Management API

Everything under /management/v1/** is authenticated with a management API key, distinct from the per-application keys /v1/** accepts, and not scoped to any one application — it administers the gateway itself.

Authorization: Bearer lattice_sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Minted with:

type ProviderAdapter = {
  id: ProviderId;
  createChatCompletion(
    request: ChatCompletionRequest,
    ctx: ProviderRequestContext,
  ): Promise<ChatCompletionResponse>;
  streamChatCompletion(
    request: ChatCompletionRequest,
    ctx: ProviderRequestContext,
  ): AsyncGenerator<ChatCompletionChunk, void, void>;
};

type ProviderRequestContext = {
  apiKey?: string;
  providerModel: string;
  signal: AbortSignal;
};

See Authentication and Security for how that key is generated, hashed, and verified — the mechanics are identical to application keys, just against a separate table with no per-key identity beyond "valid or not."

Resources#

Who calls this API#

In practice, exactly one client: the dashboard's server, via gatewayFetch (apps/dashboard/server/utils/gateway-client.ts), which holds the management key server-side and never lets it reach the browser. Nothing stops a script or CI job from calling /management/v1 directly with its own management key — it's a plain bearer-authenticated JSON API, not dashboard-specific.

Response envelope#

List endpoints return { "data": [...] }, and paginated ones (/requests) additionally echo back limit/offset. Single-resource endpoints return the resource object directly, not wrapped. Errors use the same envelope as /v1 — see Errors.

Base URL#

The gateway's PORT defaults to 3001 in development. In the dashboard's own configuration this is LATTICE_GATEWAY_URL — see Configuration Reference.