AI Setup with xAI¶

Section: AI Assistant | Article 30
Audience: System Administrators
Last Updated: 2026-04-07

Overview¶

This article walks through configuring xAI (Grok) as the AI provider for RP-PAM. xAI supports both embedding and completion models, making it a complete single-provider solution.

Prerequisites¶

Requirement	Detail
RP-PAM licence	Enterprise or MSP tier
xAI account	An account at console.x.ai
API key	A valid xAI API key
Network access	The RP-PAM server must be able to reach `api.x.ai` on port 443

Step 1: Get an xAI API Key¶

Sign in to console.x.ai.
Navigate to API Keys.
Click Create API Key.
Name it: RP-PAM
Copy the key immediately.

The key looks like: xai-...

Step 2: Encrypt the API Key¶

Store the API key in RP-PAM's encrypted vault.

Windows PowerShell:

& "C:\Program Files\Ravenphyre\RP-PAM\tools\rppam-migrate.exe" vault-store `
  --key "ai-xai-key" `
  --value "xai-YOUR_XAI_API_KEY"

Linux:

sudo /opt/rppam/tools/rppam-migrate vault-store \
  --key "ai-xai-key" \
  --value "xai-YOUR_XAI_API_KEY"

Step 3: Configure rppam.config¶

Edit the AI section in rppam.config.

Windows path: C:\ProgramData\Ravenphyre\RP-PAM\rppam.config
Linux path: /etc/rppam/rppam.config

{
  "ai": {
    "enabled": true,
    "provider": "xai",
    "apiKeyVaultKey": "ai-xai-key",
    "embeddingModel": "embedding-beta",
    "completionModel": "grok-2",
    "embeddingDimension": 1536,
    "maxTokens": 4096,
    "temperature": 0.3,
    "riskScoring": {
      "enabled": true,
      "threshold": 60
    },
    "anomalyDetection": {
      "enabled": true,
      "lookbackDays": 90
    }
  }
}

Configuration Fields¶

Field	Description	Default
`provider`	Set to `"xai"`	(required)
`apiKeyVaultKey`	Vault key for the xAI API key	(required)
`embeddingModel`	Model for text embeddings	`embedding-beta`
`completionModel`	Model for natural-language responses	`grok-2`
`embeddingDimension`	Vector dimension (must match the model)	`1536`
`maxTokens`	Maximum tokens in a completion response	`4096`
`temperature`	Response creativity (0.0-1.0)	`0.3`

Available xAI Models¶

Model	Type	Notes
`grok-2`	Completion	Latest full-featured model
`grok-2-mini`	Completion	Smaller, faster, lower cost
`embedding-beta`	Embedding	1536-dimension embedding model

Step 4: Restart RP-PAM¶

Windows PowerShell:

Restart-Service RpPam

Linux:

sudo systemctl restart rppam

Step 5: Verify AI Is Working¶

Check Module Health¶

Linux:

curl -s http://localhost:7101/api/v1/modules \
  -H "Authorization: Bearer $ADMIN_JWT" | jq '.items[] | select(.moduleName == "ai")'

PowerShell:

$modules = Invoke-RestMethod -Uri "http://localhost:7101/api/v1/modules" `
  -Headers @{ Authorization = "Bearer $adminJwt" }
$modules.items | Where-Object { $_.moduleName -eq "ai" } | ConvertTo-Json

Expected:

{
  "moduleName": "ai",
  "status": "healthy",
  "provider": "xai",
  "embeddingModel": "embedding-beta",
  "completionModel": "grok-2"
}

Test a Query¶

Linux:

curl -s -X POST http://localhost:7101/api/v1/ai/query \
  -H "Authorization: Bearer $ADMIN_JWT" \
  -H "Content-Type: application/json" \
  -d '{ "query": "Show me the most active users this week." }' | jq .

PowerShell:

$response = Invoke-RestMethod -Uri "http://localhost:7101/api/v1/ai/query" `
  -Method Post `
  -Headers @{ Authorization = "Bearer $adminJwt" } `
  -ContentType "application/json" `
  -Body '{ "query": "Show me the most active users this week." }'
$response | ConvertTo-Json

Proxy Configuration¶

If your RP-PAM server reaches the internet through a proxy:

{
  "ai": {
    "proxy": {
      "enabled": true,
      "url": "http://proxy.corp.local:8080",
      "noProxy": ["localhost", "127.0.0.1"]
    }
  }
}

Troubleshooting¶

Problem	Cause	Solution
`"status": "unhealthy"` for AI module	API key invalid or expired	Regenerate the key at console.x.ai; re-store with `vault-store`
`401 Unauthorized`	Wrong API key	Verify the vault key name matches `apiKeyVaultKey`
`429 Rate Limit`	Rate limit exceeded	Reduce request frequency; check your xAI plan limits
`Connection refused`	Server cannot reach `api.x.ai`	Check firewall rules; configure a proxy if needed
Slow responses	Model or network latency	Switch to `grok-2-mini` for faster responses
`"embeddingDimension mismatch"`	Dimension does not match model	Set `embeddingDimension` to 1536 for `embedding-beta`
`"model not found"`	Model name incorrect or not available	Verify the model name against xAI documentation

Next Steps¶

AI Setup with Ollama -- Self-hosted alternative with no data leaving your network
AI Setup with OpenAI -- Alternative cloud provider
AI Assistant Overview -- What the AI module can do