> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update a rate limit > Updates a rate limit. Only the fields you send are changed. Send `null` for `scope_id`, `scope_value`, a `target_*` field, or a per-minute metric to clear it; at least one metric must remain set. ## OpenAPI ````yaml api-reference/llm-gateway-openapi.yml put /admin/rate-limits/{id} openapi: 3.1.0 info: title: Barndoor LLM Gateway Admin API version: 1.0.0 description: > Configure the Barndoor LLM Gateway programmatically: credentials and providers, model routes and route groups, pricing, routing policies and rules, launch profiles, budgets, rate limits, model access, API keys, and organization-wide governance settings. These are the same APIs the Barndoor app uses under **LLM Management**, and the Barndoor Terraform provider manages its LLM Gateway resources through them. Every endpoint is scoped to the organization of the calling token. ## Base URL ``` https://app.barndoor.ai/api/llm-gateway ``` For a dedicated deployment, replace `app.barndoor.ai` with the host you sign in to. ## Authentication Send an access token from Barndoor's identity provider in the `Authorization` header: ``` Authorization: Bearer ``` For scripts and CI, use a service-account token from the OAuth 2.0 client-credentials grant, as the Terraform provider does. The caller needs the admin role in the organization. The `bd-...` API keys you create with these endpoints are for LLM traffic (`/v1/chat/completions`, `/v1/messages`, and so on), not for these administrative calls. ## Partial updates Most `PUT` endpoints change only the fields you send. Where a field can be cleared, send it as `null`; omitting it leaves it unchanged. The exceptions are called out on the endpoint: `PUT /admin/governance-config` replaces the whole configuration, `PUT /admin/routing-rules/{id}` replaces the whole rule, and `PUT /admin/agent-runtime-profiles/{slug}` replaces the profile's models. ## Errors Errors are returned as JSON: ```json { "error": { "message": "retry_on_429_count must be between 0 and 10", "type": "invalid_request_error" } } ``` contact: name: Barndoor Support url: https://barndoor.ai servers: - url: https://{host}/api/llm-gateway description: Your Barndoor platform host. variables: host: default: app.barndoor.ai description: >- The host serving your Barndoor deployment. Use the default for Barndoor SaaS; for a dedicated deployment, use the host you sign in to. security: - BearerAuth: [] tags: - name: Credentials description: >- Stored upstream secrets (API keys, AWS roles, Google credentials) that providers reference - name: Providers description: Named upstream providers backed by a credential and a model family - name: Model Routes description: >- Map caller-facing aliases to upstream models on one or more providers, with failover order, retries, timeouts, and cooldowns - name: Route Groups description: >- Named sets of model aliases that model access policies can target as one unit - name: Model Pricing description: >- Versioned per-million-token costs used for cost reporting and cost-based budgets - name: Routing Policies description: Model aliases that pick one of several model slots for each request - name: Routing Rules description: >- Plain-English rules that set a minimum slot or forbid slots on a routing policy - name: Launch Profiles description: >- Models and capabilities applied when members start an agent with barndoor run - name: Rate Limits description: Requests-per-minute and tokens-per-minute ceilings - name: Budgets description: Daily, weekly, or monthly token and cost ceilings - name: Model Access description: >- Allowlist and denylist policies for models, providers, aliases, and route groups - name: Governance description: Organization-wide LLM Gateway settings - name: API Keys description: Organization-managed `bd-...` gateway API keys for LLM traffic paths: /admin/rate-limits/{id}: put: tags: - Rate Limits summary: Update a rate limit description: >- Updates a rate limit. Only the fields you send are changed. Send `null` for `scope_id`, `scope_value`, a `target_*` field, or a per-minute metric to clear it; at least one metric must remain set. operationId: updateRateLimit parameters: - name: id in: path description: Record ID (UUID) required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateRateLimitRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/WithAttribution_RateLimitPolicy' '400': description: Invalid request. The error message says which field or rule failed. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid access token content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Your role does not allow this action content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such record in your organization content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: Another record already uses this name or scope content: application/json: schema: $ref: '#/components/schemas/Error' security: - BearerAuth: [] components: schemas: UpdateRateLimitRequest: type: object description: Fields to change. Omitted fields are left unchanged. properties: change_note: type: - string - 'null' description: >- Optional free-text note explaining why this edit was made. Omitting it clears any previous note — deliberately *not* the tri-state merge-patch treatment the fields above get, because the note