Skip to content

docs(aigw): Prisma AIRS AI Gateway — phase 6, navigation restructure - #1080

Merged
vrv-panw merged 32 commits into
mainfrom
docs/prisma-airs-phase-6
Sep 15, 2026
Merged

vrv-panw merged 32 commits into
mainfrom
docs/prisma-airs-phase-6

Conversation

@vrv-panw

Copy link
Copy Markdown
Contributor

Reorganises the Prisma AIRS Product navigation and merges the pages that were duplicated across it. No page is dropped.

This PR targets main directly and therefore carries phases 3–5 as well — the same work as #1079, which it supersedes. 41 commits; the last seven are phase 6. Review #1079 first if it is easier, or close it and review this one whole.

Why

Enterprise Offering was a top-level grouping. Prisma AIRS has no plan tiers, so it described a distinction that does not exist, and it was holding org management, SSO, SCIM, KMS, audit logs and secret references — all of which are administration.

What changed

The three gateways keep their own top-level space and every page they had. AI Gateway, MCP Gateway and Agent Gateway are untouched, including Virtual Keys, Universal API, Multimodal Capabilities, MCP Registry, Authentication and Reliability. Coding Agents joins them as a single page.

Everything else follows the Strata Cloud Manager left nav:

Group Holds
Observability the existing set, plus the three OTel Export pages and request logging
Catalogs LLMs, MCPs, Agents — three new overview pages, with the Model Catalog set under LLMs
Security Keys API keys, key rotation, JWT
Policies & Profiles Budget & Rate Limits, Routing Configs, Guardrails, request metadata
Administration Integrations, Workspace Control, Admin Settings, audit logs

Duplicates merged. model-catalog/integrations.mdx was doing the work of four pages — ten alias stubs across four folders pointed at three anchors inside it, so readers landing on any of them got the whole 308-line page and a jump link. Those anchors are now real pages: Workspace Provisioning and Model Provisioning (which were themselves stubs), and Budget Limits and Rate Limits under a new product/policies/.

Tier language removed rather than repointed. Eleven "This is an Enterprise plan feature" callouts, three retention tier tables pricing Developer and Production plans, and five Integrations CTAs. The Enterprise Offering page's feature cards become a Governance & Administration section on the Features page, each now linking to the page that documents it — the original cards linked nowhere.

Two things worth your eye

  • Five cards did not survive the merge. The SOC 2 / GDPR / ISO27001 / HIPAA compliance card (phase 3 removed this claim everywhere else and missed this page), Arize's "99.9% uptime SLA" card, and "Unlimited Prompts" / "Unlimited Cache TTL" / duplicate feature cards. The first two are claims rather than features. Any of them come back on request.
  • budget-policies.mdx was not split, against the plan. It documents the Admin API for workspace-level policies on self-hosted deployments; the new Policies pages document Integration-level limits in the dashboard. Different mechanisms, so splitting one into the other would have degraded both. All three now say which they are and link to the others.

How it is verified

aigw/scripts/check_nav_page_parity.py runs on every commit and asserts that every nav entry resolves to a file, every .mdx under aigw/ is reachable from the tree, and the page set matches a recorded baseline except for entries in a retirement ledger with a stated reason. It was proved by deleting a page and confirming it fails.

427 nav entries against a 431 baseline: ten in the ledger, three new Catalogs pages, one deliberate duplicate (gateway-registration, listed in both Self-Hosting and Admin Settings — Mintlify renders one URL either way).

mint validate passes. mint broken-links is clean for aigw/ apart from the api-reference links that were already blocked before this branch.

Not done, on purpose

Path alignment and Q14 are bundled for launch, not for this PR. Q14 — whether Prisma AIRS is a navigation.versions[] entry or a products/tabs one — rewrites every route, and the ~62 title/filename drifts are cheapest to fix in the same pass. Doing either alone means paying for redirects twice.

🤖 Generated with Claude Code

vrv-panw and others added 30 commits September 15, 2026 12:32
Phase 3, first slice. Everything here is content that belonged to Portkey
the company rather than to the gateway product.

