Bring your own model
What version 1 of the API Platform supports for a model you bring with your own provider account or endpoint: the Workbench only, and no Safeguard fee.
Bringing your own model means calling a model through your own provider account or your own endpoint, with your own key, instead of through Safeguard's account. Your provider bills you directly, and Safeguard charges no fee.
Version 1 is limited. The gateway accepts your own models only from the Workbench, never with an API key. In this version the Workbench's model list shows catalog models only, so a model of your own can't be picked there yet.
What version 1 supports
| Your own model | |
|---|---|
| Where it works | The Workbench route, for a person signed in to the Console. The API Platform must be switched on for the workspace. |
| With an API key | Not supported. The request is refused with 400 unsupported_parameter. |
| Safeguard fee | None. The gateway records the cost as $0, and your provider bills you under your own agreement. |
| Credit | Not needed. Nothing is reserved or charged. |
| Request log | Logged like any other request, with a cost of $0. |
| Prompt and output text | Stored only if Store prompts and outputs is on, as for any request. |
| Retries and fallbacks | Never. A failure is returned, not sent to another model. |
| Zero data retention | Not applied. Your agreement with your provider decides what it keeps. |
| Rate limit | The Workbench's per-person limit. |
In a request, a model of your own is named custom: followed by its ID in your workspace.
Add a model
A tenant admin adds the model in the web app:
- In ESSCM, open Integrations › Configure Scanner, then Models.
- Under Your own models, select Add model.
- Enter a Name and choose the Provider and the Type: Frontier vendor (your account) or Self-hosted (your endpoint).
- Under Which API does it speak?, choose OpenAI-compatible, Anthropic Messages or Google Gemini.
- Enter the Model name at the vendor, the Endpoint URL where needed, and the API key.
- Select Save.
The key is kept in Safeguard's credential vault, never with the model's settings, and it is fetched only when a call is made. It is never logged.
Safeguard's servers make the call, so a self-hosted endpoint must be reachable from Safeguard.
The Input cost and Output cost fields on that form help you compare routing choices. Nothing is billed from them. Route jobs to this model sends work from Safeguard's own AI features, such as search and chat, to the model. It has no effect on the API Platform.
Not supported yet
- Using your own key with a catalog model, such as calling an OpenAI model in the catalog with your OpenAI key. Catalog models always run on Safeguard's account. To use your key, add the model as your own.
- Calling your own models with an API key.
- Choosing your own model from the Workbench's model list.
Related
Inference API or MCP server
When to call models through Safeguard's inference API, and when to connect an AI assistant to Safeguard's MCP server instead. MCP is unlimited and never metered.
Your own provider keys
Bring your own key: run API Platform requests on your workspace's own OpenAI, Anthropic, Google or other provider key, billed by the provider, with no Safeguard fee.