Error

A valid request URL is required to generate request examples

{
  "id": "<string>",
  "name": "<string>",
  "value": "<string>",
  "models": [
    "<string>"
  ],
  "blacklisted_models": [
    "<string>"
  ],
  "weight": 123,
  "aliases": {},
  "azure_key_config": {
    "endpoint": "<string>",
    "api_version": "<string>",
    "client_id": "<string>",
    "client_secret": "<string>",
    "tenant_id": "<string>",
    "scopes": [
      "<string>"
    ]
  },
  "vertex_key_config": {
    "project_id": "<string>",
    "project_number": "<string>",
    "region": "<string>",
    "auth_credentials": "<string>",
    "force_single_region": false,
    "aws_workload_identity": {
      "audience": "<string>",
      "service_account_email": "<string>",
      "token_lifetime_seconds": 21900,
      "aws_region": "<string>",
      "aws_role_arn": "<string>"
    }
  },
  "bedrock_key_config": {
    "access_key": "<string>",
    "secret_key": "<string>",
    "session_token": "<string>",
    "region": "<string>",
    "arn": "<string>",
    "batch_s3_config": {
      "buckets": [
        {
          "bucket_name": "<string>",
          "prefix": "<string>",
          "is_default": true
        }
      ]
    }
  },
  "vllm_key_config": {
    "url": "<string>",
    "model_name": "<string>"
  },
  "ollama_key_config": {
    "url": "<string>"
  },
  "sgl_key_config": {
    "url": "<string>"
  },
  "cloudflare_key_config": {
    "account_id": "<string>"
  },
  "replicate_key_config": {
    "use_deployments_endpoint": true
  },
  "enabled": true,
  "use_for_batch_api": true,
  "config_hash": "<string>",
  "status": "<string>",
  "description": "<string>"
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

Providers

Update a key for a provider

Updates an existing key. Send the full key object. Redacted values sent back unchanged are automatically preserved (the server merges them with the stored raw values). Setting, changing, or removing any field that chooses the host Bifrost sends this key's credentials to requires a genuinely authenticated admin session - it is refused with 403 if dashboard authentication is disabled or unconfigured, even though other management endpoints remain reachable in that state. Sending the stored values back unchanged is allowed. ollama_key_config.url, sgl_key_config.url and vllm_key_config.url also follow the provider base_url destination rule: private and loopback hosts are accepted, link-local and unspecified addresses are refused with 400. Key-level and per-alias regions must be vendor region identifiers (lowercase letters, digits and hyphens, e.g. us-east-1); any other value is refused with 400. Guarded fields: ollama_key_config.url, sgl_key_config.url, vllm_key_config.url, azure_key_config.endpoint, databricks_key_config.workspace_url, github_copilot_key_config.github_domain, bedrock_key_config.endpoints.*, bedrock_mantle_key_config.endpoints.*, and aliases.<name>.endpoint.

PUT

api

providers

{provider}

keys

{key_id}

Error

A valid request URL is required to generate request examples

{
  "id": "<string>",
  "name": "<string>",
  "value": "<string>",
  "models": [
    "<string>"
  ],
  "blacklisted_models": [
    "<string>"
  ],
  "weight": 123,
  "aliases": {},
  "azure_key_config": {
    "endpoint": "<string>",
    "api_version": "<string>",
    "client_id": "<string>",
    "client_secret": "<string>",
    "tenant_id": "<string>",
    "scopes": [
      "<string>"
    ]
  },
  "vertex_key_config": {
    "project_id": "<string>",
    "project_number": "<string>",
    "region": "<string>",
    "auth_credentials": "<string>",
    "force_single_region": false,
    "aws_workload_identity": {
      "audience": "<string>",
      "service_account_email": "<string>",
      "token_lifetime_seconds": 21900,
      "aws_region": "<string>",
      "aws_role_arn": "<string>"
    }
  },
  "bedrock_key_config": {
    "access_key": "<string>",
    "secret_key": "<string>",
    "session_token": "<string>",
    "region": "<string>",
    "arn": "<string>",
    "batch_s3_config": {
      "buckets": [
        {
          "bucket_name": "<string>",
          "prefix": "<string>",
          "is_default": true
        }
      ]
    }
  },
  "vllm_key_config": {
    "url": "<string>",
    "model_name": "<string>"
  },
  "ollama_key_config": {
    "url": "<string>"
  },
  "sgl_key_config": {
    "url": "<string>"
  },
  "cloudflare_key_config": {
    "account_id": "<string>"
  },
  "replicate_key_config": {
    "use_deployments_endpoint": true
  },
  "enabled": true,
  "use_for_batch_api": true,
  "config_hash": "<string>",
  "status": "<string>",
  "description": "<string>"
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "provider": "anthropic",
    "model_requested": "<string>",
    "request_type": "<string>",
    "error_type": "<string>",
    "retry_after_ms": 150500
  }
}

