Introduction: Welcome to the Barndoor documentation portal. Explore guides, tutorials, SDKs, code samples, reference docs, and more.
Trial Guide: Complete guide to set up and configure your Barndoor platform from start to finish
Agent Profiles: Configuring agents that operate with their own access credentials to MCPs and LLMs and provides visibility to what your agents are doing and what their models costs are.
Connect AI clients to Barndoor: Step-by-Step: Connect your ToolIQ universal endpoint to your MCP Servers for Claude, ChatGPT, and other AI clients
Using the LLM Gateway: Send LLM traffic from Cursor, Claude Code, Codex, your apps, and the OpenAI / Anthropic SDKs through the Barndoor LLM Gateway.
Quickstart Guide: Configure the Barndoor LLM Gateway, connect your tools (Cursor, Claude Code, Codex, the OpenAI/Anthropic SDKs), send requests, and troubleshoot.
Use Codex with the LLM Gateway: Point Codex CLI and Codex Desktop at the Barndoor LLM Gateway using the OpenAI Responses wire format.
Managing Model Pricing: Set per-million-token costs for the models you serve through the Barndoor LLM Gateway so spending budgets, cost reports, and usage telemetry are accurate.
Configuring LLM Controls: Set token budgets, rate limits, and model access policies on traffic flowing through the Barndoor LLM Gateway.
Get the most out of your Claude subscription: Run Claude Code on your Claude subscription through the Barndoor LLM Gateway and keep working past your rate limit with automatic failover, so each developer gets the full value of the seat you pay for.
Connect your IdP: Set up SSO login and automatically provision user roles using any OIDC / SAML 2.0 compatible IdP
Connect Okta as your IdP: Step-by-step guide for configuring Okta as an OIDC Identity Provider for Barndoor SSO and automatic role mapping
Connect Microsoft Entra ID as your IdP: Step-by-step guide for configuring Microsoft Entra ID (formerly Azure AD) as an OIDC Identity Provider with SCIM Provisioning
Data Control Center: Detect, block, redact, or observe sensitive data as it flows through AI agents and the MCP layer.
Protection Profiles: Create named detection engines that define which data types to scan for. Policies can't be created until at least one profile exists.
MCP Policies: Govern enforcement on MCP tool calls — the structured requests and responses between AI agents and connected servers.
Field Controls: Deterministic, field-level redaction for specific MCP tools — independent of text-based detection.
List MCP servers: List all MCP servers available to the caller's organization. Returns paginated results with server details including connection status.
Create MCP Server: Create a new MCP server instance from a server directory template.
Get Server by Id: Get detailed information about a specific MCP server. Returns extended information including MCP URL if available.
Get Connection Status: Get the user's connection status for a specific server. Used to poll connection status during OAuth flows.
Initiate OAuth connection: Initiate OAuth connection flow for a server. Returns an authorization URL that the user should visit to complete the OAuth flow.
Delete connection: Delete the current user's connection to this server.
MCP server proxy endpoint: Proxies MCP JSON-RPC requests to third-party servers with automatic authentication.
SSE server proxy endpoint: Server-Sent Events proxy endpoint for real-time streaming communication with third-party servers.
Validate Policy: Validate a policy before creation or update. Checks for duplicate names and overlapping MCP server/agent combinations. When exclude_policy_id is provided (edit mode), that policy is excluded from validation.
Clone Policy: Clone an existing policy, creating a new policy with the same configuration but with a modified name (appending " Copy") and DRAFT status.
Get Agent Counts: Get counts of agents grouped by type (internal vs external).
Get User Info: Returns identity information for the user associated with a Barndoor API key.
LLM Gateway API: Programmatically configure and operate the Barndoor LLM Gateway: providers, model routes, pricing, governance, and gateway API keys.
List credentials: Returns every reusable credential configured in your organization.
Create a Credential: Stores a new upstream credential. The plaintext api_key (or credentials object) is written to Barndoor's encrypted secret store and is never returned by any endpoint.
Get Barndoor's AWS principal: Returns the AWS IAM principal customers should add to the trust policy of any role they hand out to Barndoor for AWS Bedrock IAM-role auth.
Validate AWS role access: Performs a real STS assume-role chain against the supplied role to confirm Barndoor can reach Bedrock. Returns the AWS error verbatim if validation fails — useful for iterating on the trust policy before saving the credential.
Validate Google Vertex access: Fetches a token via your chosen Vertex auth method and asks Vertex about a model, confirming end-to-end that both auth and model access work before saving the credential.
Get AWS trust info: Returns the Barndoor principal ARN and external ID for an AWS-role credential. Useful for re-auditing the trust policy after the fact.