Welcome page rewritten: the YouTube embed, the star callout, the edge-worker
locations, the ISO/SOC2 line, the managed-hosting paragraph, the 25M-requests
and Status Page block, the pricing accordion and "where can I reach you" are
all gone. The OpenAI examples no longer route through the Portkey SDK.

Open-source repo marketing removed — the `## Open Source` section, the
"give us a star" callouts, the GitHub contribute cards and the PR links.
Operational references stay: the Helm chart name `portkey-ai/gateway` and
the self-hosting deployment instructions are things a reader actually needs.

Model counts normalised to 3,000+ across 55 files; the 250+/200+/1600+
variants disagreed with each other. Bare provider counts (50+, 200+) are
left alone — they are a different number and I do not have the real one.

Integrations: the Ecosystem group is gone, `ecosystem.mdx` becomes
`overview.mdx` titled Overview under an Integrations group, "Preferred
Partners" becomes "Integrations", and the become-a-partner scheduling
iframe and the `partner.mdx` contributing-guide redirect are removed.

Marketing links swept: 13 `portkey.ai/pricing` plan links unwrapped, 13
`portkey.ai/docs` links repointed at their `/aigw/` equivalents, 10 that
had no equivalent unwrapped, plus the blog, status and trust portal links.
`security-portkey.mdx` keeps its structure but no longer asserts Portkey's
compliance posture or links Portkey's legal pages — those need Palo Alto's.

Also fixed: 29 "the AI Gateway's gateway" stutters left by the Phase 2
rename, the orphaned Prompt Library section on the features page, and the
3 navigation group icons.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 3, item 16. The two pages described the same system from different
angles: `architecture.mdx` had the infrastructure detail (Helm, storage
backends, auth methods, resource requirements, encryption, rationale) but
described a generic hybrid deployment; `scm-architecture.mdx` had the
accurate two-plane model, component roles, identity flow, request lifecycle
and storage ownership but no deployment detail.

One page now, titled Architecture, built on the SCM two-plane model as the
spine with the infrastructure and security sections folded in. The mermaid
diagram is redrawn to show both planes and the SCM API Gateway boundary
rather than a generic "Control Plane" box.

Dropped along the way: the two portkey.wiki demo-booking CTAs, the sample
log/metric file cards pointing into this repo's stripped image tree, and
two deployment-guide cards whose routes no longer exist. The Next Steps
cards now point at the deployment guides that do.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 3, item 4. Where a request already carries an integration slug,
`x-portkey-provider: @openai-prod` plus `"model": "gpt-4o"` becomes
`"model": "@openai-prod/gpt-4o"` and the header goes away. 60 code blocks
converted across 34 files, in cURL, the OpenAI SDKs and LangChain — the
`default_headers` / `defaultHeaders` argument is dropped entirely where the
provider header was its only entry.

Three cases keep the header, deliberately:

- **Bare provider names** (83 blocks). `x-portkey-provider: openai` is the
  direct-auth path where `Authorization` carries the provider's own key.
  There is no slug to fold into the model name.
- **Endpoints with no model parameter** (106 blocks). Files, Batches and
  fine-tuning select the provider by header because the request body has
  nowhere else to put it. The two batch blocks the first pass converted are
  restored — the model there sits inside `requests[].params`, which is a
  provider-native body, not the gateway's.
- **`headers.mdx`**, which documents the header itself. It now carries a
  note saying the model-prefix form is the one to reach for first, and when
  the header is still the answer.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 3, item 12. The old page was three cards and a video that pointed
readers at the Portkey SDK and an api-reference route that does not exist
in this version. It never actually set anything up.

The new page mirrors the SCM setup flow end to end, in Strata Cloud
Manager's own navigation vocabulary: Admin Settings → Plugins for the
Prisma AIRS key, Workspace Control, Integrations → Add LLM Integration,
Catalogs → Create Guardrail, Profiles & Policies → Config, Security Keys →
Create New, then Observability → Logs and AI Runtime → AI Sessions on the
Prisma AIRS side.

It uses OpenAI rather than Vertex AI, since the point is the shortest path
to a working request, and ends with a runnable call in cURL, OpenAI Python
and OpenAI Node — authenticating with `Authorization: Bearer`, selecting the
provider through `model: "@openai-prod/gpt-4o"`, and inheriting the
guardrail from the config attached to the API key.