Required Permissions

Permission	Granted via
`ModelProvider:Update`	RBAC role or API key scope

How permissions work

Authorizations

Authorization

string

header

required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

a Bifrost management API key,
a dashboard session token issued by POST /api/session/login,
base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Path Parameters

provider

string

required

Provider name

key_id

string

required

Key ID

Body

application/json

API key configuration

string

Unique identifier for the key

name

string

Name of the key

value

API key value (redacted in responses)

models

string[]

List of models this key can access (whitelist). ["*"] allows every model. An entry starting with regex: is an RE2 pattern matched case-insensitively against the whole model name; an empty pattern, regex:*, or a pattern that does not compile is rejected with 400. blacklisted_models wins over this list.

blacklisted_models

string[]

List of models this key cannot access (blacklist), which wins over models. ["*"] blocks every model. An entry starting with regex: is an RE2 pattern matched case-insensitively against the whole model name; an empty pattern, regex:*, or a pattern that does not compile is rejected with 400.

weight

number

Weight for load balancing

aliases

object

Model alias mappings - maps a user-facing model name to a provider-specific identifier (deployment name, inference profile ID, fine-tuned model ID, etc.)

Show child attributes

azure_key_config

object

Azure-specific key configuration

Show child attributes

vertex_key_config

object

Vertex-specific key configuration

Show child attributes

bedrock_key_config

object

AWS Bedrock-specific key configuration

Show child attributes

vllm_key_config

object

VLLM-specific key configuration

Show child attributes

ollama_key_config

object

Ollama-specific key configuration

Show child attributes

sgl_key_config

object

SGLang-specific key configuration

Show child attributes

cloudflare_key_config

object

Cloudflare Workers AI-specific key configuration

Show child attributes

replicate_key_config

object

Replicate-specific key configuration

Show child attributes

enabled

boolean

Whether the key is active (defaults to true)

use_for_batch_api

boolean

Whether this key can be used for batch API operations

config_hash

string

Hash of config.json version, used for change detection

status

string

Status of key (e.g., success, list_models_failed)

description

string

Error or status description for the key

Response

Key updated successfully

API key configuration

string

Unique identifier for the key

name

string

Name of the key

value

API key value (redacted in responses)

models

string[]

blacklisted_models

string[]

weight

number

Weight for load balancing

aliases

object

Model alias mappings - maps a user-facing model name to a provider-specific identifier (deployment name, inference profile ID, fine-tuned model ID, etc.)

Show child attributes

azure_key_config

object

Azure-specific key configuration

Show child attributes

vertex_key_config

object

Vertex-specific key configuration

Show child attributes

bedrock_key_config

object

AWS Bedrock-specific key configuration

Show child attributes

vllm_key_config

object

VLLM-specific key configuration

Show child attributes

ollama_key_config

object

Ollama-specific key configuration

Show child attributes

sgl_key_config

object

SGLang-specific key configuration

Show child attributes

cloudflare_key_config

object

Cloudflare Workers AI-specific key configuration

Show child attributes

replicate_key_config

object

Replicate-specific key configuration

Show child attributes

enabled

boolean

Whether the key is active (defaults to true)

use_for_batch_api

boolean

Whether this key can be used for batch API operations

config_hash

string

Hash of config.json version, used for change detection

status

string

Status of key (e.g., success, list_models_failed)

description

string

Error or status description for the key

Authentication

Inference

Integrations

Platform

Governance

Routing

Deprecated

Update a key for a provider

Authorizations

Path Parameters

Body

Response