SASE Integration

Route AI API traffic from your SASE or secure web gateway through an Airia AI Gateway, so network AI usage is recorded and governed.

If your company routes internet traffic through a SASE or secure web gateway, you can send the AI API traffic that passes through it to an Airia AI Gateway. Every call is recorded and governed by that gateway's policies, then passed on to the AI provider, and the response returns to the user.

SASE is a cloud security service your company's internet traffic flows through. You may also hear it called a secure web gateway or secure service edge. Because outbound traffic already passes through it, it's a good place to pick up AI API calls from scripts, SDK applications, IDE assistants, and command-line AI tools.

This page covers the Discover → Connect side: creating the configuration and pointing your SASE at it. For the full integration build (per-vendor rule setup, credential passing, closing the direct path, and token rotation), see SASE Integration.

At a glance


Surface	Network
What it does	Records and governs AI API traffic from your network by passing it through an Airia AI Gateway
How Airia connects	Your SASE decrypts outbound AI API traffic and forwards it to your Airia gateway with the configuration's credential header
Who sets it up	Your network or security team, with an Airia admin for the configuration
Time	Varies by vendor

Supported platforms

SASE Integration works with cloud-delivered SASE and secure web gateway services that can decrypt AI provider traffic and forward it to your Airia gateway.

Platform	How traffic reaches Airia
Zscaler Internet Access	Forwarding rule to a third-party proxy, with the credential in a request header
Palo Alto Prisma Access	SSL Forward Proxy decryption, then a forward proxy you host (for example NGINX or Envoy) that sends each request to your Airia gateway with the credential header
Cloudflare	Zero Trust policy that redirects provider traffic to the configuration's URL, which carries the credential in its path
Netskope	Network-layer detection and routing

For network sites and devices where traffic goes through an on-premises firewall instead, deploy the Browser Extension and the Endpoint Agent to cover AI use on those devices.

Before you start

A cloud SASE or secure web gateway that your internet traffic already flows through, with SSL/TLS inspection available for AI provider traffic.
Your SASE's root certificate deployed to managed devices, so inspected traffic doesn't cause certificate errors.
An AI Gateway in Airia with the DLP policies, guardrails, and agent constraints you want applied to this traffic.
A Standard key on that AI Gateway. Open the gateway's Access & Keys section, click Create new Key, and choose Standard as the Key type. Requests that arrive through your SASE are recorded against this key, so create it before your network team sends test traffic.
An Airia role with the Manage SASE integration permission. The Platform Admin, Admin, and Security Admin roles include it.

Setup

Part A: Create the configuration in Airia

Open SASE Integration

In Airia, go to Discover → Connect and click the SASE Integration tile.
Click Create Configuration.

Fill in the configuration

Field	Value
Name (required)	A descriptive name, for example `Corp SASE - Prod`
Description (optional)	What this configuration covers
Gateway Configuration (required)	The Airia AI Gateway to route traffic through. Its guardrails, DLP policies, and monitoring apply to everything sent to this configuration
Enable Configuration	On. When disabled, the configuration doesn't accept traffic

Click Create. The configuration appears in the list. On its row, click the copy icon and choose how your SASE passes the credential:

Copy as Header for platforms that add a request header, such as Zscaler and Prisma Access.
Copy URL for Cloudflare, which redirects to a URL. The credential is part of the URL path.

Treat the copied header or URL like a secret. Anyone with it can send traffic through your gateway as your tenant.

Requests are recorded against the AI Gateway the configuration selects. To keep traffic segments apart in reporting, for example Dev and Prod, or one per SASE vendor, create a separate AI Gateway for each segment and a configuration that points at it. Each configuration gets its own credential.

Part B: Forward AI traffic from your SASE

This step is done in your SASE console, usually by your network or security team.

Match and decrypt AI provider traffic

Create a URL category for the AI provider hosts you want governed, and an SSL/TLS inspection rule that decrypts that traffic. Place the inspection rule above any bypass rules.

Forward it to Airia with the credential

Add a forwarding rule that sends the matched traffic to your Airia gateway host, the host name at the start of the configuration's URL. Add the header you copied with Copy as Header to each forwarded request. One endpoint works for every provider. On Cloudflare, redirect to the URL from Copy URL instead of adding a header.

Place the forwarding rule above your default route. Rules are evaluated top down, so an AI rule below a broad allow rule doesn't fire. Per-vendor steps are in SASE Integration.

Verify it worked

Send an AI API request from a device behind your SASE. Open Audit → Analytics → Gateway Monitoring, or the Observability section of the AI Gateway you selected in the configuration, and confirm the request appears. To confirm enforcement, send a prompt that one of the gateway's DLP policies should catch, such as a test credit card number, and check that the policy fires.

Troubleshooting

Symptom	Fix
No requests appear on the gateway	Confirm the forwarding rule sits above your default route and any broader allow rule, and that SSL/TLS inspection applies to the provider host.
Requests are rejected at the gateway	Confirm the credential is attached to each request exactly as copied, that the configuration is enabled, and that the selected AI Gateway has an enabled Standard key.
Users see certificate errors	Deploy your SASE root certificate to those devices.
Only some AI usage shows up	Make sure every location and user group you want covered routes through the SASE rule that forwards to Airia.
Traffic arrives but nothing is blocked	Attach DLP policies or guardrails to the AI Gateway selected in the configuration.

What you get

What Airia records

Object	Recorded?	Source
AI API requests and responses	Yes	Traffic forwarded by your SASE, recorded by the selected AI Gateway
Policy results	Yes	The DLP policies, guardrails, and agent constraints on that gateway
Agents / models / MCP & tools inventory	—	Not produced by this connector

Where it shows up

Forwarded requests appear in the usage and analytics of the AI Gateway you selected, alongside the gateway's policy results. Each request is recorded against the gateway's Standard key and the address of the system that forwarded it.

How often it syncs

Continuous. Each request is recorded as it passes through the gateway.

What you can do

Govern: see which AI providers and models are called from your network, and by how much.

Secure: every forwarded request is subject to the selected gateway's DLP policies, guardrails, and agent constraints. Changing the policies on that gateway changes what this traffic is subject to, with no change on the SASE side.

Capability	Supported
Discover	No. Requests appear in the selected AI Gateway's usage and analytics
Govern	Yes
Secure	Yes, through the selected AI Gateway's policies

SASE Integration: the full integration build, per-vendor notes, and token rotation.
Browser Extension: AI sites used in the browser.
Endpoint Agent: device-level AI discovery.
Cloudflare: network-level discovery and blocking through Cloudflare Gateway.