Identifiers are placeholders (`pg-xxxxxx`, `pc-xxxxxx`). The setup guide's
real ones are internal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 433 blocks that imported createHeaders / PORTKEY_GATEWAY_URL from
portkey-ai now use the OpenAI SDK on its own: the gateway base URL is
inlined, the gateway key moves to api_key/apiKey, and residual headers
become a literal default_headers / defaultHeaders map. Where the provider
was an @slug and the block had a model to carry it, the slug folds into
the model parameter; otherwise it stays as x-portkey-provider.

Object-valued config and metadata headers are serialised with
json.dumps / JSON.stringify, which createHeaders used to do implicitly.

Verified with a per-language syntax check of every fenced block against
HEAD: no new Python or JavaScript parse failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Deletes the 867 fenced blocks that construct a Portkey SDK client and the
148 orphaned blocks that called methods on one, leaving REST, OpenAI
Python and OpenAI Node as the example set. Tab, Tabs and CodeGroup
wrappers left holding nothing are removed with their contents; no page is
left without a runnable example.

These examples come back in Phase 6.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Picks up the 89 blocks the first converter skipped — those with a comment
in front of a key, or an object-valued metadata / config header — plus the
last 21 helper references, handled individually: literal header maps for
the Bedrock Files, Strands, LangChain JS and Configs examples, the model
parameter for the Agent Builder provider-switching snippets, and reworded
prose where createHeaders was only mentioned.

No portkey-ai helper remains in the docs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The pages no longer construct a Portkey SDK client, so the dependency is
dead weight. Lines where portkey-ai was the only package now install the
OpenAI SDK instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Drop the 58 "SDK Reference" cards that pointed at the Portkey SDK docs
  (they were also broken links inside the aigw version).
- Rename the remaining "AI Gateway SDK" headings and prose to the OpenAI
  SDK / REST wording the examples now use.
- Delete the emptied Python/NodeJS tabs left behind by the SDK removal,
  plus the "Coming Soon!" placeholder tabs on aws-bedrock.
- Rewrite the tracing examples in traces.mdx to REST + OpenAI Python +
  OpenAI NodeJS, with the trace/span IDs sent as headers.
- Rebuild llama-agents.mdx: the examples had no gateway API key and still
  used the old config-with-api_key form.
- api-reference introduction now documents two integration paths instead
  of three.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Comments inside code fences now say "AI Gateway" / "Strata Cloud
Manager" instead of "Portkey" / "Portkey App" / "Portkey dashboard", and
sample variables named after the vendor (portkey, portkeyClient,
portkeyConfig, portkey_handler, the C# PortkeyAzureClient helpers) are
renamed to gateway-neutral names.

Functional identifiers are untouched: PORTKEY_API_KEY, x-portkey-*
headers, the aigw.portkey.ai host, package names, the promptfoo
portkeyConfig key, and everything under self-hosting/ and changelog/.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Rewrites prose references to the retired SDK surface (prompts
completions, rerank, feedback), repairs the garbled "Production-ready"
headings on four agent pages, retargets six anchors whose headings were
renamed earlier in Phase 3, and de-brands sample resource names in the
library and MCP-server setup steps. Fixes the $@YOUR_PROVIDER_SLUG typo
in the batches cURL example.

Functional identifiers (repo URLs, config keys, JWT claims, OTel
attributes, the @portkey-mcp prefix, portkey_options) are left as-is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reorders 115 CodeGroup and Tabs blocks across 82 integration pages so
the cURL/REST tab leads, with the OpenAI SDK examples following. Pure
reordering: the set of lines in every touched file is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Drops the x-portkey-provider header from 56 chat/embedding/image/audio
examples and moves the slug into the model value (model: "@openai/gpt-4o"),
so Authorization is the only header those requests need.

Left in place where the header is load-bearing: requests with no model
param (files, batches, fine-tuning), custom-host and ad-hoc provider
credential examples, the gateway-native "portkey" batching sentinel,
and blocks that set sibling x-portkey-provider-* headers.

