> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create or update a provider connection ## OpenAPI ````yaml /api-reference/openapi.yaml put /api/dlp/admin/v1/provider-connections/{name} openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/dlp/admin/v1/provider-connections/{name}: put: tags: - dlp summary: Create or update a provider connection operationId: upsert_connection parameters: - name: name in: path description: Provider name, e.g. `google_dlp` required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UpsertConnectionRequest' required: true responses: '200': description: The stored connection, without secret material content: application/json: schema: $ref: '#/components/schemas/ProviderConnectionResponse' '400': description: Provider mismatch, or invalid connection configuration content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '401': description: Missing or invalid bearer token content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '403': description: Caller lacks a tenant-admin role content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '500': description: Secret material could not be persisted content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' '503': description: OpenBao is not configured, so secrets cannot be stored content: application/json: schema: $ref: '#/components/schemas/DlpErrorResponse' components: schemas: UpsertConnectionRequest: oneOf: - allOf: - $ref: '#/components/schemas/UpsertTokenizationRequest' - type: object required: - provider properties: provider: type: string enum: - tokenization - allOf: - $ref: '#/components/schemas/UpsertGoogleDlpRequest' - type: object required: - provider properties: provider: type: string enum: - google_dlp - allOf: - $ref: '#/components/schemas/UpsertAwsComprehendPiiRequest' - type: object required: - provider properties: provider: type: string enum: - aws_comprehend_pii - allOf: - $ref: '#/components/schemas/UpsertAwsBedrockGuardrailsRequest' - type: object required: - provider properties: provider: type: string enum: - aws_bedrock_guardrails - allOf: - $ref: '#/components/schemas/UpsertAzureAiLanguagePiiRequest' - type: object required: - provider properties: provider: type: string enum: - azure_ai_language_pii - allOf: - $ref: '#/components/schemas/UpsertAzureContentSafetyRequest' - type: object required: - provider properties: provider: type: string enum: - azure_content_safety description: Tagged request body — the `"provider"` field selects the variant. ProviderConnectionResponse: oneOf: - allOf: - $ref: '#/components/schemas/TokenizationConnectionResponse' - type: object required: - provider properties: provider: type: string enum: - tokenization - allOf: - $ref: '#/components/schemas/GoogleDlpConnectionResponse' - type: object required: - provider properties: provider: type: string enum: - google_dlp - allOf: - $ref: '#/components/schemas/AwsComprehendPiiConnectionResponse' - type: object required: - provider properties: provider: type: string enum: - aws_comprehend_pii - allOf: - $ref: '#/components/schemas/AwsBedrockGuardrailsConnectionResponse' - type: object required: - provider properties: provider: type: string enum: - aws_bedrock_guardrails - allOf: - $ref: '#/components/schemas/AzureAiLanguagePiiConnectionResponse' - type: object required: - provider properties: provider: type: string enum: - azure_ai_language_pii - allOf: - $ref: '#/components/schemas/AzureContentSafetyConnectionResponse' - type: object required: - provider properties: provider: type: string enum: - azure_content_safety description: Tagged response — the `"provider"` field in JSON identifies the variant. DlpErrorResponse: type: object description: >- The error body every `/admin/v1` handler returns. Two shapes reach the wire and both are modelled here as optional fields: the shared auth/role gate in [`super`] emits `{"error": ...}`, while [`super::json_message`] — which the handlers themselves use — emits `{"message": ...}`. Exactly one is present on any given response. This is documentation of what the service already does, not a new contract; a handler is not free to send both. properties: error: type: - string - 'null' description: Set by the authentication and tenant-admin role gate (401 and 403). message: type: - string - 'null' description: Set by handler-level validation and store failures. UpsertTokenizationRequest: type: object required: - endpoint properties: bearer_token: type: - string - 'null' description: Supply to set or rotate the token; omit to leave unchanged. endpoint: type: string UpsertGoogleDlpRequest: type: object required: - project_id properties: bearer_token: type: - string - 'null' description: Supply to set or rotate the token; omit to leave unchanged. endpoint: type: string location: type: string project_id: type: string UpsertAwsComprehendPiiRequest: type: object properties: access_key_id: type: - string - 'null' auth_type: type: - string - 'null' endpoint: type: - string - 'null' external_id: type: - string - 'null' iam_role_arn: type: - string - 'null' language: type: string region: type: string secret_access_key: type: - string - 'null' description: Supply to set or rotate the AWS secret; omit to leave unchanged. session_token: type: - string - 'null' description: Optional AWS session token stored with the secret access key. UpsertAwsBedrockGuardrailsRequest: type: object required: - guardrail_identifier properties: access_key_id: type: - string - 'null' auth_type: type: - string - 'null' endpoint: type: - string - 'null' external_id: type: - string - 'null' guardrail_identifier: type: string guardrail_version: type: string iam_role_arn: type: - string - 'null' region: type: string secret_access_key: type: - string - 'null' description: Supply to set or rotate the AWS secret; omit to leave unchanged. session_token: type: - string - 'null' description: Optional AWS session token stored with the secret access key. UpsertAzureAiLanguagePiiRequest: type: object required: - endpoint properties: api_key: type: - string - 'null' description: Supply to set or rotate the API key; omit to leave unchanged. api_version: type: string endpoint: type: string language: type: string UpsertAzureContentSafetyRequest: type: object required: - endpoint properties: api_key: type: - string - 'null' description: Supply to set or rotate the API key; omit to leave unchanged. api_version: type: string endpoint: type: string severity_threshold: type: integer format: int32 minimum: 0 TokenizationConnectionResponse: type: object required: - org_id - endpoint - has_bearer_token properties: endpoint: type: string has_bearer_token: type: boolean description: >- Whether a bearer token is configured. The token value is never returned. org_id: type: string GoogleDlpConnectionResponse: type: object required: - org_id - project_id - location - endpoint - has_bearer_token properties: endpoint: type: string has_bearer_token: type: boolean description: >- Whether a bearer token is configured. The token value is never returned. location: type: string org_id: type: string project_id: type: string AwsComprehendPiiConnectionResponse: type: object required: - org_id - auth_type - region - language - has_credentials properties: access_key_id: type: - string - 'null' auth_type: type: string endpoint: type: - string - 'null' external_id: type: - string - 'null' has_credentials: type: boolean iam_role_arn: type: - string - 'null' language: type: string org_id: type: string region: type: string AwsBedrockGuardrailsConnectionResponse: type: object required: - org_id - auth_type - region - guardrail_identifier - guardrail_version - has_credentials properties: access_key_id: type: - string - 'null' auth_type: type: string endpoint: type: - string - 'null' external_id: type: - string - 'null' guardrail_identifier: type: string guardrail_version: type: string has_credentials: type: boolean iam_role_arn: type: - string - 'null' org_id: type: string region: type: string AzureAiLanguagePiiConnectionResponse: type: object required: - org_id - endpoint - api_version - language - has_api_key properties: api_version: type: string endpoint: type: string has_api_key: type: boolean language: type: string org_id: type: string AzureContentSafetyConnectionResponse: type: object required: - org_id - endpoint - api_version - severity_threshold - has_api_key properties: api_version: type: string endpoint: type: string has_api_key: type: boolean org_id: type: string severity_threshold: type: integer format: int32 minimum: 0 securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.