AI Proxy API

Base path /api/ai — JWT required. This is the server-side AI proxy (SEC-PROXY-1): the client never sees a provider API key. The server holds the Anthropic/OpenAI/Google keys in env vars and makes the call on the authenticated user's behalf, subject to a per-user/day budget.

POST /api/ai/call

Request body

{
  "system": "optional system prompt",
  "userMsg": "required — the user/user-turn message",
  "useSearch": false,
  "provider": "anthropic",
  "model": "optional — provider-specific model id",
  "maxTokens": 4000
}

Field	Required	Notes
userMsg	yes	Must be a non-empty string, else 400.
system	no	Defaults to ''.
useSearch	no	Defaults to false. Enables provider-side web search where supported.
provider	no	Defaults to 'anthropic'. Must be one of the server's configured PROVIDERS, else 400 Unknown provider '<x>'. Use one of: ….
model	no	Provider-specific model id; provider default is used if omitted.
maxTokens	no	Clamped to 1–16000; defaults to 4000 if not a finite number.

Response

• 200 → { "text": "…the model's response…" }
• 400 → bad body (missing userMsg, or an unknown provider)
• 429 → daily AI-spend budget exceeded — { "error": "…" }
• 502 → the upstream provider call failed — { "error": "…" }. Upstream auth/status details are not leaked to the client; any provider-side failure surfaces as a generic bad-gateway with a descriptive message.

If the client disconnects mid-request, the server aborts the in-flight upstream call rather than letting it run to completion unattended.

Why this exists

AI provider keys are never exposed to the browser — every AI call the frontend needs (research agent, deep analysis, gap analysis, etc.) is routed through this proxy rather than calling Anthropic/OpenAI/Google directly with a client-held key.

→ Related: Research · Intelligence