# Bifrost: API ## API - [API / Integrations (176 pages)](https://docs.getbifrost.ai/_llms/api/integrations.md): Documentation for API / Integrations. ### Authentication - [Creating API Keys](https://docs.getbifrost.ai/api/procuring-api-keys.md): Create and use API keys to call Bifrost management API endpoints. ### Inference #### Models - [List available models](https://docs.getbifrost.ai/api-reference/models/list-available-models.md): Lists available models. If provider is not specified, lists all models from all configured providers. #### Chat Completions - [Create a chat completion](https://docs.getbifrost.ai/api-reference/chat-completions/create-a-chat-completion.md): Creates a completion for the provided messages. Supports streaming via SSE. #### Text Completions - [Create a text completion](https://docs.getbifrost.ai/api-reference/text-completions/create-a-text-completion.md): Creates a completion for the provided prompt. Supports streaming via SSE. #### Responses - [Responses API over WebSocket](https://docs.getbifrost.ai/api-reference/responses/responses-api-over-websocket.md): Upgrades the connection to a WebSocket and runs the OpenAI Responses API in WebSocket Mode. Clients send `response.create` events on the socket and receive streamed events through the standard inference pipeline (PreLLMHook, key selection, provider call, PostLLMHook). - [Create a response](https://docs.getbifrost.ai/api-reference/responses/create-a-response.md): Creates a response using the OpenAI Responses API format. Supports streaming via SSE. - [Retrieve a response](https://docs.getbifrost.ai/api-reference/responses/retrieve-a-response.md): Retrieves a stored response by ID. - [Delete a response](https://docs.getbifrost.ai/api-reference/responses/delete-a-response.md): Deletes a stored response. - [Cancel a response](https://docs.getbifrost.ai/api-reference/responses/cancel-a-response.md): Cancels an in-flight response. Only responses created with `background: true` can be cancelled. - [List response input items](https://docs.getbifrost.ai/api-reference/responses/list-response-input-items.md): Lists the input items of a stored response. #### OCR - [Perform OCR](https://docs.getbifrost.ai/api-reference/ocr/perform-ocr.md): Extracts text and content from documents or images using optical character recognition. Supports PDF URLs, base64-encoded documents, and image URLs. #### Rerank - [Rerank documents](https://docs.getbifrost.ai/api-reference/rerank/rerank-documents.md): Reorders input documents by relevance to a query. #### Embeddings - [Create embeddings](https://docs.getbifrost.ai/api-reference/embeddings/create-embeddings.md): Creates an embedding vector representing the input text. #### Audio - [Create speech](https://docs.getbifrost.ai/api-reference/audio/create-speech.md): Generates audio from the input text. Returns audio data or streams via SSE. - [Create transcription](https://docs.getbifrost.ai/api-reference/audio/create-transcription.md): Transcribes audio into text in the input language. #### Images - [Generate an image](https://docs.getbifrost.ai/api-reference/images/generate-an-image.md): Generates images from text prompts using the specified model. - [Edit an image](https://docs.getbifrost.ai/api-reference/images/edit-an-image.md): Edits an image using a text prompt and optional mask. Accepts either `application/json` (sources as URLs or base64 under `images`) or `multipart/form-data` (to upload the image as `image` or `image[]`). Requires at least `model`, one image, and `prompt` - the latter except for the operation types dr… - [Create Variation](https://docs.getbifrost.ai/api-reference/images/create-variation.md): Creates variations of an image. Request must be sent as multipart/form-data with `model` and `image` (or `image[]`). Does not support streaming. #### Videos - [List video generation jobs](https://docs.getbifrost.ai/api-reference/videos/list-video-generation-jobs.md): Lists video generation jobs for a specific provider. Results are paginated and can be filtered using query parameters. - [Generate a video](https://docs.getbifrost.ai/api-reference/videos/generate-a-video.md): Creates a video generation job from a text prompt. This is an asynchronous operation that returns immediately with a job ID. Use the retrieve endpoint to check the status and get the video URL when generation is complete. - [Retrieve a video generation job](https://docs.getbifrost.ai/api-reference/videos/retrieve-a-video-generation-job.md): Retrieves the status and metadata for a video generation job. Use this endpoint to poll for completion status after creating a video generation job. When the status is "completed", the response will include a URL to download the video. - [Delete a video generation job](https://docs.getbifrost.ai/api-reference/videos/delete-a-video-generation-job.md): Deletes a video generation job and its associated assets. This operation cannot be undone. - [Download video content](https://docs.getbifrost.ai/api-reference/videos/download-video-content.md): Downloads the binary content of a generated video. The video must have a status of "completed" to be downloadable. Returns the raw video file (typically MP4 format). - [Remix a video](https://docs.getbifrost.ai/api-reference/videos/remix-a-video.md): Creates a new video generation job by remixing an existing video with a new prompt. The source video must have a status of "completed" to be remixed. Returns a new video generation job that can be polled for completion. #### Count Tokens - [Count tokens](https://docs.getbifrost.ai/api-reference/count-tokens/count-tokens.md): Counts the number of tokens in the provided messages. #### Compaction - [Compact context](https://docs.getbifrost.ai/api-reference/compaction/compact-context.md): Compresses a conversation into an opaque encrypted compaction item using the OpenAI-compatible context compaction API. #### Batch - [List batch jobs](https://docs.getbifrost.ai/api-reference/batch/list-batch-jobs.md): Lists batch jobs for a provider. - [Create a batch job](https://docs.getbifrost.ai/api-reference/batch/create-a-batch-job.md): Creates a batch job for asynchronous processing. - [Retrieve a batch job](https://docs.getbifrost.ai/api-reference/batch/retrieve-a-batch-job.md): Retrieves a specific batch job by ID. - [Cancel a batch job](https://docs.getbifrost.ai/api-reference/batch/cancel-a-batch-job.md): Cancels a batch job. - [Get batch results](https://docs.getbifrost.ai/api-reference/batch/get-batch-results.md): Retrieves results from a completed batch job. #### Files - [List files](https://docs.getbifrost.ai/api-reference/files/list-files.md): Lists files for a provider. - [Upload a file](https://docs.getbifrost.ai/api-reference/files/upload-a-file.md): Uploads a file to be used with batch operations or other features. - [Retrieve file metadata](https://docs.getbifrost.ai/api-reference/files/retrieve-file-metadata.md): Retrieves metadata for a specific file. - [Delete a file](https://docs.getbifrost.ai/api-reference/files/delete-a-file.md): Deletes a file. - [Download file content](https://docs.getbifrost.ai/api-reference/files/download-file-content.md): Downloads the content of a file. #### Containers - [List containers](https://docs.getbifrost.ai/api-reference/containers/list-containers.md): Lists containers for a provider. - [Create a container](https://docs.getbifrost.ai/api-reference/containers/create-a-container.md): Creates a new container for storing files and data. - [Retrieve a container](https://docs.getbifrost.ai/api-reference/containers/retrieve-a-container.md): Retrieves a specific container by ID. - [Delete a container](https://docs.getbifrost.ai/api-reference/containers/delete-a-container.md): Deletes a container. - [List files in a container](https://docs.getbifrost.ai/api-reference/containers/list-files-in-a-container.md): Lists all files in a container. - [Create a file in a container](https://docs.getbifrost.ai/api-reference/containers/create-a-file-in-a-container.md): Creates a new file in a container. You can either upload file content directly via multipart/form-data or reference an existing file by its ID. - [Retrieve a file from a container](https://docs.getbifrost.ai/api-reference/containers/retrieve-a-file-from-a-container.md): Retrieves metadata for a specific file in a container. - [Delete a file from a container](https://docs.getbifrost.ai/api-reference/containers/delete-a-file-from-a-container.md): Deletes a file from a container. - [Download file content from a container](https://docs.getbifrost.ai/api-reference/containers/download-file-content-from-a-container.md): Downloads the content of a file from a container. #### Async Jobs - [Create async chat completion](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-chat-completion.md): Submits a chat completion request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. Streaming is not supported for async requests. - [Create async text completion](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-text-completion.md): Submits a text completion request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. Streaming is not supported for async requests. - [Create async response](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-response.md): Submits a response request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. Streaming is not supported for async requests. - [Create async embedding](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-embedding.md): Submits an embedding request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. - [Create async speech](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-speech.md): Submits a speech synthesis request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. SSE