Portkey Connector
If your agents call models through Portkey, the Portkey connector brings that traffic into ANTS Platform and puts ANTS controls on it, with no change to agent code. It connects to Portkey in three ways:
| Connection | What ANTS does | What it enables |
|---|---|---|
| Log ingestion | Ingests Portkey's OpenTelemetry log export | Every agent using Portkey is discovered with its models, tools and requesting user, and its traffic appears in Tracing, the AI Agent Center and drift detection |
| Admin API | Calls Portkey's admin API with an admin key you provide | Suspend agent and key expiry also disable the agent's Portkey keys |
| Guardrail webhook | Acts as a Portkey "bring your own guardrail" webhook | Every Portkey request and response is scanned inline for prompt injection and sensitive data, and tool calls are checked against each agent's tool allow-list |
You can use the three connections together or set up only the ones you need.
Full request log export over OpenTelemetry is a Portkey feature of its Enterprise and self-hosted editions. Without it, the admin API and guardrail webhook still work, but agents are not discovered from Portkey logs. ANTS sees only traffic that goes through Portkey, so route all agent traffic through it for full coverage.
Prerequisites
- A Portkey deployment, and the Portkey URL your agents use.
- A Portkey admin API key that can read and update keys.
- In ANTS Platform, the Owner role or a custom role with write access to integrations in Project Settings.
- For the guardrail webhook, a Real-time Enforcement policy in AI Guardrails for the agents you want to check. The detection services are enabled per deployment.
Connect Portkey
Add the connector
Go to Project Settings > Integrations and add Portkey. Enter:
| Field | Notes |
|---|---|
| Portkey URL | The base URL of your Portkey deployment |
| Admin API key | Encrypted at rest and never shown again |
Saving checks the admin key by reading your Portkey keys. The page then shows a Webhook secret and the ANTS endpoints for the next two steps.
Send Portkey logs to ANTS
In Portkey, configure the OpenTelemetry export to send to your ANTS OTLP endpoint, https://<your-ants-host>/api/public/otel, with HTTP Basic authentication using a project key pair. See OpenTelemetry for building the header.
Add ANTS as a Portkey guardrail
In Portkey, create a "bring your own guardrail" webhook with the URL https://<your-ants-host>/api/public/v1/guardrails/portkey and the header Authorization: Bearer <webhook secret>. Attach it to your Portkey configs as a check before the request and after the response.
Log ingestion and agent discovery
Portkey logs are turned into traces in the project, with the model, token usage, cost, latency, tool calls and the requesting user. Every agent using Portkey appears in the AI Agent Center and on the AI Agents tab automatically, with its models and tools.
- Agent. An agent is identified by the
agent_namevalue in the request's Portkey metadata. Requests without it are attributed to an agent named after the Portkey key they used. - User. The requesting user is read from Portkey's
_usermetadata. - Tools. Tool calls in requests and responses are recorded, so the agent's observed tools appear on its agent profile and in AI TrailMaps.
Portkey traffic is covered by drift detection, Scheduled Detection and cost reporting like any other trace.
Suspension and key expiry
With the admin API key in place, ANTS controls the Portkey keys each agent uses:
- Suspend agent in the AI Agent Center disables the Portkey keys the agent was seen using, in the same action that blocks its Budget AI keys. Resume agent re-enables them.
- Portkey keys have budget and rate limits but no time-based expiry. In the connector's list of Portkey keys you can set an expiry, in hours or days, on any key. When the expiry passes, ANTS disables the key in Portkey.
Disabling and re-enabling a Portkey key are written to the audit log.
Guardrail webhook
Portkey calls ANTS before each request is sent to the model and after each response. ANTS checks the content with the agent's AI Guardrails Real-time Enforcement policy and returns a verdict:
| Policy action | Verdict returned to Portkey |
|---|---|
| Audit Only | Pass. The violation is recorded. |
| Block | Fail, so Portkey refuses the call |
| Redact | Pass with the masked content, which Portkey uses in place of the original. Ethics & Bias and Safety violations fail. |
The webhook also checks each tool call in the request against the agent's tool allow-list, which is the Declared tools list on its agent profile. A tool call outside the list fails the check, so Portkey refuses the call. Agents with no declared tools are not checked.
Checks that find a violation appear in AI Violations.
Portkey applies its own timeout to guardrail webhooks, and its documentation describes letting a request through when the timeout is reached. Keep the policies used through Portkey to the detection categories that answer within that timeout, and check Portkey's timeout setting for your edition.
Other ways to use Budget AI with Portkey
You can instead move agent traffic to Budget AI, or place Budget AI in front of Portkey for agent traffic only. Both use Budget AI's own guardrail checks, and agents hold Budget AI keys. See Budget AI in front of another gateway.