validateAwsRole.md

Validate AWS role access

Performs a real STS assume-role chain against the supplied role to confirm Barndoor can reach Bedrock. Returns the AWS error verbatim if validation fails — useful for iterating on the trust policy before saving the credential.

OpenAPI

api-reference/llm-gateway-openapi.yml
post /admin/connections/aws-role-validate
openapi: 3.1.0
info:
  title: Barndoor LLM Gateway API
  version: 1.0.0
  description: >-
    REST API for the Barndoor LLM Gateway: configure providers, model routes,
    pricing, governance, and operate a multi-provider LLM platform
    programmatically.
    
    All endpoints in this document are scoped to your organization. They are the
    same APIs powering the Barndoor portal under **LLM Configuration**,
    **LLM Controls**, and **Settings - My Models**, exposed for teams that
    prefer scripting over the UI.
    
    ## Base URL
    
    All requests are issued against your Barndoor instance:

https://app.barndoor.ai/api/llm-gateway
```

Replace app.barndoor.ai with your tenant host if you run on Enterprise.

## Authentication

Endpoints accept a JWT Bearer token issued by your Barndoor identity
provider. Tokens can be obtained interactively via the Barndoor SDK:

    const sdk = await loginInteractive();
    ```

The token must be sent in the `Authorization` header on every request:

Authorization: Bearer eyJhbGciOi...
```

Note: the bd-... API keys you create through these endpoints are for runtime LLM traffic (/v1/chat/completions, /v1/messages, etc.), not for administrative calls. Administrative endpoints require a user/admin JWT.

## Permissions

Most endpoints require an `admin` (or higher) role on the calling user.
Read-only endpoints are typically accessible by all authenticated users.
Read-only listings under `/user/...` are scoped to the authenticated user.

## Errors

Errors are returned as JSON with a stable shape:

    { "error": "BadRequest", "message": "request_timeout_secs must be between 1
    and 3600" }
    ```
  contact:
    name: Barndoor Support
    url: https://barndoor.ai
servers:
  - url: https://{host}/api/llm-gateway
    description: >-
      Production / Trial (Barndoor SaaS). The gateway lives on your Barndoor
      control-plane host. For Enterprise or self-hosted deployments, replace the
      host with your portal hostname — the authoritative value is shown on
      Settings → My Models in the portal.
    variables:
      host:
        description: Your Barndoor control-plane (portal) hostname
        default: app.barndoor.ai
  - url: https://app.barndooruat.com/api/llm-gateway
    description: UAT
  - url: https://app.barndoordev.com/api/llm-gateway
    description: Dev
security:
  - BearerAuth: []
tags:
  - name: Credentials
    description: >-
      Reusable upstream credentials (API keys, AWS roles, Vertex service
      accounts)
  - name: Providers
    description: Named upstream providers backed by credentials and a model family
  - name: Provider Catalog
    description: Read-only catalog of supported upstream provider templates
  - name: Model Routes
    description: Map client-facing aliases to one or more upstream provider/model pairs
  - name: Model Pricing
    description: Per-million-token input/output costs for usage and budget reporting
  - name: Rate Limits
    description: Requests-per-minute and tokens-per-minute caps
  - name: Token Budgets
    description: Daily, weekly, or monthly token and cost ceilings
  - name: Model Access
    description: Allowlist or denylist policies for models, providers, or aliases
  - name: Smart Models
    description: Routing policies that pick a target model based on the request
  - name: Governance Configuration
    description: Org-wide behavior toggles for the LLM Gateway
  - name: Route Health
    description: Operational view of upstream route ejection and recovery
  - name: API Keys
    description: Org-managed gateway API keys (the `bd-...` keys callers send on `/v1/...`)
  - name: User
    description: Self-service endpoints for the authenticated user
paths:
  /admin/connections/aws-role-validate:
    post:
      tags:
        - Credentials
      summary: Validate AWS role access
      description: |
        Performs a real STS assume-role chain against the supplied role to
        confirm Barndoor can reach Bedrock. Returns the AWS error verbatim if
        validation fails — useful for iterating on the trust policy before
        saving the credential.
      operationId: validateAwsRole
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ValidateAwsRoleRequest'
      responses:
        '200':
          description: Validation result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ValidationResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
components:
  schemas:
    ValidateAwsRoleRequest:
      type: object
      required:
        - region
        - iam_role_arn
        - external_id
      properties:
        region:
          type: string
          example: us-east-1
        iam_role_arn:
          type: string
          example: arn:aws:iam::222222222222:role/customer-bedrock
        external_id:
          type: string
          example: bd-ext-9f3c1
    ValidationResponse:
      type: object
      properties:
        ok:
          type: boolean
          example: true
    Error:
      type: object
      required:
        - error
        - message
      properties:
        error:
          type: string
          description: A short machine-readable error code
          example: BadRequest
        message:
          type: string
          description: A human-readable description of what went wrong
          example: request_timeout_secs must be between 1 and 3600
  responses:
    BadRequest:
      description: The request body or query parameters were invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        JWT obtained through Barndoor's authentication flow. Pass the token
        verbatim in `Authorization: Bearer <token>`. Use the Barndoor SDK's
        `loginInteractive()` helper to obtain a token in scripts and notebooks.