KyveranceAI control plane
Get startedSign in

Developer platform

Integrate through governed APIs

Development teams connect applications through API and SDK-oriented patterns, with policy, routing, telemetry, and webhook feedback coordinated by the control plane.

  1. Application

    Your service sends requests with API credentials and request context.

  2. Kyverance control plane

    Policy enforcement, transparent routing, telemetry, and outcome events.

  3. Approved provider / model

    Execution on the selected provider path under organization policy.

  4. Observability & events

    Routing explanations, request telemetry, and webhook-safe outcome feedback.

Application → Kyverance control plane → approved provider/model execution → observability and event feedback

What to design for

This page is product education. Credential management and admin tooling live in the authenticated developer console at /developers when enabled for your organization.

  • Request context

    Include organization-scoped application credentials and environment context so policy and routing can be applied consistently. Never place tenant or organization IDs in client-side storage as authority.

  • Policy enforcement

    Allowlists, quotas, budgets, and rate limits run before provider execution. Denied or constrained requests should surface an explainable reason to operators.

  • Routing decisions

    MVP routing is transparent and static, with manual override. Inspect routing explanations rather than assuming silent model changes.

  • Telemetry

    Request telemetry stays tenant-scoped. Redact secrets and prompt bodies from logs and operator surfaces that should not retain them.

  • Outcome events

    Outcome events close the loop for evaluations and operational review. Treat them as signals for deliberate change, not autonomous reconfiguration.

  • Safe webhook handling

    Verify signatures, validate payloads, enforce timeouts, and process webhooks with least privilege. Reject unexpected sources; never trust unverified callbacks.

Safe integration patterns

Samples use placeholders only. Prefer least privilege, server-side secret management, environment configuration, request validation, signature verification, and explicit error handling.

Server-side request (placeholder)
# Placeholders only — replace locally; never commit secrets
export KYVERANCE_API_BASE="https://api.example.invalid/v1"
export KYVERANCE_API_KEY="YOUR_API_KEY"

curl -sS "$KYVERANCE_API_BASE/chat/completions" \
  -H "Authorization: Bearer $KYVERANCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "YOUR_ROUTED_MODEL_ALIAS",
    "messages": [{"role": "user", "content": "Summarize release notes"}]
  }'
Webhook verification checklist (pseudo)
1. Read raw body before parsing
2. Verify signature with server-side secret (Key Vault / env)
3. Reject on mismatch, replay, or stale timestamp
4. Validate schema; ignore unknown critical fields safely
5. Acknowledge quickly; process asynchronously with retries

Ready to evaluate integration

Talk with us about developer integration, or sign in to the console when your organization membership is provisioned.

Talk to an expertSign in