---
title: "Forward a request, inspecting it on the way"
method: POST
path: "/gateway/{destination}"
---

# Forward a request, inspecting it on the way

`POST /gateway/{destination}`

## Request

- Base URL: `https://secureai.one/v1`
- URL: `https://secureai.one/v1/gateway/{destination}`
- Auth: HTTP bearer

The same inspection as /inspect with no code to write: point an HTTP client here and every request it makes is checked before it leaves.

The destination follows the prefix as a full URL, or is sent as X-Secure-AI-Target. The vendor's own credential goes in X-Secure-AI-Forward-Authorization — the Authorization header is ours and is never forwarded.

Refuses private and link-local destinations, so it cannot be used to reach a cloud metadata service. Bodies it cannot read as text are forwarded and the response carries X-Secure-AI-Inspected: false.

## Path parameters

- `destination` string, required

## Headers

- `X-Secure-AI-Forward-Authorization` string
- `X-Secure-AI-Agent` string

## Response `200`

The destination's own response, passed back. X-Secure-AI-Decision says whether anything was changed; X-Secure-AI-Audit-Id identifies the record.

## Other responses

- `401`: Missing or invalid API key.
- `402`: No API access, or the allowance is spent.
- `403`: Refused — either the destination is not permitted, or the policy blocked the contents. Nothing was sent.
- `413`: The body is larger than the gateway will inspect. Refused rather than forwarded unchecked.
- `502`: Secure AI allowed the request; the destination did not answer.

---

[API](https://skmtc.dev/secureai/apis/secure-ai.md) · [All operations](https://skmtc.dev/secureai/apis/secure-ai/llms.txt) · [OpenAPI document](https://skmtc.dev/secureai/apis/secure-ai/revisions/6eefd7f53f8b?raw)