Also corrects the @openai prefixes that would have landed on Bedrock
models in bedrock/embeddings.mdx, and a gpt-4bo typo in authentication.mdx.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
We cannot point docs.json at the Palo Alto Networks GitHub organisation, so
aigw/airs-openapi.yaml is a committed mirror of the spec repo's main rather
than a remote fetch. The mirror is flattened: overlays/docs-prose.yaml is
applied at sync time, so the docs build consumes one self-contained file while
structure and prose stay split upstream where that split earns its keep.

Mirrored from openapi@84b8bb9 -- 181 operations, 118 paths, 41 tags.

aigw/scripts/sync-openapi.sh is the only supported way to refresh it. It
refuses to run against a branch other than main or a dirty tree, so a mirror
is always reproducible from a named commit.

aigw/scripts/wire_openapi_nav.py generates the navigation from the spec repo's
docs-navigation.json. Inference's 17 tags go to the Gateway APIs tab; the 24
control-plane tags go to Admin APIs. It is idempotent -- it replaces the
generated groups rather than appending, keeping the hand-written API Reference
group first.

Prompt endpoints need no exclusion here: Prompts, Prompt Partials, Labels and
Collections are already in the spec repo's drops.yaml, and its build fails if
one reappears.

mint validate is green and resolves the local mirror.

Not verified locally, and worth knowing: group-level OpenAPI generation
produces no pages under mint dev 4.2.893 on Node v22.23.0. The preview logs a
recurring undici TypeError and renders only the 9 hand-written pages. This is
not a fault in this configuration -- the known-good remote spec generates
nothing through the same group-level shape either. Confirm on a Mintlify
preview deployment before trusting the generated URLs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Supersedes the mirror decision in dc0389d9. Every generated group now points at
raw.githubusercontent.com/PaloAltoNetworks/openapi on main, so there is no
committed copy to keep in sync and no sync script to remember to run.

Removes aigw/airs-openapi.yaml and aigw/scripts/sync-openapi.sh.

This costs nothing today. The public document is structure-only -- the spec repo
keeps reader-facing prose in overlays/docs-prose.yaml -- but that overlay's
actions currently only blank inherited prose rather than supply new prose. The
bare spec and a flattened one publish an identical 68 non-empty description and
summary strings, so nothing is lost by reading the bare one. When the overlay is
populated against the KB, the fix is for the spec repo to publish a resolved
document; docs should not go back to mirroring.

Adds aigw/scripts/check_nav_matches_remote.py for the coupling this introduces.
Navigation is generated from the spec repo's local docs-navigation.json while
Mintlify fetches from remote main, so a tag dropped upstream would leave an
empty group and a tag added upstream would go unrendered. The check fails on
either. Currently 40 tags, in sync.

Picks up two upstream changes in passing: a self-hosted second base URL
(84b8bb9) and the removal of Workspaces and SCIM workspace mappings (d155f8c),
which is why Admin APIs now carries 23 tags rather than 24.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(aigw): Phase 3 — de-Portkey the content surface
Links under aigw/ that pointed at /api-reference/... were resolving against
the Latest Portkey-branded version, so nothing flagged them as broken while a
Prisma AIRS reader silently left the Prisma AIRS docs.

Three classes, handled individually rather than by bulk prefix:

- Targets that exist under aigw/ -- repointed (inference-api/headers,
  inference-api/config-object, inference-api/open-api-specification,
  integrations/libraries/microsoft-semantic-kernel).
- Targets that will never exist -- /api-reference/sdk (no SDK reference is
  carried into aigw) and the Workspaces / Users / Log Exports Admin API groups
  (dropped from the spec). Cards removed, prose unlinked with the text kept.
- Targets never carried into aigw -- gateway-for-other-apis, anthropic-transform,
  a Messages API reference. Unlinked, text kept.

Also fixes open-api-specification.mdx, whose frontmatter still redirected to
https://github.com/Portkey-AI/openapi instead of the PaloAltoNetworks repo.

Roughly 90 links remain. Those all target generated operation pages and are
blocked on x-mint.href being set upstream in the spec.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, first item. Two classes of contact ask, both removed on your call:

Sales CTAs (13 files) — "Book a Demo" and "Schedule a Demo" cards, the
"Interested? Schedule a Call Below" iframe on enterprise-offering, the
"schedule a quick call"/"consultation" links on rate-limits, budget-limits
and enforce-budget-and-rate-limit, and two "Reach out to our team" blocks.

