One base URL. Every internal AI app protected.

Point your OpenAI and Anthropic clients at Nymgate. Prompts, streamed answers and tool calls are tokenized and restored inside your network.

Book a pilot call Try the demo

# before: https://api.openai.com/v1
client = OpenAI(
    base_url="https://nymgate.corp.internal/v1",
    api_key="pg_live_…",  # gateway key
)
client.responses.create(model="gpt-5", input=prompt)

On the wire

Your app sends values. The provider gets tokens.

Your app sends

POST /v1/responses
{
  "model": "gpt-5",
  "input": "Summarise the complaint from Sarah Collins (sarah.collins@example.com) about card 4111 1111 1111 1111."
}

api.openai.com receives

{
  "model": "gpt-5",
  "instructions": "Values enclosed in ⟦…⟧ are opaque placeholders. Preserve them exactly…",
  "input": "Summarise the complaint from ⟦PERSON:7F31:0001⟧ (⟦EMAIL:7F31:0002⟧) about card ⟦CARD:7F31:0003⟧."
}

Streaming

Tokens split across chunks still come back whole.

From api.openai.comdata: {"type":"response.output_text.delta","delta":"Hi ⟦PERS"}data: {"type":"response.output_text.delta","delta":"ON:7F31:0001⟧, your card ⟦CARD:7F"}data: {"type":"response.output_text.delta","delta":"31:0003⟧ is blocked."}

Held in the gateway⟦PERS⟦CARD:7Fnothing pending

To your appdata: {"type":"response.output_text.delta","delta":"Hi "}data: {"type":"response.output_text.delta","delta":"Sarah Collins, your card "}data: {"type":"response.output_text.delta","delta":"4111 1111 1111 1111 is blocked."}

Reference

Drop-in endpoints.

Path	Provider API	Notes
POST /v1/responses	OpenAI Responses	Streaming, tool calls, stored conversations
POST /v1/chat/completions	OpenAI Chat Completions	Streaming, tool calls
POST /v1/messages	Anthropic Messages	Streaming, tool use
Authorization / X-Api-Key	Gateway key	pg_live_… virtual key per app
X-Privacy-Conversation-Id	Optional header	Strict isolation between conversations

Operations

Logs without content. Config you already know.

One audit line per request

{"ts":"2026-10-23T09:14:02Z","app":"complaints-bot",
 "surface":"api","provider":"openai","model":"gpt-5",
 "entities":{"PERSON":1,"EMAIL":1,"CARD":1},
 "detector":"2026.10.1","policy":"a91f3c",
 "latency_ms":118,"result":"transformed"}

Configured from environment and Secrets

PG_TENANT=acme-bank
PG_REDIS_ADDR=redis.nymgate.svc:6379
PG_MASTER_KEY=<from Secret>
PG_OPENAI_API_KEY=<from Secret>
PG_ANTHROPIC_API_KEY=<from Secret>
PG_CA_BUNDLE=/etc/ssl/corp-ca.pem
PG_MAX_MESSAGE_CHARS=32000

What it covers today

Supported

OpenAI Responses and Chat Completions
Anthropic Messages
Streaming and tool calls
Text and structured content

Not yet

Embeddings (rejected, never sent raw)
Audio and realtime
Image generation and file APIs
Batch and provider-hosted tools

Give your teams AI your security team can sign off.

Book a pilot call Read the security model