DevSecOps / ML engineer playbook

Note

On the RU paid gateway Spectorn works as an OpenAI-compatible gateway: the application points base_url at https://api.ru.spectorn.ai/v1, and Spectorn authenticates the tenant, scans the input, selects a provider, forwards the safe request and scans the response. On Global only protection is available — /v1/scan works, routed chat/completions is rejected server-side.

1. Minimal integration

Python

from openai import OpenAI
import os

client = OpenAI(
    base_url="https://api.ru.spectorn.ai/v1",
    api_key=os.environ["SPECTORN_API_KEY"],
)

response = client.chat.completions.create(
    model="openrouter/deepseek/deepseek-chat",
    messages=[{"role": "user", "content": "Say ok."}],
    max_tokens=64,
)

A real chat/completions call needs an upstream provider. You can:

store it in the dashboard on the Providers page;
add it through PUT /v1/providers;
pass it as BYOK via X-Provider-Key, if the route is configured for a default upstream.

/v1/scan is the fastest gateway smoke test: it only needs a Spectorn key and never calls an external model. It is also the only one of these paths available on Global.

2. Providers as code

Shell

curl -X PUT https://api.ru.spectorn.ai/v1/providers \
  -H "Authorization: Bearer $SPECTORN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "openrouter",
    "base_url": "https://openrouter.ai/api/v1",
    "api_key": "'$OPENROUTER_API_KEY'",
    "is_default": true
  }'

Keep provider settings as part of tenant bootstrap. Provider keys are encrypted on the gateway side and are never returned to the UI or API in cleartext.

3. CI/CD checks

Before releasing your application, run:

GET /v1/health — the gateway is alive and reports its build.
POST /v1/scan with a benign and a malicious payload — verifies the fail-closed path.
POST /v1/chat/completions against a short cheap model — verifies provider routing and the billing path (RU only).
A check that conversation memory uses /v1/memory/projects/{project_id}/chat/completions with a valid X-Spectorn-Session and a per-turn X-Spectorn-Turn-Id (reused only for a retry of that logical turn); the legacy /v1/chat/completions route must reject every request carrying that header with 409 memory_scope_required.

4. Observability

Watch more than latency:

the share of blocked and shadow verdicts;
provider route, model and fallback;
the errors no_provider, model_blocked, provider_unreachable;
usage and cached tokens for the economics;
the tenant scan-mode policy: enforce or shadow.

Latency is not a universal network promise: measure it for your own region, provider, model, prompt size and stream/non-stream mode.

5. What we do not claim

There is no requirement to point the application at a local sidecar port on the hosted path.
There is no blanket latency promise for a network API.
There is no "magic" protection without a provider or model: scan is available immediately, chat needs an upstream and is not part of Global Free.