DCA Model Gateway: usage and support | Derek Coleman & Associates Inc

At a glance

Endpoint	`https://ai-gateway-east-us1.azure-api.net/gateway`
Your key	`api-key` header (OpenAI and Azure OpenAI APIs); `x-api-key` (Anthropic API, base URL `https://ai-gateway-east-us1.azure-api.net/gateway/anthropic`)
APIs	OpenAI v1 chat completions, responses and embeddings; the Azure OpenAI deployments path; the Anthropic Messages API. Streaming works.
Models	The deployments in your Azure AI Foundry, Azure AI Services or Azure OpenAI resource, or Google Vertex AI in your Google Cloud project
Connector	DCA Model Gateway Connector, application ID `7154fd27-4506-4cd5-8e3a-b2e5208d0846`: no secrets; it reaches only what you assign it a role on
Portal	https://saas.dcassociatesgroup.com: subscriptions, Connect your Foundry, Tenant keys, Regenerate gateway key

Quick start

Subscribe on the Azure Marketplace listing, select Configure account now, sign in with your work account and select Activate. The subscription shows Subscribed and the page shows your first gateway key once: store it in your secret manager.
Add the connector to your tenant and give it a data-only role on your Foundry resource. In Azure Cloud Shell, signed in to the subscription that holds the resource:
```
git clone https://github.com/Derek-Coleman-Associates-Corporation/dca-model-gateway
bash dca-model-gateway/samples/connect/connect-foundry.sh <resource-group> <foundry-resource-name>
```
The script creates the custom role DCA Model Gateway Inference (calls to deployments only: no keys, no settings) and assigns it. The built-in Cognitive Services User role also works but additionally allows listing the resource's keys. Manual steps: Connect your Foundry.
Connect: in the portal open Subscriptions, the subscription's menu, Connect your Foundry. Enter your endpoint and at least a default deployment, then select Save and test.
Keys: missed the key, or need to rotate it? In the same menu choose Regenerate gateway key. For a key per customer or application, choose Tenant keys (below).

Call the gateway:

curl https://ai-gateway-east-us1.azure-api.net/gateway/openai/v1/chat/completions \
  -H "api-key: $DCA_GATEWAY_KEY" -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"Hello"}]}'

Until a Foundry is connected, requests are refused with 409 foundry_not_connected and nothing is forwarded.

Use your SDK

from openai import OpenAI

key = "<your gateway key>"
client = OpenAI(base_url="https://ai-gateway-east-us1.azure-api.net/gateway/openai/v1", api_key=key,
                default_headers={"api-key": key})   # the gateway reads the api-key header
reply = client.chat.completions.create(
    model="gpt-4.1-mini",                         # a deployment in YOUR Foundry
    messages=[{"role": "user", "content": "Hello"}])

Azure OpenAI SDK: azure_endpoint="https://ai-gateway-east-us1.azure-api.net/gateway" and your key, unchanged code. Anthropic SDK: base_url="https://ai-gateway-east-us1.azure-api.net/gateway/anthropic". Tested samples for Python, Node.js and curl: samples.

Google Vertex AI

Prefer Gemini? Connect Google Vertex AI in your own Google Cloud project instead of an Azure AI Foundry resource: Connect your Foundry, then the Google Vertex AI tab. No key is created or shared: your own Microsoft Entra tenant issues a short-lived token to the DCA Model Gateway Connector, and the gateway exchanges it at Google for a short-lived token of a workload identity pool you control, which you grant a predict-only custom role. Your provider trusts only your tenant, so no other organization's connection can reach your project. Google bills model usage on your own billing account.

Chat completions (streaming included), embeddings (OpenAI format, translated to Vertex AI's native API), routes, the United States data boundary (your us location), tenant keys, budgets and the usage CSV work as with Azure AI Foundry
Open-weight models from Model Garden (ids ending in -maas, for example gpt-oss, DeepSeek, Qwen or GLM) work through chat completions and are billed on the open-weight tier; Llama needs its license accepted in Model Garden first
The Responses API is refused with 422 not_supported_by_provider for a Vertex AI connection, never forwarded; Claude through Vertex AI is in testing
Revoke in your project by removing the role binding (about a minute in our tests) or with Disconnect on the portal (at once)

Setup commands and errors: Connect your Vertex AI.

