Skip to content
Docs

Integrations

AgentWatch is designed to slot into infrastructure that already exists — the identity provider, the SIEM, the APM, the corporate proxy — rather than to replace any of it.

Which model providers integrate?

Section titled “Which model providers integrate?”

15 providers with 300+ pre-configured models: OpenAI, Anthropic, Google Vertex AI, AWS Bedrock, Azure OpenAI, Azure AI Foundry (setup), Groq, Mistral, Cohere, Together AI, OpenRouter, Fireworks AI, DeepSeek, Ollama, and any custom OpenAI-compatible endpoint. Self-hosted engines — Lifeboat, vLLM, TGI, Triton, llama.cpp, Ollama — connect through the custom or Ollama provider type with only a base-URL change, which is how private and commercial models end up under one policy and one audit trail.

Which client SDKs work against AgentWatch?

Section titled “Which client SDKs work against AgentWatch?”

Applications keep their existing SDK. AgentWatch accepts OpenAI, Anthropic Messages, Google Vertex AI, Azure OpenAI, and Cohere V2 wire formats inbound, and translates to whichever upstream provider is configured. Frameworks with a configurable base URL — LangChain, LlamaIndex, and similar — work unchanged. See LLM gateway and routing.

Which identity providers integrate?

Section titled “Which identity providers integrate?”
Protocol Providers
OAuth2 / OIDC Microsoft Entra ID, Okta, Google Workspace, Auth0, GitHub, Ping Identity, Keycloak, OneLogin, or any OIDC-compliant provider
SAML 2.0 Native service provider — any SAML IdP, no external gateway needed
LDAP / Active Directory LDAP and LDAPS, with CA certificate upload
SCIM v2 Per-organization provisioning endpoints; compatible with Okta, Entra ID, and other SCIM clients

Group-to-team mapping is unified across OIDC, SAML, and LDAP. See Configuration and admin.

Which observability and SIEM platforms integrate?

Section titled “Which observability and SIEM platforms integrate?”
  • Tracing — any OpenTelemetry-compatible backend: Jaeger, Grafana Tempo, Datadog APM, Honeycomb, New Relic, AWS X-Ray.
  • Metrics — Prometheus scrape endpoint; from there Grafana, Datadog, Grafana Cloud, or New Relic.
  • Logs and SIEM — structured JSON consumed by ELK, Splunk, Grafana Loki, or Datadog Logs, with authentication failures, rate-limit breaches, DLP violations, and budget events on separate streams so a SIEM can subscribe selectively. Audit records export as JSON, CSV, or PDF, or stream via the event pipeline.
  • LLM-specific tracing — Langfuse for generation and session tracking.

What about ticketing, alerting, and billing?

Section titled “What about ticketing, alerting, and billing?”

Outbound webhooks with signed payloads, event filtering, retry with exponential backoff, and delivery tracking integrate with ServiceNow, Jira, Slack, PagerDuty, or any HTTP endpoint. Events cover security, budget, DLP, authentication, provider health, and agent fleet. Email notification is built in, and Stripe is supported natively for deployments that resell governed AI access.

How does AgentWatch work with existing network security?

Section titled “How does AgentWatch work with existing network security?”

It sits behind whatever is already in place. All egress can be routed through a corporate proxy or CASB — Zscaler, Forcepoint, Netskope — via standard proxy environment variables. Production deployments are typically fronted by HAProxy, NGINX, or a cloud load balancer, and can sit behind a cloud WAF for L3/L4 absorption. Endpoint agents authenticate to the gateway with mutual TLS.

Does AgentWatch integrate with MCP?

Section titled “Does AgentWatch integrate with MCP?”

Yes, in both directions. It proxies external MCP servers behind one governed endpoint with per-server access-control lists, DLP on tool arguments and responses, permission-filtered tool discovery, and per-tool rate limits — and it exposes its own MCP tool surface for code and knowledge queries. See Agent fleet and insider risk.

Which standards does AgentWatch implement?

Section titled “Which standards does AgentWatch implement?”

OpenAI API compatibility, Model Context Protocol, OAuth 2.0/2.1 and OIDC, SAML 2.0, LDAP v3, SCIM v2 (RFC 7644), SARIF 2.1, CWE and OWASP classification, and the GDPR, HIPAA, SOX, and PCI-DSS control frameworks. Transport support covers TLS 1.2/1.3, HTTP/1.1, HTTP/2, HTTP/3 over QUIC, WebSocket, and server-sent events.

How do I connect a client SDK?

Section titled “How do I connect a client SDK?”

Change the base URL and the key — that is the whole integration for OpenAI, Anthropic, LangChain, LlamaIndex and anything built on them:

Terminal window
export OPENAI_BASE_URL="https://<your-agentwatch-host>/v1"
export OPENAI_API_KEY="ak_…"

For estates too large even for that, transparent proxy mode maps provider hostnames to the gateway so existing applications route through it with no change at all — see gateway rules.

How do I connect monitoring?

Section titled “How do I connect monitoring?”
Terminal window
# Prometheus
curl -s https://<your-agentwatch-host>/metrics | head

OpenTelemetry traces go to any OTLP collector, and the event pipeline streams to Kafka or ClickHouse. Both are configured under Settings → System, which shows live pipeline status — so you can tell “configured” from “running”, which is the distinction that matters when data is not arriving.

How do I connect an identity provider?

Section titled “How do I connect an identity provider?”

SAML, OIDC, LDAP and SCIM are covered step by step, including what to paste where and how to test before rollout, in Single sign-on and directory sync.

How do I get alerts into our tooling?

Section titled “How do I get alerts into our tooling?”

Webhooks fire on security and budget events — security.rate_limit_exceeded, security.suspicious_activity, budget thresholds — with HMAC signing and retry. Point them at your alerting endpoint and filter on the event name.

Email notification supports SMTP, SendGrid, SES and Google Workspace OAuth2, configured under Settings → System → Notifications.

Verifying an integration

Section titled “Verifying an integration”

Whatever you connect, prove it with one real event rather than a green configuration panel:

Integration Proof
SDK One completion, then the row in Usage Insights
Prometheus A non-zero counter after that request
Event pipeline A record arriving in Kafka/ClickHouse for that request
Webhook Trip a small rate limit deliberately and catch the delivery
SSO A pilot sign-in from a private window
SCIM Push one user, then de-provision them and confirm the key dies

Sources and references

Section titled “Sources and references”