Overview

Azure is a cloud provider offering access to OpenAI and Anthropic models through the Azure OpenAI Service. Bifrost performs conversions including:

Deployment mapping - Model identifiers mapped to Azure deployment IDs with version handling
Authentication modes - API key, Entra ID (Service Principal), or Managed Identity (DefaultAzureCredential) with automatic environment detection
Model routing - Automatic provider detection (OpenAI vs Anthropic) based on deployment
v1 API - Uses /openai/v1/ endpoints for all operations except transcription, which uses the classic /openai/deployments/{model}/audio/transcriptions?api-version=... path as the v1 equivalent is not yet available
Custom endpoints - Full control over Azure endpoint configuration
Multi-model support - Unified interface for OpenAI, Anthropic (via Azure), and Gemini models
Request/response pass-through - Support for raw request/response bodies for advanced use cases

Supported Operations

Operation	Non-Streaming	Streaming	Endpoint
Chat Completions	✅	✅	`/openai/v1/chat/completions`
Responses API	✅	✅	`/openai/v1/responses`
Embeddings	✅	-	`/openai/v1/embeddings`
Files	✅	-	`/openai/v1/files`
List Models	✅	-	`/openai/v1/models`
Image Generation	✅	✅	`/openai/v1/images/generations`
Image Edit	✅	✅	`/openai/v1/images/edits`
Video Generation	✅	-	`/openai/v1/videos`
Context Compaction	✅	-	`/openai/v1/responses/compact`
Decisions	✅	-	`/openai/v1/decisions` (`gpt-6-luna`), `/providers/microsoft/v1/systemone` (`Microsoft-Decision-1`)
GPT Live	-	✅	`/openai/v1/live/sessions`
Image Variation	❌	❌	-
Batch	❌	❌	-
Text Completions	❌	❌	-
Speech (TTS)	✅	✅	`/openai/v1/audio/speech`, or `/tts/cognitiveservices/v1` for Azure AI Speech
Transcription	✅	-	`/openai/deployments/{model}/audio/transcriptions`, or `/speechtotext/transcriptions:transcribe` for Azure AI Speech

Azure-specific: Batch operations and Text Completions are not supported by Azure OpenAI Service. Responses API is available for both OpenAI and Anthropic models.

Setup & Configuration

Azure requires an endpoint URL, deployment mappings, and authentication configuration. Three authentication methods are supported.

The aliases field (mapping model names to Azure deployment IDs) requires v1.5.0-prerelease2 or later. On v1.4.x, use deployments inside azure_key_config instead - see the v1.5.0 Migration Guide for details.

1. Default Credential (System Identity)

Leave value and all Entra ID fields empty. Bifrost calls azidentity.NewDefaultAzureCredential(nil), which tries credential sources in this order:

Environment variables (AZURE_CLIENT_ID + AZURE_CLIENT_SECRET + AZURE_TENANT_ID, or certificate/username variants)
Workload Identity (AKS with Workload Identity Federation)
Managed Identity (Azure VMs, App Service, AKS, Container Instances)
Azure CLI (az login)
Azure Developer CLI (azd auth login)

This covers managed identity on Azure infrastructure, workload identity in AKS, and local development via az login. No credentials need to be stored or rotated.

Web UI
API
config.json
Go SDK

Azure Default Credential authentication setup in the Bifrost Web UI showing Endpoint and API Version fields with no credential inputs

Navigate to “Model Providers” → “Configurations” → “Azure”
Click “Add Key” (or edit an existing key)
Under Authentication Method, select “Default Credential”
Set Endpoint: Your Azure OpenAI resource URL (e.g., https://your-org.openai.azure.com)
Configure Aliases: Map model names to deployment IDs (e.g., gpt-4o → my-gpt4o-deployment)
Save

Ensure the appropriate credential source is available - a managed identity attached to the Azure resource, AZURE_CLIENT_ID/AZURE_CLIENT_SECRET/AZURE_TENANT_ID env vars, or az login for local development.

# Step 1: Create the provider
curl -X POST http://localhost:8080/api/providers \
  -H "Content-Type: application/json" \
  -d '{"provider": "azure"}'

# Step 2: Create a key (Default Credential - leave value empty)
curl -X POST http://localhost:8080/api/providers/azure/keys \
  -H "Content-Type: application/json" \
  -d '{
    "name": "azure-default-credential",
    "value": "",
    "models": ["*"],
    "weight": 1.0,
    "aliases": {
      "gpt-4o": "my-gpt4o-deployment",
      "gpt-4o-mini": "my-mini-deployment"
    },
    "azure_key_config": {
      "endpoint": "env.AZURE_ENDPOINT"
    }
  }'

On v1.4.x, two differences apply:

Pass keys directly in the POST /api/providers body - there is no separate /api/providers/{provider}/keys endpoint.
Replace the top-level aliases with "deployments" inside azure_key_config:

"azure_key_config": {
  "endpoint": "env.AZURE_ENDPOINT",
  "deployments": {
    "gpt-4o": "my-gpt4o-deployment"
  }
}

