Update LLM Provider

Endpoint

PUT /apiops/projects/{projectName}/llm-providers/{providerName}/

Authentication

Requires a Personal API Access Token.

Header

Authorization: Bearer YOUR_TOKEN

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
providerName	string	Yes	LLM provider name (the provider must already exist)

Query Parameters

None

Request Body

The body is the LLM provider object. A "_class": "llm" field is not required; if you send it, it is ignored. If name is left blank in the body, it falls back to the providerName path parameter; if provided, it must match the path (case-insensitive).

Full JSON Body Example

{
  "_class": "llm",
  "name": "deepseek-primary",
  "description": "DeepSeek production provider (updated)",
  "enabled": true,
  "providerType": "DEEPSEEK",
  "endpoint": "https://api.deepseek.com/v1",
  "apiVersion": "v1",
  "authScheme": "BEARER",
  "authHeaderName": "Authorization",
  "onlyListedModels": false,
  "deploymentType": "CLOUD",
  "supportedModels": [
    {
      "modelId": "deepseek-chat",
      "displayName": "DeepSeek Chat",
      "contextWindow": 64000,
      "maxOutputTokens": 8192,
      "modality": "TEXT"
    }
  ],
  "metadata": [
    {
      "key": "team",
      "value": "platform",
      "secret": false
    }
  ]
}

Request Body Fields

Field	Type	Required	Default	Description
_class	string	No	-	Not required. Ignored when sent
name	string	No	path value	Provider name; if blank, falls back to providerName. If provided, must match the path (case-insensitive)
description	string	No	-	Free-text description
enabled	boolean	No	true	Whether the provider is active
providerType	string	No	-	Provider type enum constant (OPENAI, ANTHROPIC, AZURE_OPENAI, BEDROCK, VERTEX, COHERE, MISTRAL, DEEPSEEK, GROQ, MOONSHOT, ZHIPU, QWEN_DASHSCOPE, XAI, GOOGLE_AI_STUDIO, TOGETHER, FIREWORKS, CEREBRAS, HUGGINGFACE, OPENROUTER, PERPLEXITY, NVIDIA_NIM, VLLM, OLLAMA, CUSTOM_OPENAI_COMPAT, VOYAGE, TYPESAFE, TEI, OTHER)
endpoint	string	No	provider default	Base API URL; auto-filled from providerType when blank
apiVersion	string	No	provider default	Provider API version; auto-filled from providerType when blank
organizationId	string	No	-	Organization identifier
authScheme	string	No	provider default	Auth scheme enum constant (BEARER, API_KEY_HEADER, BASIC, AWS_SIGV4, OAUTH2, NONE, CUSTOM); auto-filled from providerType when null
authHeaderName	string	No	provider default	Credential header name; auto-filled from providerType when blank
apiKey	string	No	preserved	Primary auth secret. Omitting the field preserves the stored secret; sending an empty string deletes it. Encrypted at rest; never returned
apiSecret	string	No	preserved	Secondary auth secret. Omitting the field preserves the stored secret; sending an empty string deletes it. Encrypted at rest; never returned
region	string	No	-	Region (e.g. Bedrock AWS region)
serviceAccountJson	string	No	preserved	GCP Vertex service-account JSON. Omitting the field preserves the stored secret; sending an empty string deletes it. Encrypted at rest; never returned
supportedModels	array	No	-	The models of the provider, with their prices, enabled switch and access control — see Supported Model Fields
coldStartRetryEnabled	boolean	No	-	Deprecated, has no effect. Still accepted in the request body for compatibility; the value is ignored
onlyListedModels	boolean	No	preserved	When true, the gateway refuses a model ID that is not in supportedModels (HTTP 403). An omitted field keeps the stored value; an explicit false turns it off. true with an empty supportedModels list is rejected with 400
deploymentType	string	No	auto	Deployment type enum constant (CLOUD, ON_PREM, OTHER). A report-only label (Cloud / On-Premises / Other breakdown in AI usage reports); it never changes routing. When null it is auto-filled: OTHER for providerType OTHER (custom provider), ON_PREM for self-hosted types (VLLM, OLLAMA, CUSTOM_OPENAI_COMPAT, TEI), CLOUD otherwise. An explicit value is kept
metadata	array	No	-	Custom key/value metadata entries

endpoint and apiVersion runtime semantics

endpoint takes the base address only (e.g. https://api.deepseek.com/v1) — the request path (/chat/completions, /embeddings, /audio/transcriptions, /audio/speech, /images/generations, /responses) is appended automatically based on the request type. Putting a path in endpoint produces a broken URL at request time; for custom paths, configure a custom provider connection (see LLM Providers and Models) rather than embedding paths in endpoint. A query string embedded in endpoint is not lost, but it is relocated to the end of the resolved address, after the appended path.

