Develop / Reference
Messages
Generates a model response in the format of the Anthropic Messages API and inspects the system prompt and messages with Noirdoc Shield when Shield is active.
/v1/messages - Family
- chat
- Shield
- yes
- Streaming
- yes, SSE
- Format
- JSON
- Billing
- tokens
Request
The gateway accepts the body in the format of the Anthropic Messages API. model is required. The endpoint accepts only models whose provider speaks the Anthropic format: Claude through Google Vertex, or your own provider key (BYOK) for Anthropic or another Anthropic-compatible provider. The gateway answers any other model with 400 wrong_endpoint_for_model.
In the Anthropic SDK, set the base URL to https://api.noirdoc.de, without /v1. The SDK appends /v1/messages itself.
The SDK sends the key passed as api_key (TypeScript: apiKey) as x-api-key, and the key passed as auth_token (TypeScript: authToken) as Authorization: Bearer. The gateway accepts both headers. Anthropic SDK & Claude Code describes how to set up Claude Code.
curl https://api.noirdoc.de/v1/messages \
-H "x-api-key: $NOIRDOC_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "<model-id>",
"max_tokens": 1024,
"messages": [
{
"role": "user",
"content": "What does Mr Müller write to the firm?"
}
]
}'import os
import anthropic
client = anthropic.Anthropic(
base_url="https://api.noirdoc.de",
api_key=os.environ["NOIRDOC_API_KEY"],
)
message = client.messages.create(
model="<model-id>",
max_tokens=1024,
messages=[
{
"role": "user",
"content": "What does Mr Müller write to the firm?",
}
],
)
print(message.content[0].text)import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({
baseURL: "https://api.noirdoc.de",
apiKey: process.env.NOIRDOC_API_KEY,
});
const message = await client.messages.create({
model: "<model-id>",
max_tokens: 1024,
messages: [
{
role: "user",
content: "What does Mr Müller write to the firm?",
},
],
});
console.log(message.content);GET /v1/models lists the model IDs of the Claude models.
What Noirdoc changes
| Area | Behaviour |
|---|---|
| Model | The gateway resolves the model ID through the catalogue and sends the provider its own model name. If the response’s model field contains this name, the gateway replaces it with the ID you sent. |
| Provider | The X-Noirdoc-Provider header in the response names the provider, including on a provider error. For streams, the header is missing if the provider answers only after 15 seconds; a comment line : provider=<slug> then names the provider, see Streaming. See Providers & routing. |
anthropic-version | The gateway always sends anthropic-version: 2023-06-01 to Anthropic, even if your client sends a different value. |
| Google Vertex | If the model runs at Google Vertex, the gateway converts the model, version and anthropic-beta into the form Vertex expects. Your request to /v1/messages stays the same. |
| Noirdoc Shield | When Shield is active, the gateway replaces sensitive values in system and messages in-place with fixed placeholders ([PERSON], [IBAN], …) or rejects the request with 403 shield_violation on a block match (such as secrets or prompt injection) — without prepending a system instruction, modifying the model response or holding back stream chunks. Inspected fields lists the inspected fields. Reversible placeholder masking (<<PERSON_1>>) applies only to pre-existing legacy organisations until 30.11.2026 (Legacy masking). |
| Files and images | image and document blocks are allowed only if admins of your organisation have turned on Allow file and image attachments in requests under Models → Shield (Advanced Settings). Shield inspects inline UTF-8 text files under 4 MiB directly; binary PDFs or images return X-Noirdoc-Shield: partial; redacted=<n> or 422 shield_uninspectable_content under enforced. Details: Files and images and Files. |
| File references | With providers managed by Noirdoc, files (source of type file), containers and custom skills in container.skills must have been created through your organisation. Otherwise, the gateway answers with 404 object_not_found. |
| Headers | The gateway removes your key, X-Noirdoc-Shield and X-Noirdoc-Mask before forwarding the request. |
Sub-routes
| Method | Path | Purpose |
|---|---|---|
POST | /v1/messages | generate a response |
POST | /v1/messages/count_tokens | count the tokens of a request |
count_tokens requires model and runs through the catalogue like /v1/messages. Under Noirdoc Shield, POST /v1/messages/count_tokens skips Shield inspection at €0 (only under legacy masking until 30.11.2026 is the request masked before counting). Claude Code uses this endpoint for exact token counts; without it, Claude Code estimates the context size from the characters.
