workspace

Set a BYOK LLM provider API key for this workspace.

Encrypts and persists a bring-your-own-key (BYOK) provider API key for the authenticated workspace (AES-256-GCM, ADR-036). ADR-049: multi-provider BYOK — now accepts provider type + api_key + optional model. Requires AES L1 encryption to be enabled on this deployment (ANDISH_ENCRYPTION_L1_ENABLED=true). Supported providers: openrouter_byok, polza_byok, ollama_byok. Plaintext key is NEVER logged or returned (ADR-019). Requires 'admin' scope.

post/v1/workspace/byok-key

Request

  • Base URL: https://api.andish.ru (the document declares no server; this is the origin it was published from)
  • URL: https://api.andish.ru/v1/workspace/byok-key
  • Auth: none declared

Request body

provider'openrouter_byok' | 'polza_byok' | 'ollama_byok' required

BYOK provider type. 'openrouter_byok': OpenRouter (key must start with sk-or-v1-). 'polza_byok': polza.ai RU gateway (any non-empty Bearer token). 'ollama_byok': self-hosted Ollama (no API key required).

api_keystring

Plaintext API key for the selected provider. Required and validated for openrouter_byok and polza_byok. May be empty or omitted for ollama_byok (Ollama has no auth token). Stored AES-256-GCM encrypted per ADR-036. Plaintext is never logged or echoed back (ADR-019).

modelstring nullable

Optional model identifier to persist with the BYOK key. Used by build_llm_provider_for_tenant to route requests to the correct model without re-prompting. polza.ai example: 'google/gemini-2.5-flash-lite' (catalog ids always carry a vendor prefix — a bare 'gpt-4o-mini' is invalid on polza.ai). openrouter example: 'google/gemini-2.5-flash-lite'. If omitted, provider default is used.

Response

Key accepted and encrypted. No content returned.

Changes

No recorded changes to this operation across all 1 revision of this API.