> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbitrage.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Outage Shield

> When a provider goes down, Orbitrage detects it across orgs and reroutes to a healthy model — so your requests never hard-fail.

A provider outage shouldn't be your outage. The Outage Shield detects when a provider
(Anthropic, an Azure deployment, xAI, …) starts failing — with cross-org statistical
confidence — and reroutes affected traffic to the best healthy model until it recovers.
You detect outages faster than anyone and turn a hard-down into a non-event.

## How it works

<Steps>
  <Step title="Cross-org detection">
    The engine watches upstream outcomes per provider. It declares an outage only when,
    inside a rolling window, failures **and** the number of distinct affected orgs **and**
    the failure rate all cross their thresholds — so a 10-second blip or one bad prompt
    never trips it.
  </Step>

  <Step title="Substitute to a healthy model">
    Affected requests reroute to the best healthy model of the same (or higher) tier from a
    different provider. The substitute is billed at its own price.
  </Step>

  <Step title="Recover automatically">
    After a cooldown the engine probes the provider; the first success closes the incident
    and rerouting stops. A Slack alert fires on both trip and recovery.
  </Step>
</Steps>

## Policy

Set your policy on the [Outage Shield page](https://app.orbitrage.ai/outage-shield):

| Setting       | Default      | Meaning                                                                                                                                                                                                                               |
| ------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `on_outage`   | `substitute` | `substitute` reroutes to a healthy model; `fail` surfaces the provider error (for workloads that must have the exact pinned model).                                                                                                   |
| BYOK → pooled | `off`        | Rerouting a BYOK call to pooled spends your Orbitrage credits, so it's opt-in. Off = a BYOK call fails during its provider's outage. Only ever substitutes an **open-weight** model — a frontier model is never served from our pool. |
| Slack alerts  | `on`         | Notify your workspace on trip + recovery.                                                                                                                                                                                             |

A per-request `x-orbitrage-outage-override: fail` header forces a hard-fail for one call,
regardless of policy.

## Transparency

Substitution is never silent. Every rerouted call is flagged:

| Header                      | Value                               |
| --------------------------- | ----------------------------------- |
| `X-ScaleASAP-Failover`      | `1` when the call was rerouted.     |
| `X-ScaleASAP-Failover-From` | The provider we rerouted away from. |

In the dashboard, substituted steps record `failover_triggered`, `failover_from_provider`,
and `failover_substituted_model`, and active provider incidents show on the Outage Shield
page. The originally-requested model is preserved as `primary_model_attempted`.