---
title: "Update Hosted Provider"
method: PATCH
path: "/api/v1/hosted-providers/{provider}"
tags: ["hosted-providers"]
---

# Update Hosted Provider

`PATCH /api/v1/hosted-providers/{provider}`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `Otari-Key`
  - API key in header `x-api-key`

Rotate the key, repoint the base, or turn a provider off.

A provider defined in configuration answers 409: it is changed there.

## Path parameters

- `provider` string, required

## Request body

- HostedProviderUpdateRequest: Rotate the key, repoint the base, or turn a provider off. ``provider`` and ``name`` are immutable: changing either is a delete plus a create, because the key belongs to the provider it was issued by and requests address the name. Omitting ``api_key`` leaves the stored credential untouched, so a toggle never re-sends a secret the caller does not have; an explicit null removes it, where the provider can be served without one. ``client_args`` omitted is left alone; an explicit null clears it, and an entry echoed back as the mask keeps the stored value. ``restricted_to_organization_id`` reads the same way: omitted keeps the restriction, null lifts it.
  - `api_base` string, nullable
  - `api_key` string, nullable
  - `client_args` object, nullable
  - `enabled` boolean, nullable
  - `restricted_to_organization_id` string, uuid, nullable

## Response `200`

Successful Response

- HostedProviderPublic: One hosted provider, known by its name, its implementation and the tail of its key. No shape in this section carries key material: a stored credential is known by its last four characters and nothing else, ``client_args`` goes out with credential-shaped values masked, and ``api_base`` with the password in its userinfo and its query values masked. ``name`` is what requests address and every route takes; ``provider`` is the any-llm implementation. ``source`` says where the provider is defined. A ``config`` provider comes from the ``hosted_providers:`` block, has no row and so no ``id`` or timestamps, and is changed by editing the configuration rather than through this API; its models are administered as a stored provider's are. ``shadows_config`` marks a stored provider that wins over a configuration entry of the same name, which serves again once the row is deleted. ``has_api_key`` is false for one stored without a key, and ``decryptable`` false for one whose key or extras no configured ``OTARI_SECRET_KEY`` reads, which serves nothing until re-entered.
  - `api_base` string, nullable
  - `api_key_last4` string, nullable
  - `client_args` object, nullable
  - `created_at` string, date-time, nullable
  - `decryptable` boolean
  - `enabled` boolean, required
  - `has_api_key` boolean
  - `id` string, uuid, nullable
  - `name` string, required
  - `provider` string, required
  - `restricted_to_organization_id` string, uuid, nullable
  - `shadows_config` boolean
  - `source` 'database' | 'config'
  - `updated_at` string, date-time, nullable

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-19** `3d8fba047d0e`: 3 info
  - added the optional property `decryptable` to the response with the `200` status
  - added the optional property `has_api_key` to the response with the `200` status
  - added the required property `name` to the response with the `200` status
- **2026-10-16** `1c433ac914dc`: 4 breaking, 2 info
  - the response property `created_at` became optional for the status `200`
  - the response property `id` became optional for the status `200`
  - response property `created_at` list-of-types was widened by adding types `null` to media type `application/json` of response `200`
  - response property `id` list-of-types was widened by adding types `null` to media type `application/json` of response `200`
  - …2 more
- **2026-10-16** `cde937c0ea7e`: 2 warning, 4 info
  - removed the optional property `shadows_config` from the response with the `200` status
  - removed the optional property `source` from the response with the `200` status
  - the response property `created_at` became required for the status `200`
  - the response property `id` became required for the status `200`
  - …2 more
- …earlier changes not shown

[Operation history](https://skmtc.dev/mozilla-ai/apis/otari/changes/api/v1/hosted-providers/:provider/patch.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc.dev/mozilla-ai/apis/otari/revisions/2c95b115b0a8?raw)