streaming is not supported for async requests. - [Create async transcription](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-transcription.md): Submits a transcription request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. Streaming is not supported for async requests. - [Create async image generation](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-image-generation.md): Submits an image generation request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. Streaming is not supported for async requests. - [Create async image edit](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-image-edit.md): Submits an image edit request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. Streaming is not supported for async requests. - [Create async image variation](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-image-variation.md): Submits an image variation request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. - [Get async chat completion job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-chat-completion-job.md): Retrieves the status and result of an async chat completion job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async text completion job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-text-completion-job.md): Retrieves the status and result of an async text completion job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async response job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-response-job.md): Retrieves the status and result of an async response job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async embedding job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-embedding-job.md): Retrieves the status and result of an async embedding job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async speech job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-speech-job.md): Retrieves the status and result of an async speech job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async transcription job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-transcription-job.md): Retrieves the status and result of an async transcription job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async image generation job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-image-generation-job.md): Retrieves the status and result of an async image generation job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async image edit job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-image-edit-job.md): Retrieves the status and result of an async image edit job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Get async image variation job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-image-variation-job.md): Retrieves the status and result of an async image variation job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Create async rerank](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-rerank.md): Submits a rerank request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. - [Get async rerank job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-rerank-job.md): Retrieves the status and result of an async rerank job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. - [Create async OCR job](https://docs.getbifrost.ai/api-reference/async-jobs/create-async-ocr-job.md): Submits an OCR request for asynchronous execution. Returns a job ID immediately with HTTP 202. Poll the corresponding GET endpoint with the job ID to retrieve the result. - [Get async OCR job](https://docs.getbifrost.ai/api-reference/async-jobs/get-async-ocr-job.md): Retrieves the status and result of an async OCR job. Returns HTTP 202 if the job is still pending or processing, HTTP 200 if completed or failed. #### Realtime - [Realtime API WebSocket](https://docs.getbifrost.ai/api-reference/realtime/realtime-api-websocket.md): Opens a bidirectional WebSocket session to a realtime-capable provider (e.g. OpenAI Realtime, Azure Realtime preview). Bifrost proxies the upstream socket and applies governance, observability, and key selection on connect. - [Realtime WebRTC SDP exchange](https://docs.getbifrost.ai/api-reference/realtime/realtime-webrtc-sdp-exchange.md): Negotiates a WebRTC peer connection with the realtime provider on behalf of the client. Implements the OpenAI GA `/realtime/calls` contract: the request body is `multipart/form-data` with `sdp` (client SDP offer) and `session` (JSON session description containing `model`). - [Mint a realtime ephemeral client secret](https://docs.getbifrost.ai/api-reference/realtime/mint-a-realtime-ephemeral-client-secret.md): Calls the upstream realtime provider's `client_secrets` endpoint to mint a short-lived ephemeral token (e.g. for browser-based WebRTC clients). Bifrost selects a provider key, evaluates governance, and proxies the response. The returned token is cached and mapped to the originating virtual key for d… - [Mint a realtime session (legacy alias)](https://docs.getbifrost.ai/api-reference/realtime/mint-a-realtime-session-legacy-alias.md): Legacy alias for the realtime client-secret minting endpoint. Behaves identically to `createRealtimeClientSecret` but uses the `sessions` route shape; provided for compatibility with older OpenAI Realtime client libraries. ### Platform #### Health - [Health check](https://docs.getbifrost.ai/api-reference/health/health-check.md): Returns the health status of the Bifrost server. Checks connectivity to config store, log store, and vector store if configured. Unauthenticated by design - `/health` is in the auth middleware's system whitelist. #### Configuration - [Get configuration](https://docs.getbifrost.ai/api-reference/configuration/get-configuration.md): Retrieves the current Bifrost configuration including client config, framework config, auth config, and connection status for various stores. - [Update configuration](https://docs.getbifrost.ai/api-reference/configuration/update-configuration.md): Updates the Bifrost configuration. Supports hot-reloading of certain settings like drop_excess_requests. Some settings may require a restart to take effect. - [Get version](https://docs.getbifrost.ai/api-reference/configuration/get-version.md): Returns the current Bifrost version information. Unauthenticated by design - `/api/version` is in the auth middleware's system whitelist. - [Get proxy configuration](https://docs.getbifrost.ai/api-reference/configuration/get-proxy-configuration.md): Retrieves the current global proxy configuration. - [Update proxy configuration](https://docs.getbifrost.ai/api-reference/configuration/update-proxy-configuration.md): Updates the global proxy configuration. - [Force pricing sync](https://docs.getbifrost.ai/api-reference/configuration/force-pricing-sync.md): Triggers an immediate pricing sync and resets the pricing sync timer. #### Session - [Login](https://docs.getbifrost.ai/api-reference/session/login.md): Authenticates a user and returns a session token. Sets a cookie with the session token for subsequent requests. - [Logout](https://docs.getbifrost.ai/api-reference/session/logout.md): Logs out the current user and invalidates the session token. - [Check if authentication is enabled](https://docs.getbifrost.ai/api-reference/session/check-if-authentication-is-enabled.md): Returns whether authentication is enabled and if the current token is valid. - [Issue WebSocket ticket](https://docs.getbifrost.ai/api-reference/session/issue-websocket-ticket.md): Issues a short-lived ticket for authenticating WebSocket connections. The ticket can be used as a query parameter when upgrading to WebSocket. #### Providers - [List all providers](https://docs.getbifrost.ai/api-reference/providers/list-all-providers.md): Returns a list of all configured providers with their configurations and status. - [Add a new provider](https://docs.getbifrost.ai/api-reference/providers/add-a-new-provider.md): Adds a new provider with the specified configuration. - [Get a specific provider](https://docs.getbifrost.ai/api-reference/providers/get-a-specific-provider.md): Returns the configuration for a specific provider. - [Update a provider](https://docs.getbifrost.ai/api-reference/providers/update-a-provider.md): Updates a provider's configuration. Expects ALL fields to be provided, including both edited and non-edited fields. Partial updates are not supported. - [Delete a provider](https://docs.getbifrost.ai/api-reference/providers/delete-a-provider.md): Removes a provider from the configuration. - [List keys for a provider](https://docs.getbifrost.ai/api-reference/providers/list-keys-for-a-provider.md): Returns all keys configured for a specific provider. - [Create a key for a provider](https://docs.getbifrost.ai/api-reference/providers/create-a-key-for-a-provider.md): Creates a new API key for the specified provider. The key `id` is auto-generated if omitted. `enabled` defaults to `true` if omitted. `value` is required and must not be empty. Keys cannot be created on keyless providers. - [Get a specific key for a provider](https://docs.getbifrost.ai/api-reference/providers/get-a-specific-key-for-a-provider.md): Returns a single key for the specified provider. - [Update a key for a provider](https://docs.getbifrost.ai/api-reference/providers/update-a-key-for-a-provider.md): Updates an existing key. Send the full key object. Redacted values sent back unchanged are automatically preserved (the server merges them with the stored raw values). - [Delete a key from a provider](https://docs.getbifrost.ai/api-reference/providers/delete-a-key-from-a-provider.md): Deletes a key from the specified provider. Returns the deleted key. - [List all keys](https://docs.getbifrost.ai/api-reference/providers/list-all-keys.md): Returns a list of