curl --request PUT \
--url https://{host}/api/llm-gateway/admin/model-access/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"change_note": "<string>",
"enabled": true,
"name": "<string>",
"policy_type": "<string>",
"scope_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"scope_type": "<string>",
"scope_value": "<string>",
"scope_values": [
"<string>"
],
"targets": [
{
"alias": "<string>",
"kind": "model_alias"
}
],
"traffic_type": "<string>"
}
'import requests
url = "https://{host}/api/llm-gateway/admin/model-access/{id}"
payload = {
"change_note": "<string>",
"enabled": True,
"name": "<string>",
"policy_type": "<string>",
"scope_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope_ids": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"scope_type": "<string>",
"scope_value": "<string>",
"scope_values": ["<string>"],
"targets": [
{
"alias": "<string>",
"kind": "model_alias"
}
],
"traffic_type": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
change_note: '<string>',
enabled: true,
name: '<string>',
policy_type: '<string>',
scope_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
scope_ids: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
scope_type: '<string>',
scope_value: '<string>',
scope_values: ['<string>'],
targets: [{alias: '<string>', kind: 'model_alias'}],
traffic_type: '<string>'
})
};
fetch('https://{host}/api/llm-gateway/admin/model-access/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/api/llm-gateway/admin/model-access/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'change_note' => '<string>',
'enabled' => true,
'name' => '<string>',
'policy_type' => '<string>',
'scope_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'scope_ids' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'scope_type' => '<string>',
'scope_value' => '<string>',
'scope_values' => [
'<string>'
],
'targets' => [
[
'alias' => '<string>',
'kind' => 'model_alias'
]
],
'traffic_type' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{host}/api/llm-gateway/admin/model-access/{id}"
payload := strings.NewReader("{\n \"change_note\": \"<string>\",\n \"enabled\": true,\n \"name\": \"<string>\",\n \"policy_type\": \"<string>\",\n \"scope_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"scope_ids\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"scope_type\": \"<string>\",\n \"scope_value\": \"<string>\",\n \"scope_values\": [\n \"<string>\"\n ],\n \"targets\": [\n {\n \"alias\": \"<string>\",\n \"kind\": \"model_alias\"\n }\n ],\n \"traffic_type\": \"<string>\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{host}/api/llm-gateway/admin/model-access/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"change_note\": \"<string>\",\n \"enabled\": true,\n \"name\": \"<string>\",\n \"policy_type\": \"<string>\",\n \"scope_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"scope_ids\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"scope_type\": \"<string>\",\n \"scope_value\": \"<string>\",\n \"scope_values\": [\n \"<string>\"\n ],\n \"targets\": [\n {\n \"alias\": \"<string>\",\n \"kind\": \"model_alias\"\n }\n ],\n \"traffic_type\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{host}/api/llm-gateway/admin/model-access/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"change_note\": \"<string>\",\n \"enabled\": true,\n \"name\": \"<string>\",\n \"policy_type\": \"<string>\",\n \"scope_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"scope_ids\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"scope_type\": \"<string>\",\n \"scope_value\": \"<string>\",\n \"scope_values\": [\n \"<string>\"\n ],\n \"targets\": [\n {\n \"alias\": \"<string>\",\n \"kind\": \"model_alias\"\n }\n ],\n \"traffic_type\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"enabled": true,
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"org_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"policy_type": "<string>",
"scope_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"scope_type": "<string>",
"scope_values": [
"<string>"
],
"targets": [
{
"alias": "<string>",
"kind": "model_alias"
}
],
"traffic_type": "<string>",
"scope_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope_value": "<string>",
"created_by_email": "<string>",
"created_by_name": "<string>",
"created_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_change_note": "<string>",
"last_modified_at": "2023-11-07T05:31:56Z",
"last_modified_by_email": "<string>",
"last_modified_by_name": "<string>",
"last_modified_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}Update a model-access policy
curl --request PUT \
--url https://{host}/api/llm-gateway/admin/model-access/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"change_note": "<string>",
"enabled": true,
"name": "<string>",
"policy_type": "<string>",
"scope_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"scope_type": "<string>",
"scope_value": "<string>",
"scope_values": [
"<string>"
],
"targets": [
{
"alias": "<string>",
"kind": "model_alias"
}
],
"traffic_type": "<string>"
}
'import requests
url = "https://{host}/api/llm-gateway/admin/model-access/{id}"
payload = {
"change_note": "<string>",
"enabled": True,
"name": "<string>",
"policy_type": "<string>",
"scope_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope_ids": ["3c90c3cc-0d44-4b50-8888-8dd25736052a"],
"scope_type": "<string>",
"scope_value": "<string>",
"scope_values": ["<string>"],
"targets": [
{
"alias": "<string>",
"kind": "model_alias"
}
],
"traffic_type": "<string>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.put(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PUT',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
change_note: '<string>',
enabled: true,
name: '<string>',
policy_type: '<string>',
scope_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
scope_ids: ['3c90c3cc-0d44-4b50-8888-8dd25736052a'],
scope_type: '<string>',
scope_value: '<string>',
scope_values: ['<string>'],
targets: [{alias: '<string>', kind: 'model_alias'}],
traffic_type: '<string>'
})
};
fetch('https://{host}/api/llm-gateway/admin/model-access/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/api/llm-gateway/admin/model-access/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PUT",
CURLOPT_POSTFIELDS => json_encode([
'change_note' => '<string>',
'enabled' => true,
'name' => '<string>',
'policy_type' => '<string>',
'scope_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'scope_ids' => [
'3c90c3cc-0d44-4b50-8888-8dd25736052a'
],
'scope_type' => '<string>',
'scope_value' => '<string>',
'scope_values' => [
'<string>'
],
'targets' => [
[
'alias' => '<string>',
'kind' => 'model_alias'
]
],
'traffic_type' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{host}/api/llm-gateway/admin/model-access/{id}"
payload := strings.NewReader("{\n \"change_note\": \"<string>\",\n \"enabled\": true,\n \"name\": \"<string>\",\n \"policy_type\": \"<string>\",\n \"scope_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"scope_ids\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"scope_type\": \"<string>\",\n \"scope_value\": \"<string>\",\n \"scope_values\": [\n \"<string>\"\n ],\n \"targets\": [\n {\n \"alias\": \"<string>\",\n \"kind\": \"model_alias\"\n }\n ],\n \"traffic_type\": \"<string>\"\n}")
req, _ := http.NewRequest("PUT", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.put("https://{host}/api/llm-gateway/admin/model-access/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"change_note\": \"<string>\",\n \"enabled\": true,\n \"name\": \"<string>\",\n \"policy_type\": \"<string>\",\n \"scope_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"scope_ids\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"scope_type\": \"<string>\",\n \"scope_value\": \"<string>\",\n \"scope_values\": [\n \"<string>\"\n ],\n \"targets\": [\n {\n \"alias\": \"<string>\",\n \"kind\": \"model_alias\"\n }\n ],\n \"traffic_type\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{host}/api/llm-gateway/admin/model-access/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Put.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"change_note\": \"<string>\",\n \"enabled\": true,\n \"name\": \"<string>\",\n \"policy_type\": \"<string>\",\n \"scope_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"scope_ids\": [\n \"3c90c3cc-0d44-4b50-8888-8dd25736052a\"\n ],\n \"scope_type\": \"<string>\",\n \"scope_value\": \"<string>\",\n \"scope_values\": [\n \"<string>\"\n ],\n \"targets\": [\n {\n \"alias\": \"<string>\",\n \"kind\": \"model_alias\"\n }\n ],\n \"traffic_type\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"enabled": true,
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"org_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"policy_type": "<string>",
"scope_ids": [
"3c90c3cc-0d44-4b50-8888-8dd25736052a"
],
"scope_type": "<string>",
"scope_values": [
"<string>"
],
"targets": [
{
"alias": "<string>",
"kind": "model_alias"
}
],
"traffic_type": "<string>",
"scope_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"scope_value": "<string>",
"created_by_email": "<string>",
"created_by_name": "<string>",
"created_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_change_note": "<string>",
"last_modified_at": "2023-11-07T05:31:56Z",
"last_modified_by_email": "<string>",
"last_modified_by_name": "<string>",
"last_modified_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}Authorizations
A Barndoor API key, sent as Authorization: Bearer <key>. Keys are prefixed bdai_ and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token.
Path Parameters
Identifier, a UUID
Body
Optional free-text note explaining why this edit was made. Omitting it clears any previous note — deliberately not the tri-state treatment the scope fields above get, because the note describes the latest change and carrying an old one forward would explain the wrong edit.
Tri-state (see [deserialize_explicit_null]). A policy bound to one
entity is unbound by sending null — that is how the admin UI moves an
api_key-scoped policy back to "All API Keys". A plain Option<Uuid>
made that indistinguishable from omitting the field, so the update
silently kept the old binding (BCP-3955).
Replaces the whole UUID binding when present; [] unbinds. Omitted
leaves it unchanged. See [CreateModelAccessRequest::scope_ids].
Replaces the whole role / group binding when present; [] unbinds.
A single restriction target inside a [ModelAccessPolicy].
Targets answer the question "what is being allowed/denied?" — distinct
from scope_type, which answers "who is the policy applied to?". A
policy's targets list is OR-ed when matching: a request matches the
policy if any one of its targets matches the (provider, model) pair.
Serialised to JSONB with a kind discriminator so it round-trips cleanly
through the admin REST API.
ModelAlias matches against the literal model field in the request.
Model matches against the resolved upstream model — i.e. the underlying
model the routed mapping points at. The two are distinct because the
admin UI lets admins pick along either dimension: a goto alias fanned
out across providers is best expressed with ModelAlias, while "block any
request that ends up at gpt-4o-mini regardless of the alias used" is best
expressed with Model (so it fires even when goto resolves to
gpt-4o-mini).
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
Show child attributes
Show child attributes
Response
The requested record
An admin-API response for an entity whose core type lives in
ai_governance and so cannot carry portal-only columns.
TokenBudget and RateLimitPolicy are read by the enforcement path on
every request; hanging five display-only fields off them would put portal
concerns in the hot path's type and force every governance consumer to
carry them. Wrapping instead keeps the enforcement reads
(get_enabled_by_org and friends) returning the bare governance type,
while the admin reads return this.
Both halves are #[serde(flatten)], so the wire shape stays the flat
object the portal already consumes — same choice AdminModelPricing makes.
Every UUID-keyed entity (user / project / api_key / agent) the policy is bound to (BCP-5001). Empty means unbound: the policy is not pinned to a specific entity of its scope type.
Every role / group name the policy is bound to (BCP-5001). Empty means unbound.
A single restriction target inside a [ModelAccessPolicy].
Targets answer the question "what is being allowed/denied?" — distinct
from scope_type, which answers "who is the policy applied to?". A
policy's targets list is OR-ed when matching: a request matches the
policy if any one of its targets matches the (provider, model) pair.
Serialised to JSONB with a kind discriminator so it round-trips cleanly
through the admin REST API.
ModelAlias matches against the literal model field in the request.
Model matches against the resolved upstream model — i.e. the underlying
model the routed mapping points at. The two are distinct because the
admin UI lets admins pick along either dimension: a goto alias fanned
out across providers is best expressed with ModelAlias, while "block any
request that ends up at gpt-4o-mini regardless of the alias used" is best
expressed with Model (so it fires even when goto resolves to
gpt-4o-mini).
- Option 1
- Option 2
- Option 3
- Option 4
- Option 5
Show child attributes
Show child attributes
First element of [Self::scope_ids], kept for clients that predate
multi-entity scopes (BCP-5001). Never read for matching when
scope_ids is non-empty -- see [Self::bound_ids].
First element of [Self::scope_values]; same compatibility role as
scope_id.
Optional free text explaining why the last change was made ("Raised for the Q3 batch job", "Vendor deprecated the old endpoint").
Admin-authored and rendered in the portal, so it is untrusted input: length-capped here, escaped on render.
When the change named by last_modified_by_* happened.
Its own column rather than the row's updated_at, because updated_at
is bumped by writes nobody is attributed for -- pairing the two would
date a named admin's edit to a background job's clock. See the V75
migration for the full reasoning.