Skip to main content
POST
Create a provider connection

Authorizations

Authorization
string
header
required

A Barndoor API key, sent as Authorization: Bearer <key>. Keys are prefixed bdai_ and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token.

Body

application/json
base_url
string
required
model_provider
string
required
name
string
required
api_key
string | null
auth_type
string | null
change_note
string | null

Optional free-text note explaining why this credential was added (BCP-3998). Never a place for key material — the portal's placeholder copy asks for intent, and the value is stored in plaintext on the row and mirrored into the audit event.

credentials
any
settings
any

Response

The created record

Every column of llm_gw.connections, plus one derived field.

Serialized straight to the admin API — there is no separate response type, which is safe because no column here holds key material. secret_path is a pointer into OpenBao; key_last4 is four characters of a tail (BCP-3821).

auth_type
string
required
base_url
string
required
created_at
string<date-time>
required
id
string<uuid>
required
model_provider
string
required
name
string
required
org_id
string<uuid>
required
secret_path
string
required
settings
any
required
stores_key_material
boolean
required

Whether this credential's auth type holds a secret at all. Derived from auth_type, not stored: it is a property of the auth type, so a column would be a second copy of the same fact, free to drift.

updated_at
string<date-time>
required
created_by_email
string | null
created_by_name
string | null
created_by_user_id
string<uuid> | null
last_change_note
string | null

Optional free text explaining why the last change was made ("Raised for the Q3 batch job", "Vendor deprecated the old endpoint").

Admin-authored and rendered in the portal, so it is untrusted input: length-capped here, escaped on render.

last_modified_at
string<date-time> | null

When the change named by last_modified_by_* happened.

Its own column rather than the row's updated_at, because updated_at is bumped by writes nobody is attributed for -- pairing the two would date a named admin's edit to a background job's clock. See the V75 migration for the full reasoning.

last_modified_by_email
string | null
last_modified_by_name
string | null
last_modified_by_user_id
string<uuid> | null
key_last4
string | null

Last four characters of the stored key, once known.

None means "no tail to show", which is three different situations — stores_key_material is what tells them apart. Populated whenever key material is written, and derived on first read for credentials that predate the column.