{
  "providers": {
    "azure": {
      "keys": [
        {
          "name": "azure-default-credential",
          "value": "",
          "models": ["*"],
          "weight": 1.0,
          "aliases": {
            "gpt-4o": "my-gpt4o-deployment",
            "gpt-4o-mini": "my-mini-deployment"
          },
          "azure_key_config": {
            "endpoint": "env.AZURE_ENDPOINT"
          }
        }
      ]
    }
  }
}

On v1.4.x, use deployments inside azure_key_config instead of the top-level aliases field.

func (a *MyAccount) GetKeysForProvider(ctx *context.Context, provider schemas.ModelProvider) ([]schemas.Key, error) {
    switch provider {
    case schemas.Azure:
        return []schemas.Key{
            {
                Value:  schemas.EnvVar{}, // Leave empty - Bifrost uses DefaultAzureCredential
                Models: []string{"*"},
                Weight: 1.0,
                Aliases: schemas.KeyAliases{
                    "gpt-4o":      "my-gpt4o-deployment",
                    "gpt-4o-mini": "my-mini-deployment",
                },
                AzureKeyConfig: &schemas.AzureKeyConfig{
                    Endpoint: *schemas.NewSecretVar(os.Getenv("AZURE_ENDPOINT")),
                },
            },
        }, nil
    }
    return nil, fmt.Errorf("provider %s not supported", provider)
}

2. Azure Entra ID (Service Principal)

Set client_id, client_secret, and tenant_id to authenticate with a Service Principal. This takes priority over API key and managed identity.

Web UI
API
config.json
Go SDK

Azure Entra ID (Service Principal) authentication setup in the Bifrost Web UI showing Client ID, Client Secret, Tenant ID, and Endpoint fields

Navigate to “Model Providers” → “Configurations” → “Azure”
Click “Add Key” (or edit an existing key)
Under Authentication Method, select “Entra ID (Service Principal)”
Set Client ID: Your Azure Entra ID client ID
Set Client Secret: Your Azure Entra ID client secret
Set Tenant ID: Your Azure Entra ID tenant ID
Set Endpoint: Your Azure OpenAI resource URL
Set Scopes (Optional): Override the default OAuth scope (https://cognitiveservices.azure.com/.default). Any configured scopes replace the default entirely - if you customize this field, you must include all required scopes (the default is not automatically added)
Configure Aliases: Map model names to deployment IDs
Save

# Step 1: Create the provider
curl -X POST http://localhost:8080/api/providers \
  -H "Content-Type: application/json" \
  -d '{"provider": "azure"}'

# Step 2: Create a key (Service Principal)
curl -X POST http://localhost:8080/api/providers/azure/keys \
  -H "Content-Type: application/json" \
  -d '{
    "name": "azure-entra-key",
    "value": "",
    "models": ["*"],
    "weight": 1.0,
    "aliases": {
      "gpt-4o": "my-gpt4o-deployment",
      "gpt-4o-mini": "my-mini-deployment",
      "claude-3-5-sonnet": "my-claude-deployment"
    },
    "azure_key_config": {
      "endpoint": "env.AZURE_ENDPOINT",
      "client_id": "env.AZURE_CLIENT_ID",
      "client_secret": "env.AZURE_CLIENT_SECRET",
      "tenant_id": "env.AZURE_TENANT_ID",
      "scopes": ["https://cognitiveservices.azure.com/.default"]
    }
  }'

On v1.4.x, two differences apply: - Pass keys directly in the POST /api/providers body - there is no separate /api/providers/{provider}/keys endpoint. - Move the model mappings from aliases into azure_key_config.deployments.

{
  "providers": {
    "azure": {
      "keys": [
        {
          "name": "azure-entra-key",
          "value": "",
          "models": ["*"],
          "weight": 1.0,
          "aliases": {
            "gpt-4o": "my-gpt4o-deployment",
            "gpt-4o-mini": "my-mini-deployment",
            "claude-3-5-sonnet": "my-claude-deployment"
          },
          "azure_key_config": {
            "endpoint": "env.AZURE_ENDPOINT",
            "client_id": "env.AZURE_CLIENT_ID",
            "client_secret": "env.AZURE_CLIENT_SECRET",
            "tenant_id": "env.AZURE_TENANT_ID",
            "scopes": ["https://cognitiveservices.azure.com/.default"]
          }
        }
      ]
    }
  }
}

On v1.4.x, use deployments inside azure_key_config instead of the top-level aliases field.

