Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions docs/configuration/api-keys.md
Original file line number Diff line number Diff line change
Expand Up @@ -108,9 +108,6 @@ Managed budget enforcement exists on the managed `/dp/budget_check` path.
Current standalone boundary:

- standalone self-hosted deployments default to a disabled budget client, which is allow-all
- the standalone admin write validator currently rejects `max_budget_usd`, even though broader typed and OpenAPI surfaces reference it

Do not treat `max_budget_usd` as part of the current verified standalone admin write contract.

## Troubleshooting

Expand Down
15 changes: 2 additions & 13 deletions docs/configuration/budgets.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ sidebar_position: 37

Budget enforcement in the current gateway runtime is driven by the managed budget-check path, not by a standalone in-process budget engine.

Use this page to avoid over-assuming what `max_budget_usd` means in standalone deployments.

## Current Runtime Model

Before dispatch, the proxy can call:
Expand All @@ -27,13 +25,6 @@ Current boundary:
- managed deployments can attach a live budget client through the managed data-plane path
- standalone self-hosted deployments default to `BudgetClient::disabled()`, which allows requests through

Because of that boundary, `max_budget_usd` should not be treated as part of the current verified standalone admin write contract.

Current standalone caveat:

- the typed `ApiKey` model and admin OpenAPI mention `max_budget_usd`
- the active standalone admin JSON Schema validator rejects `max_budget_usd` on write today

## Operator Guidance

- treat managed mode as the real budget-enforcement path today
Expand Down Expand Up @@ -61,11 +52,9 @@ This is a caller-visible denial, not just an internal accounting event.

Inspect budget-check freshness and the cached-decision behavior first.

### A standalone deployment ignores `max_budget_usd`

That is expected with the current standalone runtime boundary.
### A standalone deployment does not enforce per-key budgets

If you are using the standalone admin API directly, do not send `max_budget_usd` until the write validator and runtime contract are aligned.
That is expected with the current standalone runtime boundary. Standalone deployments default to allow-all; per-key budget enforcement lives in the managed control plane via the budget-check path.

## Related Pages

Expand Down
2 changes: 1 addition & 1 deletion docs/integration/errors-and-retries.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ The proxy emits the following gateway-generated failures. The `error.type` strin
| `413` | `invalid_request_error` | Request body exceeded `proxy.request_body_limit_bytes` |
| `422` | `content_filter` | Guardrail blocked the request or response content |
| `429` | `rate_limit_exceeded` | Rate-limit rejection (per-key or per-model) |
| `429` | `billing_error` (with `code: "budget_exceeded"`) | Budget rejection from the ApiKey's `max_budget_usd` |
| `429` | `billing_error` (with `code: "budget_exceeded"`) | Budget rejection from the managed budget controller |
| `503` | `provider_unavailable` | No provider bridge is registered for the resolved provider |
| `503` | `all_candidates_unavailable` | Every routing candidate was excluded by runtime status (cooldown or background-unhealthy) and the routing model is configured with `on_all_filtered: fail`. The response carries `Retry-After: 30`. See [Routing And Failover § All-Targets-Filtered Policy](../configuration/routing-and-failover.md#all-targets-filtered-policy) |

Expand Down
2 changes: 0 additions & 2 deletions docs/overview/core-concepts.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,6 @@ An API key also carries:

`team_id` and `owner_id` are bucket identifiers consumed by `team`-scoped and `member`-scoped [`RateLimitPolicy`](#rate-limit-policy) rows. They are not access controls on their own.

Managed budget paths may also reference per-key budget state, but `max_budget_usd` is not part of the current verified standalone admin write contract.

An empty `allowed_models` list denies access to every model. A wildcard entry `"*"` allows access to every model in scope.

## Rate Limit Policy
Expand Down
2 changes: 1 addition & 1 deletion docs/overview/feature-matrix.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ Use it as a navigation aid, not as a replacement for detailed feature pages.
| Provider-specific passthrough | Available | Use `/passthrough/:provider/*rest` for unsupported or provider-native routes. |
| Standalone admin API | Available | Current admin surface includes models, API keys, provider keys, guardrails, cache policies, observability exporters, health, metrics, OpenAPI, and playground. |
| API key allowlist authz | Available | Uses hashed caller keys and model allowlists. |
| Per-key budgets | Limited | Live enforcement is currently centered on managed-mode `/dp/budget_check`. Standalone self-hosted mode defaults to allow-all, and the standalone admin write validator does not currently accept `max_budget_usd`. |
| Per-key budgets | Limited | standalone deployments do not enforce per-key budgets; managed deployments enforce via the budget controller. |
Comment thread
janiussyafiq marked this conversation as resolved.
Outdated
| Rate limits and concurrency limits | Available | Three layers are AND-combined per request: `ApiKey.rate_limit`, `Model.rate_limit`, and scope-matched `RateLimitPolicy` rows (`api_key` / `model` / `team` / `member`). |
| Routing models and failover | Available | Current model schema supports routing strategies and retry budget behavior. |
| Keyword guardrails | Available | Current runtime enforcement is on `POST /v1/chat/completions`; non-chat endpoints do not run the guardrail chain today. |
Expand Down
1 change: 0 additions & 1 deletion docs/reference/resource-schemas.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@ Not every field or shape present in the schema should be interpreted as equally

Examples:

- the typed `ApiKey` model and admin OpenAPI mention `max_budget_usd`, but the current standalone admin write validator rejects it and standalone hard-stop budget behavior is not the current documented default
- `Model.rate_limit` and `ApiKey.rate_limit` are both enforced today, alongside scope-matched `RateLimitPolicy` rows. See [Rate Limits](../configuration/rate-limits.md) for the layer order and the AND-combination semantics.
- `Model.background_model_check` exists in schema, but it only applies to direct models and its runtime effect is surfaced through `/admin/v1/models/status`
- `Guardrail.kind = bedrock` exists in schema, but current generally reliable runtime behavior is strongest on `keyword`
Expand Down
Loading