LLM Providers API

Endpoints

• List LLM Providers - List all LLM providers in a project
• Get LLM Provider - Retrieve a single LLM provider by name
• Create LLM Provider - Create (or upsert) an LLM provider
• Update LLM Provider - Update an existing LLM provider
• Delete LLM Provider - Delete an LLM provider
• Change a Model ID - Change the ID of a model and move every reference to it
• Test LLM Provider Connection - Test connectivity Manager-side, without persisting

Authentication

All endpoints require authentication using a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Permissions

LLM providers are part of the AI Gateway module and use the AI_DEVELOPMENT asset category.

• Read (list / get): requires AI_DEVELOPMENT + VIEW permission in the project
• Write (create / update / delete): requires AI_DEVELOPMENT + MANAGE permission in the project

Notes

• Name-based references: LLM providers are addressed by their name, never by internal ID. The providerName in the path must match the name in the request body.
• Upsert semantics: POST /{providerName}/ creates a new provider, or updates the existing one if a provider with the same name already exists in the project.
• No type discriminator: A write body does not need a "_class" field. If you send "_class": "llm", it is ignored.
• Secret masking (INV-06): Secret fields (apiKey, apiSecret, serviceAccountJson, secret metadata values) are never returned in read responses. They appear as boolean presence flags (apiKeySet, apiSecretSet, serviceAccountJsonSet). On update, an omitted secret preserves the stored value and an empty one deletes it.
• Credential identity model: credentialSource (GATEWAY default / CLIENT = the gateway stores no credential and forwards the caller's own auth header), apiKeyLocation (HEADER default / QUERY) and apiKeyPrefix (null = the auth scheme's own prefix, "" = raw key) refine how the API-key family of authScheme (BEARER, API_KEY_HEADER, CUSTOM) is carried on the upstream request. allowClientOverride lets an incoming request's own auth header take precedence over the stored GATEWAY credential. See authScheme ↔ credential type.
• Enum serialization: Enum fields (providerType, authScheme, credentialSource, apiKeyLocation, deploymentType, model modality) serialize as the enum constant name (e.g. "DEEPSEEK", "BEARER", "GATEWAY", "HEADER", "CLOUD", "TEXT"), not lowercase.

Provider type vs connection

The provider type comes with its endpoint and authentication scheme. Its wire protocol and paths are the type's own unless you set them. A custom vendor is a connection with providerType: OTHER and its own wire protocol and paths. The models of the provider travel in supportedModels; APIops has no separate model endpoint.

Related Documentation

• AI Gateway API - Overview of AI Gateway configuration resources
• Authentication Guide - How to obtain and use API tokens
• Error Handling - Error response formats