Error

A valid request URL is required to generate request examples

{
  "budget": {
    "id": "<string>",
    "max_limit": 123,
    "reset_duration": "<string>",
    "last_reset": "2023-11-07T05:31:56Z",
    "current_usage": 123,
    "config_hash": "<string>",
    "created_at": "2023-11-07T05:31:56Z",
    "updated_at": "2023-11-07T05:31:56Z",
    "reset_config": {
      "quarter_start_month": 6
    },
    "override_amount": 123,
    "override_mode": "cycles",
    "override_cycles_remaining": 123,
    "override_cycles_total": 123,
    "override_anchor_reset": "2023-11-07T05:31:56Z",
    "team_id": "<string>",
    "virtual_key_id": "<string>",
    "provider_config_id": 123
  },
  "effective_max_limit": 123
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

Access Profiles

Set a user's access-profile budget override (deprecated path)

deprecated

Sets or replaces the spending override on one budget of a single user’s copy of an access profile. The override is additive — while it is active the budget is enforced against max_limit + override_amount — and it leaves the budget’s base limit, current usage, and reset schedule untouched. Only this user is affected; the access profile template and every other user assigned to it keep their original limits.

Use mode: cycles with a cycles count to grant extra spend for a finite number of reset windows (the current window counts as the first), or mode: forever to keep the override until it is deleted. A finite grant is anchored to the profile’s reset window — calendar-aligned profiles anchor at the calendar period start — so every node in a cluster derives the same number of remaining cycles. The change is propagated cluster-wide and survives access-profile cloning and propagation.

budget_id must be a budget on the user’s own copy of the profile, not on the shared template.

PUT

api

users

{user_id}

access-profiles

{profile_id}

budgets

{budget_id}

override

Error

A valid request URL is required to generate request examples

{
  "budget": {
    "id": "<string>",
    "max_limit": 123,
    "reset_duration": "<string>",
    "last_reset": "2023-11-07T05:31:56Z",
    "current_usage": 123,
    "config_hash": "<string>",
    "created_at": "2023-11-07T05:31:56Z",
    "updated_at": "2023-11-07T05:31:56Z",
    "reset_config": {
      "quarter_start_month": 6
    },
    "override_amount": 123,
    "override_mode": "cycles",
    "override_cycles_remaining": 123,
    "override_cycles_total": 123,
    "override_anchor_reset": "2023-11-07T05:31:56Z",
    "team_id": "<string>",
    "virtual_key_id": "<string>",
    "provider_config_id": 123
  },
  "effective_max_limit": 123
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

This path is deprecated and will be removed in the following major release. Use /api/governance/users/{user_id}/access-profiles/{profile_id}/budgets/{budget_id}/override instead.

This endpoint is available in Bifrost Enterprise only.

Required Permissions

Permission	Granted via
`AccessProfiles:Update`	RBAC role or API key scope

How permissions work

Authorizations

Authorization

string

header

required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

a Bifrost management API key,
a dashboard session token issued by POST /api/session/login,
base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Path Parameters

user_id

string

required

ID of the user whose access-profile budget is being overridden

profile_id

integer

required

ID of the access profile assigned to the user

budget_id

string

required

ID of a budget on the user's copy of the access profile

Body

application/json

Replaces the active override on one budget. The override is additive: it does not change the budget's max_limit, current_usage, or reset schedule. Sending this request against a budget that already has an override replaces that override entirely.

amount

number

required

Additional spend in dollars added on top of max_limit while the override is active. Must be greater than 0 and finite.

mode

enum<string>

required

cycles keeps the override active for cycles reset windows starting with the current one. forever keeps it active until it is removed with a DELETE.

Available options:

cycles,

forever

cycles

integer

Number of reset windows the override stays active for, counting the current window as the first. Required and must be greater than 0 when mode is cycles; must be omitted or 0 when mode is forever.

Required range: x >= 1

Response

Budget override applied successfully

The persisted budget and the additive limit now in force.

budget

object

required

Budget configuration

Show child attributes

effective_max_limit

number

required

max_limit plus override_amount while an override is active; equal to max_limit otherwise.

Authentication

Inference

Integrations

Platform

Governance

Routing

Deprecated

Set a user's access-profile budget override (deprecated path)

Authorizations

Path Parameters

Body

Response