The workspace's provider keys, masked.

One endpoint, two shapes, mirroring the BFF: without provider it lists every key for the workspace; with one it returns that single key, or 404 if the workspace has none for it. The union response model is the honest declaration of that — see provider_keys/router.py::list_provider_keys.

provider is bounded here so an explicitly empty ?provider= fails with 422 at this edge rather than making the round trip (the BFF rejects it too); omitting it entirely is the list case. It rides through on the forwarded query string — see tokenwise_service._build_gateway_request.