Support trailers (33 files) — the "If you face any issues with X, reach out
to support@portkey.ai" paragraph and its variants. Where the trailer was the
only content under a "## Get Support" or "## Support" heading, the now-empty
heading goes with it; 29 such headings were removed.

Consequence worth naming: those pages no longer state an escalation path.
support@portkey.ai survives elsewhere (it is its own RESIDUE item), but the
per-integration pointer is gone by design, not by oversight.

aigw/scripts/strip_ctas.py does the repeating shapes and reports anything it
does not recognise rather than guessing; the six it flagged were hand-edited.
It is line-based on purpose — an earlier whole-file blank-line collapse
reflowed 119 files that had no CTA in them at all.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, second item. 22 callouts across 21 files stating that a feature is
gated behind a commercial tier, usually paired with an ask to contact us.

Three distinctions drove what stayed:

Plan tier vs deployment shape. "Enterprise self-hosted plans only" is two
claims wearing one coat. The tier goes; "available on self-hosted deployments"
is a real constraint a reader needs and stays — budget-policies, metadata,
otel/complete-logs, mcp-gateway/advanced-configuration.

Plan tier vs version requirement. secret-references and budget-policies gated
on a tier *and* a minimum gateway version. Only the tier was removed.

Ours vs theirs. Cursor, Figma, Atlassian and Tavily document their own
vendors' plan tiers. Those are facts about a third party, not our pricing,
and are untouched.

Also removed the "Plan restriction" cause from the permissions troubleshooting
page: with tiers undocumented it is no longer a diagnosis a reader can act on.

Descriptive "Enterprise Features" headings and cards are not gating callouts
and were left alone.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, fourth item. The ticker was a single top-level "banner" key in
docs.json, not an aigw-scoped element, so there was no way to drop it from
Prisma AIRS alone.

Removed globally on your call. This is a deliberate exception to "nothing in
the Latest version is modified" — the banner is now gone from Latest and
Virtual Keys (Deprecated) as well, and both linked to portkey.sh campaign
URLs that outlive the webinar anyway.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 5, third item. 13 human-readable mentions across 10 files.

The item reads larger than it is. aigw carries 1,384 occurrences of some
"portkey api key" spelling, but 1,243 are the PORTKEY_API_KEY environment
variable, 79 the x-portkey-api-key header and 62 the portkey_api_key config
key — all functional identifiers on the never-rename list. Only 13 were prose
a reader merely reads.

Renamed: Helm values comments, three MCP auth diagrams, the OpenWebUI valve
description string and shared-key label, the OpenAI-compatible setup step, and
the LiveKit placeholder. Where a line held both, the identifier was left and
only the sentence around it changed — "PORTKEY_API_KEY=<PORTKEY_API_KEY>
# Replace <PORTKEY_API_KEY> with Gateway API Key".

Guarded by a before/after count over six identifier patterns; all six are
unchanged.

Also caught in passing: those same Helm comments said the key comes "from
Portkey website" while already pointing at the Strata Cloud Manager URL. Now
they say Strata Cloud Manager.

mint validate green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ames

Phase 5 items 5 and 6.

The Setup Guide's scope had crept into plugin enablement, guardrail
creation and config creation, none of which belong in a first-request
walkthrough and all of which were wrong in the details. Cut those three
steps, renumber the rest, and point at the pages that own that content.

Rename eight pages whose filenames had drifted from their titles or
carried typos, including the requested simple-setup.mdx. Navigation and
inbound links repointed. No redirects: these are new URLs with no
inbound traffic (PLAN assumption 9).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Six headings had a full sentence glued onto the title, so the sentence
appeared in the sidebar and the anchor link. Split each into a heading
plus the paragraph it was swallowing. No wording changed.

Long headings that are genuinely one title — "Example: ...",
"MCP Gateway: ...", linked headings — were left alone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Phase 6 rewrites 146 navigation entries by hand, and two failures are silent
under `mint validate`: a page drops out of the tree and becomes an orphan file,
or an entry survives with no file behind it.

