How a request is served

Aile routes in-path. Your request goes through the relay, which selects a sharer, prices the call, takes payment, relays to the provider, meters what was used, and splits the proceeds. It is not a registry that hands you an address and steps aside.

The sequence

Format. The path you POSTed to decides the wire dialect: /v1/chat/completions is OpenAI Chat, /v1/responses is OpenAI Responses, /v1/messages is Anthropic. This one decision also fixes the shape of any error you get back.
Key gate. The sk-aile- key is read from Authorization: Bearer or x-api-key, hashed, and looked up. Its pinned filters are loaded here: a request header can narrow them but never widen them.
Model resolution. Every request names its provider: a <providerId>/<model> prefix, a bare id plus x-aile-provider, or a bare id on a provider-pinned key. Aliases (cc/ for claude) are resolved at this boundary and re-substituted on the way out, and local/<model> means self-hosted. A bare id with none of these is a 400, refused before anything is reserved or dialled, except from Claude Code (routed to claude) and the Codex CLI (routed to codex). A body that is not a JSON object reads as naming no model. A named route matching one of the key's aliases is used exactly as named instead.

Two more refusals land here, before the key's budget is checked or anything is held: a provider that cannot speak the endpoint you posted to is a 404 naming the provider and the path, and another provider's prefix sent to a pinned provider whose model ids carry no prefix of their own (codex/… on a key pinned to claude) is a 400 naming both.
Pool build. Every sharer who can serve that model, filtered by capacity kind, provider, account, node, seller, attestation and price cap.
Ordering. Sorted by quoted price ascending: un-quotable sorts last. Only within a band of sharers quoting the same price does a health-weighted draw run. Sharers whose model has passed its test are tried before untested ones, in price order inside each group. See Routing & failover.
Payment reservation. On the balance path, an estimate is reserved against your own wallet, computed from the output ceiling your request authorises. On the x402 path, payment is verified before the sharer's quota is spent. Each sharer's rate is read once, at its quote, and carried to the charge, so a price change mid-request cannot move what you pay.
Dispatch. Each attempt is one dial. Pre-dispatch refusals (a cooling account, a sharer with no payout wallet, a saturated slot) cost nothing and do not consume the attempt budget. If you hang up before an answer exists, no further sharer is dialled and the charge is voided.
Serve. One of three paths, depending on what the sharer listed. This is where the privacy properties differ; see below.
Meter and settle. Real usage replaces the estimate, and on the balance path the platform fee is taken from the sharer's share atomically at settlement. A stream an Anthropic- or Responses-format provider cuts off before its own end event cools that account for ten minutes, so the next request goes elsewhere.

The three serve paths

Self-hosted. The relay hands the request to the sharer's node, which runs the model itself. Weights never move. The node reads the prompt, because it is the thing answering it.

Subscription (through a node). The relay injects the custodied credential and the sharer's node forwards TLS ciphertext in both directions. The node is blind. The relay terminates TLS with the provider, and that is how it meters the call.

Nodeless. No machine of the sharer's is in the path at all; the relay dials the provider directly. Same visibility to the relay, no node to be blind. The non-chat endpoints (images, audio, video, music, embeddings and the rest) are served this way only, from one account per request with no failover.

What Aile can see puts these side by side.

Cross-format serving

Your endpoint and the provider's wire shape are independent. Aile composes two translator layers:

a source bridge converts a non-OpenAI request body into canonical OpenAI Chat first;
a format translator converts canonical OpenAI Chat into the provider's own shape: the Codex Responses API, Anthropic Messages, and others.

One gate decides whether a given sharer can serve a given caller format at all, so a request that cannot be translated is never dispatched and then failed.

What comes back

The decision is reported in headers that arrive with the response head, before the first token on a stream:

HTTPhttp

1x-aile-sharer: 9c2e8b7d06315a4e
2x-aile-node: a3f19c2e
3x-aile-capacity: subscription
4x-aile-blind: true
5x-aile-attempts: 2
6x-aile-price: 0.0182

x-aile-blind describes what the node saw, or says "no node" for nodeless. It is not a claim about what the relay saw. x-aile-sharer is an internal id, not the L… handle you pin a sharer with. Full list: Headers.

Two exceptions to "the status code tells you":

A slow reply is held. A streaming request with no answer after 25 seconds (never one paid with x402) is committed to 200 and kept alive until the answer exists. It carries x-aile-edge-hold in place of the headers above (self-hosted capacity, which never fails over, keeps them), and a later failure arrives as the SDK's error frame inside the stream.
502 and 504 arrive as 503. The edge in front of Aile replaces an origin 502 or 504 with its own page, so /v1 sends both as 503 and puts the real code in x-aile-status. SDKs retry any 5xx alike.

Where the money goes

Path	Caller pays	Sharer receives	Platform
x402	list × margin	100%	nothing
Balance debit	list × margin	90%	10%, from the sharer's share
Balance debit, $AILE tab	98% of that	the same 90% of list	the derived remainder

The arithmetic, including why the $AILE case leaves the sharer exactly level: Money.