describes the latest change and carrying an old one forward would explain the wrong edit. enabled: type: - boolean - 'null' name: type: - string - 'null' requests_per_minute: type: - integer - 'null' format: int32 description: >- Requests allowed per rolling 60-second window. Omit to leave unchanged; send `null` to clear. scope_id: type: - string - 'null' format: uuid description: >- UUID of the scoped entity, for UUID-keyed scope types such as `user`, `team`, or `api_key`. Omit to leave unchanged; send `null` to clear. scope_type: type: - string - 'null' scope_value: type: - string - 'null' description: >- Name of the scoped entity, for name-keyed scope types, such as a role or IdP group name. Omit to leave unchanged; send `null` to clear. target_mcp_server_id: type: - string - 'null' format: uuid description: >- Only apply to requests to this MCP server. Requires `traffic_type` `mcp` or `all`, and cannot be combined with the LLM target fields. Omit to leave unchanged; send `null` to clear. target_model_alias: type: - string - 'null' description: >- Only apply to requests whose `model` is this alias. Cannot be combined with the other target fields. Omit to leave unchanged; send `null` to clear. target_provider_id: type: - string - 'null' format: uuid description: >- Only apply to requests routed to this provider. Can be combined with `target_upstream_model`; cannot be combined with `target_model_alias` or `target_mcp_server_id`. Omit to leave unchanged; send `null` to clear. target_upstream_model: type: - string - 'null' description: >- Only apply to requests routed to this upstream model. Requires `target_provider_id`. Omit to leave unchanged; send `null` to clear. tokens_per_minute: type: - integer - 'null' format: int32 description: >- Tokens allowed per rolling 60-second window. Omit to leave unchanged; send `null` to clear. traffic_type: type: - string - 'null' WithAttribution_RateLimitPolicy: allOf: - type: object required: - id - org_id - name - scope_type - traffic_type - enabled properties: enabled: type: boolean id: type: string format: uuid member_of_group: type: - string - 'null' description: >- Give each member of this IdP group their own allowance from this one policy. Only valid with `scope_type: user` and no `scope_id` or `scope_value`. A `group`-scoped policy, by contrast, shares one allowance across all members. name: type: string org_id: type: string format: uuid requests_per_minute: type: - integer - 'null' format: int32 scope_id: type: - string - 'null' format: uuid scope_type: $ref: '#/components/schemas/ScopeType' scope_value: type: - string - 'null' target_mcp_server_id: type: - string - 'null' format: uuid description: >- Only apply to requests to this MCP server. Requires `traffic_type` `mcp` or `all`, and cannot be combined with the LLM target fields. target_model_alias: type: - string - 'null' description: >- Only apply to requests whose `model` is this alias. Cannot be combined with the other target fields. target_provider_id: type: - string - 'null' format: uuid description: >- Only apply to requests routed to this provider. Can be combined with `target_upstream_model`; cannot be combined with `target_model_alias` or `target_mcp_server_id`. target_upstream_model: type: - string - 'null' description: >- Only apply to requests routed to this upstream model. Requires `target_provider_id`. tokens_per_minute: type: - integer - 'null' format: int32 traffic_type: $ref: '#/components/schemas/TrafficType' - $ref: '#/components/schemas/ChangeAttribution' description: A rate limit. Error: type: object required: - error properties: error: type: object required: - message - type properties: message: type: string description: Human-readable explanation of what went wrong. type: type: string description: >- Error category, such as `invalid_request_error`, `authentication_error`, `permission_error`, `not_found_error`, or `conflict_error`. code: type: - string - 'null' description: Machine-readable code, when one applies. example: error: message: retry_on_429_count must be between 0 and 10 type: invalid_request_error ScopeType: type: string description: >- Who a policy applies to. `llm_provider` and `model` remain for compatibility only; to limit a budget or rate limit to a provider or model, use its `target_*` fields. enum: - org - team - user - project - api_key - mcp_server - llm_provider - model - agent - role - group TrafficType: type: string enum: - all - llm - mcp ChangeAttribution: type: object description: >- Who created and last changed the record, and why. Records created before attribution was added have no values until their next change. properties: created_by_email: type: - string - 'null' created_by_name: type: - string - 'null' created_by_user_id: type: - string - 'null' format: uuid last_change_note: type: - string - 'null' description: Note explaining the last change. last_modified_at: type: - string - 'null' format: date-time description: When the last attributed change was made. last_modified_by_email: type: - string - 'null' last_modified_by_name: type: - string - 'null' last_modified_by_user_id: type: - string - 'null' format: uuid securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- An access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (`bd-...`) are not accepted here. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.