opschain admin model-providers update

packs:ai-agents

Updates a model provider by code or row id: only the flags you pass change. A supplied credential rotates the stored API key — this is the one-place rotation brokered custody buys: no agent host ever sees the old key or the new one. Enabling a disabled provider requires the packs:ai-agents entitlement; disabling and other maintenance need no pack (the polite-lapse posture).

NEW_KEY=sk-ant-... opschain admin model-providers update demo-anthropic \
  --credential-env NEW_KEY
Updated model provider demo-anthropic

Reference custody

Custody is reference-first: the record stores a secret-vault:// reference, never a value. --credential-ref pins an existing reference, resolved at write time - an unresolvable reference refuses by name. An inline credential is vault-write sugar: the value lands in the platform vault under the reserved path and only the resulting reference is stored. Records created before the retrofit keep their inline encrypted credential until the next credential write, which moves custody to the vault.

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--display-name <name>	Human-readable provider name.
--endpoint <url>	Endpoint base URL (empty: the kind's default where one exists; an Azure-kind or openai-compatible record's endpoint can change but never be cleared).
--data-handling-approved	Sets or clears the data-handling-approved marker: the record of the estate's one-time review of this provider's data-processing terms, consulted by lanes that process customer-submitted content. Needs no pack — review bookkeeping is maintenance.
--ssl-verify	Sets or clears TLS certificate verification for the endpoint.
--ssl-ca-cert <path-or-pem>	Replaces the CA trust anchor (a PEM block inline or a certificate file path on the server host; empty returns to the system roots).
--enabled	Whether the gateway serves calls for this provider.
--credential-ref <ref>	secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel).
--credential-prompt	Prompt for the replacement API key without echo.

See also

• opschain docs cli/admin-model-providers-delete — removing one.