[AI Gateway] Add multi-provider routing for LLM proxies

gateway/examples/anthropic-openai-proxy.yaml

@@ -0,0 +1,52 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+# --------------------------------------------------------------------
+
+# --------------------------------------------------------------------
+# OpenAI -> Anthropic LLM Proxy (single-provider)
+#
+# Exposes an OpenAI-shaped /chat/completions endpoint that the
+# `openai-to-anthropic` policy translates into Anthropic's Messages API
+# format and forwards to the existing `anthropic-provider` upstream
+# (api.anthropic.com).
+#
+# Single-provider mode: there is no router in front of the policy, so
+# nothing sets metadata["selected_provider"] and the translator runs on
+# every request. "id" is omitted, so it routes to the default upstream
+# (the primary provider above).
+#
+# The provider must already be deployed and must have its x-api-key
+# set on upstream.auth (the policy does NOT inject the Anthropic key).
+#
+# The provider example's api-key-auth policy expects the proxy to send the
+# issued provider loopback key in X-API-Key.
+# --------------------------------------------------------------------
+
+apiVersion: gateway.api-platform.wso2.com/v1
+kind: LlmProxy
+metadata:
+  name: openai-to-anthropic
+spec:
+  displayName: OpenAI to Anthropic Proxy
+  version: v1.0
+  context: /openai-anthropic
+  provider:
+    id: anthropic-provider
+    auth:
+      type: api-key
+      header: X-API-Key
+      value: REPLACE_WITH_ANTHROPIC_PROVIDER_LOOPBACK_KEY
+  policies:
+    - name: openai-to-anthropic
+      version: v1
+      paths:
+        - path: /chat/completions
+          methods: [POST]
+          params:
+            model: claude-sonnet-4-5-20250929

gateway/examples/anthropic-provider.yaml

@@ -0,0 +1,58 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+# --------------------------------------------------------------------
+
+# --------------------------------------------------------------------
+# Anthropic LLM Provider Configuration
+#
+# Uses the built-in `anthropic` template and points to the public
+# Anthropic API endpoint. Replace the placeholder with a real Anthropic
+# API key (sk-ant-...) before deploying.
+#
+# The openai-to-anthropic policy on the proxy layer translates
+# OpenAI-format requests into Anthropic's Messages API wire format
+# (path /v1/messages, anthropic-version header, body rewrite).
+#
+# Auth: upstream.auth is the gateway -> Anthropic vendor auth. Proxies in
+# front of this provider inherit this vendor auth automatically.
+# --------------------------------------------------------------------
+
+apiVersion: gateway.api-platform.wso2.com/v1
+kind: LlmProvider
+metadata:
+  name: anthropic-provider
+spec:
+  displayName: Anthropic Provider
+  version: v1.0
+  template: anthropic
+  upstream:
+    url: https://api.anthropic.com
+    auth:
+      type: api-key
+      header: x-api-key
+      # Anthropic's header is x-api-key with the raw key (NO "Bearer" prefix).
+      value: sk-ant-REPLACE_WITH_ANTHROPIC_KEY
+  policies:
+    - name: api-key-auth
+      version: v1
+      paths:
+        - path: /v1/messages
+          methods: [POST]
+          params:
+            key: X-API-Key
+            in: header
+  accessControl:
+    mode: deny_all
+    exceptions:
+      - path: /v1/messages
+        methods: [POST]
+
+# The proxy in front of this provider authenticates over the internal loopback
+# route with an API key issued for this LlmProvider. Create one as shown in
+# api-key.yaml, then set the issued value as the proxy's provider.auth.value.

gateway/examples/azure-openai-provider.yaml

@@ -0,0 +1,79 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+# --------------------------------------------------------------------
+
+# --------------------------------------------------------------------
+# Azure OpenAI LLM Provider Configuration
+#
+# Uses the built-in 'azure-openai' template and points to your Azure
+# OpenAI endpoint. The openai-to-azure-openai policy on the proxy layer
+# translates OpenAI-format requests into the Azure OpenAI wire format
+# (path rewriting, api-version query param).
+#
+# Replace before deploying:
+#   - url:   your Azure OpenAI endpoint, e.g. https://my-resource.openai.azure.com
+#   - value: your Azure OpenAI API key
+#
+# Auth: upstream.auth is the gateway -> Azure vendor auth (header: api-key).
+# Proxies in front of this provider inherit this vendor auth automatically.
+# --------------------------------------------------------------------
+
+apiVersion: gateway.api-platform.wso2.com/v1
+kind: LlmProvider
+metadata:
+  name: azure-openai-provider
+spec:
+  displayName: Azure OpenAI Provider
+  version: v1.0
+  template: azure-openai
+  upstream:
+    url: https://REPLACE_WITH_AZURE_OPENAI_ENDPOINT
+    auth:
+      type: api-key
+      header: api-key
+      value: REPLACE_WITH_AZURE_OPENAI_API_KEY
+  policies:
+    - name: api-key-auth
+      version: v1
+      paths:
+        - path: /openai/deployments/{deployment}/chat/completions
+          methods: [POST]
+          params:
+            key: X-API-Key
+            in: header
+        - path: /openai/deployments/{deployment}/completions
+          methods: [POST]
+          params:
+            key: X-API-Key
+            in: header
+        - path: /openai/deployments/{deployment}/embeddings
+          methods: [POST]
+          params:
+            key: X-API-Key
+            in: header
+        - path: /openai/models
+          methods: [GET]
+          params:
+            key: X-API-Key
+            in: header
+  accessControl:
+    mode: deny_all
+    exceptions:
+      - path: /openai/deployments/{deployment}/chat/completions
+        methods: [POST]
+      - path: /openai/deployments/{deployment}/completions
+        methods: [POST]
+      - path: /openai/deployments/{deployment}/embeddings
+        methods: [POST]
+      - path: /openai/models
+        methods: [GET]
+
+# The proxy in front of this provider authenticates over the internal loopback
+# route with an API key issued for this LlmProvider. Create one as shown in
+# api-key.yaml, then set the issued value as the proxy's provider.auth.value.

