---
title: "Forward a request named in a header, inspecting it on the way"
method: POST
path: "/gateway"
---

# Forward a request named in a header, inspecting it on the way

`POST /gateway`

## Request

- Base URL: `https://secureai.one/v1`
- URL: `https://secureai.one/v1/gateway`
- Auth: HTTP bearer

The same call as /gateway/{destination}, with the destination in X-Secure-AI-Target instead of in the path. This is the form both SDKs use: a client that is handed a fetch cannot have the address rewritten underneath it, and a URL inside a URL is a thing some HTTP clients refuse to send at all.

The vendor's own credential goes in X-Secure-AI-Forward-Authorization, verbatim and with its scheme — "Bearer sk-…", not "sk-…", because it becomes the outbound Authorization header exactly as sent. The Authorization header on this request is ours and is never forwarded.

## Headers

- `X-Secure-AI-Target` string, required
- `X-Secure-AI-Forward-Authorization` string
- `X-Secure-AI-Agent` string

## Response `200`

The destination's own response, passed back. X-Secure-AI-Decision says whether anything was changed; X-Secure-AI-Audit-Id identifies the record.

## Other responses

- `401`: Missing or invalid API key.
- `402`: No API access, or the allowance is spent.
- `403`: Refused — either the destination is not permitted, or the policy blocked the contents. Nothing was sent.
- `413`: The body is larger than the gateway will inspect. Refused rather than forwarded unchecked.
- `502`: Secure AI allowed the request; the destination did not answer.

---

[API](https://skmtc.dev/secureai/apis/secure-ai.md) · [All operations](https://skmtc.dev/secureai/apis/secure-ai/llms.txt) · [OpenAPI document](https://skmtc.dev/secureai/apis/secure-ai/revisions/6eefd7f53f8b?raw)