When the model provider goes down

Reconstructs the consumer-side model gateway from the builds Uber, Grab, Wealthsimple, Bloomberg, LiteLLM, BricksLLM and OpenRouter published, then reads the layer against the outage record: OpenAI's December 2024 control-plane collapse, Anthropic's month of silent degradation, OpenRouter's own cache failure, and the one measured account of fallbacks under a real outage. A reader leaves able to argue where the gateway earns its hop, which failover triggers to automate, and why the fallback path needs scheduled drills rather than trust.

What you get out of it

• Provider status pages showed 99.80% (OpenAI) and 99.58% (Anthropic) uptime as of mid-2025: three-plus hours of downtime a month is the planning baseline, and the December 2024 OpenAI outage shows one provider is one failure domain regardless of its internal redundancy.
• Status-code failover covers only the loud failure class: Anthropic degraded up to 16% of Sonnet 4 requests for weeks while every signal a gateway routes on stayed green, so quality needs its own per-route detector.
• The fallback path rots silently: in Portkey's vendor-measured account of a 12-hour Anthropic incident, the 0.14% of gateway-fronted requests that still failed all traced to fallback misconfiguration (unmapped 529s, expired keys, dead targets), which argues for scheduled fallback drills.
• The gateway's own auxiliary dependencies are its availability: OpenRouter went down twice in February 2026 because its key-lookup cache failed, surfacing as 401s that sent customers to debug valid keys.
• The failover decision is encoded in open source defaults worth copying: LiteLLM cools a deployment for 5 seconds on a single 429 but exempts single-deployment groups, because a circuit breaker in front of the only exit converts partial failure into total failure.

Scope

Why this, now. Between OpenRouter's February 2026 gateway-side outages and the 2025 provider incident record, the layer every LLM product now routes through finally has enough published failures to be read as a system rather than a product category.

What it does not cover. The provider-side serving stack, prompt change management, agent sandboxing, and model-evaluation methodology, each covered by an earlier dig in this library.