Update LLM Provider

Endpoint

PUT /apiops/projects/{projectName}/llm-providers/{providerName}/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
providerName	string	Yes	LLM provider name (the provider must already exist)

Query Parameters

None

Request Body

The body is a polymorphic ConnectionConfigLlm object. It must include "_class": "llm". If name is left blank in the body, it falls back to the providerName path parameter; if provided, it must match the path (case-insensitive).

Full JSON Body Example

{
  "_class": "llm",
  "name": "deepseek-primary",
  "description": "DeepSeek production provider (updated limits)",
  "enabled": true,
  "providerType": "DEEPSEEK",
  "endpoint": "https://api.deepseek.com/v1",
  "apiVersion": "v1",
  "authScheme": "BEARER",
  "authHeaderName": "Authorization",
  "apiKey": "",
  "providerRpmLimit": 1000,
  "providerTpmLimit": 200000,
  "coldStartRetryEnabled": false,
  "deploymentType": "CLOUD",
  "allowedModelIds": ["deepseek-chat", "deepseek-reasoner"],
  "supportedModels": [
    {
      "modelId": "deepseek-chat",
      "displayName": "DeepSeek Chat",
      "contextWindow": 64000,
      "maxOutputTokens": 8192,
      "modality": "TEXT"
    }
  ],
  "metadata": [
    {
      "key": "team",
      "value": "platform",
      "secret": false
    }
  ]
}

Request Body Fields

Field	Type	Required	Default	Description
_class	string	Yes	-	Polymorphic discriminator — must be "llm"
name	string	No	path value	Provider name; if blank, falls back to providerName. If provided, must match the path (case-insensitive)
description	string	No	-	Free-text description
enabled	boolean	No	true	Whether the provider is active
providerType	string	No	-	Provider type enum constant (OPENAI, ANTHROPIC, AZURE_OPENAI, BEDROCK, VERTEX, COHERE, MISTRAL, DEEPSEEK, GROQ, MOONSHOT, ZHIPU, QWEN_DASHSCOPE, VLLM, OLLAMA, CUSTOM_OPENAI_COMPAT, VOYAGE, OTHER)
endpoint	string	No	provider default	Base API URL; auto-filled from providerType when blank
apiVersion	string	No	provider default	Provider API version; auto-filled from providerType when blank
organizationId	string	No	-	Organization identifier
authScheme	string	No	provider default	Auth scheme enum constant (BEARER, API_KEY_HEADER, BASIC, AWS_SIGV4, OAUTH2, NONE, CUSTOM); auto-filled from providerType when null
authHeaderName	string	No	provider default	Credential header name; auto-filled from providerType when blank
apiKey	string	No	preserved	Primary auth secret. A blank value preserves the stored secret (INV-06). Encrypted at rest; never returned
apiSecret	string	No	preserved	Secondary auth secret. A blank value preserves the stored secret (INV-06). Encrypted at rest; never returned
region	string	No	-	Region (e.g. Bedrock AWS region)
serviceAccountJson	string	No	preserved	GCP Vertex service-account JSON. A blank value preserves the stored secret. Encrypted at rest; never returned
supportedModels	array	No	-	Per-provider model snapshots
providerRpmLimit	integer	No	-	Organization-level requests-per-minute limit
providerTpmLimit	integer	No	-	Organization-level tokens-per-minute limit
coldStartRetryEnabled	boolean	No	-	Retry on 503 for self-hosted providers
deploymentType	string	No	auto	Deployment type enum constant (CLOUD, ON_PREM); auto-filled from providerType when null
providerDefinitionId	string	No	-	Optional catalog provider definition reference
allowedModelIds	array[string]	No	-	Integration-level model filter; empty/null = all models allowed
metadata	array	No	-	Custom key/value metadata entries

endpoint and apiVersion runtime semantics

endpoint takes the base address only (e.g. https://api.deepseek.com/v1) — the request path (/chat/completions, /embeddings, /audio/transcriptions, /audio/speech, /images/generations, /responses) is appended automatically based on the request type. Putting a path in endpoint produces a broken URL at request time; to set a custom path, use LLM Provider Definitions instead. A query string embedded in endpoint is not lost, but it is relocated to the end of the resolved address, after the appended path.

apiVersion only reaches the request URL for AZURE_OPENAI connections, where it is added as an api-version query parameter (skipped if one is already present). For ANTHROPIC it is sent as the anthropic-version header instead and never touches the URL. Bedrock and Vertex build their address entirely in provider-specific code, so apiVersion has no effect on either.

See Query Strings and API Versioning in the Final URL for the full behavior.

Path snapshots are server-managed

wireProtocol and the six default*Path fields are copied from the selected provider definition (providerDefinitionId) when the connection is saved; the gateway reads only that copy. They are not writable through this endpoint — values sent in the body are ignored, and values omitted are preserved from the stored record rather than cleared. To change a path, edit the provider definition in the catalog, or clear providerDefinitionId and let the provider type's built-in defaults apply.

Paths support Apinizer variable resolution (${env.name}, #{contextVar}), resolved at request time against the effective URL endpoint + path.

Notes

• _class must be "llm" or the request fails to deserialize
• The provider named providerName must already exist, otherwise a 400 Bad Request is returned
• Leaving apiKey / apiSecret blank preserves the previously stored (encrypted) secret

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "deploymentResult": {
    "success": true
  }
}

EnumStatus

• SUCCESS - Operation successful
• FAILURE - Operation failed

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "LLM provider (name: deepseek-primary) was not found!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "LLM provider name in path (deepseek-primary) does not match name in body (deepseek-2)!"
}

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/llm-providers/deepseek-primary/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "_class": "llm",
    "name": "deepseek-primary",
    "description": "DeepSeek production provider (updated limits)",
    "enabled": true,
    "providerType": "DEEPSEEK",
    "authScheme": "BEARER",
    "authHeaderName": "Authorization",
    "apiKey": "",
    "providerRpmLimit": 1000,
    "providerTpmLimit": 200000,
    "deploymentType": "CLOUD"
  }'

Permissions

• User must have AI_DEVELOPMENT + MANAGE permission in the project

Notes and Warnings

• Blank Secret Preserves Value (INV-06):
  • Sending an empty apiKey / apiSecret / serviceAccountJson keeps the previously stored encrypted value
  • Send a new non-blank value to rotate the secret
• Provider Must Exist:
  • PUT fails with "was not found" if the named provider does not exist — use Create LLM Provider (upsert) to create
• Polymorphic Discriminator:
  • "_class": "llm" is mandatory in the body
• Enum Serialization:
  • Enum values must be sent as the enum constant name (e.g. DEEPSEEK, BEARER, CLOUD, TEXT), not lowercase
• Deploy on Save:
  • The updated provider is re-encrypted and pushed to the AI Gateway workers

Related Documentation

• Create LLM Provider - Create or upsert a provider
• Get LLM Provider - Retrieve a provider by name
• Delete LLM Provider - Delete a provider
• LLM Providers API - Resource overview and permissions