Add AgentQ Integration
AgentQ uses the AI provider configured for your deployment. You can select the Qualytics-managed provider (Beta) without supplying a separate model or API key, or connect a supported external provider with your organization's credentials. This guide covers both options. For the full list of providers you can connect and the models each one offers, see Supported AI Providers.
Prerequisites
- A Qualytics account with the Manager or Admin role. The AI provider configuration is a deployment-wide setting, so no team permission is involved.
- If you choose an external provider, the credentials and provider-specific configuration it requires.
Field reference
The steps below open the Set up AgentQ page. Its General tab holds a Connection section, where you pick one of two setup paths, and a Business Context section that both paths share. What the Connection section asks for depends on the path you pick.
Easy setup, marked Beta, runs AgentQ on Qualytics AI. The gateway owns the provider, the model, and the credential, so there is nothing to fill in under Connection. The section shows a single Qualytics AI gateway panel with the note Model chosen and kept current by Qualytics. If the path is missing, see When the Qualytics Provider Is Not Listed.
| Field | Required | Type | Description |
|---|---|---|---|
| Business Context | Text | Describe your team's data quality focus, responsibilities, and domain. AgentQ reads this context back on every answer, so its responses and suggestions match your organization. Up to 2000 characters, with a counter below the box. The section carries a Required badge and you cannot leave the General tab until it is filled in. |
Custom setup connects your own provider with your organization's credentials. Selecting a provider reveals the fields that provider needs, so the form is not the same for any two providers. For the full list of providers and the models each one offers, see Supported AI Providers.
| Field | Required | Type | Description |
|---|---|---|---|
| Provider | Option | The external provider that runs AgentQ. Type to filter the list. Changing the provider clears the model and resets the provider-specific fields to that provider's defaults. | |
| Model | Option / Text | The model AgentQ calls. Type any model name the provider or gateway accepts. The arrow button offers example models, but the list does not limit what you can enter. | |
| API Key | Text | The credential the selected provider requires. It is stored encrypted and never displayed again. Hidden for Amazon Bedrock with IAM Role authentication, which stores no credential. For Amazon Bedrock with AWS access keys, the field is labeled AWS Secret Access Key. For Apigee authentication, it is labeled Apigee Client Secret. | |
| Base URL | Text | A custom endpoint for a provider that serves a compatible API, such as Ollama, OpenRouter, or LiteLLM. Leave it blank to use the provider's own endpoint. | |
| Authentication Method | Option | For OpenAI-compatible providers and Azure OpenAI, API Key (the default) sends the key you enter with every request. Apigee OAuth 2.0 (client credentials) instead exchanges an Apigee consumer key and secret for a bearer token at a token URL you provide. Amazon Bedrock offers its own authentication methods, described below. See Using an Apigee-Fronted or Header-Gated Gateway below. | |
| API Style | Option | OpenAI provider only. Responses API (the default) is what OpenAI itself serves. Choose Chat Completions API when the Base URL points at a gateway or proxy that serves only /chat/completions; most enterprise gateways do. Other OpenAI-compatible providers use their own API style and do not expose this choice. |
|
| Token Limit Parameter | Option | OpenAI provider with Chat Completions API only. max_completion_tokens (the default) is what current OpenAI models expect. Choose max_tokens when the gateway fronts other models and rejects max_completion_tokens. |
|
| Custom request headers | Text | OpenAI-compatible providers and Azure OpenAI only. Extra HTTP headers sent with every request, for gateways that require them. Turn on Secret for a header whose value is a credential; it is stored encrypted and never shown again. See Using an Apigee-Fronted or Header-Gated Gateway below. | |
| Business Context | Text | Describe your team's data quality focus, responsibilities, and domain. AgentQ reads this context back on every answer, so its responses and suggestions match your organization. Up to 2000 characters, with a counter below the box. The section carries a Required badge and you cannot leave the General tab until it is filled in. |
Provider-specific fields. These appear between API Key and Base URL, and only for the provider that needs them. Connect AgentQ stays unavailable until the required ones are filled in.