If the model runs at Google Vertex, the gateway forwards count_tokens to Vertex’s count-tokens counting method. To do so, it converts the model ID into the form Vertex expects. If Vertex rejects the request, you receive Vertex’s status code and message under the code provider_rejected_request.
count_tokens generates no model response. The gateway logs the call, skips Shield and bills €0. There is no cost estimate before forwarding. With providers managed by Noirdoc, the following still applies: if the organisation’s credit or the key’s budget is used up, the gateway answers with 402.
The gateway answers other paths under /v1/messages/ with 404 unsupported_endpoint.
Errors on this endpoint
| Status | Code | Meaning |
|---|---|---|
| 400 | model_required | The request names no model (model in the body, or in the form field for /v1/audio/transcriptions). |
| 400 | wrong_endpoint_for_model | The model belongs to a different endpoint family or API format than the endpoint called. |
| 400 | invalid_request_body | The body is not a JSON object or not encoded in UTF-8. |
| 402 | insufficient_credit | The organisation's credit is used up or lower than the estimated maximum cost of the request (including Noirdoc Shield, also on BYOK routes when Shield is active). |
| 402 | key_budget_exhausted | This key's budget is used up for the current period or does not cover the estimated cost of the request. |
| 403 | reference_not_available_on_platform | The body refers to objects at the provider (such as conversation, prompt.id or vector_store_ids) whose ownership the gateway cannot check for managed providers. |
| 403 | model_not_allowed_for_key | The model is not one of this key's allowed models. |
| 403 | provider_not_allowed_for_tenant | The organisation counts as bound by professional secrecy (§ 203 StGB); this excludes every provider that offers this model. |
| 403 | provider_not_allowed_for_key | The key's restrictions (providers, data residency, CLOUD Act, § 203) exclude every provider of this model. |
| 403 | starter_model_not_allowed | The organisation is still using only its starter credit, and the model or its managed provider is not included in starter credit. |
| 403 | shield_violation | Noirdoc Shield blocked the request before forwarding to the provider because an active protection filter configured with block matched; message names the triggered rule (secrets, pii, ner, injection or custom). |
| 403 | file_content_not_allowed | The request contains files, images or audio, and the organisation does not allow file content. |
| 403 | file_pii_blocked | A file contains personal data, and the organisation's legacy file analysis (transition until 30.11.2026) is set to block or to detect_only under enforced. |
| 404 | object_not_found | The object (file, skill or stored response) does not exist or does not belong to your organisation. |
| 404 | model_not_available | The model ID is not available to the organisation. |
| 413 | shield_input_too_large | The text to inspect in this request exceeds the Shield service limit of 4 MiB of encoded text in a single call. |
| 422 | shield_uninspectable_content | The Shield policy is enforced, and the request carries content that Shield cannot inspect as text (binary_document such as PDF or Office, media_not_inspectable such as images, audio or video, file_reference by ID or URL, file_too_large at 4 MiB or above, file_not_decodable or unrecognised_content). The gateway did not forward the request. |
| 422 | shield_config_invalid | The organisation's stored Shield configuration is invalid (for example enforced without any active protection filter, or a pattern that fails compilation); the gateway did not forward the request. |
| 422 | file_unprocessable | A file could not be processed in legacy file analysis (transition until 30.11.2026): it is too large, unreadable or in a format without analysis. The gateway did not forward the request. |
| 500 | detection_error | Detecting personal data in legacy masking (transition until 30.11.2026) failed; the gateway did not forward the request. |
| 502 | provider_misconfigured | The configuration of the selected provider is invalid, for example a base URL that is not allowed. |
| 502 | provider_unreachable | The gateway could not connect to the provider, or the connection dropped. |
| 503 | ownership_check_unavailable | The gateway could not check just now whether the object belongs to your organisation and rejected the request. The response contains Retry-After with 5 seconds. |
| 503 | shield_unavailable | The Noirdoc Shield inspection service is temporarily unreachable; the gateway never forwards a request that requires inspection uninspected (fail-closed). The response contains Retry-After with 5 seconds. |
| 504 | provider_timeout | The provider did not answer within the gateway's timeout. The response contains Retry-After with 10 seconds. |
Anthropic reference
Anthropic’s API reference for version 2023-06-01 describes all other request and response fields: Messages and Count tokens (checked on 30 September 2026).