Gateway
Package gateway is live control of the policy your API applies to every incoming request: CORS, rate limits, cache TTL and allowed methods, changed without a redeploy.
Package gateway is live control of the policy your API applies to every incoming request: CORS, rate limits, cache TTL and allowed methods, changed without a redeploy.
| Base URL | https://api.hanzo.ai |
| Operations | 3 |
| Auth | Authorization: Bearer $HANZO_API_KEY |
gateway
GET /v1/gateway/config
Read returns the EFFECTIVE edge policy the caller is subject to: the platform CORS allowlist and pre-auth per-IP flood cap in force, plus the caller's own authenticated rate ceiling, edge-cache TTLs and accepted-method allowlist. A SuperAdmin may inspect a specific tenant's effective policy with ?org=<slug>.
PUT /v1/gateway/config
Write updates one policy scope and returns the policy in force after the write. A body carrying any PLATFORM field (cors_origins, per_ip_rpm, window_sec) is a platform write and requires SuperAdmin; otherwise it is a per-org write (org_rpm, cache_ttl_sec, cache_paths, methods) scoped to the caller's own org — or, for a SuperAdmin, the tenant named by ?org=<slug>. A body that sets nothing is a 400. The abuse gate's mode is an OPERATOR field: setting it requires SuperAdmin, whichever organization it lands on. updated_at and updated_by are server-stamped; a client-supplied value is ignored.
Request body — application/json (required)
| Field | Type | Required | Description |
|---|---|---|---|
cache_paths | object | — | CachePaths overrides CacheTTLSec per path PREFIX (key "/v1/models" → seconds). |
cache_ttl_sec | integer | — | CacheTTLSec is the org's default edge-cache TTL for its responses, in seconds; 0 means no caching. |
cors_origins | string[] | — | CORSOrigins is the PLATFORM-scope CORS allowlist EdgeCORS admits: an exact origin, a bare host, or a "*.host" wildcard. |
methods | string[] | — | Methods is the allowlist of HTTP methods the edge accepts for this org. |
mode | string | — | Mode is the abuse gate's posture for THIS scope: "shadow" scores traffic and records the verdict without acting on it,… |
org_rpm | integer | — | OrgRPM is the org's OWN authenticated rate ceiling, requests per minute, as ScopeRateLimit enforces it. |
per_ip_rpm | integer | — | PerIPRPM is the PLATFORM-scope pre-auth flood cap: requests EdgeRateLimit admits per WindowSec from one client IP. |
updated_at | integer | — | UpdatedAt is the unix second this policy row was last written. |
updated_by | string | — | UpdatedBy is the validated user id that wrote this policy row. |
window_sec | integer | — | WindowSec is the window PerIPRPM is counted over, in seconds. |
GET /v1/gateway/traffic
Report who is calling this org's API right now
Traffic reports who is calling this organization's API right now: the request count for the last minute split by AGENCY LANE — agent, human, bot, unknown — and the busiest callers behind it, each with its request count, its authentication-failure count, how many distinct paths it touched, and any verdict currently held against it.
The lane split is the answer to the question a generic bot filter cannot answer: which of this traffic is the customer's own automation and which is somebody working through a list. It is computed from credentials we issued, not from the client's self-description, so a scraper cannot move itself into the agent lane by editing a header.
A validated caller appears as a FINGERPRINT — a one-way, per-process digest. It is stable enough to recognise the same caller across a minute and cannot be turned back into a key, so this report is safe to read, screenshot and paste.
Scoped to the caller's own validated organization. A SuperAdmin may inspect a specific tenant with ?org=<slug>, or the lane that has no tenant — every caller the identity boundary could not validate — with an empty ?org=.
How is this guide?
Functions
Package functions is your serverless code: publish it, call it over HTTP, watch every run and what it cost.
Generate-text-to-speech-audio
Package ai is Hanzo AI — the model API on /v1 (/v1/chat/completions, /v1/messages, /v1/models and the rest of hanzoai/ai's surface) — mounted into a cloud binary with the money, ingest and telemetry…