all configured API keys across all providers. - [List models](https://docs.getbifrost.ai/api-reference/providers/list-models.md): Lists available models with optional filtering by query, provider, or keys. - [List model details](https://docs.getbifrost.ai/api-reference/providers/list-model-details.md): Lists available models with capability metadata, when available from the model catalog, with optional filtering by query, provider, or keys. - [Get model parameters](https://docs.getbifrost.ai/api-reference/providers/get-model-parameters.md): Returns the available parameter definitions for a model. The model ID is resolved against the model-parameters catalog with fallbacks, so provider-qualified IDs returned by /v1/models (e.g. "openai/gpt-4o", "openrouter/openai/gpt-4o") and bare aliases of provider-qualified catalog entries resolve to… - [List base models](https://docs.getbifrost.ai/api-reference/providers/list-base-models.md): Returns a list of base models from the model catalog. #### Plugins - [List all plugins](https://docs.getbifrost.ai/api-reference/plugins/list-all-plugins.md): Returns a list of all plugins with their configurations and status. The `actualName` field contains the plugin name from `GetName()` (used as the map key), while `name` contains the display name from the configuration. The `types` array in the status shows which interfaces the plugin implements (llm… - [Create a new plugin](https://docs.getbifrost.ai/api-reference/plugins/create-a-new-plugin.md): Creates a new plugin with the specified configuration. Setting `path` on a non-builtin plugin loads native code (a .so, via dlopen) into the gateway process and requires genuine admin authentication - it is refused with 403 if dashboard authentication is disabled or unconfigured, even though other m… - [List built-in plugin names](https://docs.getbifrost.ai/api-reference/plugins/list-built-in-plugin-names.md): Returns the canonical list of built-in plugin names available in this Bifrost build. Use this to discover which plugins can be enabled without supplying a custom binary. - [Get a specific plugin](https://docs.getbifrost.ai/api-reference/plugins/get-a-specific-plugin.md): Returns the configuration for a specific plugin. The response includes the plugin status with types array showing which interfaces the plugin implements (llm, mcp, http). The `actualName` field shows the plugin name from GetName() (used as the map key), which may differ from the display name (`name`… - [Update a plugin](https://docs.getbifrost.ai/api-reference/plugins/update-a-plugin.md): Updates a plugin's configuration. Will reload or stop the plugin based on enabled status. The response `actualName` field shows the plugin name from GetName() (used as the map key), which may differ from the display name (`name`). Setting `path` on a non-builtin plugin loads native code (a .so, via… - [Delete a plugin](https://docs.getbifrost.ai/api-reference/plugins/delete-a-plugin.md): Removes a plugin from the configuration and stops it if running. #### MCP - [Execute MCP tool](https://docs.getbifrost.ai/api-reference/mcp/execute-mcp-tool.md): Executes an MCP tool and returns the result. - [List MCP clients](https://docs.getbifrost.ai/api-reference/mcp/list-mcp-clients.md): Returns a paginated list of configured MCP clients with their tools and connection state. Supports case-insensitive name search and exact-match filtering by connection type, auth type, code-mode, and enabled/disabled status. Multi-value filters accept a comma-separated list and use OR semantics with… - [Add MCP client](https://docs.getbifrost.ai/api-reference/mcp/add-mcp-client.md): Adds a new MCP client with the specified configuration. Note: tool_pricing is not available when creating a new client; tool pricing can only be set once the tool list is known. For shared-connection clients tools are fetched after client creation; for per-user auth types they are discovered during… - [Edit MCP client](https://docs.getbifrost.ai/api-reference/mcp/edit-mcp-client.md): Updates an existing MCP client's configuration. All fields are optional (PATCH semantics); connection_type, auth_type, connection_string, stdio_config, and oauth_config_id are immutable after creation. Unlike client creation, tool_pricing can be included to set per-tool execution costs since tools a… - [Remove MCP client](https://docs.getbifrost.ai/api-reference/mcp/remove-mcp-client.md): Removes an MCP client from the configuration. - [Reconnect MCP client](https://docs.getbifrost.ai/api-reference/mcp/reconnect-mcp-client.md): Reconnects an MCP client that is in an error or unstable state. Not applicable (400) to any per-call client — a shared client running per-call (needs_session_stickiness false/omitted) as well as any per-user auth type — since none of them hold a shared upstream connection to re-establish. Also not a… - [Complete MCP client OAuth flow](https://docs.getbifrost.ai/api-reference/mcp/complete-mcp-client-oauth-flow.md): Completes an OAuth flow for an MCP client after the admin has authorized the request upstream. Call it once the flow's status_url reports "authorized". It serves every admin-side OAuth completion with one endpoint: - [Initiate verification for a pending MCP client](https://docs.getbifrost.ai/api-reference/mcp/initiate-verification-for-a-pending-mcp-client.md): Starts the one-time admin OAuth authorization for an MCP client sitting in pending_verification state (declared via config.json with auth_type "oauth" or "per_user_oauth"). Runs OAuth metadata discovery (RFC 8414) and dynamic client registration (RFC 7591) against the client's connection_string when… - [Reauthorize an MCP client](https://docs.getbifrost.ai/api-reference/mcp/reauthorize-an-mcp-client.md): Redoes the OAuth consent flow for an already-authorized OAuth-based MCP client, without delete-and-recreate. The flow always runs against the credentials currently stored on the client's OAuth config. - [Verify a pending per-user-headers MCP client](https://docs.getbifrost.ai/api-reference/mcp/verify-a-pending-per-user-headers-mcp-client.md): Completes the admin verification for an MCP client with auth_type "per_user_headers". The admin supplies sample values for every declared per_user_header_keys entry; Bifrost opens an upstream connection with them, discovers the tool list, persists it, and transitions the client to connected. The sam… - [Verify a pending or repair a needs_reauth token_exchange MCP client](https://docs.getbifrost.ai/api-reference/mcp/verify-a-pending-or-repair-a-needs_reauth-token_exchange-mcp-client.md): Completes admin verification for an MCP client with auth_type "token_exchange". No request body: the subject of the exchange is always the signed-in admin's own identity-provider token (from an SSO session or an identity-authenticated bearer request) — there is no manual token input. Bifrost exchang… - [List MCP sessions](https://docs.getbifrost.ai/api-reference/mcp/list-mcp-sessions.md): Returns every per-user MCP authentication artifact visible to the caller: OAuth tokens, header credentials, and pending submission / consent flows. - [Revoke an MCP session](https://docs.getbifrost.ai/api-reference/mcp/revoke-an-mcp-session.md): Revokes a session by primary key. Accepts these row kinds: - OAuth token rows → hard-deletes the token plus any pending OAuth flow for the same binding (so an in-flight callback can't undo the revoke) - Header credential rows → hard-deletes the credential plus any pending header submission flow… - [Re-authenticate or edit an MCP session](https://docs.getbifrost.ai/api-reference/mcp/re-authenticate-or-edit-an-mcp-session.md): Mints a fresh authentication flow against the same MCP client and identity as the existing row. Two branches based on row type: - [Get per-user-headers submission flow](https://docs.getbifrost.ai/api-reference/mcp/get-per-user-headers-submission-flow.md): Returns the pending submission flow row plus the live MCP client's schema (required header names + optional admin header names). Used by the `/workspace/mcp-sessions/auth?flow=&kind=headers` landing page to render the values form. - [Submit per-user-headers values](https://docs.getbifrost.ai/api-reference/mcp/submit-per-user-headers-values.md): Consumes a pending submission flow row: verifies the caller's values against the upstream MCP server, upserts the credential keyed by the flow row's (mode, identity), then deletes the flow row and the bound temp token. Mirrors the OAuth callback's "complete the flow" semantics. - [Revoke a per-user-headers credential](https://docs.getbifrost.ai/api-reference/mcp/revoke-a-per-user-headers-credential.md): Hard-deletes a per-user-headers credential row by primary key. Authorization scoping is enforced server-side — callers may only delete credentials visible to their identity. #### MCP Tool Groups - [List MCP Tool Groups](https://docs.getbifrost.ai/api-reference/mcp-tool-groups/list-mcp-tool-groups.md): Returns tool groups visible to the caller. When all of `limit`, `offset`, and `search` are omitted, every group is returned in one response. - [Create MCP Tool Group](https://docs.getbifrost.ai/api-reference/mcp-tool-groups/create-mcp-tool-group.md): Creates a new tool group along with its attachments in a single transaction. Validates that every `mcp_client_id` points to a deployed MCP client and that every named tool exists on its server. - [Get MCP Tool Group by ID](https://docs.getbifrost.ai/api-reference/mcp-tool-groups/get-mcp-tool-group-by-id.md) - [Update MCP Tool Group](https://docs.getbifrost.ai/api-reference/mcp-tool-groups/update-mcp-tool-group.md): Partial update. Scalar fields preserve the current value when omitted. Array fields are replace-on-send: an empty array clears all