> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a routing rule > Adds a rule to a routing policy. A rule is a plain-English `description` of the requests it applies to, with a minimum slot (`floor_slot`), slots it forbids (`deny_slots`), or both. Slot numbers are 0-based positions in the policy's `slots` list. Conflicts with the policy's other rules are reported in the response but do not block the save. When a floor and a ban cannot both be honored, the ban wins. ## OpenAPI ````yaml api-reference/llm-gateway-openapi.yml post /admin/routing-rules openapi: 3.1.0 info: title: Barndoor LLM Gateway Admin API version: 1.0.0 description: > Configure the Barndoor LLM Gateway programmatically: credentials and providers, model routes and route groups, pricing, routing policies and rules, launch profiles, budgets, rate limits, model access, API keys, and organization-wide governance settings. These are the same APIs the Barndoor app uses under **LLM Management**, and the Barndoor Terraform provider manages its LLM Gateway resources through them. Every endpoint is scoped to the organization of the calling token. ## Base URL ``` https://app.barndoor.ai/api/llm-gateway ``` For a dedicated deployment, replace `app.barndoor.ai` with the host you sign in to. ## Authentication Send an access token from Barndoor's identity provider in the `Authorization` header: ``` Authorization: Bearer ``` For scripts and CI, use a service-account token from the OAuth 2.0 client-credentials grant, as the Terraform provider does. The caller needs the admin role in the organization. The `bd-...` API keys you create with these endpoints are for LLM traffic (`/v1/chat/completions`, `/v1/messages`, and so on), not for these administrative calls. ## Partial updates Most `PUT` endpoints change only the fields you send. Where a field can be cleared, send it as `null`; omitting it leaves it unchanged. The exceptions are called out on the endpoint: `PUT /admin/governance-config` replaces the whole configuration, `PUT /admin/routing-rules/{id}` replaces the whole rule, and `PUT /admin/agent-runtime-profiles/{slug}` replaces the profile's models. ## Errors Errors are returned as JSON: ```json { "error": { "message": "retry_on_429_count must be between 0 and 10", "type": "invalid_request_error" } } ``` contact: name: Barndoor Support url: https://barndoor.ai servers: - url: https://{host}/api/llm-gateway description: Your Barndoor platform host. variables: host: default: app.barndoor.ai description: >- The host serving your Barndoor deployment. Use the default for Barndoor SaaS; for a dedicated deployment, use the host you sign in to. security: - BearerAuth: [] tags: - name: Credentials description: >- Stored upstream secrets (API keys, AWS roles, Google credentials) that providers reference - name: Providers description: Named upstream providers backed by a credential and a model family - name: Model Routes description: >- Map caller-facing aliases to upstream models on one or more providers, with failover order, retries, timeouts, and cooldowns - name: Route Groups description: >- Named sets of model aliases that model access policies can target as one unit - name: Model Pricing description: >- Versioned per-million-token costs used for cost reporting and cost-based budgets - name: Routing Policies description: Model aliases that pick one of several model slots for each request - name: Routing Rules description: >- Plain-English rules that set a minimum slot or forbid slots on a routing policy - name: Launch Profiles description: >- Models and capabilities applied when members start an agent with barndoor run - name: Rate Limits description: Requests-per-minute and tokens-per-minute ceilings - name: Budgets description: Daily, weekly, or monthly token and cost ceilings - name: Model Access description: >- Allowlist and denylist policies for models, providers, aliases, and route groups - name: Governance description: Organization-wide LLM Gateway settings - name: API Keys description: Organization-managed `bd-...` gateway API keys for LLM traffic paths: /admin/routing-rules: post: tags: - Routing Rules summary: Create a routing rule description: >- Adds a rule to a routing policy. A rule is a plain-English `description` of the requests it applies to, with a minimum slot (`floor_slot`), slots it forbids (`deny_slots`), or both. Slot numbers are 0-based positions in the policy's `slots` list. Conflicts with the policy's other rules are reported in the response but do not block the save. When a floor and a ban cannot both be honored, the ban wins. operationId: createRoutingRule parameters: - name: policy_id in: query description: ID of the routing policy the rules belong to. required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/RoutingRuleDraft' required: true responses: '201': description: The created rule, with any conflicts it introduces content: application/json: schema: $ref: '#/components/schemas/RoutingRuleWriteResponse' '400': description: '`policy_id` is missing or not a UUID, or the body is invalid' content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid access token content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Your role does not allow this action content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such record in your organization content: application/json: schema: $ref: '#/components/schemas/Error' '422': description: >- The rule is well-formed but invalid: for example, it sets neither `floor_slot` nor `deny_slots`, or another rule on the policy already uses its name content: application/json: schema: $ref: '#/components/schemas/Error' security: - BearerAuth: [] components: schemas: RoutingRuleDraft: type: object description: >- A routing rule to create, or the full replacement for an existing one. Set `floor_slot`, `deny_slots`, or both. required: - name - description properties: deny_slots: type: array items: type: integer format: int32 description: Slots a matching request may not use. description: type: string description: >- Plain-English description of the requests the rule applies to, up to 2,000 characters. enabled: type: boolean floor_slot: type: - integer - 'null' format: int32 description: Lowest slot a matching request may use. name: type: string description: Rule name, unique within the policy, up to 120 characters. RoutingRuleWriteResponse: allOf: - $ref: '#/components/schemas/RoutingRule' - type: object required: - conflicts properties: conflicts: type: array items: $ref: '#/components/schemas/RuleConflict' description: >- Conflicts with the policy's other rules. Advisory: the rule was saved. description: >- The saved rule and any conflicts it now has with the policy's other rules. Error: type: object required: - error properties: error: type: object required: - message - type properties: message: type: string description: Human-readable explanation of what went wrong. type: type: string description: >- Error category, such as `invalid_request_error`, `authentication_error`, `permission_error`, `not_found_error`, or `conflict_error`. code: type: - string - 'null' description: Machine-readable code, when one applies. example: error: message: retry_on_429_count must be between 0 and 10 type: invalid_request_error RoutingRule: type: object description: >- A routing rule. Slot numbers are 0-based positions in the policy's `slots` list. required: - id - org_id - policy_id - name - description - deny_slots - enabled properties: deny_slots: type: array items: type: integer format: int32 description: >- Slots this rule forbids. A ban wins over a floor when both cannot be honored. description: type: string description: >- Plain-English description of the requests the rule applies to. The router reads it to decide whether a request matches. enabled: type: boolean floor_slot: type: - integer - 'null' format: int32 description: Lowest slot a matching request may use. Null means no floor. id: type: string format: uuid name: type: string org_id: type: string format: uuid policy_id: type: string format: uuid RuleConflict: type: object description: >- Two rules that cannot both be honored, or one that contradicts itself. Conflicts do not block saving; at request time the ban wins. required: - rule - conflicts_with - detail properties: conflicts_with: type: string detail: type: string rule: type: string securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- An access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (`bd-...`) are not accepted here. ````