Skip to content

docs(aigw): Prisma AIRS AI Gateway — phases 3, 4 and 5 - #1079

Closed
vrv-panw wants to merge 24 commits into
mainfrom
docs/prisma-airs-phases-3-5
Closed

vrv-panw wants to merge 24 commits into
mainfrom
docs/prisma-airs-phases-3-5

Conversation

@vrv-panw

Copy link
Copy Markdown
Contributor

One PR, replacing the stack. Supersedes #1077 and #1078, both now closed.

Why this contains three phases and not one. #1075 merged to main at 06:00 with phases 1 and 2. Phase 3 (#1076) then merged into the umbrella branch at 11:03 — after the umbrella had already landed. So phases 3, 4 and 5 never reached main. This branch is the phase-5 tip merged with current main, carrying all three.

323 files, +5,384 / −27,806. mint validate green.

Phase 3 — branded content, SDK removal, REST-first

Portkey SDK examples are gone everywhere. Every page offers REST, OpenAI Python and OpenAI Node, with REST leading in all 115 CodeGroup/Tabs blocks. Code comments and sample identifiers de-branded inside fences; functional identifiers untouched.

Chat, embedding, image and audio examples no longer send x-portkey-provider — the provider slug rides in model as @openai/gpt-4o. The header stays where it is load-bearing: no-model endpoints (files, batches, fine-tuning), custom-host and ad-hoc credential examples, the gateway-native portkey batching sentinel, and blocks with sibling x-portkey-provider-* headers.

Removed: page icons, the welcome-page YouTube link, the GitHub star ask, edge worker locations, the ISO/SOC/GDPR/HIPAA compliance line, the no-storage and managed-hosting paragraph, the 25M-requests claim, pricing questions.

Phase 4 — API reference generation

Every aigw navigation group reads the spec straight from the PaloAltoNetworks/openapi raw URL. No mirror, no sync script. 40 tags across six generated groups; aigw/scripts/wire_openapi_nav.py rebuilds navigation idempotently, and check_nav_matches_remote.py fails on spec/nav drift.

api-reference links that resolved to the Latest version are repointed where a target exists, and unlinked with their text kept where one never will.

Phase 5 — callouts, naming, page hygiene

Commit Scope
cc27c7c2 Sales CTAs and support "reach out" trailers — 53 files
f808ad61 Pro/Enterprise plan-gating callouts — 24 files
5090818f Agent Gateway webinar banner — docs.json
0b5b2b58 API key renamed to Gateway API Key in prose — 13 edits, 10 files
cd88027d Setup Guide cut to its core steps, 8 filename normalisations
c153a29a 6 composite headings split into heading + prose

What Phase 5 deliberately kept

  • Deployment-shape constraints (self-hosted, hybrid, air-gapped) are real requirements, not plan gates.
  • Third-party vendors' own pricing tiers — Cursor, Figma, Atlassian, Tavily, Anthropic. Not ours to rewrite.
  • Every functional identifier. The API-key rename touched prose only: of 1,384 "portkey api key" spellings under aigw/, 1,371 are the env var, the HTTP header or the config key. A before/after count over six identifier patterns proves none moved.
  • Long headings that are genuinely one titleExample: …, MCP Gateway: …, linked headings.

Three things to confirm

  1. The Setup Guide points somewhere other than what was picked. The chosen target was the Latest-version /introduction/make-your-first-request, but that page has exactly three headings — Get your Portkey API Key, Integrate Portkey, Next Steps — and covers none of the three cut steps. Pointing at it would have been a dead end, so the page points at /aigw/integrations/guardrails/palo-alto-panw-prisma and /aigw/product/ai-gateway/configs instead.
  2. The page title is now "Simple Setup", not "Setup Guide", to match the requested filename. One-line revert if the filename was meant to change but the title kept.
  3. ~30 pages now have no support escalation path. Direct consequence of taking both the sales CTAs and the support trailers.

Blast radius outside aigw/

The webinar banner was the global banner key in docs.json, not an .mdx — removing it also takes it off Latest and Virtual Keys. Agreed in advance as an explicit exception to the no-Latest-edits rule.

No redirects were added for the eight Phase 5 renames, per PLAN assumption 9: these are new URLs with no inbound links.

🤖 Generated with Claude Code

vrv-panw and others added 24 commits September 15, 2026 12:32
Phase 3, first slice. Everything here is content that belonged to Portkey
the company rather than to the gateway product.

