---
title: "Create a custom API provider"
method: POST
path: "/credits/custom-endpoints"
tags: ["Custom APIs"]
---

# Create a custom API provider

`POST /credits/custom-endpoints`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/custom-endpoints`
- Auth: HTTP bearer

Creates one BYOK provider and optionally up to 50 actions atomically. Requires an enterprise workspace with Custom APIs enabled, the workspace owner, credentials:manage and catalog:write, plus MFA or passkey step-up completed in the last ten minutes. Locus validates the upstream URL against SSRF controls, encrypts the credential, validates every JSON Schema and example, and never returns the raw credential.

## Request body

- CustomProviderCreateRequest
  - `slug` string, required: Stable provider name. The public catalog name is custom-{slug}.
  - `name` string, required
  - `description` string
  - `baseUrl` string, uri, required: HTTPS upstream origin validated against SSRF and private-network controls.
  - `auth` CustomAuthInput, required: For type=none, omit credential. For type=header or type=query, supply name.
    - `type` 'bearer' | 'header' | 'query' | 'none', required
    - `name` string: Required for header and query authentication; must be a valid HTTP field name.
    - `prefix` string: Optional value prefix for header or query authentication. Bearer authentication always uses 'Bearer '.
    - `credential` string: Required when creating a bearer, header, or query provider. Omit during an update to retain the encrypted credential. Never returned.
  - `traffic` CustomTrafficPolicy
    - `requestsPerMinute` integer, required: Must not exceed the platform-wide 60,000 request-per-minute ceiling.
    - `maxConcurrency` integer, required
    - `timeoutSeconds` integer, required
    - `circuitBreaker` CustomCircuitBreakerPolicy, required
      - `failureThreshold` integer, required
      - `windowSeconds` integer, required
      - `cooldownSeconds` integer, required
  - `endpoint` CustomEndpointCreateRequest
    - `slug` string, required: Stable 3–64 character action name.
    - `name` string, required
    - `description` string, required
    - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required
    - `path` string, required: Upstream path. Placeholders must reference required scalar properties from inputSchema.
    - `inputSchema` object, required: Compilable JSON Schema, at most 64 KiB and 32 levels deep, whose root type is object. Top-level transport-control names are reserved.
    - `inputExample` object, required: Executable example that must satisfy inputSchema.
    - `outputSchema` object, nullable: Optional JSON Schema, at most 64 KiB and 32 levels deep.
    - `outputExample` unknown
    - `providerCostUsdc` union, required: Upstream provider cost in USD, rounded up to six decimal places.
      - string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - number
    - `markupBps` integer, required: Percentage markup, also limited by the workspace's effective cap.
    - `flatMarkupUsdc` union, required: Flat USD markup, also limited by the workspace's effective cap.
      - string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - number
    - `enabled` boolean: Enabled actions must have a positive end-user price.
  - `endpoints` CustomEndpointCreateRequest[]: Use endpoint or endpoints, never both. Slugs must be unique within the request.
    - `slug` string, required: Stable 3–64 character action name.
    - `name` string, required
    - `description` string, required
    - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required
    - `path` string, required: Upstream path. Placeholders must reference required scalar properties from inputSchema.
    - `inputSchema` object, required: Compilable JSON Schema, at most 64 KiB and 32 levels deep, whose root type is object. Top-level transport-control names are reserved.
    - `inputExample` object, required: Executable example that must satisfy inputSchema.
    - `outputSchema` object, nullable: Optional JSON Schema, at most 64 KiB and 32 levels deep.
    - `outputExample` unknown
    - `providerCostUsdc` union, required: Upstream provider cost in USD, rounded up to six decimal places.
      - string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - number
    - `markupBps` integer, required: Percentage markup, also limited by the workspace's effective cap.
    - `flatMarkupUsdc` union, required: Flat USD markup, also limited by the workspace's effective cap.
      - string: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - number
    - `enabled` boolean: Enabled actions must have a positive end-user price.

## Response `201`

Provider and any supplied actions created

- CustomProviderResponse
  - `success` unknown, required
  - `provider` CustomProvider, required
    - `id` string, uuid, required
    - `slug` string, required
    - `publicProvider` string, required: Provider name used in catalog discovery and /wrapped/credits/{provider}/{endpoint}.
    - `name` string, required
    - `description` string, nullable, required
    - `baseUrl` string, uri, nullable, required: Null when upstream configuration is redacted for this caller.
    - `auth` CustomAuthView, required
      - `type` 'bearer' | 'header' | 'query' | 'none' | 'null', nullable, required: Null when upstream configuration is redacted for this caller.
      - `name` string, nullable, required
      - `prefix` string, nullable, required
      - `configured` boolean, required
      - `hint` string, nullable, required: Non-secret credential hint for an authorized owner; never the credential itself.
      - `version` integer, required
      - `updatedAt` string, date-time, nullable, required
    - `traffic` CustomTrafficPolicy, required
      - `requestsPerMinute` integer, required: Must not exceed the platform-wide 60,000 request-per-minute ceiling.
      - `maxConcurrency` integer, required
      - `timeoutSeconds` integer, required
      - `circuitBreaker` CustomCircuitBreakerPolicy, required
        - `failureThreshold` integer, required
        - `windowSeconds` integer, required
        - `cooldownSeconds` integer, required
    - `endpoints` CustomEndpoint[], required
      - `id` string, uuid, required
      - `slug` string, required
      - `publicSlug` string, required: Catalog and execution identity.
      - `name` string, required
      - `description` string, required
      - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required
      - `path` string, required
      - `inputSchema` object, required
      - `inputExample` object, required
      - `outputSchema` object, nullable, required
      - `outputExample` unknown, required
      - `providerCostUsdc` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `markupBps` integer, required
      - `flatMarkupUsdc` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `endUserPriceUsdc` string, required: Non-negative exact decimal string with at most six fractional digits. Endpoint-specific positivity and amount limits still apply.
      - `enabled` boolean, required
      - `pricingRevision` integer, required
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `400`: Invalid URL, authentication, traffic policy, schema, example, route, or pricing
- `403`: Feature, enterprise plan, owner, scope, or recent step-up requirement not met
- `409`: That provider slug is already in use in this workspace

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)