AI Provider Keys

List AI provider keys

GET/v1/workspaces/{workspaceId}/ai_provider_keys

Create a new AI provider key

POST/v1/workspaces/{workspaceId}/ai_provider_keys

Get an AI provider key by ID

GET/v1/workspaces/{workspaceId}/ai_provider_keys/{id}

Delete an AI provider key

DELETE/v1/workspaces/{workspaceId}/ai_provider_keys/{id}

Update an AI provider key

PATCH/v1/workspaces/{workspaceId}/ai_provider_keys/{id}

ModelsExpand Collapse

AIProviderKey object { metadata, spec, info }

AIProviderKey is a credential for an AI provider, scoped to a workspace. Most keys are customer-provided (BYOK); Cadenya also provisions promotional keys (see AIProviderKeyInfo.is_promotional), which cannot be modified or deleted by account administrators. The secret value is never returned in responses.

metadata: ResourceMetadata { id, accountId, createdAt, 7 more }

Standard metadata for persistent, named resources (e.g., agents, tools, prompts)

id: string

Unique identifier for the resource (prefixed ULID, e.g., “agent_01HXK…”)

accountId: string

Account this resource belongs to for multi-tenant isolation (prefixed ULID)

createdAt: string

Timestamp when this resource was created

formatdate-time

name: string

Human-readable name for the resource (e.g., “Customer Support Agent”, “Email Tool”) Required for resources that users interact with directly

profileId: string

ID of the actor (user or service account) that created this resource

workspaceId: string

Workspace this resource belongs to for organizational grouping (prefixed ULID)

bundleKey: optional string

Optional bundle ownership key. When set, indicates the resource is managed by a configuration bundle identified by this key. Used by BulkWorkspaceResources.Apply to track which resources belong to which bundle for reconciliation / soft-delete on re-apply.

externalId: optional string

External ID for the resource (e.g., a workflow ID from an external system)

labels: optional map[string]

Arbitrary key-value pairs for categorization and filtering Examples: {“environment”: “production”, “team”: “platform”, “version”: “v2”}

updatedAt: optional string

Timestamp when this resource was last updated

formatdate-time

spec: AIProviderKeySpec { apiKey, openrouter, provider }

apiKey: optional string

The provider credential. Accepted on create/update; never populated in responses (the server returns an empty value to avoid leaking it).

openrouter: optional unknown

OpenRouterConfig holds OpenRouter-specific settings. Empty for now; it exists as the oneof seam so provider-specific options (region, base URL, etc.) can be added later without restructuring the spec.

provider: optional "AI_PROVIDER_UNSPECIFIED" or "AI_PROVIDER_OPENROUTER"

The AI provider this key authenticates against.

formatenum

One of the following:

"AI_PROVIDER_UNSPECIFIED"

"AI_PROVIDER_OPENROUTER"

info: optional object { disabledModelCount, enabledModelCount, isPromotional }

AIProviderKeyInfo carries server-derived, read-only details about a key, for AI provider management UIs.

disabledModelCount: optional number

Number of disabled models provisioned on this key.

formatint32

enabledModelCount: optional number

Number of enabled models provisioned on this key.