---
title: "Create Hosted Provider"
method: POST
path: "/api/v1/hosted-providers"
tags: ["hosted-providers"]
---

# Create Hosted Provider

`POST /api/v1/hosted-providers`

## Request

- The document declares no server URL.
- Auth: one of:
  - API key in header `Otari-Key`
  - API key in header `x-api-key`

Configure a provider with the key this deployment will serve it on.

Everything the provider lists on that key is offered at once; a provider
that will not say yields a provider with no models, not an error. A
provider the configuration defines may be created too, and the stored one
then serves instead.

## Request body

- HostedProviderCreateRequest: Configure a provider this deployment will serve hosted inference on. ``provider`` is the any-llm implementation. ``name`` is what requests address it by (``name:model``), defaulting to ``provider``; a name of its own lets two endpoints of one implementation coexist. ``api_key`` may be left out for a backend that needs none, or for an endpoint of its own (``api_base``), which is called with a placeholder key. ``client_args`` is whatever the provider's SDK client needs beyond the key (Bedrock's region and IAM pair), the same shape an organization provider key takes. Values under credential-shaped names come back masked. ``restricted_to_organization_id`` keeps the provider to one organization; every other one is served as if it were not configured.
  - `api_base` string, nullable
  - `api_key` string, nullable
  - `client_args` object, nullable
  - `enabled` boolean
  - `name` string, nullable
  - `provider` string, required
  - `restricted_to_organization_id` string, uuid, nullable

## Response `201`

Successful Response

- HostedProviderPublic: One hosted provider, known by its name, its implementation and the tail of its key. No shape in this section carries key material: a stored credential is known by its last four characters and nothing else, ``client_args`` goes out with credential-shaped values masked, and ``api_base`` with the password in its userinfo and its query values masked. ``name`` is what requests address and every route takes; ``provider`` is the any-llm implementation. ``source`` says where the provider is defined. A ``config`` provider comes from the ``hosted_providers:`` block, has no row and so no ``id`` or timestamps, and is changed by editing the configuration rather than through this API; its models are administered as a stored provider's are. ``shadows_config`` marks a stored provider that wins over a configuration entry of the same name, which serves again once the row is deleted. ``has_api_key`` is false for one stored without a key, and ``decryptable`` false for one whose key or extras no configured ``OTARI_SECRET_KEY`` reads, which serves nothing until re-entered.
  - `api_base` string, nullable
  - `api_key_last4` string, nullable
  - `client_args` object, nullable
  - `created_at` string, date-time, nullable
  - `decryptable` boolean
  - `enabled` boolean, required
  - `has_api_key` boolean
  - `id` string, uuid, nullable
  - `name` string, required
  - `provider` string, required
  - `restricted_to_organization_id` string, uuid, nullable
  - `shadows_config` boolean
  - `source` 'database' | 'config'
  - `updated_at` string, date-time, nullable

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-19** `3d8fba047d0e`: 7 info
  - added the new optional request property `name`
  - the request property `api_key` became optional
  - request property `api_key` list-of-types was widened by adding types `null` to media type `application/json`
  - the `api_key` request property's minLength was decreased from `1` to `0`
  - …3 more
- **2026-10-16** `1c433ac914dc`: 4 breaking, 2 info
  - the response property `created_at` became optional for the status `201`
  - the response property `id` became optional for the status `201`
  - response property `created_at` list-of-types was widened by adding types `null` to media type `application/json` of response `201`
  - response property `id` list-of-types was widened by adding types `null` to media type `application/json` of response `201`
  - …2 more
- **2026-10-16** `cde937c0ea7e`: 2 warning, 4 info
  - removed the optional property `shadows_config` from the response with the `201` status
  - removed the optional property `source` from the response with the `201` status
  - the response property `created_at` became required for the status `201`
  - the response property `id` became required for the status `201`
  - …2 more
- …earlier changes not shown

[Operation history](https://skmtc.dev/mozilla-ai/apis/otari/changes/api/v1/hosted-providers/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc.dev/mozilla-ai/apis/otari/revisions/2c95b115b0a8?raw)