LLM Providers API

Endpoints

• List LLM Providers - List all LLM providers in a project
• Get LLM Provider - Retrieve a single LLM provider by name
• Create LLM Provider - Create (or upsert) an LLM provider
• Update LLM Provider - Update an existing LLM provider
• Delete LLM Provider - Delete an LLM provider
• Test LLM Provider Connection - Test connectivity Manager-side, without persisting

Authentication

All endpoints require authentication using a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Permissions

LLM providers are part of the AI Gateway module and use the AI_DEVELOPMENT asset category.

• Read (list / get): requires AI_DEVELOPMENT + VIEW permission in the project
• Write (create / update / delete): requires AI_DEVELOPMENT + MANAGE permission in the project

Notes

• Name-based references: LLM providers are addressed by their name, never by internal ID. The providerName in the path must match the name in the request body.
• Upsert semantics: POST /{providerName}/ creates a new provider, or updates the existing one if a provider with the same name already exists in the project.
• Polymorphic body: Because ConnectionConfigLlm is a subtype of the generic connection-config family, every write body must include the discriminator "_class": "llm". Omitting it causes deserialization to fail.
• Secret masking (INV-06): Secret fields (apiKey, apiSecret, serviceAccountJson, secret metadata values) are never returned in read responses. They appear as boolean presence flags (apiKeySet, apiSecretSet, serviceAccountJsonSet). A blank secret on update preserves the stored value.
• Credential identity model: credentialSource (GATEWAY default / CLIENT = the gateway stores no credential and forwards the caller's own auth header), apiKeyLocation (HEADER default / QUERY) and apiKeyPrefix (null = the auth scheme's own prefix, "" = raw key) refine how the API-key family of authScheme (BEARER, API_KEY_HEADER, CUSTOM) is carried on the upstream request. allowClientOverride lets an incoming request's own auth header take precedence over the stored GATEWAY credential. See authScheme ↔ credential type.
• Enum serialization: Enum fields (providerType, authScheme, credentialSource, apiKeyLocation, deploymentType, model modality) serialize as the enum constant name (e.g. "DEEPSEEK", "BEARER", "GATEWAY", "HEADER", "CLOUD", "TEXT"), not lowercase.

Provider catalog vs connection

Built-in provider templates are selected when you save a connection (providerType, optional providerDefinitionId). A custom vendor is a connection with its own wire protocol and paths — APIops does not expose a separate provider-definition catalog CRUD API. Model catalog entries are managed under Model Catalog.

Related Documentation

• AI Gateway API - Overview of AI Gateway configuration resources
• Authentication Guide - How to obtain and use API tokens
• Error Handling - Error response formats