BYO-LLM

Update an LLM provider (owner-only) · 0 credits

PARTIAL update of non-secret fields (label, base_url, model_default, model_map, extra_headers, routing_policy, billing_mode, enabled). The credential (api_key / aws:{…}) is WRITE-ONLY: if sent, it is re-encrypted and the key_fingerprint is recomputed; otherwise it is kept. It re-validates SSRF on base_url if it changes. Firm-scoped OWNER-ONLY. No charge. Scope: mcp | * (NOT cases).

patch/api/v1/llm-providers/{id}

Request

  • Base URL: https://legal.nexusquantum.legal
  • URL: https://legal.nexusquantum.legal/api/v1/llm-providers/{id}
  • Auth: HTTP bearer

Path parameters

idstring uuid required

Request body

labelstring
base_urlstring

Does not apply to bedrock. Re-validated against SSRF if it changes.

model_defaultstring
model_mapobject

Role→model map, no silent defaults. Recommendation (not a default): A → claude-fable-5 · B → claude-opus-4-8 · C → claude-opus-4-8 or an equally strong reasoning model; any model of the 3 kinds works in any node. B ≠ A recommended.

extra_headersobject
routing_policy'own_only' | 'own_then_platform'
role'A' | 'B' | 'C' nullable

Node this engine is assigned to: 'A' (primary analysis), 'B' (adversarial audit) or 'C' (adversarial counterparty). Omit or null = the firm's DEFAULT engine, which serves every node and role (consulta, chat, draft…). Precedence: node engine → default engine → (when the policy forbids platform) Node A engine → platform. Allows a DIFFERENT engine per node: B and C should not share a model with A, or the cross-audit loses its value. Send null to revert to the default engine.

billing_modestring
enabledboolean
api_keystring

New credential (openai_compatible/anthropic). WRITE-ONLY.

Response

Provider updated (non-secret projection).

idstring uuid
labelstring

Human-readable name, unique within the firm.

kind'openai_compatible' | 'anthropic' | 'bedrock'

Adapter family.

base_urlstring nullable

Endpoint (openai_compatible: required; anthropic: optional; bedrock: null, derived from region). Validated against SSRF.

model_defaultstring

Default model.

model_mapobject

Role→model map (e.g. { "A": "claude-opus-4-8", "B": "gpt-4o" }). No silent defaults: each node uses exactly the declared model (or model_default when the role is not mapped). Recommendation (not a default): Node A → claude-fable-5 · Node B → claude-opus-4-8 · Node C → claude-opus-4-8 or another equally strong reasoning model; any model of the 3 kinds works in any node. B ≠ A is recommended to preserve the independence of the audit.

key_fingerprintstring nullable

NON-secret, NON-reversible fingerprint of the credential (hash, e.g. sha256:a1b2c3d4e5f6; older rows may show the legacy format sk-p…a1b2). The ONLY representation of the key that leaves the API.

extra_headersobject

Optional extra headers for the provider.

routing_policy'own_only' | 'own_then_platform'

own_then_platform leaves the platform chain as a fallback if your provider fails recoverably.

role'A' | 'B' | 'C' nullable

Node this engine is assigned to: 'A' (primary analysis), 'B' (adversarial audit) or 'C' (adversarial counterparty). Omit or null = the firm's DEFAULT engine, which serves every node and role (consulta, chat, draft…). Precedence: node engine → default engine → (when the policy forbids platform) Node A engine → platform. Allows a DIFFERENT engine per node: B and C should not share a model with A, or the cross-audit loses its value. Additive (per-node BYO, 2026-07-24).

billing_modestring

Billing mode (default platform).

enabledboolean

Whether it is active for routing firm traffic.

last_verified_atstring date-time nullable

Last successful /test health check.

created_atstring date-time
updated_atstring date-time
secret_at_rest'encrypted_aes_256_gcm' | 'plaintext'

Creation response only: at-rest encryption status of the credential.

Changes

No recorded changes to this operation across all 1 revision of this API.