The guard asserts every entry resolves to a file, every .mdx under aigw/ is
reachable from the tree, and the page set matches a recorded baseline except
for entries carrying a reason in the retirement ledger. Verified by feeding it
a deliberately dropped page first — "no error" is a weak signal unless the tool
would have errored.

Duplicate entries report rather than fail: Mintlify renders one URL either way,
and the restructure lists gateway-registration in two places on purpose. Four
such duplicates already exist from the Phase 1 carry-over.

Also unlinks the dead /aigw/support/contact-us reference in nitro-mode, keeping
its text. That page was never carried over and is not going to be.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Twenty pages are alias stubs — their whole content is a frontmatter `url:`
pointer. Eighteen pointed at bare /product/, /integrations/ and /api-reference/
paths, which resolve to the Latest, Portkey-branded docs. Clicking "Budget
Limits" in the Prisma AIRS sidebar left the Prisma AIRS docs entirely.

Phase 1 rewrote 1,807 body links to /aigw/ and never touched frontmatter, so
this class was missed wholesale. Seventeen now resolve inside the version.

Two are legitimately external and untouched: the PANW openapi repo and
langroid's own site. One cannot be fixed — microsoft-semantic-kernel points at
the C# SDK page, and the SDK group was removed from aigw in Phase 1, so it
keeps pointing at Latest until that page has an aigw equivalent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`model-catalog/integrations.mdx` was doing the work of four pages: ten alias
stubs across four folders pointed at three anchors inside it. Readers landing
on any of them got the whole 308-line page and a jump link.

The three anchor sections are now real pages. Workspace Provisioning and Model
Provisioning were themselves alias stubs, so they become the pages they were
already named after. Budget Limits and Rate Limits move to a new
`product/policies/` folder, since they are policy concerns rather than catalog
ones and Phase 6 will group them that way. Integrations keeps its intro, its
setup steps and its FAQs, and gains a card group pointing at the four.

Eight stubs retire. A word-multiset diff over the before and after set shows
14 words lost, all of them from the two "(see the section below)" phrases that
correctly became cross-links.

Also fixes the parity guard: it walked into groups bound to an OpenAPI spec
and treated their generated operation entries ("POST /chat/completions") as
page paths. Those groups are now skipped, and --docs lets the baseline be
recorded from a pre-restructure docs.json. Verified by deleting a page from
the tree and confirming the guard fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Each of the 42 groups scoped itself with a "tag" key. That key is not in
Mintlify's navigation schema, so it was ignored, and a group carrying
openapi.source with nothing narrowing it autogenerates the whole document:
every group rendered all 187 operations, nested under whichever one the
reader opened.

Each group now names its operations as "METHOD /path" strings, taken from
docs-navigation.json in the spec repo. openapi.source and directory are
unchanged. Two tags arrive with this: Deployments and Org Guardrails, both
under Administration, where the spec repo places them.

sync_api_nav.py replaces wire_openapi_nav.py, which generated the "tag"
keys, and check_nav_matches_remote.py, which compared the two sides after
the fact. A drift detector cannot police a fact one side generates, which
is how a key that did nothing survived seven months. The spec repo owns
which tag is in which group and which operations are in it; we own where
those groups hang in the tabs. Bare, the script compares and exits
non-zero; --apply writes. It fails loudly on a fragment group with no home
here, a spec-backed group the fragment has dropped, and a returning "tag"
key -- all three negative-tested.

The workflow runs the check on every pull request and opens a pull request
from --apply on a schedule or on a dispatch from the spec repo, so a spec
change lands as a reviewable diff. Making the check required is a repository
setting, and the dispatch needs wiring on their side; both are in TODO.md.

This does not close the rendering gap. The "tag" key was valid JSON
describing an untouched spec, and every check on both sides passed while
the site was broken.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Prisma AIRS has no plan tiers. Every feature is in the product, so a page that
lists what you get if you upgrade describes something that does not exist, and
the fourteen callouts pointing at it gate features that are not gated.

`product/enterprise-offering.mdx` was nineteen cards and no prose. The nine
that named a capability with no home elsewhere on the Features page — org
management, SSO, access rules, audit logs, KMS, data isolation, retention,
data lake export, executive reporting — become a Governance & Administration
section there, each now linking to the page that documents it, which the
original cards did not do. Budget Limits and Custom Rate Limits join the AI
Gateway group; Central Guardrails joins Guardrails.