Amazon Bedrock
| Field | Required | Type | Description |
|---|---|---|---|
| Authentication Method | Option | How Qualytics authenticates to Bedrock. The options are API Key (bearer token), AWS Access Keys, and IAM Role (pod identity or assumed role), and the default is API Key (bearer token). Your choice decides which of the fields below appear. See Amazon Bedrock Authentication. | |
| AWS Access Key ID | Text | Shown for AWS Access Keys only. The non-secret half of the key pair. The secret half goes in AWS Secret Access Key. | |
| IAM Role ARN (optional) | Text | Shown for IAM Role only. Leave it blank to use the AWS identity assigned to your deployment, or enter a role for Qualytics to assume. Managed deployments require one. | |
| External ID (optional) | Text | Shown for IAM Role only. Used for confused-deputy protection when the target role lives in another AWS account. | |
| AWS Region | Option | The AWS region your Bedrock endpoint runs in. Defaults to us-east-1. |
Azure OpenAI
| Field | Required | Type | Description |
|---|---|---|---|
| Azure OpenAI Endpoint | Text | The resource endpoint, in the form https://your-resource.openai.azure.com. |
|
| API Version | Text | The Azure OpenAI API version to call. Defaults to 2024-12-01-preview. |
Google Vertex AI
| Field | Required | Type | Description |
|---|---|---|---|
| GCP Project ID | Text | The Google Cloud project that hosts the model. | |
| GCP Location | Option | The Google Cloud region to call. Defaults to us-central1. |
Snowflake Cortex
| Field | Required | Type | Description |
|---|---|---|---|
| Snowflake Account Identifier | Text | Your account in orgname-accountname form, such as myorg-myaccount. Qualytics builds the full Cortex endpoint from it, so you never type the endpoint yourself. |
The page displays a data-processing notice for whichever path you select, naming who processes the data AgentQ sends. For Easy setup the notice explains that the data is processed on Amazon Web Services (AWS), which acts as a data processor; for an external provider it names that provider and points to its own data use and privacy policies. Review the notice and your organization's data-handling requirements before connecting.
Steps
Step 1: Click AgentQ in the left sidebar.
Step 2: At the bottom of the AgentQ sidebar, under Manage, click Settings . Beside the Manage label, a status dot and the provider name, or Not connected, show the current state. The Settings entry appears only for the Manager and Admin roles. While no provider is connected, the page is titled Set up AgentQ with a Not connected pill, and opens on the General tab.
Two other ways in
While no provider is connected and no conversation exists yet, the AgentQ page itself shows a preview headed Ask about your data. Act on the answer. with Easy setup and Custom setup cards; clicking a card opens the same page with that path already selected. The AgentQ row on Settings > Integrations also offers a Set up AgentQ button that leads here.
Step 3: Under Connection, pick a path. Easy setup reads Runs on Qualytics AI. and Custom setup reads Bring your own provider, model, and key.
Step 4: Fill in the required fields for the path you picked and write the Business Context. The Field reference above lists what each path asks for. Review the data-processing notice shown below the form.
Step 5: Click Continue. Until the tab is complete, the hint above the buttons reads Finish the Connection tab to continue. The page moves to the Access Control tab. Back returns to General.
Step 6: Pick how much of your data AgentQ may share with the provider. The default is Source data shared, which turns everything on. Each level lists the capabilities it adds, shown as the screens they appear in. See Configure Access Controls for what each level means.
Step 7: Click Connect AgentQ. The hint above it reads Nothing is sent to a provider until you connect. Discard drops everything you entered instead.
Info
Qualytics sends a minimal request to the selected provider to test the connection before storing the configuration. For an external provider, this test also validates the supplied credentials. If the test fails or the provider is unreachable, an error appears and nothing is connected.
Step 8: The toast AgentQ is connected appears and you land on the chat. Under Manage, the status dot turns green beside the provider's name, Qualytics AI for Easy setup, and the Audit entry appears for Admins. The AgentQ row on Settings > Integrations now shows the provider with a Connected badge and an Open AgentQ button.
Once connected, AgentQ is ready to use. See AgentQ Overview for next steps.
Using an Apigee-Fronted or Header-Gated Gateway
Many organizations reach their language models through an internal API gateway. The gateway speaks the OpenAI chat completions API, so the OpenAI provider with a custom Base URL already knows how to talk to it, but the gateway only accepts requests that carry its own headers, a bearer token issued by Apigee, or both. The settings below cover this, with custom headers and Apigee authentication available for every OpenAI-compatible provider and for Azure OpenAI. They are not tied to a particular gateway.
