Configure an Upstream

Tasks

Add an upstream provider so AIControls can route developer requests to it. For how upstream routing works conceptually, see Upstreams.

Anthropic

1. Go to Settings → Upstreams → Add upstream and select Anthropic.

2. Fill in the upstream fields:

   Field	Value
   Name	Any label, e.g. anthropic-prod
   API Key	Your sk-ant-... key from console.anthropic.com
   Models	Leave blank to allow all, or restrict to specific model IDs

note

AIControls supports all Claude models including claude-opus-4-8, claude-sonnet-4-6, and claude-haiku-4-5. New models appear automatically as Anthropic releases them.

OpenAI

1. Select OpenAI as the provider.

2. Fill in the upstream fields:

   Field	Value
   Name	e.g. openai-prod
   API Key	Your sk-... key from platform.openai.com
   Organization ID	Optional — your OpenAI org ID if using multiple orgs

Azure OpenAI

1. Select Azure OpenAI as the provider.

2. Fill in the upstream fields:

   Field	Value
   Name	Any label, e.g. azure-foundry-prod
   URL	Your resource endpoint plus /openai, e.g. https://YOUR_RESOURCE.cognitiveservices.azure.com/openai
   Model Patterns	Glob(s) matching the deployment name(s), e.g. gpt-4o — controls routing
   Static Model List	The deployment name(s) you created in Azure AI Foundry, e.g. gpt-4o — controls what's advertised via model discovery

note

This covers Azure OpenAI-family models (e.g. GPT-4o) reached via chat completions — the endpoint format above is specific to that path. If your organization instead routes Claude models through Azure AI Foundry (the Claude Code cloud provider gateway), a different endpoint format applies — check with your AIControls administrator for that setup.

note

Azure upstreams added here always authenticate via Azure AD managed identity (DefaultAzureCredential) — there's no API key field, and any value you'd enter here is never sent. Credentials (a service principal's AZURE_CLIENT_ID/AZURE_TENANT_ID/AZURE_CLIENT_SECRET, or workload identity federation) are configured on the AIControls proxy's environment by your platform team, not in this form. (Self-hosted deployments configuring upstreams directly in config.yaml can instead set an explicit API key per upstream — that path isn't covered by this page.)

Amazon Bedrock

1. Select Amazon Bedrock as the provider.

2. Fill in the upstream fields:

   Field	Value
   Region	e.g. us-east-1
   Access Key ID	AWS access key with Bedrock invoke permissions
   Secret Access Key	Corresponding AWS secret
   Role ARN	Optional — assume a role instead of using static credentials

note

For Bedrock, we recommend a dedicated IAM user with bedrock:InvokeModel permission scoped to the specific model ARNs you want to allow.

warning

Upstream names must be unique — adding an upstream with a name that already exists is rejected so an existing upstream is never overwritten by mistake.

When you configure more than one upstream for the same provider, give each a distinguishing scope — a different Priority, or a Model Patterns / Identity Source match — so AIControls knows which one to route each request to. Two enabled same-provider upstreams with the same priority and no distinguishing scope are ambiguous, and requests that either could serve are denied with an ambiguous-routing error. The Add/Edit form warns you before you save such a pair.

See also

For how AIControls picks between multiple configured upstreams, see Upstreams.