Version: v5.7.0

opschain admin model-providers

packs:ai-agents

Manage the ModelProvider catalog the platform brokers agent model calls through. The custody posture: "Rather than share API keys with each Agent, they reference a provider who does the heavy lifting." A provider is a first-class record beside identity providers and secrets providers — kind (anthropic | openai | azure-foundry-anthropic | azure-openai | openai-compatible), an endpoint (optional for the hosted kinds, where empty means the kind's default; required for the Azure kinds and openai-compatible, which address a URL in your own tenancy or network), an encrypted, write-only API key (optional for openai-compatible, whose self-hosted endpoints are often unauthenticated or mTLS-fronted) and an enabled flag — with the same lifecycle treatment: audited writes and admin-plane authorization on every verb.

Microsoft estates: the Azure kinds target Azure OpenAI Service / Azure AI Foundry inference endpoints in your own tenancy and region — azure-foundry-anthropic for Claude deployments speaking the Anthropic wire, azure-openai for GPT-family deployments speaking the OpenAI chat-completions wire. A Microsoft 365 or GitHub Copilot seat licence is not model capacity: brokered agent calls consume an Azure OpenAI / Foundry deployment you provision and pay for in Azure, not a Copilot seat entitlement. Authentication is by API key in this release; Microsoft Entra ID is a planned follow-up.

An agent in brokered custody references a provider by code in its manifest (OPSCHAIN_MODEL_PROVIDER on the agent host) and calls the platform's model gateway (/api/model/{provider}/…) with its own session credential; the gateway injects the stored key server-side and streams the provider's answer through. No model key ever exists on an agent host, and rotation happens here, in one place. Registration refuses an agent whose manifest names a provider this catalog does not hold.

Creating or enabling a provider requires the packs:ai-agents entitlement (the same pack an ai-type agent enrols under); on lapse, stored providers keep serving and only new registrations refuse (the polite-lapse posture).

Subcommand	Purpose
`list`	Every provider: kind, endpoint, credential presence, enabled state.
`show <code-or-id>`	One provider's record.
`create <code>`	Register a provider (API key via env/prompt, never argv).
`update <code-or-id>`	Change fields; a supplied credential rotates the stored key.
`delete <code-or-id>`	Remove a provider.

Every verb rides the v2 ModelProviderService, which authenticates user tokens only: the caller's own opschain login session is the primary credential. An explicit --auth-token wins, and OPSCHAIN_ADMIN_TOKEN / the opschain admin login token remain the fallback for automation; the server still requires the /admin updatable determination.

Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.

See also​

See also