Use the API through Cloudflare AI Gateway
Add the ISMS Copilot API to Cloudflare AI Gateway as a custom provider, call it through the gateway, and set the gateway's logging and caching to match your data rules.
Cloudflare AI Gateway can sit in front of the ISMS Copilot API as a custom provider: you get the gateway's analytics, rate limiting and caching controls on the same requests, and your code keeps the OpenAI wire.
No tool calling. The API is a text-only subset and rejects tools with a 400, through the gateway or not. No JSON mode, n is 1, no images. See Errors.
1. Add the custom provider
In the Cloudflare dashboard: AI Gateway, Custom Providers, Add Custom Provider.
| Field | Value |
|---|---|
| Name | ISMS Copilot |
| Slug | ismscopilot |
| Base URL | https://api.ismscopilot.com |
The base URL is the host only; the gateway appends the path you call. The same can be done with Cloudflare's API (POST /accounts/{account_id}/ai-gateway/custom-providers).
2. Call it through your gateway
The custom provider path is custom-<slug>, followed by our path:
curl https://gateway.ai.cloudflare.com/v1/$CF_ACCOUNT_ID/$CF_GATEWAY_ID/custom-ismscopilot/v1/chat/completions \
-H "Authorization: Bearer $ISMS_API_KEY" \
-H "cf-aig-authorization: Bearer $CF_AIG_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"model": "isms-fast",
"messages": [{"role": "user", "content": "Which NIS 2 incident reports do we owe in Belgium?"}],
"ismscopilot": {"frameworks": ["NIS_2_BE"]}
}'Authorization carries your sk-isms- key. cf-aig-authorization carries the gateway token, when your gateway requires one.
From the OpenAI SDK, set the base URL to the gateway path:
import os
from openai import OpenAI
client = OpenAI(
base_url=f"https://gateway.ai.cloudflare.com/v1/{os.environ['CF_ACCOUNT_ID']}/{os.environ['CF_GATEWAY_ID']}/custom-ismscopilot/v1",
api_key=os.environ["ISMS_API_KEY"],
default_headers={"cf-aig-authorization": f"Bearer {os.environ['CF_AIG_TOKEN']}"},
)
resp = client.chat.completions.create(
model="isms-fast-eu",
messages=[{"role": "user", "content": "Summarise GDPR Article 28 for a processor contract review."}],
extra_body={"ismscopilot": {"frameworks": ["GDPR"]}},
)
print(resp.choices[0].message.content)Cloudflare's unified /compat/chat/completions endpoint can also reach custom providers, with the model written as custom-ismscopilot/isms-fast. Pins (ismscopilot) were not checked on /compat; use the provider-specific path above when you pin.
3. Set logging and caching to your data rules
Our Zero Data Retention covers the ISMS Copilot API. The gateway is a separate service in your Cloudflare account. If gateway logging is on, Cloudflare stores the prompts and answers in your account; if caching is on, it stores answers to replay. Turn logging and caching off for these requests if prompts may hold personal or customer data: per request, send cf-aig-collect-log: false and cf-aig-skip-cache: true, or turn off Logs and Cache in the gateway settings. Otherwise check that your Cloudflare terms cover it.
Caching can also return a stale answer after a framework module changes. If you cache, keep the time-to-live short and follow the knowledge changelog.
Notes
- Spend caps and the 120 requests per minute limit are per ISMS Copilot key and still apply behind the gateway.
- Response headers such as
x-isms-frameworksare part of our response; check that your gateway configuration passes them through if you log them. - The steps follow Cloudflare's custom-provider documentation as read on 2026-10-28. We did not run a live call through a gateway for this page.