Straits Hub — Enterprise AI Fabric Gateway

Every data-plane endpoint (everything except GET /openapi.json) requires a fabric API key: Authorization: Bearer fab_… (an x-api-key header is also accepted). Keys resolve to a principal bound to a project, a default logical profile, budgets and a guardrail policy — so identity, policy and spend are attached before routing ever runs. Invalid or missing keys return 401 authentication_failed.

curl https://fabric.whymelabs.com/v1/models \
  -H "Authorization: Bearer fab_demo_admin"

Both route prefixes serve the same handlers: /v1/... and /api/v1/... — point any OpenAI/OpenRouter SDK at either as its base URL.

Set stream: true on chat-like endpoints to receive Server-Sent Events. The fabric speaks three streaming dialects, matching each protocol skin:

• /chat/completions — OpenAI style: data: {chat.completion.chunk} frames (role chunk, paced content deltas, delta.tool_calls, then a final usage-bearing chunk), terminated by data: [DONE].
• /responses — typed response.* events with an event: name and monotonic sequence_number (response.created → response.output_item.added → response.content_part.added → response.output_text.delta… → response.completed). No [DONE] terminator.
• /messages — Anthropic named events: message_start, ping, content_block_start / content_block_delta (text_delta, input_json_delta) / content_block_stop, message_delta (carries stop_reason + output tokens), message_stop. No [DONE].

curl -N https://fabric.whymelabs.com/v1/chat/completions \
  -H "Authorization: Bearer fab_demo_admin" \
  -H "Content-Type: application/json" \
  -d '{
  "model": "@company/general-fast",
  "stream": true,
  "messages": [{ "role": "user", "content": "Hello fabric" }]
}'

data: {"id":"gen_…","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"role":"assistant","content":""},"logprobs":null,"finish_reason":null}],…}

data: {"id":"gen_…","object":"chat.completion.chunk","choices":[{"index":0,"delta":{"content":"Hello! "},"logprobs":null,"finish_reason":null}],…}

data: {"id":"gen_…","object":"chat.completion.chunk","choices":[{"index":0,"delta":{},"logprobs":null,"finish_reason":"stop"}],"usage":{…}}

data: [DONE]

Guardrails still apply to streams: the pipeline runs output guardrails before frames are emitted, so a blocked generation fails with a 403 error instead of a truncated stream. When metadata is requested, fabric_metadata rides on the final usage-bearing chunk (OpenAI dialect) or the completed response object.

Every failure — gateway, guardrail, quota, or any provider's native error — is normalized into one canonical class (memo §9.1). The class is carried in error.code, so clients can branch on stable semantics instead of provider-specific strings. Classes marked retryable are retried internally on an alternate credential / node / endpoint before the gateway ever returns the error; safety blocks (content_policy_rejection, dlp_block) are never retried on a more permissive route.

{
  "error": {
    "message": "secrets detected in prompt: AWS access key",
    "type": "content_policy_violation",
    "code": "dlp_block",
    "param": null
  }
}

POST /messages uses the Anthropic envelope instead: { "type": "error", "error": { "type", "message" } }.

Applications should target organization-managed logical service profiles rather than volatile provider model names (memo §4.3). A profile encapsulates an approved model set, routing objective, guardrail policy, cache policy, cost ceiling, resilience profile and audit mode — so operators can move traffic between models without a single client change. Pass a profile id anywhere a model is accepted; profiles also appear in GET /models as type: "profile" entries.

OpenRouter-compatible fields (model, models, provider, session_id) stay valid; enterprise controls live in the optional routing object. session_id keeps model pinning and prompt-cache affinity stable across an agent session. routing.explain: true (or X-Fabric-Explain: true) attaches the full fabric_metadata route explanation; X-OpenRouter-Metadata: enabled attaches it with node refs masked.

{
  "model": "@company/confidential",
  "session_id": "agent-session-01HXYZ",
  "messages": [{ "role": "user", "content": "Review this contract." }],
  "provider": { "zdr": true },
  "routing": {
    "deadline_ms": 15000,
    "maximum_cost_usd": 0.20,
    "explain": true
  }
}