attachments in that dimension. - [Delete MCP Tool Group](https://docs.getbifrost.ai/api-reference/mcp-tool-groups/delete-mcp-tool-group.md): Deletes the group; attachments are removed automatically. #### OAuth - [Get per-user OAuth flow detail](https://docs.getbifrost.ai/api-reference/oauth/get-per-user-oauth-flow-detail.md): Returns the pending OAuth flow row metadata: which MCP client is being authorized, which identity (user / VK / session) the resulting token will be bound to, and whether an active token already exists for that binding (`has_active_token`). - [Start the upstream OAuth authorization for a pending flow](https://docs.getbifrost.ai/api-reference/oauth/start-the-upstream-oauth-authorization-for-a-pending-flow.md): Reconstructs the upstream provider's authorize URL for a pending OAuth flow. The auth-landing page redirects the browser to that URL; the user completes upstream auth; the upstream provider redirects back to `/api/oauth/callback`, which exchanges the code for tokens server-side and stores them again… - [OAuth callback endpoint](https://docs.getbifrost.ai/api-reference/oauth/oauth-callback-endpoint.md): Handles the OAuth provider callback after user authorization. This endpoint processes the authorization code and exchanges it for an access token. On success, displays an HTML page that closes the authorization window. - [Get OAuth config status](https://docs.getbifrost.ai/api-reference/oauth/get-oauth-config-status.md): Retrieves the current status of an OAuth configuration. Shows whether the OAuth flow is pending, authorized, or failed, and includes token expiration and scopes if authorized. - [Revoke OAuth config](https://docs.getbifrost.ai/api-reference/oauth/revoke-oauth-config.md): Revokes a server-level OAuth configuration and its associated access token. After revocation, the MCP client will no longer be able to use this OAuth token. Revocation is not terminal for the client: an admin can restore access by redoing consent via POST /api/mcp/client/{id}/reauthorize, which runs… #### Circuit Breaker - [List circuit breaker policies](https://docs.getbifrost.ai/api-reference/circuit-breaker/list-circuit-breaker-policies.md): Returns all circuit breaker policies defined in this workspace. - [Create circuit breaker policy](https://docs.getbifrost.ai/api-reference/circuit-breaker/create-circuit-breaker-policy.md): Creates a new circuit breaker policy and immediately activates it in the running gateway. Returns 409 if a policy with the same name already exists. - [Update circuit breaker policy](https://docs.getbifrost.ai/api-reference/circuit-breaker/update-circuit-breaker-policy.md): Replaces a circuit breaker policy by name. The `name` field in the request body must match the URL parameter or be omitted. Changes take effect immediately in the running gateway. - [Delete circuit breaker policy](https://docs.getbifrost.ai/api-reference/circuit-breaker/delete-circuit-breaker-policy.md): Deletes a circuit breaker policy by name and removes it from the running gateway. Any open circuits for this policy are discarded immediately. - [Get circuit breaker state](https://docs.getbifrost.ai/api-reference/circuit-breaker/get-circuit-breaker-state.md): Returns a snapshot of all currently-open circuits. Main circuits are keyed by policy name. Per-key sub-circuits are keyed by `"\x00"`. Circuits not present in the map are closed. #### Logging - [Get logs](https://docs.getbifrost.ai/api-reference/logging/get-logs.md): Retrieves logs with filtering, search, and pagination via query parameters. - [Delete logs](https://docs.getbifrost.ai/api-reference/logging/delete-logs.md): Deletes logs by their IDs. - [Get a single log entry](https://docs.getbifrost.ai/api-reference/logging/get-a-single-log-entry.md): Retrieves a single log entry by its ID. - [Get logs for a session](https://docs.getbifrost.ai/api-reference/logging/get-logs-for-a-session.md): Returns the paginated logs belonging to a single parent-request session (grouped by `parent_request_id`). Sorted ascending by timestamp by default. - [Get aggregate totals for a session](https://docs.getbifrost.ai/api-reference/logging/get-aggregate-totals-for-a-session.md): Returns aggregate request count, token usage, cost, and duration for a single session. - [Get log statistics](https://docs.getbifrost.ai/api-reference/logging/get-log-statistics.md): Returns statistics for logs matching the specified filters. - [Get request count histogram](https://docs.getbifrost.ai/api-reference/logging/get-request-count-histogram.md): Returns time-bucketed request counts. Bucket size is auto-calculated from the time range. - [Get token usage histogram](https://docs.getbifrost.ai/api-reference/logging/get-token-usage-histogram.md): Returns time-bucketed token usage (prompt, completion, total). - [Get cost histogram](https://docs.getbifrost.ai/api-reference/logging/get-cost-histogram.md): Returns time-bucketed cost data with model breakdown. - [Get model usage histogram](https://docs.getbifrost.ai/api-reference/logging/get-model-usage-histogram.md): Returns time-bucketed model usage with success/error breakdown. - [Get latency histogram](https://docs.getbifrost.ai/api-reference/logging/get-latency-histogram.md): Returns time-bucketed latency percentiles (avg, p90, p95, p99). - [Get cost histogram by provider](https://docs.getbifrost.ai/api-reference/logging/get-cost-histogram-by-provider.md): Returns time-bucketed cost data with provider breakdown. - [Get token histogram by provider](https://docs.getbifrost.ai/api-reference/logging/get-token-histogram-by-provider.md): Returns time-bucketed token usage with provider breakdown. - [Get latency histogram by provider](https://docs.getbifrost.ai/api-reference/logging/get-latency-histogram-by-provider.md): Returns time-bucketed latency percentiles with provider breakdown. - [Get throughput histogram](https://docs.getbifrost.ai/api-reference/logging/get-throughput-histogram.md): Returns time-bucketed token-generation throughput in tokens per second. The bucket size is derived from the requested window. - [Get throughput histogram by provider](https://docs.getbifrost.ai/api-reference/logging/get-throughput-histogram-by-provider.md): Returns time-bucketed tokens per second with a per-provider breakdown. - [Get cost histogram by dimension](https://docs.getbifrost.ai/api-reference/logging/get-cost-histogram-by-dimension.md): Returns time-bucketed cost data grouped by an arbitrary dimension (`provider`, `team_id`, `customer_id`, `user_id`, `business_unit_id`, `project_id`, `app`, `user_agent`). The dimension is supplied via the required `dimension` query parameter. - [Get token histogram by dimension](https://docs.getbifrost.ai/api-reference/logging/get-token-histogram-by-dimension.md): Returns time-bucketed token usage grouped by an arbitrary dimension. See `getLogsDimensionCostHistogram` for the list of supported dimensions. - [Get latency histogram by dimension](https://docs.getbifrost.ai/api-reference/logging/get-latency-histogram-by-dimension.md): Returns time-bucketed latency percentiles (avg, p90, p95, p99) grouped by an arbitrary dimension. - [Get dropped requests count](https://docs.getbifrost.ai/api-reference/logging/get-dropped-requests-count.md): Returns the number of dropped requests. - [Get available filter data](https://docs.getbifrost.ai/api-reference/logging/get-available-filter-data.md): Returns the distinct values each filter dimension offers, drawn from the logs of roughly the last month. - [Get model usage rankings](https://docs.getbifrost.ai/api-reference/logging/get-model-usage-rankings.md): Returns models ranked by usage with trend percentages versus the previous comparable period. Accepts the same filter parameters as the histogram endpoints. - [Get rankings by governance dimension](https://docs.getbifrost.ai/api-reference/logging/get-rankings-by-governance-dimension.md): Returns the entities of one governance dimension ranked by spend, tokens and request volume, with trend percentages versus the previous comparable period. Requests carrying no value for the dimension are reported under an `Unassigned` entry rather than dropped, so the rows reconcile with real traffi… - [Get user usage rankings](https://docs.getbifrost.ai/api-reference/logging/get-user-usage-rankings.md): Returns users ranked by spend, tokens and request volume, with trend percentages versus the previous comparable period. Only requests that resolved to a user are counted. - [Get consolidated dashboard data](https://docs.getbifrost.ai/api-reference/logging/get-consolidated-dashboard-data.md): Returns every metric shown on the workspace dashboard in a single response: overview totals and histograms, provider usage, model rankings, dimension rankings (team, user, virtual key, customer, business unit), and MCP usage. Intended for external integrations that want the full dashboard in one cal… - [Recalculate log costs](https://docs.getbifrost.ai/api-reference/logging/recalculate-log-costs.md): Starts an asynchronous background job that recalculates log costs in batches. The returned payload is a job status object that can be polled via the status endpoint. - [Get log cost recalculation status](https://docs.getbifrost.ai/api-reference/logging/get-log-cost-recalculation-status.md): Returns the current status of a log cost recalculation job. When `id` is omitted, the current in-flight job is returned, or `idle` when no job is running. - [Cancel log cost recalculation](https://docs.getbifrost.ai/api-reference/logging/cancel-log-cost-recalculation.md): Cancels the recalculation job selected by `id`, or the current in-flight recalculation when `id` is omitted. Cancellation stops further batches; cost updates already committed to log records are