---
title: "Register a local BYO Perception engine (owner-only) · 0 credits"
method: POST
path: "/api/v1/perception-providers"
tags: ["BYO-Perception"]
---

# Register a local BYO Perception engine (owner-only) · 0 credits

`POST /api/v1/perception-providers`

## Request

- Base URL: `https://legal.nexusquantum.legal`
- URL: `https://legal.nexusquantum.legal/api/v1/perception-providers`
- Auth: HTTP bearer

Registers a LOCAL OCR/ASR engine for the firm. The credential (bearer) is OPTIONAL and WRITE-ONLY (encrypted, never returned). `base_url` is validated against SSRF. With an engine registered, that firm's perception goes to ITS engine; without one, it uses the platform engines with a `ZERO_RETENTION_EXTERNAL_PERCEPTION` notice (a warning, NOT a block). Per-firm limit. Scope: mcp | * (NOT cases).

## Request body

- CreatePerceptionProviderRequest: Creates a BYO Perception config. `credentials` (the local engine's bearer token) is OPTIONAL and WRITE-ONLY (encrypted AES-256-GCM and never returned).
  - `label` string, required: 1–120 characters.
  - `capability` 'ocr' | 'asr', required
  - `adapter` string: Default `nexus_http`.
  - `base_url` string, required: Required; validated against SSRF (422 INVALID_PROVIDER_URL).
  - `credentials` string, nullable: WRITE-ONLY. Bearer token of the local engine; optional. Encrypted server-side and never returned.
  - `extra_headers` object: Optional additional headers (string→string map).
  - `enabled` boolean: Default true.

## Response `201`

Config created (no credential in the response).

- PerceptionProvider: BYO Perception config (the firm's LOCAL OCR/ASR engine). Non-secret twin of `LlmProvider`: it NEVER returns the credential — only `key_fingerprint` and non-secret fields. Firm-scoped, bound to the key's `firm_owner_id`.
  - `id` string, uuid
  - `label` string: Human-readable label (1–120).
  - `capability` 'ocr' | 'asr': OCR (image/scanned PDF) or ASR (audio/video).
  - `adapter` string: Adapter for the local contract. Default `nexus_http` (POST {base_url}/ocr|/asr).
  - `base_url` string: Local engine endpoint (validated against SSRF).
  - `key_fingerprint` string, nullable: NON-reversible hash of the credential (e.g. `sha256:a1b2c3d4`); null if the engine uses no credential. The credential NEVER leaves.
  - `enabled` boolean
  - `created_at` string, date-time

## Other responses

- `400`: VALIDATION_ERROR (label/capability/base_url)
- `409`: PROVIDER_LIMIT_REACHED (firm provider limit)
- `422`: INVALID_PROVIDER_URL (base_url fails SSRF)

---

[API](https://skmtc.dev/nexusquantum/apis/nexus-legal-api.md) · [All operations](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nexusquantum/apis/nexus-legal-api/revisions/4084d8d4eb0b?raw)