Route by workspace
Map authenticated users and API keys to the correct Foundry project or shared shard.
Execution plane and control plane
Meter consistently
Normalize model usage into Kimss Credits and attribute it to tenants, agents, and billing pools.
Enforce boundaries
Keep workspace identity and permissions attached to calls instead of relying on a single blended Azure resource.
One preferred developer surface
The universal gateway uses routes such as /v1/agents/run and /v1/models/completions. Clients authenticate with X-Kimss-Key or a bearer token and can identify a workspace with X-Workspace-ID.
Azure API Management is an optional path in the Kimss architecture. Direct Foundry routing remains the safe default until an environment’s APIM path and telemetry have passed end-to-end verification.