Tenant keys

Give each of your customers or applications its own gateway key: Subscriptions, the subscription's menu, Tenant keys. Every key reaches the same connected Foundry, with its own limits and usage.

Add key: name it after the customer or application; the key is shown once. Team allows 25 keys and Partner Edition 100, the Default key included
Monthly budget per key (at least 1,000 tokens): over it, that key alone is refused with 403 until the next month (UTC); responses carry x-dca-budget-remaining-tokens
Regenerate issues a new secret at once; Revoke ends an additional key for good without touching the others
Usage per key for any of the last six months, and Download usage (CSV): tokens per day, key, deployment, billing tier, route and data boundary, for rebilling

Keys can be added once the subscription shows Subscribed. Guide: Tenant keys.

Which deployment answers

`x-dca-route`	Uses	If you did not map it
`cheap`, `auto`, `reasoning`, `code`, `frontier`	The deployment you mapped to that route	Your default deployment
`oss-only`	Your mapped open-weight deployment (enforced: refused with `422 not_open_weight` if it bills as frontier)	Refused with `422`; never sent to the default
No header	The deployment named in `model`	Your default deployment when `model` is empty

Send x-dca-data-boundary: us to use only the deployments you declared for the United States data boundary; anything else is refused with 422 no_eligible_provider, never rerouted. Response headers x-dca-backend, x-dca-model and x-dca-remaining-quota-tokens show who served the request and what budget is left. Full reference: API reference.

Errors and fixes

You see	Meaning	Fix
`409 foundry_not_connected`	No Foundry connected to this subscription	Open Connect your Foundry in the portal and save a connection
`502 foundry_auth_failed` with `AADSTS700016`	The connector is not in your Microsoft Entra tenant	Admin consent on the portal page, or `az ad sp create --id 7154fd27-4506-4cd5-8e3a-b2e5208d0846`
`401 PermissionDenied` from your Foundry	The connector has no role on the resource yet	Assign the role; allow up to 10 minutes; select Test again
`403` from your Foundry	The resource refuses public network traffic	Allow public network access on the resource
`404 DeploymentNotFound`	No deployment with that name	Check the deployment name, not the model name
`422 route_not_configured` / `no_eligible_provider`	Route not mapped / nothing declared for the US boundary	Map it on the Connect your Foundry page
`401` invalid subscription key	Wrong, rotated, revoked or cancelled key	Use the current key, or regenerate it on the Subscriptions or Tenant keys page
`429` / `403` without an error code	This key's per-minute limit / its monthly cap or the budget you set for it	Wait `retry-after` seconds / caps and budgets reset on the 1st (UTC); raise or remove the key's budget on Tenant keys

Every code: Errors. A gateway refusal is never forwarded to any model.

Limits and billing

Plan	Per key	Keys	Monthly fee and included each month	Beyond the included amount
Team	60,000 tokens/minute; 500M tokens/month	25	US$199; 200M open-weight + 25M frontier routed tokens; 5 active tenants	US$0.25 per 1M open-weight; US$0.60 per 1M frontier; US$15 per additional active tenant
Partner Edition	120,000 tokens/minute; 2,500M tokens/month	100	US$499; 1,000M open-weight + 100M frontier routed tokens; 25 active tenants

Model usage is billed by Microsoft on your own Azure subscription; the gateway does not resell it. Routed tokens are counted only for requests that reached your deployment, by the tier of the model your deployment serves. An active tenant is a key that routed at least one token in the subscription's monthly billing period; keys that are never used are free. Prices as listed on 2026-10-15; the Marketplace listing is authoritative. Details: Limits and billing.

Security and privacy

No keys shared or stored: the gateway signs in to your tenant as the connector and can use only the role you grant
Stop at any time: Disconnect in the portal stops the gateway at once (Reconnect resumes with the same settings); disabling the connector's enterprise application in your tenant stops it within five minutes; a removed role assignment can take Azure hours to apply
Prompts and responses are never stored; the gateway records key ID, route, deployment name, data boundary and token counts (90 days)
Your connection (tenant ID, endpoint, deployment names, per-key budgets) is deleted within an hour of cancelling the subscription

Details: Security and privacy and our privacy notice.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) with your Marketplace subscription ID, the time of a failing request (UTC) and the full error body. Never send your gateway key.