retained and are not rolled back. Logs that the job has not processed remain unchanged. - [Get MCP tool logs](https://docs.getbifrost.ai/api-reference/logging/get-mcp-tool-logs.md): Retrieves MCP tool execution logs with filtering, search, and pagination via query parameters. - [Delete MCP tool logs](https://docs.getbifrost.ai/api-reference/logging/delete-mcp-tool-logs.md): Deletes MCP tool logs by their IDs. - [Get MCP tool log by ID](https://docs.getbifrost.ai/api-reference/logging/get-mcp-tool-log-by-id.md): Retrieves a single MCP tool execution log by ID, including hydrated object-storage payloads when configured. - [Get MCP tool log statistics](https://docs.getbifrost.ai/api-reference/logging/get-mcp-tool-log-statistics.md): Returns statistics for MCP tool logs matching the specified filters. - [Get available MCP log filter data](https://docs.getbifrost.ai/api-reference/logging/get-available-mcp-log-filter-data.md): Returns all unique filter data from MCP tool logs (tool names, server labels). - [Get MCP tool call volume histogram](https://docs.getbifrost.ai/api-reference/logging/get-mcp-tool-call-volume-histogram.md): Returns time-bucketed MCP tool call volume with success/error breakdown. - [Get MCP cost histogram](https://docs.getbifrost.ai/api-reference/logging/get-mcp-cost-histogram.md): Returns time-bucketed MCP tool call cost data. - [Get top MCP tools by call count](https://docs.getbifrost.ai/api-reference/logging/get-top-mcp-tools-by-call-count.md): Returns the top 10 MCP tools by call count, with cost totals. #### Prompt Repository - [List folders](https://docs.getbifrost.ai/api-reference/prompt-repository/list-folders.md): Returns all prompt folders. - [Create folder](https://docs.getbifrost.ai/api-reference/prompt-repository/create-folder.md): Creates a new prompt folder. - [Get folder](https://docs.getbifrost.ai/api-reference/prompt-repository/get-folder.md): Returns a folder by ID. - [Update folder](https://docs.getbifrost.ai/api-reference/prompt-repository/update-folder.md): Updates a folder's name or description. - [Delete folder](https://docs.getbifrost.ai/api-reference/prompt-repository/delete-folder.md): Deletes a folder and cascades to contained prompts. - [List prompts](https://docs.getbifrost.ai/api-reference/prompt-repository/list-prompts.md): Returns all prompts, optionally filtered by folder. - [Create prompt](https://docs.getbifrost.ai/api-reference/prompt-repository/create-prompt.md): Creates a new prompt. - [Get prompt](https://docs.getbifrost.ai/api-reference/prompt-repository/get-prompt.md): Returns a prompt by ID with its latest version. - [Update prompt](https://docs.getbifrost.ai/api-reference/prompt-repository/update-prompt.md): Updates a prompt's name or folder. - [Delete prompt](https://docs.getbifrost.ai/api-reference/prompt-repository/delete-prompt.md): Deletes a prompt and all its versions and sessions. - [List prompt versions](https://docs.getbifrost.ai/api-reference/prompt-repository/list-prompt-versions.md): Returns all versions for a prompt. - [Create prompt version](https://docs.getbifrost.ai/api-reference/prompt-repository/create-prompt-version.md): Creates a new version for a prompt. - [Get prompt version](https://docs.getbifrost.ai/api-reference/prompt-repository/get-prompt-version.md): Returns a specific version by ID. - [Delete prompt version](https://docs.getbifrost.ai/api-reference/prompt-repository/delete-prompt-version.md): Deletes a specific version. - [List prompt sessions](https://docs.getbifrost.ai/api-reference/prompt-repository/list-prompt-sessions.md): Returns all sessions for a prompt. - [Create prompt session](https://docs.getbifrost.ai/api-reference/prompt-repository/create-prompt-session.md): Creates a new playground session for a prompt. - [Get prompt session](https://docs.getbifrost.ai/api-reference/prompt-repository/get-prompt-session.md): Returns a specific session by ID. - [Update prompt session](https://docs.getbifrost.ai/api-reference/prompt-repository/update-prompt-session.md): Updates a session's messages, model params, etc. - [Delete prompt session](https://docs.getbifrost.ai/api-reference/prompt-repository/delete-prompt-session.md): Deletes a specific session. - [Rename prompt session](https://docs.getbifrost.ai/api-reference/prompt-repository/rename-prompt-session.md): Renames a session. - [Commit session as version](https://docs.getbifrost.ai/api-reference/prompt-repository/commit-session-as-version.md): Commits the current session state as a new prompt version. #### Skills - [Upload skill file](https://docs.getbifrost.ai/api-reference/skills/upload-skill-file.md): Uploads one file for later attachment to a skill version. The response contains either an object-storage key or a database blob ID. - [Clean up orphan skill files](https://docs.getbifrost.ai/api-reference/skills/clean-up-orphan-skill-files.md): Deletes uploaded files that are not attached to any skill version. This is mostly a maintenance escape hatch: Bifrost also runs orphan cleanup on server startup. Non-forced cleanup preserves uploads newer than 24 hours so files are not deleted while a skill is still being edited. - [Get all-skills version](https://docs.getbifrost.ai/api-reference/skills/get-all-skills-version.md): Returns the current version of the synthetic `bifrost-all-skills` marketplace plugin. - [Bump all-skills version](https://docs.getbifrost.ai/api-reference/skills/bump-all-skills-version.md): Manually bumps the synthetic `bifrost-all-skills` plugin version as an escape hatch for marketplace refreshes. - [List skills](https://docs.getbifrost.ai/api-reference/skills/list-skills.md): Returns a paginated list of skills from the Skills Repository. - [Create skill](https://docs.getbifrost.ai/api-reference/skills/create-skill.md): Creates a new skill and immediately serves its first immutable version. - [Get skill](https://docs.getbifrost.ai/api-reference/skills/get-skill.md): Returns a skill by ID. Pass `version` to inspect a historical version snapshot. - [Update skill](https://docs.getbifrost.ai/api-reference/skills/update-skill.md): Creates a new immutable skill version. Set `serve` to false to save the version without switching the served version. - [Delete skill](https://docs.getbifrost.ai/api-reference/skills/delete-skill.md): Deletes a skill and all of its versions. - [List skill versions](https://docs.getbifrost.ai/api-reference/skills/list-skill-versions.md): Returns immutable version snapshots for a skill. - [Shift served skill version](https://docs.getbifrost.ai/api-reference/skills/shift-served-skill-version.md): Changes the served version for a skill without deleting newer versions. - [Get Claude Code skills marketplace](https://docs.getbifrost.ai/api-reference/skills/get-claude-code-skills-marketplace.md): Public marketplace JSON consumed by Claude Code. Available only when the Bifrost server can access the `git` binary. - [Get Codex skills marketplace JSON](https://docs.getbifrost.ai/api-reference/skills/get-codex-skills-marketplace-json.md): Public Codex marketplace JSON for inspecting the skills and plugin sources exposed by Bifrost. - [Download all skills as ZIP](https://docs.getbifrost.ai/api-reference/skills/download-all-skills-as-zip.md): Public ZIP download containing every currently served skill. - [Download skill as ZIP](https://docs.getbifrost.ai/api-reference/skills/download-skill-as-zip.md): Public ZIP download containing a single currently served skill. - [Download skill file](https://docs.getbifrost.ai/api-reference/skills/download-skill-file.md): Public raw file download from the currently served version of a skill. #### Cache - [Clear cache entry by cache ID](https://docs.getbifrost.ai/api-reference/cache/clear-cache-entry-by-cache-id.md): Deletes a single cache entry by its storage ID. Read the cache ID from `extra_fields.cache_debug.cache_id` on a prior response — it is populated on both cache hits and cache misses. - [Clear cache by cache key](https://docs.getbifrost.ai/api-reference/cache/clear-cache-by-cache-key.md): Clears a cache entry by its direct cache key. #### Vault - [Flush vault secret cache](https://docs.getbifrost.ai/api-reference/vault/flush-vault-secret-cache.md): Clears the in-memory vault secret cache so the next resolution of every `vault.` reference re-fetches from the configured backend (AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault). #### Infrastructure - [WebSocket connection](https://docs.getbifrost.ai/api-reference/infrastructure/websocket-connection.md): Upgrades to a WebSocket connection for real-time updates. Server pushes log events, MCP log events, and store update notifications. Heartbeat pings are sent every 30 seconds. - [MCP protocol SSE stream](https://docs.getbifrost.ai/api-reference/infrastructure/mcp-protocol-sse-stream.md): Opens a Server-Sent Events stream for the MCP protocol server. Returns `Content-Type: text/event-stream`. - [MCP protocol message](https://docs.getbifrost.ai/api-reference/infrastructure/mcp-protocol-message.md): Receives a JSON-RPC 2.0 message for the MCP protocol server. Returns a JSON-RPC 2.0 response, or null for notifications. - [Prometheus metrics](https://docs.getbifrost.ai/api-reference/infrastructure/prometheus-metrics.md): Returns Prometheus-formatted metrics for monitoring. Registered behind the management auth middleware chain, so a scraper must present management credentials (or the route must be added to `client_config.whitelisted_routes`). - [Inspect a request without forwarding it](https://docs.getbifrost.ai/api-reference/infrastructure/inspect-a-request-without-forwarding-it.md): Runs the pre-model plugin checks against a request and answers whether forwarding it upstream is allowed, without calling any provider. Intended for