func (a *MyAccount) GetKeysForProvider(ctx *context.Context, provider schemas.ModelProvider) ([]schemas.Key, error) {
    switch provider {
    case schemas.Azure:
        return []schemas.Key{
            {
                Value:  schemas.EnvVar{}, // Leave empty for Service Principal auth
                Models: []string{"*"},
                Weight: 1.0,
                Aliases: schemas.KeyAliases{
                    "gpt-4o":            "my-gpt4o-deployment",
                    "gpt-4o-mini":       "my-mini-deployment",
                    "claude-3-5-sonnet": "my-claude-deployment",
                },
                AzureKeyConfig: &schemas.AzureKeyConfig{
                    Endpoint:     *schemas.NewSecretVar(os.Getenv("AZURE_ENDPOINT")),
                    ClientID:     schemas.NewSecretVar(os.Getenv("AZURE_CLIENT_ID")),
                    ClientSecret: schemas.NewSecretVar(os.Getenv("AZURE_CLIENT_SECRET")),
                    TenantID:     schemas.NewSecretVar(os.Getenv("AZURE_TENANT_ID")),
                    Scopes:       []string{"https://cognitiveservices.azure.com/.default"},
                },
            },
        }, nil
    }
    return nil, fmt.Errorf("provider %s not supported", provider)
}

Required Azure roles:

OpenAI models: Cognitive Services OpenAI User
Anthropic models: Cognitive Services AI Services User

3. Direct Authentication (API Key)

Provide the Azure API key in the value field. Use this for simple setups without managed identity or Service Principal.

Web UI
API
config.json
Go SDK

Azure API Key authentication setup in the Bifrost Web UI showing API Key, Endpoint, and API Version fields

Navigate to “Model Providers” → “Configurations” → “Azure”
Click “Add Key” (or edit an existing key)
Under Authentication Method, select “API Key”
Set API Key: Your Azure API key
Set Endpoint: Your Azure OpenAI resource URL
Configure Aliases: Map model names to deployment IDs
Save

# Step 1: Create the provider
curl -X POST http://localhost:8080/api/providers \
  -H "Content-Type: application/json" \
  -d '{"provider": "azure"}'

# Step 2: Create a key (API Key auth)
curl -X POST http://localhost:8080/api/providers/azure/keys \
  -H "Content-Type: application/json" \
  -d '{
    "name": "azure-api-key",
    "value": "env.AZURE_API_KEY",
    "models": ["*"],
    "weight": 1.0,
    "aliases": {
      "gpt-4o": "my-gpt4o-deployment",
      "gpt-4o-mini": "my-mini-deployment"
    },
    "azure_key_config": {
      "endpoint": "env.AZURE_ENDPOINT"
    }
  }'

{
  "providers": {
    "azure": {
      "keys": [
        {
          "name": "azure-api-key",
          "value": "env.AZURE_API_KEY",
          "models": ["*"],
          "weight": 1.0,
          "aliases": {
            "gpt-4o": "my-gpt4o-deployment",
            "gpt-4o-mini": "my-mini-deployment"
          },
          "azure_key_config": {
            "endpoint": "env.AZURE_ENDPOINT"
          }
        }
      ]
    }
  }
}

On v1.4.x, use deployments inside azure_key_config instead of the top-level aliases field.

func (a *MyAccount) GetKeysForProvider(ctx *context.Context, provider schemas.ModelProvider) ([]schemas.Key, error) {
    switch provider {
    case schemas.Azure:
        return []schemas.Key{
            {
                Value:  *schemas.NewSecretVar("env.AZURE_OPENAI_KEY"),
                Models: []string{"*"},
                Weight: 1.0,
                Aliases: schemas.KeyAliases{
                    "gpt-4o":      "my-gpt4o-deployment",
                    "gpt-4o-mini": "my-mini-deployment",
                },
                AzureKeyConfig: &schemas.AzureKeyConfig{
                    Endpoint: *schemas.NewSecretVar(os.Getenv("AZURE_ENDPOINT")),
                },
            },
        }, nil
    }
    return nil, fmt.Errorf("provider %s not supported", provider)
}

Authentication precedence: (1) Entra ID if client_id, client_secret, and tenant_id are all set; (2) API key if value is non-empty; (3) DefaultAzureCredential (managed identity) if neither is provided.

azure_key_config fields:

Field	Required	Default	Description
`endpoint`	Yes	-	Azure OpenAI resource endpoint URL
`client_id`	No	-	Entra ID client ID (Service Principal auth)
`client_secret`	No	-	Entra ID client secret (Service Principal auth)
`tenant_id`	No	-	Entra ID tenant ID (Service Principal auth)
`scopes`	No	`["https://cognitiveservices.azure.com/.default"]`	OAuth scopes for token requests
`use_speech_endpoints`	No	`false`	Send speech and transcription requests to Azure AI Speech
`use_voice_live_endpoints`	No	`false`	Send realtime WebSocket sessions to Azure Voice Live

Key-level fields:

Field	Required	Description
`aliases`	No	Map model names to Azure deployment IDs (v1.5.0-prerelease2+)
`value`	No	Azure API key (leave empty for Entra ID or managed identity)
`models`	Yes	Models this key can serve; use `["*"]` to allow all

Beta Headers

For Anthropic models on Azure, Bifrost validates anthropic-beta headers and drops unsupported headers from the request. Azure supports most Anthropic beta features. Supported: computer-use-*, structured-outputs-*, advanced-tool-use-*, mcp-client-*, prompt-caching-scope-*, compact-*, context-management-*, files-api-*, interleaved-thinking-*, skills-*, context-1m-*, redact-thinking-* Not supported: fast-mode-* You can override these defaults per provider via the Beta Headers tab in provider configuration or via beta_header_overrides. See the full support matrix in the Anthropic provider docs.