gateway/examples/azure-openai-proxy.yaml

@@ -0,0 +1,51 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+# --------------------------------------------------------------------
+
+# --------------------------------------------------------------------
+# OpenAI -> Azure OpenAI LLM Proxy (single-provider)
+#
+# Exposes an OpenAI-shaped /chat/completions endpoint that the
+# `openai-to-azure-openai` policy translates into Azure OpenAI's
+# /openai/deployments/{deployment}/chat/completions?api-version=...
+# format and forwards to the `azure-openai-provider` upstream.
+#
+# Single-provider mode: the policy omits the "provider" parameter, so
+# it runs on every request without needing a setter policy.
+#
+# Replace before deploying:
+#   - apiVersion param: a valid Azure OpenAI api-version
+#     (e.g. 2024-02-15-preview)
+#   - model param (optional): pin the deployment id here, otherwise
+#     the request body's "model" field is used as the deployment.
+# --------------------------------------------------------------------
+
+apiVersion: gateway.api-platform.wso2.com/v1
+kind: LlmProxy
+metadata:
+  name: openai-to-azure-openai
+spec:
+  displayName: OpenAI to Azure OpenAI Proxy
+  version: v1.0
+  context: /azure-openai
+  provider:
+    id: azure-openai-provider
+    auth:
+      type: api-key
+      header: X-API-Key
+      value: REPLACE_WITH_AZURE_OPENAI_PROVIDER_LOOPBACK_KEY
+  policies:
+    - name: openai-to-azure-openai
+      version: v1
+      paths:
+        - path: /chat/completions
+          methods: [POST]
+          params:
+            apiVersion: "2024-02-15-preview"
+            model: gpt-4o

gateway/examples/gemini-provider.yaml

@@ -0,0 +1,60 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+# --------------------------------------------------------------------
+
+# --------------------------------------------------------------------
+# Gemini LLM Provider Configuration
+#
+# Uses the built-in `gemini` template and points to Google's Gemini API.
+# The openai-to-gemini policy on the proxy layer translates OpenAI-format
+# requests into Gemini's generateContent API format.
+#
+# Auth: upstream.auth is the gateway -> Gemini vendor auth
+# (header: x-goog-api-key). Proxies inherit this vendor auth automatically.
+# --------------------------------------------------------------------
+
+apiVersion: gateway.api-platform.wso2.com/v1
+kind: LlmProvider
+metadata:
+  name: gemini-provider
+spec:
+  displayName: Gemini Provider
+  version: v1.0
+  template: gemini
+  upstream:
+    url: https://generativelanguage.googleapis.com
+    auth:
+      type: api-key
+      header: x-goog-api-key
+      value: REPLACE_WITH_GEMINI_API_KEY
+  policies:
+    - name: api-key-auth
+      version: v1
+      paths:
+        - path: /v1beta/models/{model}:generateContent
+          methods: [POST]
+          params:
+            key: X-API-Key
+            in: header
+        - path: /v1beta/models/{model}:streamGenerateContent
+          methods: [POST]
+          params:
+            key: X-API-Key
+            in: header
+  accessControl:
+    mode: deny_all
+    exceptions:
+      - path: /v1beta/models/{model}:generateContent
+        methods: [POST]
+      - path: /v1beta/models/{model}:streamGenerateContent
+        methods: [POST]
+
+# The proxy in front of this provider authenticates over the internal loopback
+# route with an API key issued for this LlmProvider. Create one as shown in
+# api-key.yaml, then set the issued value as the proxy's provider.auth.value.

gateway/examples/mistral-openai-proxy.yaml

@@ -0,0 +1,53 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+# --------------------------------------------------------------------
+
+# --------------------------------------------------------------------
+# OpenAI -> Mistral LLM Proxy (single-provider)
+#
+# Exposes an OpenAI-shaped /chat/completions endpoint that the
+# `openai-to-mistral` policy adapts to Mistral's chat completions API
+# and forwards to the existing `mistral-provider` upstream
+# (api.mistral.ai).
+#
+# Single-provider mode: there is no router in front of the policy, so
+# nothing sets metadata["selected_provider"] and the translator runs on
+# every request. "id" is omitted, so it routes to the default upstream
+# (the primary provider above).
+#
+# The provider must already be deployed and must have its Authorization
+# bearer token set on upstream.auth (the policy does NOT inject the
+# Mistral key).
+#
+# The provider example's api-key-auth policy expects the proxy to send the
+# issued provider loopback key in X-API-Key.
+# --------------------------------------------------------------------
+
+apiVersion: gateway.api-platform.wso2.com/v1
+kind: LlmProxy
+metadata:
+  name: openai-to-mistral
+spec:
+  displayName: OpenAI to Mistral Proxy
+  version: v1.0
+  context: /openai-mistral
+  provider:
+    id: mistral-provider
+    auth:
+      type: api-key
+      header: X-API-Key
+      value: REPLACE_WITH_MISTRAL_PROVIDER_LOOPBACK_KEY
+  policies:
+    - name: openai-to-mistral
+      version: v1
+      paths:
+        - path: /chat/completions
+          methods: [POST]
+          params:
+            model: mistral-large-latest