Gateway reference
Sentinel's supported providers and routes, CLI commands, environment variables, and gateway states
The SUPERWISE® Sentinel gateway reference lists the model providers a gateway supports and the one route it intercepts for each, the Sentinel CLI commands, the gateway container's environment variables, and gateway states. A gateway intercepts OpenAI v1/chat/completions, Anthropic v1/messages, and Gemini generateContent; every other route passes through untouched.
Supported providers & intercepted routes
The gateway exposes each provider under its own path and intercepts only the text generation route below. All other routes for a provider pass through untouched.
| Provider | CLI name | Client base-URL variable | Gateway path | Intercepted route |
|---|---|---|---|---|
| OpenAI | openai | OPENAI_BASE_URL | /openai | v1/chat/completions |
| Anthropic | anthropic | ANTHROPIC_BASE_URL | /anthropic | v1/messages |
| Gemini | google | GOOGLE_GEMINI_BASE_URL | /gemini | *generateContent* |
| Custom | (as named) | OPENAI_BASE_URL | /{provider_name} | v1/chat/completions |
The gateway also exposes a diagnostic POST /test route. Send it a completion-style payload and it returns the same request after your guardrails run, with redactions applied, or a block reason if the request would be rejected, without forwarding it to the provider. Traffic on /test is never recorded in telemetry. The CLI wraps this route as sentinel test. For a quick check, a body of {"text": "..."} also works; see How do I confirm a guardrail fires? for an example and its response.
The gateway answers health checks on /healthz and returns 404 on /, so point load balancer and platform health checks at /healthz.
CLI commands
| Command | Description |
|---|---|
sentinel --version | Show the installed CLI version. |
sentinel quickstart | Guided setup: create or connect a gateway, choose providers, and enable the proxy. |
sentinel auth | Log in to SUPERWISE through your browser. Add --client-credentials to authenticate with a Client ID and Secret instead (generate tokens). |
sentinel gateway start | Bootstrap and run a local gateway container. --sentinel-id targets an existing Sentinel; --custom-providers '<json>' registers OpenAI-compatible backends (see Custom providers); --timeout <seconds> sets the gateway's upstream request timeout (default 1800). Prints a link to the Sentinel in the SUPERWISE app when it creates a new one. Creating or connecting a gateway needs an Admin role; a --sentinel-id that doesn't exist is reported before the container starts. |
sentinel gateway stop | Stop and remove the local gateway container. The Sentinel's configuration stays in the SUPERWISE Agentic Management Platform (AMP). |
sentinel gateway update | Update the local gateway container in place — for example, to pull and run a newer image. |
sentinel gateway status | Show the local gateway's status: whether Docker and the container are running, the gateway URL and its health, the running version (and whether an update is available), the Sentinel ID, and a link to the Sentinel in the app. Add --details to also print the Sentinel's full policy — its guardrails and token-optimization config. |
sentinel gateway logs | Print the local gateway container's logs. --tail <n> sets how many lines to show (default 50). |
sentinel proxy config url | Set the gateway URL to route traffic to. |
sentinel proxy config providers | Choose which providers to intercept (openai, anthropic, google, or all). |
sentinel proxy config apps | Choose which local apps Sentinel auto-configures to route through the gateway (codex, claude_desktop, all, or none). For apps that don't read env vars, the CLI edits their own config file. Claude Desktop auto-configuration is macOS/Linux only. |
sentinel proxy config | Run on its own to see help, or pass --url, --providers, and/or --apps for a non-interactive one-liner (e.g. sentinel proxy config --url https://gateway.example.com --providers "openai anthropic" --apps codex). |
sentinel test | Send a test payload through the gateway's guardrails and print what would be blocked or redacted — no LLM call, and nothing recorded in telemetry. |
sentinel proxy on | Inject the provider base-URL variables into new shell sessions, and auto-configure any enabled apps (e.g. Codex, Claude Desktop). |
sentinel proxy off | Remove the variables and restore direct-to-cloud routing. |
sentinel proxy status | Show whether traffic interception is currently active. |
The CLI persists its state to ~/.config/sentinel/config.json (%APPDATA%\sentinel\config.json on Windows).
Reset if instrumentation misbehaves:
sentinel proxy offremoves the injected base-URL variables and restores direct-to-cloud routing — a safe way to undo interception and get out of a bad state. Re-enable withsentinel proxy ononce it's fixed.
Gateway container environment variables
| Variable | Required | Description |
|---|---|---|
SENTINEL_ID | Yes | The Sentinel ID registered in the platform. |
SW_CLIENT_ID | Yes | SUPERWISE API Client ID used to register with the control plane (generate tokens). |
SW_CLIENT_SECRET | Yes | SUPERWISE API Client Secret. |
CUSTOM_PROVIDERS | No | JSON array of {provider_name, base_url} objects for OpenAI-compatible backends. See Custom providers. |
SENTINEL_EXTERNAL_HOST | No | The URL where this gateway is reachable (e.g. https://sentinel.yourcompany.com). Reported to the control plane at startup and shown as the Gateway URL in the app's Connect dialog. If omitted, the gateway auto-detects its local IPv4 and registers http://<ip> (no port) — set it explicitly when running behind a load balancer or API gateway. |
Gateway states
| State | Meaning |
|---|---|
Pending | No heartbeat received yet, or no heartbeat in the last 10 minutes. |
Active | A heartbeat was received within the last 10 minutes (heartbeats are sent every 60 seconds). |
Get Sentinel: Sentinel on superwise.ai.
See also
- Deploy a gateway: the Windows app, the CLI, Docker, Helm, AWS, Google Cloud, or Azure.
- Connect your applications: route your apps to the gateway.
- Architecture: how the gateway intercepts a request.
Updated about 16 hours ago