an intercepting proxy that holds the original request and needs a verdict before releasing it. #### Webhooks - [List webhook endpoints](https://docs.getbifrost.ai/api-reference/webhooks/list-webhook-endpoints.md): Returns webhook endpoints, optionally filtered by search text, subscribed event, and disabled status. Signing secrets are never included and custom header values are redacted. - [Create a webhook endpoint](https://docs.getbifrost.ai/api-reference/webhooks/create-a-webhook-endpoint.md): Creates a webhook endpoint. The signing secret is generated by the server and returned once in the response — it cannot be supplied and cannot be retrieved again afterwards. - [Get a webhook endpoint](https://docs.getbifrost.ai/api-reference/webhooks/get-a-webhook-endpoint.md) - [Update a webhook endpoint](https://docs.getbifrost.ai/api-reference/webhooks/update-a-webhook-endpoint.md): Updates a webhook endpoint. The signing secret is immutable here — use the rotate-secret endpoint to change it. - [Delete a webhook endpoint](https://docs.getbifrost.ai/api-reference/webhooks/delete-a-webhook-endpoint.md) - [Rotate a webhook signing secret](https://docs.getbifrost.ai/api-reference/webhooks/rotate-a-webhook-signing-secret.md): Generates a new signing secret for the endpoint and returns it once. The previous secret stops verifying immediately — there is no grace window, so update your receiver in the same change. - [Send a test delivery](https://docs.getbifrost.ai/api-reference/webhooks/send-a-test-delivery.md): Sends a sample signed delivery for the chosen event through the production signing path. - [List delivery history](https://docs.getbifrost.ai/api-reference/webhooks/list-delivery-history.md): Returns one page of delivery-attempt history for an endpoint, newest first. - [Search delivery history](https://docs.getbifrost.ai/api-reference/webhooks/search-delivery-history.md): Returns one page of delivery-attempt history across every endpoint the filters select, newest first. Unlike the per-endpoint `/api/webhooks/{id}/deliveries` route, every filter is optional, so an unfiltered call returns history for all endpoints. - [Re-queue a delivery](https://docs.getbifrost.ai/api-reference/webhooks/re-queue-a-delivery.md): Re-queues the delivery a history record belongs to, under its original webhook-id so receivers can deduplicate the replay. #### Notifications - [List dashboard notifications](https://docs.getbifrost.ai/api-reference/notifications/list-dashboard-notifications.md): Returns notifications the caller is entitled to see, newest first. Notifications addressed to `all` are visible to everyone; those addressed to `roles` are only returned when the caller holds one of the listed roles. A local admin sees every notification. - [Publish a dashboard notification](https://docs.getbifrost.ai/api-reference/notifications/publish-a-dashboard-notification.md): Persists a notification and pushes it over the dashboard WebSocket to every connected client the audience covers. ### Governance #### Teams - [List teams](https://docs.getbifrost.ai/api-reference/governance/list-teams.md): Returns a list of all teams. - [Create team](https://docs.getbifrost.ai/api-reference/governance/create-team.md): Creates a new team. - [Get team](https://docs.getbifrost.ai/api-reference/governance/get-team.md): Returns a specific team by ID. - [Update team](https://docs.getbifrost.ai/api-reference/governance/update-team.md): Updates an existing team. - [Delete team](https://docs.getbifrost.ai/api-reference/governance/delete-team.md): Deletes a team. - [List team members](https://docs.getbifrost.ai/api-reference/teams/list-team-members.md): Returns all members of a team with their user details and membership source. - [Add team member](https://docs.getbifrost.ai/api-reference/teams/add-team-member.md): Adds a user to a team. Both the team and user must exist. - [Remove team member](https://docs.getbifrost.ai/api-reference/teams/remove-team-member.md): Removes a user from a team. - [Get user's teams](https://docs.getbifrost.ai/api-reference/users/get-users-teams.md): Returns the list of teams a user belongs to, including the membership source. - [Update user's team assignments](https://docs.getbifrost.ai/api-reference/users/update-users-team-assignments.md): Replaces the user's manual team assignments. Synced team memberships (from SCIM providers) are preserved and cannot be removed via this endpoint. - [List customers attached to a team](https://docs.getbifrost.ai/api-reference/teams/list-customers-attached-to-a-team.md) - [Attach a customer to a team](https://docs.getbifrost.ai/api-reference/teams/attach-a-customer-to-a-team.md) - [Detach a customer from a team](https://docs.getbifrost.ai/api-reference/teams/detach-a-customer-from-a-team.md) - [List teams attached to a customer](https://docs.getbifrost.ai/api-reference/customers/list-teams-attached-to-a-customer.md) #### Virtual Keys - [List virtual keys](https://docs.getbifrost.ai/api-reference/governance/list-virtual-keys.md): Returns a list of all virtual keys with their configurations. - [Create virtual key](https://docs.getbifrost.ai/api-reference/governance/create-virtual-key.md): Creates a new virtual key with the specified configuration. - [Get virtual key quota](https://docs.getbifrost.ai/api-reference/governance/get-virtual-key-quota.md): Returns the overall budget and rate limit quota for the authenticated virtual key, as well as per-provider and per-model budgets and rate limits (with current usage). Each budget also carries the actual per-model usage for its current cycle. This is a self-service endpoint - no admin authentication… - [Rotate multiple virtual keys](https://docs.getbifrost.ai/api-reference/governance/rotate-multiple-virtual-keys.md): Generates a new value for each listed virtual key. When the client vk_rotation_cooldown setting is non-zero, each retired value keeps authenticating until previous_value_expires_at; otherwise it stops working immediately. - [Get virtual key](https://docs.getbifrost.ai/api-reference/governance/get-virtual-key.md): Returns a specific virtual key by ID. - [Update virtual key](https://docs.getbifrost.ai/api-reference/governance/update-virtual-key.md): Updates an existing virtual key's configuration. - [Delete virtual key](https://docs.getbifrost.ai/api-reference/governance/delete-virtual-key.md): Deletes a virtual key. - [Rotate virtual key](https://docs.getbifrost.ai/api-reference/governance/rotate-virtual-key.md): Generates a new value for the virtual key. When the client vk_rotation_cooldown setting is non-zero, the retired value keeps authenticating until previous_value_expires_at; otherwise it stops working immediately. - [List users attached to a virtual key](https://docs.getbifrost.ai/api-reference/virtual-keys/list-users-attached-to-a-virtual-key.md) - [Attach users to a virtual key](https://docs.getbifrost.ai/api-reference/virtual-keys/attach-users-to-a-virtual-key.md) - [Detach a user from a virtual key](https://docs.getbifrost.ai/api-reference/virtual-keys/detach-a-user-from-a-virtual-key.md) - [Set virtual key budget override](https://docs.getbifrost.ai/api-reference/governance/set-virtual-key-budget-override.md): Sets or replaces the spending override on one of a virtual key's budgets. The override is additive — while it is active the budget is enforced against `max_limit + override_amount` — and it leaves the budget's base limit, current usage, and reset schedule untouched. - [Remove virtual key budget override](https://docs.getbifrost.ai/api-reference/governance/remove-virtual-key-budget-override.md): Removes any active override from the budget, so it is enforced against its base `max_limit` again. The budget's current usage and reset schedule are unchanged, and the removal is permanent — a cleared grant cannot be re-derived. Safe to call on a budget that has no override. - [List virtual keys available to a user](https://docs.getbifrost.ai/api-reference/users/list-virtual-keys-available-to-a-user.md): Returns every virtual key assigned to the user, independent of access profiles, so directly-assigned standalone keys are visible alongside profile-issued ones. - [Mint an extra virtual key for a user](https://docs.getbifrost.ai/api-reference/users/mint-an-extra-virtual-key-for-a-user.md): Issues an additional virtual key for the user. - [Get user's virtual keys by email](https://docs.getbifrost.ai/api-reference/users/get-users-virtual-keys-by-email.md): **Enterprise only.