模型在听谁的话
这个接口是 OpenAI 兼容的，这部分不需要介绍：base URL、key、SDK、流式、工具调用，需要用量时最后一帧带 usage，十个模型共用一把 key。
下面只讲其中不标准的那一部分，以及它的边界。
system 消息
在用厂商自己的 API 时，system prompt 归厂商所有。你可以往后追加，既看不到它，也删不掉它。多数场景下这没有影响。在 agent 类工作负载里，有时会有影响：你仔细调好的行为，最终表现里仍混着你没写过的指令。
在这里，消息列表是你的。不改写，不删减。只在你已有的 system / developer 消息之后插入一条额外的 system。
这条内容写成“运行配置”，而不是用户消息。这个区别来自实际行为，而不是出于措辞偏好：同样的文字放在用户消息里，会被当作一个有待权衡的主张；放在配置里，会被直接执行。内容相同，位置不同，结果不同。
清洗规则
客户端的 system prompt 会累积一些让模型推迟行动的指令——不确定就询问、执行前先确认、注意安全。放在对话场景里合理，放在 agent 的循环里，每一步都要多绕一圈。
这类表述在请求离开网关之前会被规整，换成保留原意但不拖延行动的版本：缺失信息时按合理默认值处理，除非步骤不可逆否则继续，给出具体结果。
有两条限制：
- 只作用于
system和developer消息。 用户消息里的文字逐字节透传，按普通内容处理。这一条在代码里落实，不可配置。 - 效果因情况而异。 规整能起多大作用，取决于模型，也取决于你的客户端已经在 system 里写了什么。它不是一项统一的提升。
开关这一层
按请求控制，用一个请求头：
curl https://api.apixy.top/v1/chat/completions \
-H "Authorization: Bearer sk-..." \
-H "Content-Type: application/json" \
-H "x-wbg-purge: off" \
-d '{"model":"deepseek-v4.1-flash","messages":[{"role":"user","content":"hi"}]}'
| 取值 | 行为 |
|---|---|
append（默认） |
插在你的 system 消息之后 |
prepend |
插在所有消息之前 |
replace |
移除你的 system 消息，保留我们这条 |
off |
透传 |
在自己对比不同版本的 prompt、需要一条干净基线时比较有用——同一个接口、同一把 key，不用另外维护一套环境。
限制
- 它改变模型的表达方式，不改变模型的能力。
- 用户消息里的内容仍由模型自行判定，这一层触及不到。
- 上游对任何一次请求保有最终决定权。这一层减少的是你自己那套框架带来的干扰，不覆盖上游的判断。
模型
deepseek-v4-pro · deepseek-v4.1-flash · glm-5.3 · glm-5.3-flash · kimi-k3 · kimi-k3-1 · kimi-k3.1-pro · minimax-m3 · minimax-m3.1-flash
以 GET /v1/models 为准。调用权限随会员开通，每把 key 每分钟 60 次，细则见 API 面板。
Whose instructions the model follows
This endpoint is OpenAI-compatible. That part needs no introduction: base URL, key, SDK, streaming, tool calls, and usage when you request it — ten models behind one key.
What follows describes the one part that isn’t standard, and the boundaries around it.
The system message
With a vendor’s own API, the system prompt belongs to the vendor. You can append to it. You cannot read it, and you cannot remove it. In most cases that’s acceptable. In agent workloads it sometimes isn’t: you tune a behaviour carefully, and the result still reflects instructions you never wrote.
Here the message list is yours. Nothing is rewritten, nothing is dropped. One additional system block is inserted after your existing system / developer messages.
That block is written as operating configuration rather than as a user message. The distinction is functional, not cosmetic: identical text placed in a user turn is treated as a claim to be weighed against other context, while the same text placed as configuration is applied. Same content, different position, different result.
Scrub rules
Client-side system prompts accumulate instructions that delay action — ask when unsure, confirm before acting, exercise caution regarding safety. These are reasonable in a chat context and expensive in an agent loop, where they cost a round trip on each step.
Such phrasing is normalized before the request leaves the gateway, into equivalents that preserve the intent without the stall: choose a reasonable default, proceed unless a step is irreversible, be concrete.
Two constraints apply:
systemanddevelopermessages only. Text in user turns is passed through byte for byte and treated as ordinary content. This is enforced in code, not configurable.- Effectiveness varies. How much normalization helps depends on the model and on what your client already placed in its system message. It is not a uniform improvement.
Toggling the layer
Per request, using a header:
curl https://api.apixy.top/v1/chat/completions \
-H "Authorization: Bearer sk-..." \
-H "Content-Type: application/json" \
-H "x-wbg-purge: off" \
-d '{"model":"deepseek-v4.1-flash","messages":[{"role":"user","content":"hi"}]}'
| Value | Behaviour |
|---|---|
append (default) |
inserted after your system messages |
prepend |
inserted before all messages |
replace |
your system messages removed, ours kept |
off |
passthrough |
Useful when comparing your own prompt revisions against a clean baseline — same endpoint, same key, no second project to maintain.
Limits
- It changes how a model responds, not what it is capable of.
- Content inside user turns remains the model’s judgement. This layer does not reach into them.
- Upstream retains final discretion on any request. This layer reduces interference from your own scaffolding; it does not override upstream decisions.
Models
deepseek-v4-pro · deepseek-v4.1-flash · glm-5.3 · glm-5.3-flash · kimi-k3 · kimi-k3-1 · kimi-k3.1-pro · minimax-m3 · minimax-m3.1-flash
GET /v1/models is authoritative. Access is included with membership, 60 requests per minute per key. Details in the API panel.