Welcome page rewritten: the YouTube embed, the star callout, the edge-worker
locations, the ISO/SOC2 line, the managed-hosting paragraph, the 25M-requests
and Status Page block, the pricing accordion and "where can I reach you" are
all gone. The OpenAI examples no longer route through the Portkey SDK.

Open-source repo marketing removed — the `## Open Source` section, the
"give us a star" callouts, the GitHub contribute cards and the PR links.
Operational references stay: the Helm chart name `portkey-ai/gateway` and
the self-hosting deployment instructions are things a reader actually needs.

Model counts normalised to 3,000+ across 55 files; the 250+/200+/1600+
variants disagreed with each other. Bare provider counts (50+, 200+) are
left alone — they are a different number and I do not have the real one.

Integrations: the Ecosystem group is gone, `ecosystem.mdx` becomes
`overview.mdx` titled Overview under an Integrations group, "Preferred
Partners" becomes "Integrations", and the become-a-partner scheduling
iframe and the `partner.mdx` contributing-guide redirect are removed.

Marketing links swept: 13 `portkey.ai/pricing` plan links unwrapped, 13
`portkey.ai/docs` links repointed at their `/aigw/` equivalents, 10 that
had no equivalent unwrapped, plus the blog, status and trust portal links.
`security-portkey.mdx` keeps its structure but no longer asserts Portkey's
compliance posture or links Portkey's legal pages — those need Palo Alto's.

Also fixed: 29 "the AI Gateway's gateway" stutters left by the Phase 2
rename, the orphaned Prompt Library section on the features page, and the
3 navigation group icons.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 3, item 16. The two pages described the same system from different
angles: `architecture.mdx` had the infrastructure detail (Helm, storage
backends, auth methods, resource requirements, encryption, rationale) but
described a generic hybrid deployment; `scm-architecture.mdx` had the
accurate two-plane model, component roles, identity flow, request lifecycle
and storage ownership but no deployment detail.

One page now, titled Architecture, built on the SCM two-plane model as the
spine with the infrastructure and security sections folded in. The mermaid
diagram is redrawn to show both planes and the SCM API Gateway boundary
rather than a generic "Control Plane" box.

Dropped along the way: the two portkey.wiki demo-booking CTAs, the sample
log/metric file cards pointing into this repo's stripped image tree, and
two deployment-guide cards whose routes no longer exist. The Next Steps
cards now point at the deployment guides that do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 3, item 4. Where a request already carries an integration slug,
`x-portkey-provider: @openai-prod` plus `"model": "gpt-4o"` becomes
`"model": "@openai-prod/gpt-4o"` and the header goes away. 60 code blocks
converted across 34 files, in cURL, the OpenAI SDKs and LangChain — the
`default_headers` / `defaultHeaders` argument is dropped entirely where the
provider header was its only entry.

Three cases keep the header, deliberately:

- **Bare provider names** (83 blocks). `x-portkey-provider: openai` is the
  direct-auth path where `Authorization` carries the provider's own key.
  There is no slug to fold into the model name.
- **Endpoints with no model parameter** (106 blocks). Files, Batches and
  fine-tuning select the provider by header because the request body has
  nowhere else to put it. The two batch blocks the first pass converted are
  restored — the model there sits inside `requests[].params`, which is a
  provider-native body, not the gateway's.
- **`headers.mdx`**, which documents the header itself. It now carries a
  note saying the model-prefix form is the one to reach for first, and when
  the header is still the answer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 3, item 12. The old page was three cards and a video that pointed
readers at the Portkey SDK and an api-reference route that does not exist
in this version. It never actually set anything up.

The new page mirrors the SCM setup flow end to end, in Strata Cloud
Manager's own navigation vocabulary: Admin Settings → Plugins for the
Prisma AIRS key, Workspace Control, Integrations → Add LLM Integration,
Catalogs → Create Guardrail, Profiles & Policies → Config, Security Keys →
Create New, then Observability → Logs and AI Runtime → AI Sessions on the
Prisma AIRS side.

It uses OpenAI rather than Vertex AI, since the point is the shortest path
to a working request, and ends with a runnable call in cURL, OpenAI Python
and OpenAI Node — authenticating with `Authorization: Bearer`, selecting the
provider through `model: "@openai-prod/gpt-4o"`, and inheriting the
guardrail from the config attached to the API key.