** Returns all virtual keys associated with a user, looked up by email address. Returns an empty `virtual_keys` array when the user exists but has no virtual keys assigned. Intended for MDM and credential-helper integrations that need to resolve a user's keys without knowing their… #### Customers - [List customers](https://docs.getbifrost.ai/api-reference/governance/list-customers.md): Returns a list of all customers. - [Create customer](https://docs.getbifrost.ai/api-reference/governance/create-customer.md): Creates a new customer. - [Get customer](https://docs.getbifrost.ai/api-reference/governance/get-customer.md): Returns a specific customer by ID. - [Update customer](https://docs.getbifrost.ai/api-reference/governance/update-customer.md): Updates an existing customer. - [Delete customer](https://docs.getbifrost.ai/api-reference/governance/delete-customer.md): Deletes a customer. #### Users - [List users](https://docs.getbifrost.ai/api-reference/users/list-users.md): Returns a paginated list of users with optional search. - [Create user](https://docs.getbifrost.ai/api-reference/users/create-user.md): Manually creates a new user in the organization. - [Get user](https://docs.getbifrost.ai/api-reference/users/get-user.md): Returns a single Enterprise user. - [Delete user](https://docs.getbifrost.ai/api-reference/users/delete-user.md): Permanently removes a user from the organization. This cascades to delete the user's governance settings (budget/rate limits), team memberships, access profiles, and OIDC sessions. Cannot delete yourself. - [Get user by email](https://docs.getbifrost.ai/api-reference/users/get-user-by-email.md): Returns a single Enterprise user resolved by URL-encoded email address. - [Get current user permissions](https://docs.getbifrost.ai/api-reference/users/get-current-user-permissions.md): Returns the RBAC permissions for the authenticated user. When SCIM is not enabled, returns full permissions for all resources. Otherwise returns the permissions associated with the user's assigned role. - [Get the calling user's virtual-key creation policy](https://docs.getbifrost.ai/api-reference/users/get-the-calling-users-virtual-key-creation-policy.md): Resolves the access profile that would govern a virtual key the **calling** user creates, returning its name or none. Whether governance applies at all is decided separately from the `VirtualKeys:CreateStandalone` permission (see `/api/governance/users/me/permissions`); this endpoint only resolves t… - [Assign role to user](https://docs.getbifrost.ai/api-reference/users/assign-role-to-user.md): Assigns an RBAC role to a user. This also auto-assigns the default access profile for the new role and reloads the RBAC permission cache. - [Create user governance](https://docs.getbifrost.ai/api-reference/users/create-user-governance.md) - [Update user governance](https://docs.getbifrost.ai/api-reference/users/update-user-governance.md) - [Delete user governance](https://docs.getbifrost.ai/api-reference/users/delete-user-governance.md) #### Business Units - [List business units](https://docs.getbifrost.ai/api-reference/governance/list-business-units.md): Returns a paginated list of business units, each with its user count. - [Create business unit](https://docs.getbifrost.ai/api-reference/governance/create-business-unit.md): Creates a new business unit. Names must be unique. - [Get business unit](https://docs.getbifrost.ai/api-reference/governance/get-business-unit.md): Returns a specific business unit by ID, including governance and user count. - [Update business unit](https://docs.getbifrost.ai/api-reference/governance/update-business-unit.md): Updates the business unit name. - [Delete business unit](https://docs.getbifrost.ai/api-reference/governance/delete-business-unit.md): Deletes a business unit. Every user membership of it is atomically removed as part of the deletion, and each affected user's governance is refreshed so the business unit stops applying to their requests. - [List business unit users](https://docs.getbifrost.ai/api-reference/governance/list-business-unit-users.md): Returns a paginated list of users that belong to the business unit, each with the provenance of its membership edge so a caller can tell an admin assignment apart from an identity-provider-synced one. - [Assign user to business unit](https://docs.getbifrost.ai/api-reference/governance/assign-user-to-business-unit.md): Assigns an existing user to the business unit. Membership is many-to-many, so a user may belong to several business units and there is no conflict to reject. - [Remove user from business unit](https://docs.getbifrost.ai/api-reference/governance/remove-user-from-business-unit.md): Removes a user's membership of the business unit. - [Create business unit governance](https://docs.getbifrost.ai/api-reference/governance/create-business-unit-governance.md): Configures budget and/or rate limit governance for a business unit. At least one of `budget` or `rate_limit` is required. Returns 409 if the business unit already has governance configured (use PUT to update). - [Update business unit governance](https://docs.getbifrost.ai/api-reference/governance/update-business-unit-governance.md): Updates budget and/or rate limit governance for a business unit. Passing an empty `budget` or `rate_limit` object removes that governance component. - [Delete business unit governance](https://docs.getbifrost.ai/api-reference/governance/delete-business-unit-governance.md): Removes all budget and rate limit governance from a business unit. - [List customers attached to a business unit](https://docs.getbifrost.ai/api-reference/business-units/list-customers-attached-to-a-business-unit.md) - [Attach customers to a business unit](https://docs.getbifrost.ai/api-reference/business-units/attach-customers-to-a-business-unit.md) - [Detach a customer from a business unit](https://docs.getbifrost.ai/api-reference/business-units/detach-a-customer-from-a-business-unit.md) - [List business units attached to a customer](https://docs.getbifrost.ai/api-reference/customers/list-business-units-attached-to-a-customer.md) #### Access Profiles - [List access profiles](https://docs.getbifrost.ai/api-reference/access-profiles/list-access-profiles.md): Returns access profiles visible to the caller. - [Create access profile](https://docs.getbifrost.ai/api-reference/access-profiles/create-access-profile.md): Creates a new access profile template. The profile is inactive until attached to a role. No size limits are enforced on create; the limits apply on update. - [Get access profile by ID](https://docs.getbifrost.ai/api-reference/access-profiles/get-access-profile-by-id.md): Returns the profile plus its role attachments and the count of users holding a copy. - [Update access profile](https://docs.getbifrost.ai/api-reference/access-profiles/update-access-profile.md): Partial update. Omitted fields preserve the current value. `rate_limit: null` explicitly clears the existing rate limit. Size limits enforced: max 100 provider_configs, max 100 budgets, max 50 tags. - [Delete access profile](https://docs.getbifrost.ai/api-reference/access-profiles/delete-access-profile.md): Blocked with 409 if any users still hold copies. Detach role attachments or remove user assignments first. - [Activate access profile](https://docs.getbifrost.ai/api-reference/access-profiles/activate-access-profile.md): Sets the profile active. Idempotent. - [Deactivate access profile](https://docs.getbifrost.ai/api-reference/access-profiles/deactivate-access-profile.md): Sets the profile inactive. Idempotent. User copies are preserved; the profile is hidden from selection menus. - [Clone an access profile](https://docs.getbifrost.ai/api-reference/access-profiles/clone-an-access-profile.md): Creates a fresh copy of the profile under a new name. The clone has no role attachments or user copies. - [Propagate template changes to user copies](https://docs.getbifrost.ai/api-reference/access-profiles/propagate-template-changes-to-user-copies.md): Pushes selected fields from the template to every user that holds a copy. Use `dry_run: true` to preview the impact. By default, accumulated usage is preserved. - [Attach roles to access profile](https://docs.getbifrost.ai/api-reference/access-profiles/attach-roles-to-access-profile.md): Attaches one or more roles. Setting `is_default: true` makes the profile the role's default for new users. `apply_to_existing: true` provisions the profile to users already in the role. - [Detach role from access profile](https://docs.getbifrost.ai/api-reference/access-profiles/detach-role-from-access-profile.md) - [List version snapshots for an access profile](https://docs.getbifrost.ai/api-reference/access-profiles/list-version-snapshots-for-an-access-profile.md) - [Get a single version snapshot](https://docs.getbifrost.ai/api-reference/access-profiles/get-a-single-version-snapshot.md) - [List audit log entries for a single profile](https://docs.getbifrost.ai/api-reference/access-profiles/list-audit-log-entries-for-a-single-profile.md) - [List workspace-wide audit log entries](https://docs.getbifrost.ai/api-reference/access-profiles/list-workspace-wide-audit-log-entries.md) - [List access profiles held by a user](https://docs.getbifrost.ai/api-reference/access-profiles/list-access-profiles-held-by-a-user.md) - [Detach a user's access profile](https://docs.getbifrost.ai/api-reference/access-profiles/detach-a-users-access-profile.md): Removes the profile from the user and deletes every virtual key it produced. Fails closed if a virtual key cannot be deleted. - [Set a user's access-profile budget override](https://docs.getbifrost.ai/api-reference/access-profiles/set-a-users-access-profile-budget-override.md): Sets or replaces the spending override on one budget of a single user's copy of an access profile. The override is additive — while it is active the budget is enforced against `max_limit + override_amount` — and it leaves the budget's base limit, current usage, and reset schedule untouched. Only thi… - [Remove a user's access-profile budget override](https://docs.getbifrost.ai/api-reference/access-profiles/remove-a-users-access-profile-budget-override.md): Removes any active override from the user's budget, so it is enforced against its base `max_limit` again. The budget's current usage and reset schedule are unchanged, and the removal is permanent — a cleared grant cannot be re-derived. Safe to call on a budget that has no override. - [Add an extra virtual key under a user's access profile (deprecated) (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/add-an-extra-virtual-key-under-a-users-access-profile-deprecated-deprecated-path.md): Issues an additional virtual key for the user. - [Delete a virtual key from a user's access profile](https://docs.getbifrost.ai/api-reference/access-profiles/delete-a-virtual-key-from-a-users-access-profile.md) #### Projects - [List projects](https://docs.getbifrost.ai/api-reference/projects/list-projects.md): Returns projects