Google Vertex AI

Vertex AI is the Google Cloud–resident way to call Gemini: your project, your region, your billing, your IAM. Sentisec connects to it with a service-account key stored on your workspace, and speaks Vertex's OpenAI-compatible chat-completions surface — so any OpenAI-shaped client works unchanged.

Two things make Vertex different from every other provider on this site, and both are covered below: it authenticates with a service account rather than an API key, and you must pin it explicitly on the request.

Before you start

Connect it to your workspace

In the dashboard, open Settings → Providers. Under Provider keys, choose Add Vertex AI key and fill in three fields:

Click Save credential, then issue a Sentisec API key under Settings → API keys → Issue key if you do not already have one. The credential takes effect on your next request; there is nothing to restart.

Sentisec exchanges the service account for a short-lived Google OAuth access token at request time, keeps it warm, and refreshes it before it expires. You never mint or rotate a token yourself — rotating the service-account key in GCP and re-pasting it is the whole lifecycle.

Pin Vertex on the request

This is the step that is easy to miss and expensive to get wrong.

Vertex model ids are publisher-prefixed — google/gemini-2.5-flash — and that vendor/model shape overlaps how other providers name their models. Sentisec will not guess from it. If you do not name Vertex explicitly, your request goes somewhere else (or fails to resolve a provider at all).

Send the header on every Vertex request:

X-Sentisec-Upstream-Provider: vertex

Sentisec consumes that header and strips it before forwarding, so Google never sees it.

If you would rather every request from a workspace default to Vertex without the header, ask us to set that default for your workspace.

First call

curl -X POST https://api.sentisec.ch/ws/<your-workspace-id>/v1/chat/completions \
  -H "Authorization: Bearer $SENTISEC_API_KEY" \
  -H "X-Sentisec-Upstream-Provider: vertex" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "google/gemini-2.5-flash",
    "messages": [{"role": "user", "content": "hi"}]
  }'

The response is the standard OpenAI Chat Completions body. The session appears under Sessions in the dashboard.

OpenAI SDKs

Set the header once on the client and every call carries it.

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.sentisec.ch/ws/<your-workspace-id>/v1",
    api_key=os.environ["SENTISEC_API_KEY"],
    default_headers={"X-Sentisec-Upstream-Provider": "vertex"},
)

resp = client.chat.completions.create(
    model="google/gemini-2.5-flash",
    messages=[{"role": "user", "content": "hi"}],
)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.sentisec.ch/ws/<your-workspace-id>/v1",
  apiKey: process.env.SENTISEC_API_KEY!,
  defaultHeaders: { "X-Sentisec-Upstream-Provider": "vertex" },
});

const resp = await client.chat.completions.create({
  model: "google/gemini-2.5-flash",
  messages: [{ role: "user", content: "hi" }],
});

Streaming ("stream": true) and OpenAI-format tool calling both work on this surface, and tool calls are gated exactly as they are on every other provider.

Model ids

Vertex ids carry the publisher prefix. These are the ones surfaced in model discovery:

Which ids your project can actually call depends on the model-access entitlements you have provisioned in Google Cloud, not on Sentisec. If Vertex rejects a model, the upstream error body comes back to you intact.

Endpoints and regions

Sentisec builds the endpoint from your credential, per request:

https://<location>-aiplatform.googleapis.com/v1/projects/<project-id>/locations/<location>/endpoints/openapi/chat/completions

The global location uses the un-prefixed aiplatform.googleapis.com host instead. This is why project and region are part of the credential rather than settings you configure once for the whole account: two workspaces can point at two different projects and regions with no shared state.

Embeddings

Embeddings are not available on the Vertex OpenAI-compatible surface — a request there returns 404 embeddings_not_supported_for_provider. Use Google Gemini (gemini-embedding-001) or OpenAI for embeddings.

If something goes wrong

More: Provider unavailable.

See also

• Google Gemini — the API-key route, when you do not need a GCP-resident deployment
• Providers — every provider Sentisec carries
• Enterprise — in-VPC deployment