List the provider catalog: Read-only catalog of upstream providers Barndoor knows about. Use these entries as templates when creating providers — slug, default_base_url, default_models, and auth_type are pre-filled sensible defaults.
Create a Provider: Creates a new named provider. Either supply a connection_id to share an existing credential, or supply api_key / credentials to create an inline secret as part of the request.
Update a provider: Patches a provider. To detach a provider from a shared credential and switch it back to an inline API key, send connection_id: null and the new api_key (or credentials) in the same request.
Delete a provider: Deleting a provider also removes every model route that pointed at it.
List all model routes: Returns every model route in the org, with their owning provider's name.
Create a Model Route: Creates a model route. A 1:1 enablement (model_alias == upstream_model) for an existing provider/model pair will fold into the existing row rather than failing — this lets you re-issue the same create call idempotently from automation.
List pricing rules: One row per logical pricing rule, each with the currently-effective version, a version_count, and a scheduled_count of any future-dated changes waiting to activate.
Create or Schedule Pricing: - Omit (or null) effective_from to activate the price now. - Pass a future effective_from to schedule the change ahead of time.
Get a pricing rule's history: Returns every version of a single rule (current, scheduled, archived, and prior live versions), newest first.
Look up a single pricing version: Returns one specific version of a pricing rule by id. Useful for resolving a pricing_rule_id recorded in an audit event when that version is no longer the current one.
Edit a scheduled pricing version: Updates a future-dated (scheduled) pricing version in place. Past versions are immutable — to change the active price create a new version via POST /admin/model-pricing instead.
Restore an archived pricing rule: Resurrects a previously archived pricing rule. The id should be the archived version's id, as returned from GET /admin/model-pricing/archived.
List Barndoor's default pricing: The default pricing catalog Barndoor maintains. Use as a starting point for import-defaults and sync-defaults.
Import default pricing: Inserts entries from Barndoor's managed pricing catalog into your organization. Existing rows are not touched (use sync-defaults to update those).
Sync to default pricing: Overwrites pricing rows in your org whose costs have drifted from the current Barndoor-managed defaults. Org-managed (pinned) rows are not touched.
Create a model access policy: Either an allowlist (only listed targets are permitted) or a denylist (listed targets are blocked). Targets can specify a model alias, an upstream model, a provider, or a (provider, model) combination.
Preview a smart-model decision: Dry-runs the determiner against an in-flight policy draft and a sample request body. Useful for checking how a new policy would route real traffic before saving it.
Get Route Health: Returns a per-route operational view of upstream health: which routes are currently healthy, half-open (probing), or ejected (cooling down), along with consecutive-failure counts and recent state transitions. Useful for dashboards and incident triage.
Reset a route to healthy: Force a (provider, upstream model) route back to healthy, clearing any active cooldown both on the local pod and across the fleet. Useful after an upstream incident is resolved and you don't want to wait for natural recovery.
List org API keys: Lists every gateway API key in the organization (one entry per key). The raw key value is never returned — only its prefix and metadata.
Create an Org API Key: Creates a new bd-... gateway API key. The raw key is returned in this response and never again — copy it immediately. Either assign the key to a user_id or bind it to a group_name; not both.
Revoke an API key: Revoking a key disables it for all future requests.
List models I can call: Returns every model the authenticated user is allowed to call, filtered by your organization's model-access policies and the user's IdP groups and roles. Use the display_model field as the value of the model parameter on /v1/... requests.
List my API keys: Lists the gateway API keys created by the authenticated user.
Create a personal API key: Creates an API key owned by the authenticated user. Equivalent to the Settings - My Models flow in the Barndoor portal.
Terraform Provider: Manage your Barndoor organization as code with the official Terraform provider
Getting Started: Generate a provider credential, configure the Barndoor Terraform provider, and apply your first resource
Manage MCP Access: Onboard an MCP server, connect it tenant-wide, register an AI Agent, and govern access with a policy — all in Terraform
Manage the LLM Gateway: Configure LLM providers, model routing with failover, access policies, rate limits, and token budgets in Terraform
Manage Data Protection: Define custom detection types, allow lists, and enforcement policies as code, with a dry-run-first rollout
Best Practices: Importing existing configuration, avoiding drift, destroy semantics, secrets hygiene, and running the Barndoor provider in CI
Barndoor SDKs: The Barndoor SDKs empowers developers to connect to governed Model Context Protocol (MCP) servers, enabling seamless interaction with platforms like Salesforce, Notion, and GitHub. Whether you're building AI-driven applications with OpenAI or performing direct API calls, the SDK simplifies authentic…