Models this profile's key can see, plus the authoritative default.

WHY A SEPARATE ENDPOINT rather than widening the connect response. The validator runs once, at connect time, before anything is stored — but the user needs this list every time they open the form, including long after connecting, and when editing a model on an already-connected provider. A connect-time-only payload cannot serve that, and widening tuple[bool, str] across all four validators would burden every connect with a list most of them do not need.

NEVER RETURNS ANOTHER USER'S DATA. The caller supplies no key and no profile id: profile_id comes from the authenticated session, and the key is the one already encrypted under THAT profile's document. There is no input through which another profile could be named.

ALWAYS 200, NEVER BLOCKS THE USER. The model field is free text and stays that way, so an unobtainable list is a missing convenience, not an error:

available=false, reason="no_key" nothing connected yet available=false, reason="unavailable" provider refused or is unreachable (Claude's /v1/models has 404'd before — see _validate_claude_key's fallback path)

default_model is returned in every case, including with no key, because the dashboard needs it for the placeholder before anything is connected. It is read from core.ai_models, which is env-overridable — the backend is the single source of truth and the dashboard must not keep its own copy.