Deliberately not carried over:

- The Compliances & Certificates card (SOC 2, GDPR, ISO27001, HIPAA). Phase 3
  removed this claim everywhere else and missed this page.
- Arize's "99.9% uptime SLA" card, same reason — a commercial commitment the
  docs should not make. It becomes an Access Control card.
- "Unlimited Prompts", "Unlimited Cache TTL", "Advanced Routing", "Universal
  API", "AI-Native Observability". The first two are tier framing; the rest
  already have cards on the Features page.

The eleven "This is an Enterprise plan feature" <Check> blocks are gone rather
than repointed, as are the three retention tier tables in logs, traces and
analytics, which priced Developer and Production plans against Strata Cloud
Manager. Five Integrations CTAs now point at the Governance section.

Two more entries in the retirement ledger: the page itself, and the
`enterprise-offering/logs-export` alias, whose target was already in the tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Deviation from the plan, flagged rather than made silently. Slice 6.5 was to
fold `enterprise-offering/budget-policies.mdx` — 873 lines, "Usage & Rate Limit
Policies" — into the two new Policies pages. Reading it, that would have been
the wrong merge.

The two describe different mechanisms. Budget Limits and Rate Limits are set
on an Integration in the dashboard and cascade to the providers created from
it. `budget-policies.mdx` documents the Admin API for workspace-level policies
on self-hosted deployments 1.17.0 and up: condition keys, group-by dimensions,
targets, validation rules, twenty worked examples, and an API reference. It
shares a spine across both policy types — conditions, authentication, base URL
— that would have to be duplicated to split it, and its twenty use cases
interleave usage and rate limits by design.

So it stays one page and keeps every line. The Phase 6 tree already lists it
as its own entry under Policies & Profiles, which is where 6.6 will put it.
All three pages now say which mechanism they are and link to the other.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
vrv-panw and others added 2 commits September 15, 2026 18:34
Enterprise Offering is gone as a grouping. It held org management, SSO, SCIM,
KMS, audit logs, security, components and secret references — none of which is
a tier, all of which are administration. The whole product is enterprise, so
the grouping was describing a distinction that does not exist.

The three gateways keep their own top-level space and every page they had. AI
Gateway, MCP Gateway and Agent Gateway are unchanged, including Virtual Keys,
Universal API, Multimodal Capabilities, MCP Registry, Authentication and
Reliability. Coding Agents joins them as a single page.

Everything else follows the Strata Cloud Manager left nav:

  Observability      absorbs the three OTel Export pages and request logging
  Catalogs           LLMs, MCPs, Agents — three new overview pages, with the
                     Model Catalog set under LLMs
  Security Keys      API keys, key rotation, JWT
  Policies & Profiles  Budget & Rate Limits, Routing Configs, Guardrails,
                     request metadata
  Administration     Integrations, Workspace Control, Admin Settings, audit logs

Gateway Registration now appears under Admin Settings as well as in the
Self-Hosting tab. Mintlify renders one URL either way; it belongs in both
places because you reach it from both.

No page left the tree: 427 entries against a 431 baseline, minus ten in the
retirement ledger, plus the three new Catalogs pages and the one deliberate
duplicate. The parity guard checks this rather than trusting the arithmetic.

Also repoints twenty links that still pointed at the alias paths retired in
6.3 — `model-catalog/budget-limits` and `model-catalog/rate-limits` — which
broke when those stubs were deleted. `mint broken-links` is now clean for
aigw/ apart from the api-reference links that were already blocked.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Part of the 6.3 alias retirement, missed because the sweep commit staged only
aigw/ and docs.json. The snippet is included by several Integrations pages, so
the dead path reached further than its one file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@mintlify

mintlify Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated
portkey-docs 🟢 Ready View Preview Sep 15, 2026, 1:09 PM

@vrv-panw
vrv-panw merged commit 34c4bae into main Sep 15, 2026
3 checks passed
@vrv-panw
vrv-panw deleted the docs/prisma-airs-phase-6 branch September 18, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants