# Barndoor Documentation

- [Introduction](https://docs.barndoor.ai/index.md): Welcome to the Barndoor documentation portal. Explore guides, tutorials, SDKs, code samples, reference docs, and more.
- [Trial Guide](https://docs.barndoor.ai/how-tos/trial-guide.md): Complete guide to set up and configure your Barndoor platform from start to finish
- [Notifications](https://docs.barndoor.ai/how-tos/notifications.md): Subscribe to the events you care about and get them delivered where you actually look — in-app, email, Slack, Microsoft Teams, or a webhook.
- [Reading the Dashboard](https://docs.barndoor.ai/how-tos/read-dashboard.md): What the counts, policy decision totals and top-activity tables on the Barndoor home Dashboard measure, and where they differ from the usage dashboards.
- [Agent Profiles](https://docs.barndoor.ai/how-tos/agent-profile/overview.md): Configuring agents that operate with their own access credentials to MCPs and LLMs and provides visibility to what your agents are doing and what their models costs are.
- [Adding Your Agents](https://docs.barndoor.ai/how-tos/agent-profile/add-an-agent.md): Step-by-step guide for adding an agent in Barndoor.
- [Adding MCP Servers](https://docs.barndoor.ai/how-tos/add-an-mcp-server.md): Step-by-step guide to adding a new MCP server in Barndoor.
- [Managing Policies](https://docs.barndoor.ai/how-tos/manage-policies.md): Step-by-step guide to validate, create, activate, update, clone, and audit policies with the v2 API.
- [Granular Tool Use Confirmations](https://docs.barndoor.ai/how-tos/tool-confirmations.md): Require human approval for any tool call — including reads — on a per-tool, per-group basis from the Access Control Center.
- [Connecting Accounts to Barndoor](https://docs.barndoor.ai/how-tos/connected-accounts.md): Step-by-step guide for connecting external accounts (like Salesforce) in Barndoor.
- [Connect AI clients to Barndoor](https://docs.barndoor.ai/how-tos/connecting-barndoor-to-agents.md): Step-by-Step: Connect your ToolIQ universal endpoint to your MCP Servers for Claude, ChatGPT, and other AI clients
- [MCP Change Management](https://docs.barndoor.ai/how-tos/mcp-change-management.md): See every connected MCP server's tool inventory and version history, know which policies a change touches, and get alerted the moment a server's tools move.
- [Use Google Drive labels in Field Controls](https://docs.barndoor.ai/how-tos/google-drive-labels.md): Discover your organization's Drive classification labels with Barndoor-managed Google credentials.
- [Reading the MCP Usage Dashboard](https://docs.barndoor.ai/how-tos/read-mcp-usage-dashboard.md): What each metric on the MCP Usage Dashboard measures, and how to read the trends, errors, by-period and breakdown tabs.
- [Using the LLM Gateway](https://docs.barndoor.ai/how-tos/use-llm-gateway.md): Send LLM traffic from Cursor, Claude Code, Codex, your apps, and the OpenAI / Anthropic SDKs through the Barndoor LLM Gateway.
- [Quickstart Guide](https://docs.barndoor.ai/how-tos/llm-gateway-quickstart.md): Configure the Barndoor LLM Gateway as an admin — credentials, providers, models, routes, and governance — then send requests and troubleshoot.
- [Connecting Your Tools to the LLM Gateway](https://docs.barndoor.ai/how-tos/connect-tools-to-llm-gateway.md): Grab your API key, model name, and gateway endpoint from the Barndoor portal, then point Cursor, Claude Code, Codex, or the OpenAI / Anthropic SDKs at the gateway.
- [Use Codex with the LLM Gateway](https://docs.barndoor.ai/how-tos/use-codex-with-llm-gateway.md): Point Codex CLI and Codex Desktop at the Barndoor LLM Gateway using the OpenAI Responses wire format.
- [Managing Model Pricing](https://docs.barndoor.ai/how-tos/manage-model-pricing.md): Control the per-million-token prices the Barndoor LLM Gateway uses to cost requests, so spending budgets and cost reporting are accurate.
- [Configuring LLM Controls](https://docs.barndoor.ai/how-tos/use-llm-controls.md): Set token and spending budgets, rate limits, and model access policies on traffic flowing through the Barndoor LLM Gateway.
- [Get the most out of your Claude subscription](https://docs.barndoor.ai/how-tos/llm-gateway-failover.md): Run Claude Code on your Claude subscription through the Barndoor LLM Gateway and keep working past your rate limit with automatic failover, so each developer gets the full value of the seat you pay for.
- [Failover, Cooldowns, and Route Health](https://docs.barndoor.ai/how-tos/llm-gateway-failover-and-cooldowns.md): How a model route's ordered targets fail over, which errors trigger it, and how cooldowns and route health keep traffic off failing targets.
- [Routing Policies](https://docs.barndoor.ai/how-tos/llm-routing-policies.md): Give callers one model name — like smart — and let the gateway pick the cheapest model strong enough for each request, constrained by plain-English routing rules, model access, and budgets.
- [Calling Jev Through the Gateway](https://docs.barndoor.ai/how-tos/use-jev-classifier.md): Call TypeSafe's Jev classifier through the Barndoor LLM Gateway with TypeSafe's own SDKs, so classification traffic gets the same API keys, budgets, audit trail, and usage reporting as your chat models.
- [Connecting a Self-Hosted Model](https://docs.barndoor.ai/how-tos/connect-self-hosted-model.md): Route traffic from your own model server — vLLM, Ollama, SGLang, or anything with an OpenAI-compatible API — through the Barndoor LLM Gateway, so in-house models get the same budgets, audit trail, and usage reporting as your hosted providers.
- [Reading the LLM Usage Dashboard](https://docs.barndoor.ai/how-tos/read-llm-usage-dashboard.md): What each metric on the LLM Usage Dashboard measures — requests, tokens, estimated cost, duration, errors and failovers — and how to read the trends, errors, resilience, caching, by-period and breakdown tabs.
- [Connect your IdP](https://docs.barndoor.ai/how-tos/idp-setup.md): Set up SSO login and automatically provision user roles using any OIDC / SAML 2.0 compatible IdP
- [Connect Okta as your IdP](https://docs.barndoor.ai/how-tos/okta-oin-setup.md): Configure Barndoor SSO using the official OIN app with SCIM provisioning
- [Connect Microsoft Entra ID as your IdP](https://docs.barndoor.ai/how-tos/entra-idp-setup.md): Step-by-step guide for configuring Microsoft Entra ID (formerly Azure AD) as an OIDC Identity Provider with SCIM Provisioning
- [Redirect URI Allowlisting](https://docs.barndoor.ai/how-tos/redirect-uri-allowlisting.md): Allowlist the Barndoor redirect URI in your OAuth application
- [IP Allow Listing](https://docs.barndoor.ai/how-tos/ip-allowlisting.md): Configure your firewall to allow Barndoor MCP traffic
- [Export audit logs to your own storage](https://docs.barndoor.ai/how-tos/log-export.md): Stream Barndoor audit events to your own S3-compatible or Azure Blob storage in near real time
- [Lock Down Claude Enterprise to One Barndoor URL](https://docs.barndoor.ai/how-tos/claude-enterprise-barndoor-universal-url.md): How to configure Claude with Barndoor to manage the MCP access of your organization's users.
- [Data Control Center](https://docs.barndoor.ai/how-tos/data-control-center/overview.md): Detect, block, redact, or observe sensitive data as it flows through AI agents and the MCP layer.
- [Protection Profiles](https://docs.barndoor.ai/how-tos/data-control-center/protection-profiles.md): Create named detection engines that define which data types to scan for. Policies can't be created until at least one profile exists.
- [MCP Policies](https://docs.barndoor.ai/how-tos/data-control-center/mcp-policies.md): Govern enforcement on MCP tool calls — the structured requests and responses between AI agents and connected servers.
- [Field Controls](https://docs.barndoor.ai/how-tos/data-control-center/field-controls.md): Deterministic, field-level redaction for specific MCP tools — independent of text-based detection.
- [Masking & Partial Redaction](https://docs.barndoor.ai/how-tos/data-control-center/masking.md): Replace a detected value with a placeholder, or keep the first or last few characters readable and mask the rest — credit-card style.
- [Barndoor API Reference](https://docs.barndoor.ai/api-reference/introduction.md)
- [List MCP servers](https://docs.barndoor.ai/api-reference/servers/listServers.md): List all MCP servers available to the caller's organization. Returns paginated results with server details including connection status.
- [Create MCP Server](https://docs.barndoor.ai/api-reference/servers/createServer.md): Create a new MCP server instance from a server directory template.
- [Get Server by Id](https://docs.barndoor.ai/api-reference/servers/getServer.md): Get detailed information about a specific MCP server. Returns extended information including MCP URL if available.
- [Delete Server by Id](https://docs.barndoor.ai/api-reference/servers/deleteServer.md): Delete an MCP server and all associated connections.
- [Update MCP Server](https://docs.barndoor.ai/api-reference/servers/updateServer.md): Update an existing MCP server's configuration.
- [Get Connection Status](https://docs.barndoor.ai/api-reference/connections/getConnectionStatus.md): Get the user's connection status for a specific server. Used to poll connection status during OAuth flows.
- [Initiate OAuth connection](https://docs.barndoor.ai/api-reference/connections/initiateConnection.md): Initiate OAuth connection flow for a server. Returns an authorization URL that the user should visit to complete the OAuth flow.
- [Delete connection](https://docs.barndoor.ai/api-reference/connections/deleteConnection.md): Delete the current user's connection to this server.
- [List Server Connections](https://docs.barndoor.ai/api-reference/connections/listServerConnections.md): List who in the organization holds a connection to this MCP server — the inverse of the caller-scoped connection endpoints, which only ever return your own connection.
- [MCP server proxy endpoint](https://docs.barndoor.ai/api-reference/mcp/proxyMcpRequest.md): Proxies MCP JSON-RPC requests to third-party servers with automatic authentication.
- [SSE server proxy endpoint](https://docs.barndoor.ai/api-reference/sse/proxySSERequest.md): Server-Sent Events proxy endpoint for real-time streaming communication with third-party servers.
- [List Policies](https://docs.barndoor.ai/api-reference/policies/listPolicies.md)
- [Create or Update Policy](https://docs.barndoor.ai/api-reference/policies/createPolicy.md)
- [Validate Policy](https://docs.barndoor.ai/api-reference/policies/validatePolicy.md): Validate a policy before creation or update. Checks for duplicate names and overlapping MCP server/agent combinations. When exclude_policy_id is provided (edit mode), that policy is excluded from validation.
- [Get Policy](https://docs.barndoor.ai/api-reference/policies/getPolicy.md)
- [List Policy Revisions](https://docs.barndoor.ai/api-reference/policies/listPolicyRevisions.md): List all revisions for a given policy with pagination.
- [Update Policy](https://docs.barndoor.ai/api-reference/policies/updatePolicy.md)
- [Clone Policy](https://docs.barndoor.ai/api-reference/policies/clonePolicy.md): Clone an existing policy, creating a new policy with the same configuration but with a modified name (appending " Copy") and DRAFT status.
- [Enable Policy](https://docs.barndoor.ai/api-reference/policies/enablePolicy.md)
- [Disable Policy](https://docs.barndoor.ai/api-reference/policies/disablePolicy.md)
- [Enable Restriction](https://docs.barndoor.ai/api-reference/policies/enableRestriction.md)
- [Disable Restriction](https://docs.barndoor.ai/api-reference/policies/disableRestriction.md)
- [Get Filter Definitions](https://docs.barndoor.ai/api-reference/policies/getFilterDefinitions.md): Return filter categories for the policies list UI.
- [Get Policies Summary](https://docs.barndoor.ai/api-reference/policies/getPoliciesSummary.md): Return summary counts of policies by status.
- [Reload Policy Cache](https://docs.barndoor.ai/api-reference/policies/reloadCache.md)
- [List Agents](https://docs.barndoor.ai/api-reference/agents/listAgents.md): List registered agents with pagination.
- [GET Agent by Id](https://docs.barndoor.ai/api-reference/agents/getAgent.md): Get details of a specific agent by ID, including its application directory configuration.
- [Register Agent](https://docs.barndoor.ai/api-reference/agents/registerAgent.md): Register a new agent with Barndoor.
- [Delete Agent by Id](https://docs.barndoor.ai/api-reference/agents/deleteAgent.md): Unregister an agent from Barndoor.
- [Get Agent Counts](https://docs.barndoor.ai/api-reference/agents/counts/getAgentCounts.md): Get counts of agents grouped by type (internal vs external).
- [LLM Gateway API](https://docs.barndoor.ai/api-reference/llm-gateway/introduction.md): Programmatically configure the Barndoor LLM Gateway: credentials, providers, model routes, pricing, governance, routing policies, launch profiles, and gateway API keys.
- [List credentials](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/listCredentials.md): Returns every credential in your organization. A credential holds an upstream secret (an API key, an AWS role, or Google credentials) that one or more providers reference. The secret itself is never returned; `key_last4` shows the last four characters when the credential stores a key.
- [Create a Credential](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/createCredential.md): Stores a new upstream credential. The plaintext `api_key` (or `credentials` object) is written to Barndoor's encrypted secret store and is never returned by any endpoint.
- [Get a credential](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/getCredential.md)
- [Update a credential](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/updateCredential.md): Updates a credential. Only the fields you send are changed. Sending `api_key` or `credentials` rotates the stored secret for every provider that references this credential.
- [Delete a credential](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/deleteCredential.md): Deletes a credential. The request is refused with `409` while any provider still references it; move or delete those providers first.
- [Get Barndoor's AWS principal](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/getAwsRoleConfig.md): Returns the AWS principal ARN to name as the trusted principal in the trust policy of any IAM role you give Barndoor for Amazon Bedrock role-based access.
- [Get AWS trust info](https://docs.barndoor.ai/api-reference/llm-gateway/credentials/getAwsTrustInfo.md): Returns the Barndoor principal ARN and the per-credential external ID for an AWS role credential: the two values your role's trust policy needs.
- [List providers](https://docs.barndoor.ai/api-reference/llm-gateway/providers/listProviders.md)
- [Create a Provider](https://docs.barndoor.ai/api-reference/llm-gateway/providers/createProvider.md): Creates a named upstream provider. Providers whose auth type needs a secret must reference an existing credential with `connection_id`; sending `api_key` or `credentials` here is rejected with `400`.
- [Get a provider](https://docs.barndoor.ai/api-reference/llm-gateway/providers/getProvider.md)
- [Update a provider](https://docs.barndoor.ai/api-reference/llm-gateway/providers/updateProvider.md): Updates a provider. Only the fields you send are changed. To rotate the upstream key, update the credential instead. You can rebind the provider to a different credential with `connection_id`, but a provider whose auth type needs a secret cannot be detached from its credential.
- [Delete a provider](https://docs.barndoor.ai/api-reference/llm-gateway/providers/deleteProvider.md): Deletes a provider and every model route that pointed at it.
- [List all model routes](https://docs.barndoor.ai/api-reference/llm-gateway/model-routes/listAllRoutes.md): Returns every model route in the organization with its provider's name. Each row also carries the rate it would be billed at (`effective_pricing`) and, when applicable, whether an exhausted budget, a health cooldown, or a model retired from the provider's catalog is affecting it.
- [Create a Model Route](https://docs.barndoor.ai/api-reference/llm-gateway/model-routes/createRoute.md): Creates a model route from a caller-facing `model_alias` to an `upstream_model` on a provider.
- [Reorder model routes](https://docs.barndoor.ai/api-reference/llm-gateway/model-routes/reorderRoutes.md): Sets the `priority` of several routes in one call. Routes that share an alias fail over in ascending priority order.
- [Update a model route](https://docs.barndoor.ai/api-reference/llm-gateway/model-routes/updateRoute.md): Updates a model route. Only the fields you send are changed. When your organization requires pricing for model routes, an enabled route must still match a pricing rule after the update; setting `enabled: false` is always allowed.
- [Delete a model route](https://docs.barndoor.ai/api-reference/llm-gateway/model-routes/deleteRoute.md)
- [List a provider's model routes](https://docs.barndoor.ai/api-reference/llm-gateway/model-routes/listProviderRoutes.md)
- [List route groups](https://docs.barndoor.ai/api-reference/llm-gateway/route-groups/listRouteGroups.md): Returns every route group in the organization with its member aliases. A route group is a named set of model aliases that a model access policy can target as one unit.
- [Create a route group](https://docs.barndoor.ai/api-reference/llm-gateway/route-groups/createRouteGroup.md): Creates a route group, optionally with its initial member aliases. An empty group is valid: you can attach it to a policy and add members later.
- [Update a route group](https://docs.barndoor.ai/api-reference/llm-gateway/route-groups/updateRouteGroup.md): Renames a route group or changes its description. When `model_aliases` is present it replaces the whole membership; omit it to leave members unchanged.
- [Delete a route group](https://docs.barndoor.ai/api-reference/llm-gateway/route-groups/deleteRouteGroup.md): Deletes a route group. Model access policies that targeted the group are not rewritten: the target remains and matches nothing. Review those policies after deleting a group, because an allowlist that relied on it no longer grants those routes.
- [Add routes to a route group](https://docs.barndoor.ai/api-reference/llm-gateway/route-groups/addRouteGroupMembers.md): Adds aliases to the group. Aliases that are already members are ignored.
- [Remove a route from a route group](https://docs.barndoor.ai/api-reference/llm-gateway/route-groups/removeRouteGroupMember.md)
- [List pricing rules](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/listPricing.md): One row per pricing rule, each showing the currently effective version, a `version_count`, and a `scheduled_count` of future-dated changes waiting to activate. Archived rules are not included.
- [Create or Schedule Pricing](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/createPricing.md): Creates a pricing rule, or appends a new version to an existing one. A rule is identified by `model_provider` and `model_pattern`.
- [Get a pricing rule's history](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/getPricingHistory.md): Returns every version of one rule (current, scheduled, archived, and earlier versions).
- [List archived pricing rules](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/listArchivedPricing.md)
- [Get a pricing version](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/getPricingVersion.md): Returns one version of a pricing rule by ID, including versions that are no longer current.
- [Edit a scheduled pricing version](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/updatePricing.md): Updates a future-dated (scheduled) pricing version in place. Past versions are immutable: to change the active price, create a new version with `POST /admin/model-pricing`.
- [Archive or cancel a pricing version](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/archivePricing.md): What happens depends on the version you target:
- [List Barndoor's default pricing](https://docs.barndoor.ai/api-reference/llm-gateway/model-pricing/listPricingDefaults.md): Returns the default pricing catalog Barndoor maintains. Rules with `sync_mode: auto` follow changes to these defaults automatically, `tracking` rules surface them for review, and `pinned` rules ignore them.
- [List routing policies](https://docs.barndoor.ai/api-reference/llm-gateway/routing-policies/listRoutingPolicies.md): Returns every routing policy in the organization. A routing policy is a model alias that, when called, picks one of several model slots per request.
- [Create a routing policy](https://docs.barndoor.ai/api-reference/llm-gateway/routing-policies/createRoutingPolicy.md): Creates a routing policy. Callers use the policy's `model_alias` like any other model name; the gateway sends each request to one of the `slots`.
- [Update a routing policy](https://docs.barndoor.ai/api-reference/llm-gateway/routing-policies/updateRoutingPolicy.md): Updates a routing policy. Only the fields you send are changed; the merged result must still pass the same validation as a new policy.
- [Delete a routing policy](https://docs.barndoor.ai/api-reference/llm-gateway/routing-policies/deleteRoutingPolicy.md)
- [List a policy's routing rules](https://docs.barndoor.ai/api-reference/llm-gateway/routing-rules/listRoutingRules.md): Returns the rules attached to one routing policy, plus any conflicts between them.
- [Create a routing rule](https://docs.barndoor.ai/api-reference/llm-gateway/routing-rules/createRoutingRule.md): Adds a rule to a routing policy. A rule is a plain-English `description` of the requests it applies to, with a minimum slot (`floor_slot`), slots it forbids (`deny_slots`), or both. Slot numbers are 0-based positions in the policy's `slots` list.
- [Replace a routing rule](https://docs.barndoor.ai/api-reference/llm-gateway/routing-rules/updateRoutingRule.md): Replaces a routing rule with the body you send. Conflicts are reported in the response.
- [Delete a routing rule](https://docs.barndoor.ai/api-reference/llm-gateway/routing-rules/deleteRoutingRule.md)
- [List launch profiles](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/listLaunchProfiles.md): Returns the organization's launch profiles. A launch profile sets the models and capabilities that members get when they start Claude Code or Codex through `barndoor run`.
- [Create a launch profile](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/createLaunchProfile.md): Creates a launch profile for one client. Every value in `config` must be a single model route alias that resolves in your organization.
- [Get a launch profile](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/getLaunchProfile.md)
- [Replace a launch profile's models and capabilities](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/replaceLaunchProfileContract.md): Replaces the profile's `config` and, when sent, its `capabilities`, creating a new version of the profile.
- [Rename or activate a launch profile](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/updateLaunchProfileMetadata.md): Updates the profile's display name or active state without creating a new version.
- [Delete a launch profile](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/deleteLaunchProfile.md): Deletes a launch profile. The request fails with `409` if the profile is still referenced.
- [Make a launch profile the default](https://docs.barndoor.ai/api-reference/llm-gateway/launch-profiles/setDefaultLaunchProfile.md): Makes this profile the organization's default for its client, replacing the previous default. Inactive profiles cannot be made the default.
- [List rate limits](https://docs.barndoor.ai/api-reference/llm-gateway/rate-limits/listRateLimits.md)
- [Create a rate limit](https://docs.barndoor.ai/api-reference/llm-gateway/rate-limits/createRateLimit.md): Creates a per-minute request and/or token ceiling for a scope, measured over a rolling 60-second window. At least one of `requests_per_minute` and `tokens_per_minute` is required.
- [Update a rate limit](https://docs.barndoor.ai/api-reference/llm-gateway/rate-limits/updateRateLimit.md): Updates a rate limit. Only the fields you send are changed. Send `null` for `scope_id`, `scope_value`, a `target_*` field, or a per-minute metric to clear it; at least one metric must remain set.
- [Delete a rate limit](https://docs.barndoor.ai/api-reference/llm-gateway/rate-limits/deleteRateLimit.md)
- [List budgets](https://docs.barndoor.ai/api-reference/llm-gateway/token-budgets/listBudgets.md)
- [Create a budget](https://docs.barndoor.ai/api-reference/llm-gateway/token-budgets/createBudget.md): Creates a token and/or cost ceiling for a scope over a daily, weekly, or monthly period. Set `token_limit`, `cost_limit`, or both; use `token_limit: 0` with a `cost_limit` for a cost-only budget.
- [Update a budget](https://docs.barndoor.ai/api-reference/llm-gateway/token-budgets/updateBudget.md): Updates a budget's name, limits, period, alert thresholds, exhaustion action, traffic type, or enabled state. Only the fields you send are changed. A budget's scope and targets cannot be changed; create a new budget instead.
- [Delete a budget](https://docs.barndoor.ai/api-reference/llm-gateway/token-budgets/deleteBudget.md)
- [List model access policies](https://docs.barndoor.ai/api-reference/llm-gateway/model-access/listModelAccess.md)
- [Create a model access policy](https://docs.barndoor.ai/api-reference/llm-gateway/model-access/createModelAccess.md): Creates an allowlist (only the listed targets are permitted) or a denylist (the listed targets are blocked) for a scope. A target can be a model alias, an upstream model, a provider, a provider and alias pair, or a route group.
- [Update a model access policy](https://docs.barndoor.ai/api-reference/llm-gateway/model-access/updateModelAccess.md): Updates a model access policy. Only the fields you send are changed. Send `null` for `scope_id` or `scope_value` to unbind the policy from a single entity.
- [Delete a model access policy](https://docs.barndoor.ai/api-reference/llm-gateway/model-access/deleteModelAccess.md)
- [Get governance configuration](https://docs.barndoor.ai/api-reference/llm-gateway/governance/getGovernanceConfig.md): Returns the organization's LLM Gateway governance settings. An organization that has never changed them gets the defaults.
- [Update governance configuration](https://docs.barndoor.ai/api-reference/llm-gateway/governance/updateGovernanceConfig.md): Replaces the organization's governance settings.
- [List API keys](https://docs.barndoor.ai/api-reference/llm-gateway/api-keys/listApiKeys.md): Lists the gateway API keys in the organization. The raw key is never returned, only its prefix and metadata.
- [Create an Org API Key](https://docs.barndoor.ai/api-reference/llm-gateway/api-keys/createApiKey.md): Creates a `bd-...` gateway API key for LLM traffic. The raw key is returned in this response and never again, so copy it immediately.
- [Get an API key](https://docs.barndoor.ai/api-reference/llm-gateway/api-keys/getApiKey.md)
- [Disable or enable an API key](https://docs.barndoor.ai/api-reference/llm-gateway/api-keys/setApiKeyDisabled.md): Temporarily disables a key, or re-enables it. A disabled key is rejected on every request, but unlike revocation this is reversible and the key does not need to be reissued.
- [Revoke an API key](https://docs.barndoor.ai/api-reference/llm-gateway/api-keys/revokeApiKey.md): Permanently revokes a key. It is rejected on every future request. To stop a key temporarily, disable it instead.
- [Terraform Provider](https://docs.barndoor.ai/terraform/index.md): Manage your Barndoor organization as code with the official Terraform provider
- [Getting Started](https://docs.barndoor.ai/terraform/getting-started.md): Generate a provider credential, configure the Barndoor Terraform provider, and apply your first resource
- [Manage MCP Access](https://docs.barndoor.ai/terraform/manage-mcp-access.md): Onboard an MCP server, connect it tenant-wide, register an AI Agent, and govern access with a policy — all in Terraform
- [Manage the LLM Gateway](https://docs.barndoor.ai/terraform/llm-gateway.md): Configure model routes with failover, access policies, route groups, rate limits, budgets, pricing, routing policies, and governance settings in Terraform
- [Manage Data Protection](https://docs.barndoor.ai/terraform/data-protection.md): Define custom detection types, allow lists, and enforcement policies as code, with a dry-run-first rollout
- [Best Practices](https://docs.barndoor.ai/terraform/best-practices.md): Importing existing configuration, avoiding drift, destroy semantics, secrets hygiene, and running the Barndoor provider in CI
- [Barndoor SDKs](https://docs.barndoor.ai/sdks/introduction.md): The Barndoor SDKs empowers developers to connect to governed Model Context Protocol (MCP) servers, enabling seamless interaction with platforms like Salesforce, Notion, and GitHub. Whether you're building AI-driven applications with OpenAI or performing direct API calls, the SDK simplifies authentic…
- [Python](https://docs.barndoor.ai/sdks/python.md)
- [Typescript](https://docs.barndoor.ai/sdks/typescript.md)
- [General](https://docs.barndoor.ai/sdks/examples/general.md)
- [CrewAI](https://docs.barndoor.ai/sdks/examples/crewAI.md)
- [Mcp servers](https://docs.barndoor.ai/mcp-servers/index.md)

## OpenAPI Specs

- [llm-gateway-openapi](/api-reference/llm-gateway-openapi.yml)
- [openapi](/api-reference/openapi.yml)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.