apiVersion only reaches the request URL for AZURE_OPENAI connections, where it is added as an api-version query parameter (skipped if one is already present). For ANTHROPIC it is sent as the anthropic-version header instead and never touches the URL. Bedrock and Vertex build their address entirely in provider-specific code, so apiVersion has no effect on either.

See Query Strings and API Versioning in the Final URL for the full behavior.

Wire protocol and paths

wireProtocol and the six default*Path fields are the provider type's own, unless you set them on the connection. You can write them through this endpoint. A body that omits them, or sends a blank path, keeps the stored values. If the body changes providerType, the stored values are not kept and the new type's own apply. For a vendor outside the provider type list, use providerType: OTHER and set the protocol and paths on the connection.

Paths support Apinizer variable resolution (${env.name}, #{contextVar}), resolved at request time against the effective URL endpoint + path.

Notes

• The provider named providerName must already exist, otherwise a 400 Bad Request is returned
• Omitting apiKey / apiSecret / serviceAccountJson preserves the previously stored (encrypted) secret; sending an empty string deletes it
• Every model needs a modelId, and a modelId can appear only once in supportedModels; a duplicate or blank modelId is 400
• A model that you remove from supportedModels must not be in use: an AI proxy, policy or knowledge base that names it makes the request 400, and the message names where the model is used
• An aclEntries row must name an existing consumer, application or organization, otherwise the request is 400. Name the subject with subjectName (consumer username, application name or organization name) or with subjectId. A name is looked up in the project of the provider, then in the admin project. If both are sent, subjectId wins. A name that matches more than one subject is 400: one match in the project of the provider wins over matches in the admin project, two matches in the project of the provider are ambiguous, and so are several matches in the admin project when the project of the provider has none. Send subjectId then
• healthStatus, lastHealthCheckAt and lastLatencyMs are read-only. An update keeps the stored values

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "deploymentResult": {
    "success": true
  }
}

EnumStatus

• SUCCESS - Operation successful
• FAILURE - Operation failed

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "LLM provider (name: deepseek-primary) was not found!"
}

or

{
  "status": "FAILURE",
  "resultMessage": "LLM provider name in path (deepseek-primary) does not match name in body (deepseek-2)!"
}

Error Response (401 Unauthorized)

{
  "status": "FAILURE",
  "resultMessage": "Token is not valid!"
}

cURL Example

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/llm-providers/deepseek-primary/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "_class": "llm",
    "name": "deepseek-primary",
    "description": "DeepSeek production provider (updated)",
    "enabled": true,
    "providerType": "DEEPSEEK",
    "authScheme": "BEARER",
    "authHeaderName": "Authorization",
    "deploymentType": "CLOUD"
  }'

Permissions

• User must have AI_DEVELOPMENT + MANAGE permission in the project

Notes and Warnings

• Omitted Secret Preserves Value (INV-06):
  • Leaving apiKey / apiSecret / serviceAccountJson out of the body keeps the previously stored encrypted value
  • Sending an empty string deletes the stored secret, so a pipeline that does not change a secret must omit the field
  • Send a new non-blank value to rotate the secret
• Provider Must Exist:
  • PUT fails with "was not found" if the named provider does not exist — use Create LLM Provider (upsert) to create
• Enum Serialization:
  • Enum values must be sent as the enum constant name (e.g. DEEPSEEK, BEARER, CLOUD, TEXT), not lowercase
• Deploy on Save:
  • The updated provider is re-encrypted and pushed to the AI Gateway workers

Related Documentation

• Create LLM Provider - Create or upsert a provider
• Get LLM Provider - Retrieve a provider by name
• Delete LLM Provider - Delete a provider
• LLM Providers API - Resource overview and permissions