Models and privacy labels

Every model in AnonRouter is a route with a declared privacy guarantee, a set of capabilities, and a price. Model IDs follow a creator/model slug, for example meta-llama/llama-3.3-70b. The router also resolves a model's raw provider route id, so either form works in a request.

List models

GET /v1/models returns the models enabled on the deployment. It requires an inference or management key.

curl "https://control.anonrouter.ai/v1/models" \
  -H "Authorization: Bearer $ANONROUTER_API_KEY"

Each entry describes one model:

Illustrative model object

{
  "id": "meta-llama/llama-3.3-70b",
  "object": "model",
  "owned_by": "meta-llama",
  "display_name": "Llama 3.3 70B",
  "provider": "venice",
  "model_type": "text",
  "privacy_class": "private",
  "provider_privacy_class": "private",
  "context_window": 65536,
  "max_output_tokens": 4096,
  "pricing": {
    "input_usd_per_million_tokens": 0.7,
    "output_usd_per_million_tokens": 2.8,
    "unit_usd": null
  },
  "capabilities": {
    "embeddings": false,
    "streaming": true,
    "tools": true,
    "web": false,
    "reasoning": {
      "supported": false,
      "effort_configurable": false,
      "supported_efforts": [],
      "can_disable": false,
      "default_effort": null,
      "always_on": false
    }
  },
  "routing": {
    "enabled": true,
    "quality_tier": 4,
    "tasks": ["general", "coding"],
    "expected_latency_ms": 900
  }
}

The endpoint is the source of truth

Field values above are illustrative. Prices, context windows, and the enabled model set change over time. Read them from the live endpoint rather than hard-coding them.

model_type is one of text, image, tts, or embedding. For flat-priced media models, pricing.unit_usd is the per-image or per-character price and the per-token fields are null.

Public catalog

GET /v1/catalog/models is an unauthenticated, cacheable view of the catalog with richer privacy metadata (privacyLevel, privacySummary, privacyNotes, moderation, and modalities). It supports ETag and returns 304 when unchanged, which makes it convenient for a public model browser.

Privacy labels

Every route carries one privacy classification. The label tells you the strongest guarantee that route actually provides.

Label	`privacy_class`	What it means
Anonymous	`anonymous`	Your identity is hidden, but the model provider can see the prompt while serving it. Provider retention is not guaranteed.
Private	`private`	Prompt and response content is not retained after the request completes.
TEE	`tee`	Inference runs inside a hardware-isolated, attestable enclave.
E2EE	`e2ee`	Your client encrypts the prompt so that only a verified enclave can decrypt it.

AnonRouter never stores payloads

These labels describe the upstream provider handling. Regardless of the label, AnonRouter itself does not write prompts or responses to disk. On Anonymous routes the provider can still see the prompt, so provider zero-retention is not guaranteed there.

Read `privacyNotes`, not just the label

The label is a category; the per-route notes are the actual boundary, and on two of them the difference matters.

E2EE says the enclave you verified is the only thing that can decrypt — not that it is the machine running the model. On some Venice routes the enclave that holds your key is a verified gateway rather than the model host: it decrypts and forwards the plaintext onward inside the provider. The route's privacyNotes say so.

private is a retention promise, not an enclave. Phala AI, for instance, is an aggregator gateway that decrypts before forwarding and carries no attestation at all. A provider whose name evokes confidential computing is not thereby a TEE route.

TEE and E2EE labels describe the route modality; they do not by themselves claim a particular strength of attestation. See the E2EE client guide for encrypted transport setup and TEE verification and encrypted inference for the live provider matrix, verification levels, public evidence API, request receipts, and the opaque NEAR v2 protocol.

Capabilities

The capabilities block tells you what a model supports before you call it:

streaming: server-sent event streaming.
tools: tool-calling fields are accepted and forwarded to the model.
web: the model can use web access.
embeddings: the model is an embedding model.
reasoning: whether reasoning is supported, whether the effort level is configurable, which efforts are attested, and whether it can be disabled. See reasoning controls.

Moderation

Moderation is a property of the model, not a router policy. Models published as uncensored run unfiltered. The public catalog exposes a moderation field so you can filter the catalog by it.

Model health

GET /v1/models/uptime?model=<id>&days=<n> returns a passive success-rate and latency series for a model, computed from request metadata.