Identifiers are placeholders (`pg-xxxxxx`, `pc-xxxxxx`). The setup guide's
real ones are internal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 433 blocks that imported createHeaders / PORTKEY_GATEWAY_URL from
portkey-ai now use the OpenAI SDK on its own: the gateway base URL is
inlined, the gateway key moves to api_key/apiKey, and residual headers
become a literal default_headers / defaultHeaders map. Where the provider
was an @slug and the block had a model to carry it, the slug folds into
the model parameter; otherwise it stays as x-portkey-provider.

Object-valued config and metadata headers are serialised with
json.dumps / JSON.stringify, which createHeaders used to do implicitly.

Verified with a per-language syntax check of every fenced block against
HEAD: no new Python or JavaScript parse failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Deletes the 867 fenced blocks that construct a Portkey SDK client and the
148 orphaned blocks that called methods on one, leaving REST, OpenAI
Python and OpenAI Node as the example set. Tab, Tabs and CodeGroup
wrappers left holding nothing are removed with their contents; no page is
left without a runnable example.

These examples come back in Phase 6.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Picks up the 89 blocks the first converter skipped — those with a comment
in front of a key, or an object-valued metadata / config header — plus the
last 21 helper references, handled individually: literal header maps for
the Bedrock Files, Strands, LangChain JS and Configs examples, the model
parameter for the Agent Builder provider-switching snippets, and reworded
prose where createHeaders was only mentioned.

No portkey-ai helper remains in the docs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The pages no longer construct a Portkey SDK client, so the dependency is
dead weight. Lines where portkey-ai was the only package now install the
OpenAI SDK instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Drop the 58 "SDK Reference" cards that pointed at the Portkey SDK docs
  (they were also broken links inside the aigw version).
- Rename the remaining "AI Gateway SDK" headings and prose to the OpenAI
  SDK / REST wording the examples now use.
- Delete the emptied Python/NodeJS tabs left behind by the SDK removal,
  plus the "Coming Soon!" placeholder tabs on aws-bedrock.
- Rewrite the tracing examples in traces.mdx to REST + OpenAI Python +
  OpenAI NodeJS, with the trace/span IDs sent as headers.
- Rebuild llama-agents.mdx: the examples had no gateway API key and still
  used the old config-with-api_key form.
- api-reference introduction now documents two integration paths instead
  of three.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Comments inside code fences now say "AI Gateway" / "Strata Cloud
Manager" instead of "Portkey" / "Portkey App" / "Portkey dashboard", and
sample variables named after the vendor (portkey, portkeyClient,
portkeyConfig, portkey_handler, the C# PortkeyAzureClient helpers) are
renamed to gateway-neutral names.

Functional identifiers are untouched: PORTKEY_API_KEY, x-portkey-*
headers, the aigw.portkey.ai host, package names, the promptfoo
portkeyConfig key, and everything under self-hosting/ and changelog/.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rewrites prose references to the retired SDK surface (prompts
completions, rerank, feedback), repairs the garbled "Production-ready"
headings on four agent pages, retargets six anchors whose headings were
renamed earlier in Phase 3, and de-brands sample resource names in the
library and MCP-server setup steps. Fixes the $@YOUR_PROVIDER_SLUG typo
in the batches cURL example.

Functional identifiers (repo URLs, config keys, JWT claims, OTel
attributes, the @portkey-mcp prefix, portkey_options) are left as-is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reorders 115 CodeGroup and Tabs blocks across 82 integration pages so
the cURL/REST tab leads, with the OpenAI SDK examples following. Pure
reordering: the set of lines in every touched file is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Drops the x-portkey-provider header from 56 chat/embedding/image/audio
examples and moves the slug into the model value (model: "@openai/gpt-4o"),
so Authorization is the only header those requests need.

Left in place where the header is load-bearing: requests with no model
param (files, batches, fine-tuning), custom-host and ad-hoc provider
credential examples, the gateway-native "portkey" batching sentinel,
and blocks that set sibling x-portkey-provider-* headers.

Also corrects the @openai prefixes that would have landed on Bedrock
models in bedrock/embeddings.mdx, and a gpt-4bo typo in authentication.mdx.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
We cannot point docs.json at the Palo Alto Networks GitHub organisation, so
aigw/airs-openapi.yaml is a committed mirror of the spec repo's main rather
than a remote fetch. The mirror is flattened: overlays/docs-prose.yaml is
applied at sync time, so the docs build consumes one self-contained file while
structure and prose stay split upstream where that split earns its keep.

