Opening IO Gateway

How-to guides

Test API

Use when
Dashboard route validation
Updated
September 4, 2026

Test API sends a dashboard-authenticated prompt through the provider-routing layer. Use its default operator-bypass mode to validate an upstream account, model, or custom route; select a managed-key profile to validate that key's policy too.

Test API panel showing a custom model request and a successful response with HTTP status, latency, selected model, and raw response details.
Use Test API to validate route behavior before giving the route to client keys.

Before you start

Sign in to the dashboard with an operator session. The default selection is operator bypass, which does not apply a managed key's scope, per-request cap, or budget. Select an active managed API-key profile to apply those controls before dispatch; only its ID is sent, never its plaintext secret.

Run a test

  1. 1
    Open Test API.

    Use the dashboard action near account and model management.

  2. 2
    Select a model and policy mode.

    Choose a provider model or a ctm: alias; keep operator bypass for a route-only check or choose an active managed-key profile to test its policy.

  3. 3
    Send a short prompt.

    Use a small request when validating credentials, quota, or routing behavior.

  4. 4
    Inspect the result.

    Check response status, account selection, and provider error details.

What a passing result proves

  • Credentials work The selected provider account can authenticate upstream.
  • Route exists The selected model or custom alias is known to IO Gateway.
  • Operator route works In bypass mode, the gateway can choose an eligible upstream account and send the operator test.
  • Managed policy works With a selected profile, provider/account scope, per-request caps, and the cumulative input-token budget are checked before dispatch.
Choose the right mode

Operator bypass proves the route without client-key restrictions. A selected managed profile validates policy without exposing its secret; send a request with the actual client key as the final integration check.