1. Chat Completions

Request Parameters

Core Parameter Mapping

Parameter	Azure Handling	Notes
`model`	Mapped to `deployment_id`	Supports version matching and base model matching
`max_completion_tokens`	Direct pass-through	OpenAI models only
`temperature`, `top_p`	Direct pass-through	Same across all models
All other params	Model-specific conversion	Converted per underlying provider (OpenAI/Anthropic)

Authentication Configuration

Azure uses custom endpoint and deployment configuration:

Gateway
Go SDK

curl -X POST http://localhost:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/gpt-4-deployment",
    "messages": [{"role": "user", "content": "Hello"}],
    "deployment": "my-gpt4-deployment",
    "endpoint": "https://my-org.openai.azure.com"
  }' \
  -H "api-key: YOUR_AZURE_API_KEY"

resp, err := client.ChatCompletionRequest(schemas.NewBifrostContext(ctx, schemas.NoDeadline), &schemas.BifrostChatRequest{
    Provider: schemas.Azure,
    Model:    "gpt-4",
    Input:    messages,
    Params: &schemas.ChatParameters{
        ExtraParams: map[string]interface{}{
            "deployment": "my-gpt4-deployment",
            "endpoint": "https://my-org.openai.azure.com",
        },
    },
})

Key Configuration

Azure supports three authentication methods: Managed Identity (DefaultAzureCredential), Entra ID (Service Principal), and Direct (API Key). Precedence: Entra ID (if configured) → API key (if value set) → DefaultAzureCredential.

Managed Identity / DefaultAzureCredential

If no API key and no Entra ID credentials are provided, Bifrost automatically uses DefaultAzureCredential, which detects the auth environment.

{
  "aliases": {
    "gpt-4": "my-gpt4-deployment"
  },
  "azure_key_config": {
    "endpoint": "https://your-org.openai.azure.com"
  }
}

Azure Entra ID (Service Principal)

If you set client_id, client_secret, and tenant_id, Azure Entra ID authentication will be used with priority over API key authentication.

{
  "aliases": {
    "gpt-4": "my-gpt4-deployment",
    "gpt-4-turbo": "my-gpt4-turbo-deployment",
    "claude-3": "my-claude-deployment"
  },
  "azure_key_config": {
    "endpoint": "https://your-org.openai.azure.com",
    "client_id": "your-client-id",
    "client_secret": "your-client-secret",
    "tenant_id": "your-tenant-id",
    "scopes": ["https://cognitiveservices.azure.com/.default"]
  }
}

Required Azure Roles:

For OpenAI models: Cognitive Services OpenAI User
For Anthropic models: Cognitive Services AI Services User

Direct Authentication (API Key)

{
  "value": "your-azure-api-key",
  "aliases": {
    "gpt-4": "my-gpt4-deployment",
    "gpt-4-turbo": "my-gpt4-turbo-deployment",
    "claude-3": "my-claude-deployment"
  },
  "azure_key_config": {
    "endpoint": "https://your-org.openai.azure.com"
  }
}

Configuration Details:

endpoint - Azure OpenAI resource endpoint (required)
client_id - Azure Entra ID client ID (optional, for Service Principal auth)
client_secret - Azure Entra ID client secret (optional, for Service Principal auth)
tenant_id - Azure Entra ID tenant ID (optional, for Service Principal auth)
scopes - OAuth scopes for token requests (default: ["https://cognitiveservices.azure.com/.default"])
use_speech_endpoints - Send speech and transcription requests to Azure AI Speech (optional, default false; an alias can override it)
use_voice_live_endpoints - Send realtime WebSocket sessions to Azure Voice Live (optional, default false; an alias can override it)
aliases - Map of model names to Azure deployment IDs (optional, set at key level)
allowed_models - List of allowed models to use from this key (optional)

Deployment Selection

Deployments can be specified at three levels (in order of precedence):

Per-request (highest priority)
{ "deployment": "custom-deployment" }

Key configuration

{ "aliases": { "gpt-4": "my-gpt4-deployment" } }

Model name (lowest priority, if no deployment specified) Model name is used as deployment ID directly

OpenAI Models

When using OpenAI models (GPT-4, GPT-4 Turbo, GPT-3.5-Turbo, etc.), Bifrost passes through OpenAI-compatible parameters directly.

Parameter Mapping for OpenAI

All OpenAI-standard parameters are supported. Refer to OpenAI documentation for detailed conversion details.

Anthropic Models

When using Anthropic models through Azure (Claude 3 family), Bifrost converts requests to Anthropic format.

Parameter Mapping for Anthropic

All Anthropic-standard parameters are supported with special handling:

Reasoning/Thinking: reasoning parameters converted to Anthropic’s thinking structure
System messages: Extracted and placed in separate system field
Tool message grouping: Consecutive tool messages merged

Refer to Anthropic documentation for detailed conversion details.

