AI settings
Which models to use, failover order, reasoning effort; each provider's health and 24-hour call volume.
Overview
| Card | Meaning |
|---|---|
| Model availability | How many enabled providers are healthy; how many levels the failover chain has |
| Calls (24 h) | Calls, failures and p95 latency from the audit log (absent when audit is off) |
| Failures to date | Failures since the gateway started, whether a provider is failing repeatedly right now, the last failure |
Failover chain and activity
In routing order: which one is active, last success, consecutive failures. A provider that keeps failing drops to the next one; every answer records which model produced it. On the right, the 24-hour call curve.
Routing
One card per provider; expand to edit:
| Field | Meaning |
|---|---|
| Type | openai (every OpenAI-compatible gateway: Volcengine Ark, DeepSeek, Qwen, Ollama, vLLM…) or azure (API version and deployment name instead of a model name) |
| Model | ark-code-latest on the Ark coding plan, the endpoint id for a custom endpoint |
| Base URL | Endpoint address |
| API key | Paste a new one; blank keeps the current key (last 4 shown) |
| Tags | Labels like primary,cloud, informational only |
| Timeout (s) | Per-call cap, default 180. Triage / investigation / rule drafting on a reasoning model can take minutes per call; a timeout degrades the result (triage shows "AI scoring incomplete"), so set 300+ for slow models |
| Reasoning effort | See below |
The order is the failover order; drag to change. To replace a provider: add the new one, enable it, delete the old one, then "Save and reload". Saving an empty list makes every LLM call fail.
Reasoning effort
Reasoning models (Doubao / GPT-5 / Claude / Qwen3 / Gemini 2.5 and so on) think before answering, adding 30–90 s per call. The gateway grades by task:
| Level | Behaviour |
|---|---|
| Auto (recommended) | No reasoning for titles, angles, offense summaries; low for NL→AQL (RST_NL2AQL_REASONING); high for offense investigation, triage, rule designs |
| Off | No reasoning anywhere |
| Low / High | Override every task |
The gateway recognises the vendor from Base URL and model name and translates the level into each vendor's parameter (Ark thinking, OpenAI reasoning_effort, Qwen enable_thinking, Claude thinking, Gemini, OpenRouter); unknown models get no parameter, and a 400 on the parameter triggers a retry without it. "High" on OpenAI o-series / GPT-5 sends reasoning_effort=high, which costs more than the default.
If triage keeps timing out, set this provider to "Low" first and compare quality before deciding between a higher timeout and a different model.
Where it is stored
/app/state/llm_providers.yml on the state volume, API keys encrypted. LLM_* in .env only seeds the first start.
Users and roles
Three roles: administrators change configuration, analysts investigate, read-only only looks. Create, disable, reset passwords, delete; role changes apply at once. Needs the separate user table (Postgres).
Activation
Which capabilities need a licence, how to get a trial, online and offline activation, licence states, upgrade notes.