Mirrored from openapi@84b8bb9 -- 181 operations, 118 paths, 41 tags.

aigw/scripts/sync-openapi.sh is the only supported way to refresh it. It
refuses to run against a branch other than main or a dirty tree, so a mirror
is always reproducible from a named commit.

aigw/scripts/wire_openapi_nav.py generates the navigation from the spec repo's
docs-navigation.json. Inference's 17 tags go to the Gateway APIs tab; the 24
control-plane tags go to Admin APIs. It is idempotent -- it replaces the
generated groups rather than appending, keeping the hand-written API Reference
group first.

Prompt endpoints need no exclusion here: Prompts, Prompt Partials, Labels and
Collections are already in the spec repo's drops.yaml, and its build fails if
one reappears.

mint validate is green and resolves the local mirror.

Not verified locally, and worth knowing: group-level OpenAPI generation
produces no pages under mint dev 4.2.893 on Node v22.23.0. The preview logs a
recurring undici TypeError and renders only the 9 hand-written pages. This is
not a fault in this configuration -- the known-good remote spec generates
nothing through the same group-level shape either. Confirm on a Mintlify
preview deployment before trusting the generated URLs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Supersedes the mirror decision in dc0389d9. Every generated group now points at
raw.githubusercontent.com/PaloAltoNetworks/openapi on main, so there is no
committed copy to keep in sync and no sync script to remember to run.

Removes aigw/airs-openapi.yaml and aigw/scripts/sync-openapi.sh.

This costs nothing today. The public document is structure-only -- the spec repo
keeps reader-facing prose in overlays/docs-prose.yaml -- but that overlay's
actions currently only blank inherited prose rather than supply new prose. The
bare spec and a flattened one publish an identical 68 non-empty description and
summary strings, so nothing is lost by reading the bare one. When the overlay is
populated against the KB, the fix is for the spec repo to publish a resolved
document; docs should not go back to mirroring.

Adds aigw/scripts/check_nav_matches_remote.py for the coupling this introduces.
Navigation is generated from the spec repo's local docs-navigation.json while
Mintlify fetches from remote main, so a tag dropped upstream would leave an
empty group and a tag added upstream would go unrendered. The check fails on
either. Currently 40 tags, in sync.

Picks up two upstream changes in passing: a self-hosted second base URL
(84b8bb9) and the removal of Workspaces and SCIM workspace mappings (d155f8c),
which is why Admin APIs now carries 23 tags rather than 24.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(aigw): Phase 3 — de-Portkey the content surface
Links under aigw/ that pointed at /api-reference/... were resolving against
the Latest Portkey-branded version, so nothing flagged them as broken while a
Prisma AIRS reader silently left the Prisma AIRS docs.

Three classes, handled individually rather than by bulk prefix:

- Targets that exist under aigw/ -- repointed (inference-api/headers,
  inference-api/config-object, inference-api/open-api-specification,
  integrations/libraries/microsoft-semantic-kernel).
- Targets that will never exist -- /api-reference/sdk (no SDK reference is
  carried into aigw) and the Workspaces / Users / Log Exports Admin API groups
  (dropped from the spec). Cards removed, prose unlinked with the text kept.
- Targets never carried into aigw -- gateway-for-other-apis, anthropic-transform,
  a Messages API reference. Unlinked, text kept.

Also fixes open-api-specification.mdx, whose frontmatter still redirected to
https://github.com/Portkey-AI/openapi instead of the PaloAltoNetworks repo.

Roughly 90 links remain. Those all target generated operation pages and are
blocked on x-mint.href being set upstream in the spec.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, first item. Two classes of contact ask, both removed on your call:

Sales CTAs (13 files) — "Book a Demo" and "Schedule a Demo" cards, the
"Interested? Schedule a Call Below" iframe on enterprise-offering, the
"schedule a quick call"/"consultation" links on rate-limits, budget-limits
and enforce-budget-and-rate-limit, and two "Reach out to our team" blocks.

Support trailers (33 files) — the "If you face any issues with X, reach out
to support@portkey.ai" paragraph and its variants. Where the trailer was the
only content under a "## Get Support" or "## Support" heading, the now-empty
heading goes with it; 29 such headings were removed.

