LLM Providers API

Endpoints

List LLM Providers - List all LLM providers in a project
Get LLM Provider - Retrieve a single LLM provider by name
Create LLM Provider - Create (or upsert) an LLM provider
Update LLM Provider - Update an existing LLM provider
Delete LLM Provider - Delete an LLM provider
Test LLM Provider Connection - Test connectivity Manager-side, without persisting

All endpoints require authentication using a Personal API Access Token.

Authorization: Bearer YOUR_TOKEN

LLM providers are part of the AI Gateway module and use the AI_DEVELOPMENT asset category.

Read (list / get): requires AI_DEVELOPMENT + VIEW permission in the project
Write (create / update / delete): requires AI_DEVELOPMENT + MANAGE permission in the project

Name-based references: LLM providers are addressed by their name, never by internal ID. The providerName in the path must match the name in the request body.
Upsert semantics: POST /{providerName}/ creates a new provider, or updates the existing one if a provider with the same name already exists in the project.
Polymorphic body: Because ConnectionConfigLlm is a subtype of the generic connection-config family, every write body must include the discriminator "_class": "llm". Omitting it causes deserialization to fail.
Secret masking (INV-06): Secret fields (apiKey, apiSecret, serviceAccountJson, secret metadata values) are never returned in read responses. They appear as boolean presence flags (apiKeySet, apiSecretSet). A blank secret on update preserves the stored value.
Enum serialization: Enum fields (providerType, authScheme, deploymentType, model modality) serialize as the enum constant name (e.g. "DEEPSEEK", "BEARER", "CLOUD", "TEXT"), not lowercase.