1. Provider, Model, Base URL and API Style
Under Custom setup, select OpenAI. This recipe uses the OpenAI provider on purpose: it accepts any model name the gateway exposes, and it is the one provider whose API style you can choose. Other OpenAI-compatible providers use their own default endpoints and API styles; this recipe assumes the selectable API style of the OpenAI provider. Type the model name supplied by your gateway into the Model field. You do not need to select an example or press Enter to keep it. Any name is accepted here; whether the gateway accepts it is checked when you save. Enter the gateway endpoint as the Base URL up to and including the version segment. The client appends the API path on its own:
Set API Style to Chat Completions API; the OpenAI provider otherwise uses OpenAI's Responses API, which a gateway that serves only /chat/completions answers with a 404. If the gateway fronts models other than OpenAI's and rejects the max_completion_tokens field, also set Token Limit Parameter to max_tokens.
2. Authentication Method
Leave API Key selected when the gateway takes a static key in the Authorization header. Select Apigee OAuth 2.0 (client credentials) when the gateway expects a token minted by Apigee. The form then asks for:
| FIELD | DESCRIPTION |
|---|---|
| Apigee Token URL | The full address of your Apigee proxy's token endpoint, typically ending in /oauth/token or /oauth/accesstoken. Your Apigee team provides it. |
| Apigee Client ID | The consumer key of the Apigee developer app registered for Qualytics. |
| Apigee Client Secret | The developer app's consumer secret. This replaces the API Key field and is stored encrypted. |
| Scope | Optional. Leave blank unless your API product requires one. |
| Client Credentials Sent As | How the key and secret reach the token endpoint. The default, an HTTP Basic Authorization header, matches Apigee's standard policy. Choose form parameters only if your proxy was configured to read client_id and client_secret from the request body. |
| grant_type Parameter Location | Where grant_type=client_credentials is placed. The default, the request body, matches Apigee's standard policy. Choose the query string only if your proxy was configured that way. |
Qualytics requests a token with the client credentials grant, sends it as Authorization: Bearer on every model call, and requests a new one shortly before it expires. If the gateway rejects a token as expired, Qualytics requests a fresh one and retries the call once.
3. Custom request headers
Click Add header for each header the gateway requires and enter its name and value. Turn on Secret for a header whose value is a credential, such as a gateway API key: its value is stored encrypted, is never shown again, and stays in place when you edit the configuration later unless you type a new one.
A value can contain placeholders that Qualytics fills in on every request, which is how per-request tracing headers are configured:
| PLACEHOLDER | FILLED IN WITH |
|---|---|
{{uuid}} |
A new random UUID (version 4) |
{{utc_iso8601}} |
The current UTC time, for example 2026-09-18T14:05:00.000Z |
{{utc_iso8601_no_zone}} |
The same time without the trailing Z, for gateways that validate against that pattern |
For example, a gateway that wants a client identifier, a secret key, a fresh request ID and a timestamp on every call would be configured as:
| HEADER | VALUE | SECRET |
|---|---|---|
x-client-id |
APP123 |
|
x-api-key |
the key issued by the gateway | |
x-request-id |
{{uuid}} |
|
x-request-date |
{{utc_iso8601}} |
Headers the client sets itself, such as Authorization and Content-Type, cannot be overridden here.
Note
When you click Connect AgentQ (or Save changes when editing), the connection test sends a request through the full path, so a wrong header, a missing scope, a rejected client secret, or a model name the gateway does not know is reported immediately rather than after the fact. The error shows a Validation log listing every request the test made (the Apigee token exchange, then the model request), with the failing one marked, including the request headers that were sent and the gateway's own response. The credentials you configured are masked in the log. Endpoint addresses, the values of headers you did not mark as secret, request bodies, and whatever the gateway put in its response are shown as they were sent and received, so review the log before sharing it outside your team.
Note
A stored secret is only ever sent to the destination it was entered for, and a change of host or of scheme (https to http) counts as a new destination. Which secrets you have to re-enter in the same save depends on where each one goes:
- With API Key authentication, changing the Base URL (or the Azure endpoint or Snowflake account) asks for the API Key again, and for the value of every secret header.
- With Apigee OAuth 2.0, changing the Apigee Token URL asks only for the Apigee Client Secret; secret headers stay stored because they never go to the token endpoint. Changing the Base URL asks only for the secret headers; the client secret stays stored because the token endpoint has not moved.
- Switching between API Key and Apigee OAuth 2.0 asks for the credential issued for the new method in the API Key / Apigee Client Secret field, even when the model and token endpoints share the same host.
For more detail on the Apigee side, see the Apigee documentation on the client credentials grant type and on requesting access tokens.