List model access policies

OpenAPI

api-reference/llm-gateway-openapi.yml
get /admin/model-access
openapi: 3.1.0
info:
  title: Barndoor LLM Gateway API
  version: 1.0.0
  description: >
    REST API for the Barndoor LLM Gateway: configure providers, model routes,
    pricing, governance, and operate a multi-provider LLM platform
    programmatically.

All endpoints in this document are scoped to your organization. They are the
    same APIs powering the Barndoor portal under **LLM Configuration**,
    **LLM Controls**, and **Settings - My Models**, exposed for teams that
    prefer scripting over the UI.

## Base URL

All requests are issued against your Barndoor instance:

https://app.barndoor.ai/api/llm-gateway
```

Replace app.barndoor.ai with your tenant host if you run on Enterprise.

Authentication

Endpoints accept a JWT Bearer token issued by your Barndoor identity provider. Tokens can be obtained interactively via the Barndoor SDK:

    const sdk = await loginInteractive();
    ```

The token must be sent in the `Authorization` header on every request:

Authorization: Bearer eyJhbGciOi...
```

Note: the bd-... API keys you create through these endpoints are for runtime LLM traffic (/v1/chat/completions, /v1/messages, etc.), not for administrative calls. Administrative endpoints require a user/admin JWT.

Permissions

Most endpoints require an admin (or higher) role on the calling user. Read-only endpoints are typically accessible by all authenticated users. Read-only listings under /user/... are scoped to the authenticated user.

Errors

Errors are returned as JSON with a stable shape:

    { "error": "BadRequest", "message": "request_timeout_secs must be between 1 and 3600" }
    ```
  contact:
    name: Barndoor Support
    url: https://barndoor.ai
servers:
  - url: https://{host}/api/llm-gateway
    description: >-
      Production / Trial (Barndoor SaaS). The gateway lives on your Barndoor
      control-plane host. For Enterprise or self-hosted deployments, replace the
      host with your portal hostname — the authoritative value is shown on
      Settings → My Models in the portal.
    variables:
      host:
        description: Your Barndoor control-plane (portal) hostname
        default: app.barndoor.ai
  - url: https://app.barndooruat.com/api/llm-gateway
    description: UAT
  - url: https://app.barndoordev.com/api/llm-gateway
    description: Dev
security:
  - BearerAuth: []
tags:
  - name: Credentials
    description: >-
      Reusable upstream credentials (API keys, AWS roles, Vertex service
      accounts)
  - name: Providers
    description: Named upstream providers backed by credentials and a model family
  - name: Provider Catalog
    description: Read-only catalog of supported upstream provider templates
  - name: Model Routes
    description: Map client-facing aliases to one or more upstream provider/model pairs
  - name: Model Pricing
    description: Per-million-token input/output costs for usage and budget reporting
  - name: Rate Limits
    description: Requests-per-minute and tokens-per-minute caps
  - name: Token Budgets
    description: Daily, weekly, or monthly token and cost ceilings
  - name: Model Access
    description: Allowlist or denylist policies for models, providers, or aliases
  - name: Smart Models
    description: Routing policies that pick a target model based on the request
  - name: Governance Configuration
    description: Org-wide behavior toggles for the LLM Gateway
  - name: Route Health
    description: Operational view of upstream route ejection and recovery
  - name: API Keys
    description: Org-managed gateway API keys (the `bd-...` keys callers send on `/v1/...`)
  - name: User
    description: Self-service endpoints for the authenticated user
paths:
  /admin/model-access:
    get:
      tags:
        - Model Access
      summary: List model access policies
      operationId: listModelAccessPolicies
      responses:
        '200':
          description: List of model access policies
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ModelAccessPolicy'
components:
  schemas:
    ModelAccessPolicy:
      type: object
      required:
        - id
        - org_id
        - name
        - scope_type
        - policy_type
        - targets
        - traffic_type
        - enabled
      properties:
        id:
          type: string
          format: uuid
        org_id:
          type: string
          format: uuid
        name:
          type: string
        scope_type:
          type: string
          enum:
            - org
            - team
            - user
            - project
            - api_key
            - mcp_server
            - agent
            - role
            - group
        scope_id:
          type: string
          format: uuid
          nullable: true
        scope_value:
          type: string
          nullable: true
        policy_type:
          type: string
          enum:
            - allowlist
            - denylist
        targets:
          type: array
          items:
            $ref: '#/components/schemas/ModelAccessTarget'
        traffic_type:
          type: string
          enum:
            - llm
            - all
        enabled:
          type: boolean
    ModelAccessTarget:
      oneOf:
        - type: object
          required:
            - kind
            - alias
          properties:
            kind:
              type: string
              enum:
                - model_alias
            alias:
              type: string
              description: User-facing alias (supports trailing `*` wildcard)
              example: gpt-4o-mini
        - type: object
          required:
            - kind
            - model
          properties:
            kind:
              type: string
              enum:
                - model
            model:
              type: string
              description: Resolved upstream model id (supports trailing `*` wildcard)
              example: gpt-4o-mini-2024-07-18
        - type: object
          required:
            - kind
            - provider_id
          properties:
            kind:
              type: string
              enum:
                - provider
            provider_id:
              type: string
              format: uuid
        - type: object
          required:
            - kind
            - provider_id
            - model
          properties:
            kind:
              type: string
              enum:
                - provider_model
            provider_id:
              type: string
              format: uuid
            model:
              type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        JWT obtained through Barndoor's authentication flow. Pass the token
        verbatim in `Authorization: Bearer <token>`. Use the Barndoor SDK's
        `loginInteractive()` helper to obtain a token in scripts and notebooks.