Model fallbacks
When a model you name cannot answer, try other models you chose, in order — inside your policy, never less sovereign, and never above the cost limit you set.
When your code names a model — model="openai/gpt-6.1-sol" — and that model cannot answer, Stav first tries the model's other Provider Endpoints. A model fallback is what happens next: other models you chose, tried in order.
Without a fallback, a model served by one Inference Provider has nowhere to go when that provider is down. With one, the request is answered by the next model on your list instead of failing.
Set one up
In Your workspace → Govern → Key policies → Model fallbacks. Owners and admins can edit; every member can see the rules.
A rule names:
- the model it is for (the one your code names);
- one to three fallback models, tried in order;
- who it applies to: the whole workspace, or one API key. A key's rule replaces the workspace rule for that model — the two are never merged;
- a cost limit: a fallback whose expected cost is above this many times the named model's is skipped. The default is 3.
Saving a rule for the same model and scope replaces the old one.
With MCP: model_fallbacks_list, model_fallbacks_set, model_fallbacks_delete.
When a fallback runs
| Request | Fallback? |
|---|---|
Names a model, creator/model | Yes — after the model's own endpoints |
Pins an endpoint, creator/model/provider | No. A pin must be served by the endpoint it names |
model="auto" or a Router | No. The Smart Router has its own failover |
A Claude model on /v1/messages, or an OpenAI model on /v1/responses, sent to the provider's own API | Yes, non-streaming: the fallback runs on Stav's translated path |
A fallback runs only after an error another provider could serve: a 5xx, a 429, a timeout, or a provider Stav has taken out of rotation. A 4xx your request caused is never retried on another model — it would be refused there too.
A request makes at most four calls in total: the named model's endpoints and the fallbacks share that limit.
What a fallback never does
- It never leaves your policy. Each fallback is resolved under the same rules as the named model: your sovereignty floor, compute region, ZDR, no-training and blocked providers.
- It is never less sovereign. A fallback endpoint must be at the same sovereignty level as the endpoint your named model was about to use, or higher. A fallback with no known level is skipped.
- It never exceeds your cost limit. A fallback above the limit, or whose price is unknown, is skipped.
Every skipped fallback is named, with the reason, in the request's routing details.
How you can tell
- The response's
modelandX-Stav-Modelname the model that answered. X-Stav-Fallback-Fromnames the model you asked for (non-streaming; a stream's headers are sent before the fallback can happen).- Your workspace → Monitor → Request log: the request shows "Answered by your fallback model", with both models.
- The routing details list every call the request made, in order, and why any other endpoint or fallback was skipped.
You are billed for the model that answered, at its catalogue price.