> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Save one client's settings > Replaces the client's capabilities, appending a version; the first save creates the settings. `preferences` are stored but not read by a launch: Model Access decides which models each person can use, and every launch slot is derived from that (the newest allowed route of the slot's family). ## OpenAPI ````yaml /api-reference/openapi.yaml put /api/llm-gateway/admin/client-settings/{client} openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/llm-gateway/admin/client-settings/{client}: put: tags: - llm-gateway summary: Save one client's settings description: >- Replaces the client's capabilities, appending a version; the first save creates the settings. `preferences` are stored but not read by a launch: Model Access decides which models each person can use, and every launch slot is derived from that (the newest allowed route of the slot's family). operationId: put_client_settings parameters: - name: client in: path description: '`claude` (Claude Code) or `codex` (Codex)' required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/PutClientSettingsRequest' required: true responses: '200': description: The saved settings content: application/json: schema: $ref: '#/components/schemas/ClientSettings' '400': description: >- Malformed request (an unknown slot key, an empty or list-valued preference, a capability outside the client's contract) '401': description: Missing or invalid credentials '403': description: Caller is not permitted to act on this resource in this organization '404': description: Unknown client '503': description: The first save kept losing a race with another first save; retry components: schemas: PutClientSettingsRequest: type: object required: - capabilities properties: capabilities: $ref: '#/components/schemas/AgentRuntimeCapabilities' preferences: type: object description: >- Any subset of the client's slot keys (possibly empty). Each value is a single Model Route or routing-policy alias. Stored but not read by a launch, which derives every slot from the person's allowed models. A trailing `[1m]` on a Claude value is accepted for older clients and dropped. additionalProperties: type: string propertyNames: type: string ClientSettings: type: object description: >- One client's settings, or the built-in defaults when the organization has not saved any. required: - client - exists - id - version - capabilities - preferences properties: capabilities: $ref: '#/components/schemas/AgentRuntimeCapabilities' client: type: string description: '`claude` (Claude Code) or `codex` (Codex).' exists: type: boolean description: >- False until the organization first saves settings for the client; the other fields then describe the built-in defaults. id: type: string format: uuid description: >- Stable settings id (deterministic per organization and client, so it is the same before and after the first save). preferences: type: object description: >- Stored per-slot model preferences. Accepted and kept, but not read by a launch: every slot is derived from the models Model Access allows the person (the newest allowed route of the slot's family). additionalProperties: type: string propertyNames: type: string updated_at: type: - string - 'null' format: date-time version: type: integer format: int32 description: >- Current version, 0 when `exists` is false. Each save appends a version. minimum: 0 AgentRuntimeCapabilities: type: object description: |- The normalized capability contract compiled by barndoor-cli into client-specific flags and configuration. The product default is the client's native loop (`client_default`); `locked_down` is an explicit named preset, not the omitted-envelope fallback. properties: additional_instructions: type: string default: '' allowed_commands: type: array items: type: string default: [] allowed_tools: type: array items: type: string default: [] blocked_commands: type: array items: type: string default: [] blocked_tools: type: array items: type: string default: [] browser: type: string default: native environment: type: string default: inherit filesystem: type: string default: read_write network: type: string default: native preset: type: string default: client_default schema_version: type: integer format: int32 default: 1 minimum: 0 shell: type: string default: native skills: type: boolean default: true subagents: type: boolean default: true unreviewed_desktop_builds: type: boolean description: >- Codex only. When true, Codex Desktop may launch a version newer than the installed Barndoor CLI has reviewed, under the newest reviewed version's rules and with a warning to the user, instead of being refused until Barndoor is updated. A managed-device setting can still turn it off. Default false; independent of `preset`. default: false securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.