Special Notes for Azure + Anthropic

API version automatically set to 2023-06-01 for Anthropic models
Endpoints use /anthropic/v1/ paths internally
Authentication uses x-api-key header for Anthropic models
Minimum reasoning budget: 1024 tokens

Streaming

Streaming uses OpenAI or Anthropic format depending on model type:

OpenAI models: Standard OpenAI streaming with chat.completion.chunk events
Anthropic models: Anthropic streaming format with content blocks

2. Responses API

The Responses API is available for both OpenAI and Anthropic models on Azure using the /openai/v1/responses endpoint.

Request Parameters

Core Parameter Mapping

Parameter	Azure Handling	Notes
`instructions`	Becomes system message	Model-specific conversion
`input`	Converted to user message(s)	String or array support
`max_output_tokens`	Model-specific field mapping	OpenAI vs Anthropic conversion
All other params	Model-specific conversion	Converted per underlying provider

OpenAI Models

For OpenAI models (GPT-4, etc.), conversion follows OpenAI’s Responses API format.

Anthropic Models

For Anthropic models (Claude, etc.), conversion follows Anthropic’s message format:

instructions becomes system message
reasoning mapped to thinking structure

Endpoint Configuration

Gateway
Go SDK

curl -X POST http://localhost:8080/v1/responses \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/claude-3-sonnet",
    "input": "Hello, how are you?",
    "instructions": "You are a helpful assistant",
    "deployment": "my-claude-deployment",
    "endpoint": "https://my-org.openai.azure.com"
  }' \
  -H "api-key: YOUR_AZURE_API_KEY"

resp, err := client.ResponsesRequest(schemas.NewBifrostContext(ctx, schemas.NoDeadline), &schemas.BifrostResponsesRequest{
    Provider: schemas.Azure,
    Model:    "claude-3-sonnet",
    Input:    messages,
    Params: &schemas.ResponsesParameters{
        Instructions: schemas.Ptr("You are a helpful assistant"),
    },
})

Special Handling

Uses /openai/v1/responses endpoint
All request body conversions handled automatically
Supports raw request body passthrough for advanced cases

OpenAI Models - gpt-oss Special Message Handling: For OpenAI models through Azure, see OpenAI Responses API documentation for details on special gpt-oss model handling regarding reasoning conversion (summaries vs. content blocks). Anthropic Models: Refer to Anthropic Responses API for parameter details.

3. Embeddings

Embeddings are supported for OpenAI models only (not available for Anthropic models on Azure).

Request Parameters

Parameter	Azure Handling
`input`	Direct pass-through
`model`	Mapped to deployment
`dimensions`	Direct pass-through (when supported)

Gateway
Go SDK

curl -X POST http://localhost:8080/v1/embeddings \
  -H "Content-Type: application/json" \
  -d '{
    "model": "text-embedding-3-small",
    "input": ["text to embed"],
    "deployment": "my-embedding-deployment"
  }' \
  -H "api-key: YOUR_AZURE_API_KEY"

resp, err := client.EmbeddingRequest(schemas.NewBifrostContext(ctx, schemas.NoDeadline), &schemas.BifrostEmbeddingRequest{
    Provider: schemas.Azure,
    Model:    "text-embedding-3-small",
    Input: []schemas.EmbeddingContent{
        {{Type: schemas.EmbeddingContentPartTypeText, Text: schemas.Ptr("text to embed")}},
    },
})

Response Conversion

Embeddings response is passed through directly from Azure OpenAI with standard format:

{
  "data": [
    {
      "object": "embedding",
      "embedding": [0.1234, -0.5678, ...],
      "index": 0
    }
  ],
  "model": "text-embedding-3-small",
  "usage": {
    "prompt_tokens": 10,
    "total_tokens": 10
  }
}

4. Files API

Files operations are supported for OpenAI models only.

Supported Operations

Operation	Support
Upload	✅
List	✅
Retrieve	✅
Delete	✅
Get Content	✅

Files are stored in Azure and can be used with batch operations.

5. Image Generation

Image Generation is supported for OpenAI models on Azure and uses the OpenAI-compatible format.

Request Parameters

Core Parameter Mapping

Parameter	Azure Handling	Notes
`model`	Mapped to `deployment_id`	Deployment ID must be configured
`prompt`	Direct pass-through	Prompt text for image generation
All other params	Direct pass-through	Uses OpenAI format

Azure uses the same conversion as OpenAI (see OpenAI Image Generation):

Model & Prompt: bifrostReq.Model → req.Model (mapped to deployment), bifrostReq.Prompt → req.Prompt
Parameters: All other fields from bifrostReq are embedded directly into the request struct via struct embedding

