Gateway API

The gateway is the address your apps call. It speaks the OpenAI and Anthropic APIs, so most apps and SDKs work by changing only the base URL and the key. New to this? Start with Connect your first app.

Base URL

Where the app runs	Base URL
On the same machine	http://127.0.0.1:3939
On your network	http://<machine address>:3939, after you turn on private network access
Anywhere Pro	The hosted HTTPS address from Access from anywhere

OpenAI clients add /v1 to the base URL. Anthropic clients use the base URL as it is. Msty Nexus Business listens on port 3949.

Copy the addresses from Connections, under Gateway access.

Keys

Every request needs a Nexus key from Connections. Send it in any one of these headers:

Authorization: Bearer <nexus-key>
X-Msty-Nexus-Token: <nexus-key>
x-api-key: <nexus-key>

Use x-api-key for Anthropic clients that expect it. It’s still a Nexus key.

Never send a provider key to Nexus. Nexus adds the provider’s key itself, from its own secure storage, and never forwards your Nexus key to a provider.

Two roles:

• Inference only: can call the routes on this page. Can’t change anything.
• Administration Pro: full control, including settings and keys. Use it only for scripts that manage Nexus, such as the CLI.

Routes

Not every model supports every route. A model only gets the requests it can handle (see What a model can do).

OpenAI-compatible

Route	What it does
GET /v1/models	List the models this key can use
GET /v1/models/{id}	One model
POST /v1/chat/completions	Chat
POST /v1/responses	Responses API
POST /v1/responses/input_tokens	Count input tokens
POST /v1/responses/compact	Compact a conversation
GET /v1/responses/{id}	Get a stored response
DELETE /v1/responses/{id}	Delete a stored response
GET /v1/responses/{id}/input_items	List a response’s input items
POST /v1/responses/{id}/cancel	Cancel a response
POST /v1/embeddings	Embeddings
POST /v1/images/generations	Make images
POST /v1/images/edits	Edit images (multipart upload)
POST /v1/audio/speech	Text to speech
POST /v1/audio/transcriptions	Speech to text

Anthropic-compatible

Route	What it does
POST /v1/messages	Messages
POST /v1/messages/count_tokens	Count tokens

Other

Route	What it does
POST /v1/rerank	Rank documents against a query: { model, query, documents[] } in, indexed scores out
POST /v1/systemone (also /v1/decisions)	The native contract for decision models. Decision presets also work through chat, as @preset/<slug>.
POST /v1/web/search, /v1/web/fetch, /v1/web/image	Web Search
GET, POST, DELETE /mcp	Tools Gateway, for MCP clients
GET /v1/capabilities	What this Runtime supports: routes, provider kinds and actions
GET /health, GET /version	Health and version. No key needed.

Web search and /mcp follow the key’s tool rules, not its model rules.

Model names

The model field can be:

Form	Example	Goes to
Model ID	openai/gpt-4.1, ollama/llama3.1:8b, llamacpp/qwen.gguf	That model
Alias	coding-local	The model the alias points to. See Model Aliases.
Preset	@preset/coder-fast	A model with saved settings. See Presets.
Smart Route	@route/everyday	The model the route picks. See Smart Routes.
Balancer pool	@pool/chat	A healthy model in the pool. See Smart Balancer.

A model ID wins over an alias with the same name. Hidden models aren’t listed in /v1/models and can’t be called by ID or alias.

Image edits and audio transcriptions are multipart uploads. They take a model ID or alias only, not a preset, route or pool.

Presets are defaults. A preset’s settings, such as temperature, apply first. Fields in your request override them for that one call.

What a model can do

Each model has endpoint families that say which routes it supports:

Family	Routes
openai.chat_completions	Chat
openai.responses	Responses
openai.embeddings	Embeddings
openai.images	Image generation and edits
openai.audio_speech	Text to speech
openai.audio_transcriptions	Speech to text
anthropic.messages	Messages
rerank.documents	Rerank

Nexus checks the family before anything leaves the machine. A request a model can’t handle fails at once with MODEL_ENDPOINT_NOT_SUPPORTED.

Each model in GET /v1/models can also carry msty_capabilities, a summary apps can use without reading provider-specific data:

"msty_capabilities": {
  "preferred_endpoint": "openai.chat_completions",
  "context_window": 131072,
  "max_output_tokens": 8192,
  "vision": true,
  "file_input": false,
  "tool_use": true,
  "reasoning": false,
  "citations": null
}

null means Nexus doesn’t know. It doesn’t mean the model lacks it. For online models, limits come from the same published model data Nexus uses for prices. Nexus doesn’t guess limits for local models.

Headers you can send to providers

Some providers take extra, non-secret headers. Nexus passes these through:

• OpenAI project or organization
• Anthropic beta features
• OpenRouter referer, title and category

Nexus removes or blocks anything that carries credentials, sets the provider’s authentication itself, and strips provider credential and CORS headers from responses.

Usage that’s counted

Chat, Responses, Messages and embeddings record tokens in Usage. Image generation records tokens only when the provider reports them. Speech, transcription, image edits and rerank aren’t counted in tokens.

Request IDs

Every response carries a Nexus request ID, in three headers:

• X-Msty-Nexus-Request-Id
• X-Request-Id
• request-id

Quote it when you look a request up in Activity or ask for support.

Errors

Errors have one shape:

{
  "type": "error",
  "request_id": "nxs_req_example",
  "error": {
    "code": "MODEL_ENDPOINT_NOT_SUPPORTED",
    "message": "Model does not support this endpoint.",
    "type": "invalid_request_error",
    "param": "model",
    "messageKey": "error.model.endpoint.not.supported",
    "details": {}
  }
}

Check error.code in your code, never the English message.

Common codes:

Code	Means
UNAUTHORIZED	Missing, wrong or revoked Nexus key
FORBIDDEN	The key’s role or scope doesn’t allow this
MODEL_NOT_FOUND	No visible model, alias, preset, route or pool by that name
MODEL_ENDPOINT_NOT_SUPPORTED	The model can’t handle this route
PROVIDER_NOT_CONFIGURED	The provider is missing its key or settings
PROVIDER_REQUEST_FAILED	The provider returned an error
INFERENCE_BUSY	Every local slot is busy and the queue is full. Retry later.
INFERENCE_QUEUE_TIMEOUT	The request waited too long for a free slot
DATA_PROTECTION_BLOCKED	Data Protection stopped the request
FEATURE_NOT_ENTITLED	Your plan or this machine doesn’t include the feature
CORS_ORIGIN_NOT_ALLOWED	A browser page’s origin isn’t allowed

Calls from a web page

Browsers block calls to Nexus until you allow the page’s origin. In Settings, under Network and access, add each origin to Allowed browser origins, such as https://dashboard.example.com.

• Allow exact origins. Avoid *: it lets any website try to call Nexus with a key it has.
• Allowing an origin doesn’t open Nexus to your network. That’s a separate switch.
• The browser’s preflight check needs no key. The real request still does.

If the browser blocks the call before it reaches Nexus, check the allowed origins. If Nexus answers UNAUTHORIZED, check the key.