Model provider
packs:ai-agents
A model provider is one catalog record for an AI model endpoint — a
first-class provider record beside identity providers and secrets providers,
so agents reference a provider by name and the platform's model gateway does
the heavy lifting rather than API keys being shared with each agent. The API
credential is write-only end to end: an inline value is held encrypted at
rest on the record (never written into a vault), a credential_ref pins a
reference resolved through a registered server-resolved secrets provider,
and no response, audit row or error ever echoes it — reads serve
credential_set only. Create and enable require the packs:ai-agents
entitlement, with the polite-lapse posture: stored providers keep resolving
on lapse, only new registrations refuse. Served by the v2
ModelProviderService: ListModelProviders, GetModelProvider,
CreateModelProvider, UpdateModelProvider and DeleteModelProvider
(admin-only; every write is audited).
ModelProvider
ModelProvider is one registered model-provider record. The credential is never a field: reads carry credential_set only.
| Field | Type | Meaning |
|---|---|---|
code | string | The estate code the provider is addressed by (agent manifests reference it, and the gateway path carries it). |
created_at | timestamp | When the record was created. |
credential_ref | string | The canonical secret-vault:// reference the credential lives at (reference-first custody) — an address, never a value. Empty when the credential is held encrypted at rest on the record (an inline write clears the reference; a reference write clears the at-rest value). |
credential_set | boolean | Whether a credential is held — a pinned reference or an inline value encrypted at rest (the value is write-only). |
data_handling_approved | boolean | Whether this provider's data-processing terms passed the estate's data-handling review. The approval is a property of the catalog entry — never a hardcoded provider list — so a future or custom provider inherits the same one-time check. Lanes that process customer-submitted content (the support SME's AI lane) refuse to be configured against an unapproved provider. |
display_name | string | Human-readable display name. |
enabled | boolean | Whether the record is enabled. |
endpoint | string | Endpoint override; empty means the kind's default where one exists (https://api.anthropic.com / https://api.openai.com/v1). The Azure kinds and openai-compatible have no default: their records require the customer's own resource/deployment or hosted URL (azure-openai may carry an api-version query). |
id | string | The record's identity. |
kind | string | The provider kind: "anthropic", "openai", "azure-foundry-anthropic", "azure-openai" or "openai-compatible" (a self-hosted OpenAI-dialect endpoint). The kind picks the default endpoint and how the gateway injects the credential upstream; openai-compatible injects an Authorization bearer only when a credential is stored (the credential is optional for that kind alone). |
ssl_ca_cert | string | A CA trust anchor for the endpoint's TLS connection: a PEM block inline, or a certificate file path on the server host; empty uses the system roots. |
ssl_verify | boolean | Whether the endpoint's TLS certificate is verified (default true; false is an explicit operator opt-out for self-signed self-hosted endpoints). |
tokens_per_day | integer/string | The provider-level model budget's calendar-day window: a ceiling on model tokens across every agent and every call through this provider, on the estate's reporting calendar, enforced at the model gateway after the agents' grant caps. 0 is no ceiling on this window; there is no estate default. |
tokens_per_minute | integer/string | The budget's sliding-minute window (the burst ceiling). 0 is no ceiling. |
tokens_per_month | integer/string | The budget's calendar-month window. 0 is no ceiling. |
tokens_per_quarter | integer/string | The budget's fiscal-quarter window (usage.fiscal_year_start). 0 is no ceiling. |
tokens_per_week | integer/string | The budget's calendar-week window. 0 is no ceiling. |
tokens_per_year | integer/string | The budget's fiscal-year window. 0 is no ceiling. |
updated_at | timestamp | When the record was last updated. |
On create and update the six windows are optional: absent leaves a
window as it is (no ceiling on create), 0 clears it, a negative value
refuses by name. The spend against each ceiling is read through
ListProviderUsage / ListProvidersOverview (token_budget,
opschain docs resources/model_usage).
Related pages
opschain docs model-providers— the component page: the gateway, credential custody, the provider kinds and the provider-level model budget.opschain docs resources/model_usage—ProviderTokenBudgetWindow, the budget's spend against ceiling per window.opschain docs ai-agents— the "ai" agent type that references providers by name.opschain docs resources/agent— the agent's model disclosures.