Configuration

Gateway
Go SDK

curl -X POST http://localhost:8080/v1/images/generations \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/dall-e-3",
    "prompt": "A sunset over the mountains",
    "size": "1024x1024",
    "n": 1,
    "deployment": "my-image-gen-deployment"
  }' \
  -H "api-key: YOUR_AZURE_API_KEY"

resp, err := client.ImageGenerationRequest(schemas.NewBifrostContext(ctx, schemas.NoDeadline), &schemas.BifrostImageGenerationRequest{
    Provider: schemas.Azure,
    Model:    "dall-e-3",
    Input: &schemas.ImageGenerationInput{
        Prompt: "A sunset over the mountains",
    },
    Params: &schemas.ImageGenerationParameters{
        Size:    schemas.Ptr("1024x1024"),
        N:       schemas.Ptr(1),
    },
})

Response Conversion

Non-streaming: Azure responses are unmarshaled directly into BifrostImageGenerationResponse since Bifrost’s response schema is a superset of OpenAI’s format. All fields are passed through as-is.
Streaming: Azure streaming responses use Server-Sent Events (SSE) format with the same event types as OpenAI (see OpenAI Image Generation Streaming).

Streaming

Image generation streaming is supported and uses OpenAI’s streaming format with Server-Sent Events (SSE).

6. Image Edit

Requests use multipart/form-data, not JSON.

Image Edit is supported for OpenAI models on Azure and uses the OpenAI-compatible format. Azure uses the same conversion as OpenAI (see OpenAI Image Edit):

Request Conversion: Uses openai.HandleOpenAIImageEditRequest with Azure-specific URL construction
URL Format: {endpoint}/openai/v1/images/edits
Authentication: Azure API key or OAuth bearer token (via getAzureAuthHeaders)
Deployment Mapping: Model identifier mapped to Azure deployment ID
Response Conversion: Same as OpenAI - responses unmarshaled directly into BifrostImageGenerationResponse
Streaming: Supported via openai.HandleOpenAIImageEditStreamRequest with Azure-specific URL and authentication

7. List Models

Request Parameters

None required.

Response Conversion

Lists available models/deployments configured in the Azure key. Response includes model metadata, capabilities, and lifecycle status.

{
  "data": [
    {
      "id": "gpt-4",
      "object": "model",
      "created": 1687882411,
      "status": "active",
      "lifecycle_status": "stable",
      "capabilities": {
        "chat_completion": true,
        "embeddings": false
      }
    }
  ]
}

Caveats

Deployment ID Required

Severity: High Behavior: Model names must map to Azure deployment IDs Impact: Request fails without valid deployment mapping Code: azure.go:145-200

Model Provider Detection

Severity: Medium Behavior: Automatic detection of OpenAI vs Anthropic based on model name Impact: Different conversion logic applied transparently Code: azure.go:92-114

Version Matching for Deployments

Severity: Low Behavior: Model version differences ignored when matching to deployments Impact: gpt-4 and gpt-4-turbo can map to same deployment Code: models.go:13-58

8. Video Generation

Azure routes video generation to OpenAI’s Sora models via the Azure OpenAI-compatible endpoint. All parameters are identical to OpenAI Video Generation. Supported Operations

Operation	Supported	Notes
Generate	✅	`POST /v1/videos`
Retrieve	✅	`GET /v1/videos/{id}`
Download	✅	`GET /v1/videos/{id}/content`
Delete	✅	`DELETE /v1/videos/{id}`
List	✅	`GET /v1/videos`
Remix	❌	Not supported

9. Context Compaction

Context compaction is supported for OpenAI models on Azure. It follows the same request and response format as OpenAI Context Compaction. Endpoint: POST /openai/v1/responses/compact Bifrost routes the request to {endpoint}/openai/v1/responses/compact using the configured Azure deployment. Deployment mapping and authentication (API key, Entra ID, or managed identity) are applied automatically, identical to the Responses API.

10. Decisions

Two kinds of Azure deployment answer /v1/decisions, each on its own endpoint and in its own format:

Model	Azure endpoint	Format
`gpt-6-luna`	`/openai/v1/decisions`	OpenAI’s decisions format
`Microsoft-Decision-1`	`/providers/microsoft/v1/systemone`	TypeSafe’s System One format

Bifrost picks the endpoint by model name: a deployment of the gpt-6-luna family goes to /openai/v1/decisions, and any other deployment to /providers/microsoft/v1/systemone. Azure sends the deployment name as the model, so when your deployment is named differently, map the model name to it with a key alias. Bifrost then recognizes the deployment by the alias name:

{ "aliases": { "gpt-6-luna": "my-luna-deployment", "Microsoft-Decision-1": "my-decision-deployment" } }

gpt-6-luna

curl http://localhost:8080/v1/decisions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/gpt-6-luna",
    "input": "Customer message: I was double charged and nobody replied to my two emails.",
    "questions": [
      { "type": "predicate", "name": "is_frustrated", "instructions": "Is the customer frustrated?" },
      { "type": "choice", "name": "category", "instructions": "Pick the ticket category",
        "choices": [ { "value": "billing" }, { "value": "bug" }, { "value": "other" } ] }
    ]
  }'

Bifrost calls POST {endpoint}/openai/v1/decisions in OpenAI’s decisions format, so requests and answers map as on OpenAI, including input_image parts (a base64 data URL or a public HTTPS URL). Authentication (API key, Entra ID, or managed identity) is applied as for every other Azure call, and no api-version is sent. Azure is rolling the endpoint out by region; a deployment in a region without it returns Azure’s own error. See Microsoft’s Decisions API guide for availability and limits.

Microsoft-Decision-1

curl http://localhost:8080/v1/decisions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/Microsoft-Decision-1",
    "input": "Customer message: I was double charged and nobody replied to my two emails.",
    "questions": [
      { "type": "predicate", "name": "is_frustrated", "instructions": "Is the customer frustrated?" }
    ]
  }'

Bifrost calls POST {endpoint}/providers/microsoft/v1/systemone, which uses TypeSafe’s System One format, so questions are converted as on TypeSafe. Authentication (API key, Entra ID, or managed identity) is applied as for every other Azure call, and no api-version is sent. Differences from TypeSafe:

Text only. An input_image part is rejected by Bifrost with a 400; the model would otherwise read it as text.
Strict top-level fields. An extra field forwarded with x-bf-passthrough-extra-params comes back as Azure’s 400 (Unrecognized request argument supplied).
Limits. Choice questions take 2-255 options and score questions 2-10 levels; the context window is 32,768 tokens.
No response id. Azure’s x-request-id is in extra_fields.provider_response_headers.

Bifrost does not otherwise gate decisions on Azure by model name: a deployment that serves neither endpoint returns Azure’s own error. With convert_decision_to_responses on, gpt-6-luna and Microsoft-Decision-1 are still served natively. The complexity router can use Microsoft-Decision-1 as its classifier. A decision is priced from the model catalog: at the model’s decision rates where it lists them, otherwise at its chat rates. A model the catalog does not list is priced at $0; add a pricing override for the Decisions request type to bill it.

11. Azure AI Speech

use_speech_endpoints sends speech and transcription requests to Azure AI Speech instead of an Azure OpenAI deployment, on the same key and endpoint. Set it in azure_key_config to route every audio request on the key, or on an alias to route one model. An alias value wins over the key’s in both directions. Other requests on the key, such as chat, still go to Azure OpenAI. The endpoint must be a Foundry (AI Services) resource or a Speech resource with a custom domain. Both *.openai.azure.com and *.cognitiveservices.azure.com work. An API key is sent as Ocp-Apim-Subscription-Key. Entra ID and managed identity send a bearer token, as for every other Azure call. A key with an explicit models list must list the alias names it serves.

{
  "name": "azure-key",
  "value": "env.AZURE_API_KEY",
  "models": ["*"],
  "azure_key_config": { "endpoint": "env.AZURE_ENDPOINT" },
  "aliases": {
    "mai-voice": { "model_id": "MAI-Voice-2.1-Flash", "use_speech_endpoints": true },
    "fast-stt": { "model_id": "fast-transcription", "use_speech_endpoints": true }
  }
}

The model ID, which is the alias model_id or the requested model on a key with use_speech_endpoints, picks the voice or transcription mode.

Text to speech

Endpoint: POST /v1/audio/speech, sent to {endpoint}/tts/cognitiveservices/v1 as SSML

Model ID	Voice sent to Azure
`neural`	`voice` as is, such as `en-US-JennyNeural`
A voice suffix, such as `DragonHDLatestNeural` or `MAI-Voice-2.1-Flash`	`{voice}:{suffix}`, such as `en-US-Harper:MAI-Voice-2.1-Flash`

A voice that already contains : is sent as is. OpenAI voice names such as alloy are not Azure voices and get a 400.

Parameter	Azure SSML
`input`	Escaped voice text. An input that starts with `<speak` is sent as the whole SSML document.
`speed`	`<prosody rate="{speed}">`
`language_code`	`xml:lang` on `<speak>`, `en-US` when not set
`style`, `styledegree`, `role`	`<mstts:express-as>`
`response_format`	`mp3` (default), `opus`, `wav` and `pcm` map to 24 kHz formats; `aac` and `flac` fall back to mp3; any other value is sent as the `X-Microsoft-OutputFormat` name
`instructions`	Dropped

stream_format: "sse" streams the audio as Azure synthesizes it. usage.input_chars counts characters as Azure bills them: the whole SSML except the <speak> and <voice> tags, with each Chinese character counted twice. Markup Bifrost adds, such as <prosody>, is billed.

curl http://localhost:8080/v1/audio/speech \
  -H "Content-Type: application/json" \
  -d '{
    "model": "azure/mai-voice",
    "voice": "en-US-Harper",
    "input": "Your order shipped.",
    "speed": 1.2
  }' --output speech.mp3

Speech to text

Endpoint: POST /v1/audio/transcriptions, sent to {endpoint}/speechtotext/transcriptions:transcribe?api-version=2025-10-15 as an audio part and a JSON definition

Model ID	Azure mode
`fast-transcription`	Fast transcription
`llm-speech`	LLM Speech (`enhancedMode.task`)
Any other, such as `MAI-Transcribe-2`	`enhancedMode.model` set to the model ID

LLM Speech and MAI-Transcribe are available only in some regions; other regions answer 400 with Enhanced mode is currently not supported yet.

Field	Azure definition
`language`	`locales`. `fast-transcription` needs a full locale such as `en-US`; a bare code such as `en` is dropped and Azure detects the language.
`prompt`	`enhancedMode.prompt` on `llm-speech`; dropped otherwise
`target_language`	`llm-speech` translates into it
`response_format: "verbose_json"`	`modelOptions.timestamps: "word"` on MAI-Transcribe
`response_format: "diarized_json"`, `diarization`, `max_speakers`	`diarization`
`channels`, `phrases`	`channels`, `phraseList.phrases`. Pass a comma-separated value in a multipart form.
`profanity_filter_mode`, `transcribe_style`	`profanityFilterMode`, `modelOptions.transcribeStyle`

The response carries text, duration, language, segments (speaker-labelled when diarized) and words. usage.seconds is the duration rounded up to the second, which is what Azure meters.

curl http://localhost:8080/v1/audio/transcriptions \
  -F model=azure/fast-stt \
  -F [email protected] \
  -F language=en-US \
  -F diarization=true

Until the model catalog lists rates for these model IDs, Bifrost reports their cost as $0 while Azure still bills the usage; add a pricing override to track it.

12. Azure Voice Live

use_voice_live_endpoints sends realtime WebSocket sessions to Azure Voice Live instead of Azure OpenAI, on the same key and endpoint. Set it in azure_key_config for every realtime session on the key, or on an alias for one model. An alias value wins over the key’s in both directions. Other requests on the key still go to Azure OpenAI. Endpoint: /v1/realtime (WebSocket), sent to {endpoint}/voice-live/realtime?api-version=2026-04-10&model={model ID} with the key’s API key or Entra token. An alias api_version replaces the default version.

"aliases": {
  "gpt-realtime-vl": { "model_id": "gpt-realtime", "use_voice_live_endpoints": true }
}

The model ID is a Voice Live model such as gpt-realtime, gpt-4.1 or phi4-mm-realtime, which needs no deployment. Connect to ws://localhost:8080/v1/realtime?model=azure/gpt-realtime-vl. Events pass through as Voice Live sends them, including object voices such as {"name": "en-US-Ava:DragonHDLatestNeural", "type": "azure-standard"}, azure_semantic_vad, noise suppression, word timestamps, visemes and session.avatar.connect.

WebRTC (/v1/realtime/calls) and client secrets (/v1/realtime/client_secrets) answer 400: Voice Live signals WebRTC over its own WebSocket and reports usage on the browser’s data channel.
A realtime intent answers 400.
Turns are priced at the Azure OpenAI rates for the same model name until the model catalog lists Voice Live rates.

13. GPT Live

Azure serves GPT-Live on OpenAI’s wire protocol, so a session’s events, delegation, billing and log row are the same as on OpenAI. Open the session on /v1/live/sessions (a WebSocket, or a POST with an SDP offer for WebRTC) with the azure/ prefix on the voice model:

{
  "type": "session.start",
  "session": {
    "model": "azure/gpt-live-1",
    "delegation": { "type": "responses", "responses": { "model": "gpt-5.5" } }
  }
}

A voice model without a prefix runs on Azure when the request comes from the Azure OpenAI SDK, and on OpenAI otherwise on /openai/v1/live/sessions, the same provider the session’s attach and content routes default to. Bifrost connects to {endpoint}/openai/v1/live/sessions with the key’s API key or Entra ID token. Both session.model and delegation.responses.model are deployment names on Azure, and Bifrost maps each through the key’s aliases. Azure runs the backend on the voice deployment’s resource, so one key must serve both models, and the key’s endpoint is used even when an alias sets its own.

Sidebands: /v1/live/sessions/{session_id}/attach and /openai/v1/live/sessions/{session_id}/attach take ?provider=azure or the x-model-provider: azure header, and the Azure OpenAI SDK’s user agent selects Azure too. Without any of these, the route uses OpenAI when OpenAI is configured.
Browser permissions: Azure rejects session.client on WebRTC create, so Bifrost drops it upstream and applies allowed_client_events and allowed_server_events itself on the browser’s data channel. A browser event outside the list gets OpenAI’s event_not_allowed error and never reaches Azure. Sidebands are not restricted.
Recordings: /v1/live/sessions/{session_id}/content answers 400 unsupported_operation. Azure does not store GPT-Live sessions yet and rejects session.store.
Pricing overrides match the deployment name Bifrost sends, not the alias.

Configuration

HTTP Settings: Max Connections 5000 | Max Idle 60 seconds Endpoint Format: https://{resource-name}.openai.azure.com/openai/v1/{path} Note: Bifrost uses the Azure OpenAI v1 API. No api-version query parameter is needed.

Setup & Configuration

See the Setup & Configuration section at the top of this page for authentication instructions and full configuration examples.