Consequence worth naming: those pages no longer state an escalation path.
support@portkey.ai survives elsewhere (it is its own RESIDUE item), but the
per-integration pointer is gone by design, not by oversight.

aigw/scripts/strip_ctas.py does the repeating shapes and reports anything it
does not recognise rather than guessing; the six it flagged were hand-edited.
It is line-based on purpose — an earlier whole-file blank-line collapse
reflowed 119 files that had no CTA in them at all.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, second item. 22 callouts across 21 files stating that a feature is
gated behind a commercial tier, usually paired with an ask to contact us.

Three distinctions drove what stayed:

Plan tier vs deployment shape. "Enterprise self-hosted plans only" is two
claims wearing one coat. The tier goes; "available on self-hosted deployments"
is a real constraint a reader needs and stays — budget-policies, metadata,
otel/complete-logs, mcp-gateway/advanced-configuration.

Plan tier vs version requirement. secret-references and budget-policies gated
on a tier *and* a minimum gateway version. Only the tier was removed.

Ours vs theirs. Cursor, Figma, Atlassian and Tavily document their own
vendors' plan tiers. Those are facts about a third party, not our pricing,
and are untouched.

Also removed the "Plan restriction" cause from the permissions troubleshooting
page: with tiers undocumented it is no longer a diagnosis a reader can act on.

Descriptive "Enterprise Features" headings and cards are not gating callouts
and were left alone.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, fourth item. The ticker was a single top-level "banner" key in
docs.json, not an aigw-scoped element, so there was no way to drop it from
Prisma AIRS alone.

Removed globally on your call. This is a deliberate exception to "nothing in
the Latest version is modified" — the banner is now gone from Latest and
Virtual Keys (Deprecated) as well, and both linked to portkey.sh campaign
URLs that outlive the webinar anyway.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, third item. 13 human-readable mentions across 10 files.

The item reads larger than it is. aigw carries 1,384 occurrences of some
"portkey api key" spelling, but 1,243 are the PORTKEY_API_KEY environment
variable, 79 the x-portkey-api-key header and 62 the portkey_api_key config
key — all functional identifiers on the never-rename list. Only 13 were prose
a reader merely reads.

Renamed: Helm values comments, three MCP auth diagrams, the OpenWebUI valve
description string and shared-key label, the OpenAI-compatible setup step, and
the LiveKit placeholder. Where a line held both, the identifier was left and
only the sentence around it changed — "PORTKEY_API_KEY=<PORTKEY_API_KEY>
# Replace <PORTKEY_API_KEY> with Gateway API Key".

Guarded by a before/after count over six identifier patterns; all six are
unchanged.

Also caught in passing: those same Helm comments said the key comes "from
Portkey website" while already pointing at the Strata Cloud Manager URL. Now
they say Strata Cloud Manager.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ames

Phase 5 items 5 and 6.

The Setup Guide's scope had crept into plugin enablement, guardrail
creation and config creation, none of which belong in a first-request
walkthrough and all of which were wrong in the details. Cut those three
steps, renumber the rest, and point at the pages that own that content.

Rename eight pages whose filenames had drifted from their titles or
carried typos, including the requested simple-setup.mdx. Navigation and
inbound links repointed. No redirects: these are new URLs with no
inbound traffic (PLAN assumption 9).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Six headings had a full sentence glued onto the title, so the sentence
appeared in the sidebar and the anchor link. Split each into a heading
plus the paragraph it was swallowing. No wording changed.

Long headings that are genuinely one title — "Example: ...",
"MCP Gateway: ...", linked headings — were left alone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@mintlify

mintlify Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated
portkey-docs 🟢 Ready View Preview Sep 15, 2026, 12:12 PM

@vrv-panw

Copy link
Copy Markdown
Contributor Author

Superseded by #1080, which targets main directly and contains every commit on this branch plus eight more.

Closing rather than merging on purpose. This branch's docs.json still carries 40 "tag": keys, which are not in Mintlify's navigation schema and are therefore ignored — every one of those groups autogenerates all 187 API operations. #1080 replaces them with explicit per-group operation lists. Merging here would publish the bug that #1080 fixes.

Verified against both pushed heads: this branch has 40 tag keys and 0 operation entries; #1080 has 0 and 187, and is a strict superset of this branch's commits.

🤖 Generated with Claude Code

@vrv-panw vrv-panw closed this Sep 15, 2026
@vrv-panw
vrv-panw deleted the docs/prisma-airs-phases-3-5 branch September 18, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants