listCredentials.md

List credentials

Returns every reusable credential configured in your organization.

OpenAPI

openapi: 3.1.0
info:
  title: Barndoor LLM Gateway API
  version: 1.0.0
  description: >
    REST API for the Barndoor LLM Gateway: configure providers, model routes,

pricing, governance, and operate a multi-provider LLM platform
    programmatically.

All endpoints in this document are scoped to your organization. They are the

same APIs powering the Barndoor portal under **LLM Configuration**,

**LLM Controls**, and **Settings - My Models**, exposed for teams that

prefer scripting over the UI.

## Base URL

All requests are issued against your Barndoor instance:

```
https://app.barndoor.ai/api/llm-gateway
```

Replace `app.barndoor.ai` with your tenant host if you run on Enterprise.

## Authentication

Endpoints accept a JWT Bearer token issued by your Barndoor identity
provider. Tokens can be obtained interactively via the Barndoor SDK:

```ts
const sdk = await loginInteractive();
```

The token must be sent in the `Authorization` header on every request:

```
Authorization: Bearer eyJhbGciOi...
```

Note: the `bd-...` API keys you create through these endpoints are for
runtime LLM traffic (`/v1/chat/completions`, `/v1/messages`, etc.), not for
administrative calls. Administrative endpoints require a user/admin JWT.

## Permissions

Most endpoints require an `admin` (or higher) role on the calling user.
Read-only endpoints are typically accessible by all authenticated users.
Read-only listings under `/user/...` are scoped to the authenticated user.

## Errors

Errors are returned as JSON with a stable shape:

```json
{ "error": "BadRequest", "message": "request_timeout_secs must be between 1 and 3600" }
```

### Contact

Barndoor Support: [Barndoor Support](/content/site-root.html)

## Servers

- Production / Trial (Barndoor SaaS): `https://{host}/api/llm-gateway`
- UAT: `https://app.barndooruat.com/api/llm-gateway`
- Dev: `https://app.barndoordev.com/api/llm-gateway`

### Security

- BearerAuth: []

### Tags

- **Credentials**: Reusable upstream credentials (API keys, AWS roles, Vertex service accounts)
- **Providers**: Named upstream providers backed by credentials and a model family
- **Provider Catalog**: Read-only catalog of supported upstream provider templates
- **Model Routes**: Map client-facing aliases to one or more upstream provider/model pairs
- **Model Pricing**: Per-million-token input/output costs for usage and budget reporting
- **Rate Limits**: Requests-per-minute and tokens-per-minute caps
- **Token Budgets**: Daily, weekly, or monthly token and cost ceilings
- **Model Access**: Allowlist or denylist policies for models, providers, or aliases
- **Smart Models**: Routing policies that pick a target model based on the request
- **Governance Configuration**: Org-wide behavior toggles for the LLM Gateway
- **Route Health**: Operational view of upstream route ejection and recovery
- **API Keys**: Org-managed gateway API keys (the `bd-...` keys callers send on `/v1/...`)
- **User**: Self-service endpoints for the authenticated user

## Paths

### /admin/connections

GET
- Tags: Credentials
- Summary: List credentials
- Description: Returns every reusable credential configured in your organization.
- OperationId: listCredentials
- Responses:
  - '200':
      Description: List of credentials
      Content:
        application/json:
          Schema:
            Type: array
            Items:
              $ref: '#/components/schemas/Credential'
  - '401':
      $ref: '#/components/responses/Unauthorized'
  - '403':
      $ref: '#/components/responses/Forbidden'

## Components

### Schemas

#### Credential
- Type: object
- Description: |
  A reusable upstream credential, called *Credentials* in the portal UI.
  One credential can back multiple providers (e.g. a single OpenAI key
  used by several routes).
- Required:
  - id
  - org_id
  - name
  - model_provider
  - auth_type
  - base_url
  - settings
  - created_at
  - updated_at
- Properties:
  - id:
      Type: string
      Format: uuid
      Example: 4f8b2a3c-12ee-4d92-9c7b-e7d2f8b0a111
  - org_id:
      Type: string
      Format: uuid
      Description: The organization that owns this credential
  - name:
      Type: string
      Example: OpenAI Production
  - model_provider:
      $ref: '#/components/schemas/ModelProviderSlug'
  - auth_type:
      $ref: '#/components/schemas/AuthType'
  - base_url:
      Type: string
      Format: uri
      Description: |
        Upstream base URL the credential points at. Defaults to the public
        provider URL but can be overridden for self-hosted or proxy setups.
      Example: https://api.openai.com/v1
  - settings:
      Type: object
      Description: |
        Provider-specific settings that aren't sensitive (e.g. AWS region,
        Vertex project id, Azure API version). Sensitive credentials live
        in the encrypted secret store and are never returned by the API.
      AdditionalProperties: true
      Example:
        region: us-east-1
        model_api_family: anthropic_messages
  - created_at:
      Type: string
      Format: date-time
  - updated_at:
      Type: string
      Format: date-time

#### ModelProviderSlug
- Type: string
- Description: Slug of the upstream model provider this resource speaks to
- Enum:
  - openai
  - anthropic
  - azure_openai
  - google_ai
  - bedrock
  - vertex
  - groq
  - together
  - mistral
  - cohere
  - xai
  - fireworks
  - perplexity
  - openrouter
  - deepseek
  - custom
- Example: openai

#### AuthType
- Type: string
- Description: >
  The authentication scheme this credential or provider uses to talk to
  the upstream model provider. Valid values depend on `model_provider`:

for OpenAI/Anthropic-style vendors this is typically `api_key`; for AWS
  Bedrock it is one of `aws_role`, `aws_keys`, or `bedrock_api_key`; for
  Google Vertex it is `google_adc`, `google_service_account`, or
  `google_impersonation`; Anthropic OAuth passthrough uses
  `oauth_passthrough`.
- Example: api_key

#### Error
- Type: object
- Required:
  - error
  - message
- Properties:
  - error:
      Type: string
      Description: A short machine-readable error code
      Example: BadRequest
  - message:
      Type: string
      Description: A human-readable description of what went wrong
      Example: request_timeout_secs must be between 1 and 3600

### Responses

#### Unauthorized
- Description: Missing or invalid authentication
- Content:
    application/json:
      Schema:
        $ref: '#/components/schemas/Error'

#### Forbidden
- Description: Authenticated, but the caller's role does not allow this action
- Content:
    application/json:
      Schema:
        $ref: '#/components/schemas/Error'

### Security Schemes

#### BearerAuth
- Type: http
- Scheme: bearer
- BearerFormat: JWT
- Description: |
  JWT obtained through Barndoor's authentication flow. Pass the token
  verbatim in `Authorization: Bearer <token>`. Use the Barndoor SDK's
  `loginInteractive()` helper to obtain a token in scripts and notebooks.