DCA Model Gateway: usage and support | Derek Coleman & Associates Inc

At a glance

Endpoint	`https://ai-gateway-east-us1.azure-api.net/gateway`
Your key	`api-key` header (OpenAI and Azure OpenAI APIs); `x-api-key` (Anthropic API, base URL `https://ai-gateway-east-us1.azure-api.net/gateway/anthropic`)
APIs	OpenAI v1 chat completions, responses and embeddings; the Azure OpenAI deployments path; the Anthropic Messages API. Streaming works.
Models	The deployments in your Azure AI Foundry, Azure AI Services or Azure OpenAI resource
Connector	DCA Model Gateway Connector, application ID `7154fd27-4506-4cd5-8e3a-b2e5208d0846`: no secrets; it reaches only what you assign it a role on
Portal	https://saas.dcassociatesgroup.com: subscriptions, Connect your Foundry, Regenerate gateway key

Quick start

Subscribe on the Azure Marketplace listing, select Configure account now, sign in with your work account and select Subscribe. If the status then shows Pending activation, our team confirms new subscriptions before billing starts; carry on with the next steps.
Add the connector to your tenant and give it a data-only role on your Foundry resource. In Azure Cloud Shell, signed in to the subscription that holds the resource:
```
git clone https://github.com/Derek-Coleman-Associates-Corporation/dca-model-gateway
bash dca-model-gateway/samples/connect/connect-foundry.sh <resource-group> <foundry-resource-name>
```
The script creates the custom role DCA Model Gateway Inference (calls to deployments only: no keys, no settings) and assigns it. The built-in Cognitive Services User role also works but additionally allows listing the resource's keys. Manual steps: Connect your Foundry.
Connect: in the portal open Subscriptions, the subscription's menu, Connect your Foundry. Enter your endpoint and at least a default deployment, then select Save and test.
Get your key: in the same menu choose Regenerate gateway key. It is shown once; store it in your secret manager.

Call the gateway:

curl https://ai-gateway-east-us1.azure-api.net/gateway/openai/v1/chat/completions \
  -H "api-key: $DCA_GATEWAY_KEY" -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"Hello"}]}'

Until a Foundry is connected, requests are refused with 409 foundry_not_connected and nothing is forwarded.

Use your SDK

from openai import OpenAI

key = "<your gateway key>"
client = OpenAI(base_url="https://ai-gateway-east-us1.azure-api.net/gateway/openai/v1", api_key=key,
                default_headers={"api-key": key})   # the gateway reads the api-key header
reply = client.chat.completions.create(
    model="gpt-4.1-mini",                         # a deployment in YOUR Foundry
    messages=[{"role": "user", "content": "Hello"}])

Azure OpenAI SDK: azure_endpoint="https://ai-gateway-east-us1.azure-api.net/gateway" and your key, unchanged code. Anthropic SDK: base_url="https://ai-gateway-east-us1.azure-api.net/gateway/anthropic". Tested samples for Python, Node.js and curl: samples.

Which deployment answers

`x-dca-route`	Uses	If you did not map it
`cheap`, `auto`, `reasoning`, `code`, `frontier`	The deployment you mapped to that route	Your default deployment
`oss-only`	Your mapped open-weight deployment	Refused with `422`; never sent to the default
No header	The deployment named in `model`	Your default deployment when `model` is empty

Send x-dca-data-boundary: us to use only the deployments you declared for the United States data boundary; anything else is refused with 422 no_eligible_provider, never rerouted. Response headers x-dca-backend, x-dca-model and x-dca-remaining-quota-tokens show who served the request and what budget is left. Full reference: API reference.

Errors and fixes

You see	Meaning	Fix
`409 foundry_not_connected`	No Foundry connected to this subscription	Open Connect your Foundry in the portal and save a connection
`502 foundry_auth_failed` with `AADSTS700016`	The connector is not in your Microsoft Entra tenant	Admin consent on the portal page, or `az ad sp create --id 7154fd27-4506-4cd5-8e3a-b2e5208d0846`
`401 PermissionDenied` from your Foundry	The connector has no role on the resource yet	Assign the role; allow up to 10 minutes; select Test again
`403` from your Foundry	The resource refuses public network traffic	Allow public network access on the resource
`404 DeploymentNotFound`	No deployment with that name	Check the deployment name, not the model name
`422 route_not_configured` / `no_eligible_provider`	Route not mapped / nothing declared for the US boundary	Map it on the Connect your Foundry page
`401` invalid subscription key	Wrong, rotated or cancelled key	Use the current key, or Regenerate gateway key
`429` / `403` without an error code	This key's per-minute / monthly token limit	Wait `retry-after` seconds / the monthly cap resets on the 1st (UTC)

Every code: Errors. A gateway refusal is never forwarded to any model.

Limits and billing

Plan	Per key	Monthly fee and included routed tokens	Beyond the included amount
Team	60,000 tokens/minute; 500M tokens/month	US$199; 200M open-weight + 25M frontier	US$0.25 per 1M open-weight; US$0.60 per 1M frontier
Partner Edition	120,000 tokens/minute; 2,500M tokens/month	US$499; 1,000M open-weight + 100M frontier	US$0.25 per 1M open-weight; US$0.60 per 1M frontier

Model usage is billed by Microsoft on your own Azure subscription; the gateway does not resell it. Routed tokens are counted only for requests that reached your deployment, by the tier of the model your deployment serves. Each subscription has one gateway key; the plan's active tenants meter is not charged. Prices as listed on 2026-10-15; the Marketplace listing is authoritative. Details: Limits and billing.

Security and privacy

No keys shared or stored: the gateway signs in to your tenant as the connector and can use only the role you grant
Stop at any time: Disconnect in the portal stops the gateway immediately; removing the role assignment or the connector's enterprise application blocks it in Azure once Azure applies the change
Prompts and responses are never stored; the gateway records key ID, route, deployment name, data boundary and token counts (90 days)
Your connection (tenant ID, endpoint, deployment names) is deleted within an hour of cancelling the subscription

Details: Security and privacy and our privacy notice.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) with your Marketplace subscription ID, the time of a failing request (UTC) and the full error body. Never send your gateway key.