateway requires one by default; when MCP OAuth is enabled it also accepts validated access tokens. Missing, invalid, revoked, and expired credentials are refused before the governed operation runs.

An API key with no scopes is unrestricted. A scoped key can call only the operation families named by its scopes. An MCP OAuth token needs mcp:read or mcp:call when scope enforcement is enabled, which is the default. See Authentication for the API-key scope map and MCP OAuth 2.1 for token validation.

How do you administer DVARA?

Use DVARA Flightdeck for workspaces, keys, providers, routes, policies, budgets, MCP servers, users, and audit evidence. Use its GitOps export and import for bulk configuration.

The Automation API was removed in 1.7.0. Do not send workspace, route, policy, budget, or credential CRUD requests to /v1/admin/**; those routes return 404. See Operate DVARA with Flightdeck for the supported workflows and export and import configuration for bulk changes.

Two narrow routes remain under /v1/admin:

• GET /v1/admin/config/bundle/signing-key returns only the public key used to verify signed configuration bundles.
• From 1.10.0, POST /v1/admin/config/import runs the GitOps import from a pipeline, with an owner's personal access token. See Import from a pipeline.

Neither is an administration API.

How do you monitor an application?

Endpoint	Authentication	What it tells you
GET /actuator/health	None	Overall health without component details
GET /actuator/health/liveness	None	Whether the process should be restarted
GET /actuator/health/readiness	None	Whether the process should receive traffic
GET /actuator/info	None	Build and version information
GET /actuator/gateway-status	DVARA_ACTUATOR_API_KEY	Gateway runtime, provider, route, region, and configuration status
GET /actuator/license	DVARA_ACTUATOR_API_KEY	Enterprise posture and licence status; absent from the Open Source distribution
GET /actuator/prometheus	DVARA_ACTUATOR_METRICS_API_KEY	Prometheus metrics, using a separate credential

If either actuator credential is empty, its protected endpoint fails closed. Keep the general operator key and metrics key different so a scraper cannot read broader runtime status.