visible to the caller: those they created, those with no recorded creator, and those they belong to. Each project's roster is narrowed the same way, so `members` is a subset of the true roster and `pagination.total` counts only what the caller may see. - [Create project](https://docs.getbifrost.ai/api-reference/projects/create-project.md): Creates a project. `access_rule` is required and has no default, since a rule that could be assumed might widen a request. The project starts with no members: add the roster through the member routes. - [Get project](https://docs.getbifrost.ai/api-reference/projects/get-project.md): Returns one project with its caps, its provider and MCP access, and the part of its roster the caller may see. A project outside the caller's data access reads as not found rather than forbidden. - [Update project](https://docs.getbifrost.ai/api-reference/projects/update-project.md): Applies a patch to the stored project. Fields the body omits are left as stored, and child lists are paired with their stored rows by `id`, so a cap keeps its accumulated spend and its window across an edit while a child the body stops naming is deleted. - [Delete project](https://docs.getbifrost.ai/api-reference/projects/delete-project.md): Deletes the project with its providers, its caps, the spend recorded against them, and its roster. A roster is not a reason to refuse, so there is no force flag. Log rows keep the attribution they already carry. - [List project members](https://docs.getbifrost.ai/api-reference/projects/list-project-members.md): Returns the roster with each member's caps, narrowed to what the caller's data access permits. There is no pagination on this route. - [Add project members](https://docs.getbifrost.ai/api-reference/projects/add-project-members.md): Adds users to the roster. The call is create-only: a user already on the roster keeps their existing membership and caps. - [Update project member caps](https://docs.getbifrost.ai/api-reference/projects/update-project-member-caps.md): Restates one member's caps in full: a source the body does not name loses its cap, and an empty body clears every cap the member holds. The member's identity is not editable. - [Remove project member](https://docs.getbifrost.ai/api-reference/projects/remove-project-member.md): Removes a member from the roster and deletes the caps derived for them. On a project with `split_policy: equal` this enlarges every remaining member's slice, and the recalculation is queued and reported as `redivision_job_id`. - [List a user's projects](https://docs.getbifrost.ai/api-reference/projects/list-a-users-projects.md): Returns the projects the named user belongs to, intersected with the projects the caller may see, so asking about a user reveals nothing the caller could not already read. An unknown user returns an empty list rather than a not-found error. #### RBAC - [List roles](https://docs.getbifrost.ai/api-reference/rbac/list-roles.md): Returns all roles visible to the caller, scoped by data access control. - [Create role](https://docs.getbifrost.ai/api-reference/rbac/create-role.md): Creates a custom role with the specified data access control scope. If `dac` is omitted, defaults to `all-data`. - [Get role by ID](https://docs.getbifrost.ai/api-reference/rbac/get-role-by-id.md) - [Update role](https://docs.getbifrost.ai/api-reference/rbac/update-role.md): Partial update. Omitted fields preserve the current value. Notable: omitting `dac` preserves the current scope (does not default to `all-data`). - [Delete role](https://docs.getbifrost.ai/api-reference/rbac/delete-role.md): Deletes a custom role. Built-in system roles cannot be deleted and return 403. - [List permissions assigned to a role](https://docs.getbifrost.ai/api-reference/rbac/list-permissions-assigned-to-a-role.md) - [Replace the permission set on a role](https://docs.getbifrost.ai/api-reference/rbac/replace-the-permission-set-on-a-role.md): Replaces the permission set assigned to the role. Send the complete list of permission IDs that should be active for the role. - [List RBAC resources](https://docs.getbifrost.ai/api-reference/rbac/list-rbac-resources.md): Returns the set of resource names that permissions can target. - [List RBAC operations](https://docs.getbifrost.ai/api-reference/rbac/list-rbac-operations.md): Returns the set of operation names that permissions can grant. - [List all RBAC permissions](https://docs.getbifrost.ai/api-reference/rbac/list-all-rbac-permissions.md): Returns every (resource, operation) pair that can be granted to a role. #### Audit Logs - [List audit logs](https://docs.getbifrost.ai/api-reference/audit-logs/list-audit-logs.md): Retrieves CADF-compliant audit log events with filtering, search, and pagination via query parameters. Most filter dimensions accept either a single value (singular parameter, e.g. `action`) or a JSON-encoded array of values (plural parameter, e.g. `actions`); when both are supplied the plural array… - [Get audit log filter data](https://docs.getbifrost.ai/api-reference/audit-logs/get-audit-log-filter-data.md): Returns the distinct values available for each audit log filter dimension, used to populate filter dropdowns in the dashboard. - [Export audit logs](https://docs.getbifrost.ai/api-reference/audit-logs/export-audit-logs.md): Streams audit log events matching the supplied filters as a downloadable file. Accepts the same filter query parameters as `GET /api/audit-logs`. The response is returned as an attachment with a generated filename. - [Get audit log by ID](https://docs.getbifrost.ai/api-reference/audit-logs/get-audit-log-by-id.md): Retrieves a single audit log event by its unique ID. - [Verify audit log signature](https://docs.getbifrost.ai/api-reference/audit-logs/verify-audit-log-signature.md): Recomputes the HMAC-SHA256 signature for a single audit log event and compares it (in constant time) against the stored signature to detect tampering. #### Budgets & Rate Limits - [List budgets](https://docs.getbifrost.ai/api-reference/governance/list-budgets.md): Returns a list of all budgets. Use the `from_memory` query parameter to get data from in-memory cache. - [List rate limits](https://docs.getbifrost.ai/api-reference/governance/list-rate-limits.md): Returns a list of all rate limits. Use the `from_memory` query parameter to get data from in-memory cache. #### Model Configs - [List model limits](https://docs.getbifrost.ai/api-reference/governance/list-model-limits.md): Returns a paginated list of model limits with their budget and rate limit settings. - [Create model config](https://docs.getbifrost.ai/api-reference/governance/create-model-config.md): Creates a new model configuration with budget and rate limit settings. - [Get model config](https://docs.getbifrost.ai/api-reference/governance/get-model-config.md): Returns a specific model configuration by ID. - [Update model config](https://docs.getbifrost.ai/api-reference/governance/update-model-config.md): Updates an existing model configuration's budget and rate limit settings. - [Delete model config](https://docs.getbifrost.ai/api-reference/governance/delete-model-config.md): Deletes a model configuration. #### Provider Governance - [List provider governance](https://docs.getbifrost.ai/api-reference/governance/list-provider-governance.md): Returns a list of all providers with their governance settings (budget and rate limits). - [Update provider governance](https://docs.getbifrost.ai/api-reference/governance/update-provider-governance.md): Updates governance settings (budget and rate limits) for a specific provider. - [Delete provider governance](https://docs.getbifrost.ai/api-reference/governance/delete-provider-governance.md): Removes governance settings (budget and rate limits) for a specific provider. #### Pricing Overrides - [List pricing overrides](https://docs.getbifrost.ai/api-reference/governance/list-pricing-overrides.md): Returns all pricing overrides, optionally filtered by scope. - [Create pricing override](https://docs.getbifrost.ai/api-reference/governance/create-pricing-override.md): Creates a new pricing override. The most specific matching scope always wins during cost resolution. - [Update pricing override](https://docs.getbifrost.ai/api-reference/governance/update-pricing-override.md): Updates an existing pricing override. Omitted fields are merged from the existing record. The `patch` field is always replaced in full when provided. - [Delete pricing override](https://docs.getbifrost.ai/api-reference/governance/delete-pricing-override.md): Deletes a pricing override by ID. ### Routing #### Routing Rules - [List routing rules](https://docs.getbifrost.ai/api-reference/routing/list-routing-rules.md): Returns a list of all routing rules configured for intelligent request routing across providers. - [Create routing rule](https://docs.getbifrost.ai/api-reference/routing/create-routing-rule.md): Creates a new CEL-based routing rule for intelligent request routing. Provider and model can be left empty to use the incoming request values. - [Get routing rule](https://docs.getbifrost.ai/api-reference/routing/get-routing-rule.md): Returns a specific routing rule by ID. - [Update routing rule](https://docs.getbifrost.ai/api-reference/routing/update-routing-rule.md): Updates an existing routing rule's configuration. - [Delete routing rule](https://docs.getbifrost.ai/api-reference/routing/delete-routing-rule.md): Deletes a routing rule. #### Complexity Analyzer - [Get complexity analyzer config](https://docs.getbifrost.ai/api-reference/routing/get-complexity-analyzer-config.md): Returns the full complexity analyzer runtime config, including the semantic embedding configuration, the llm fallback classifier configuration, and per-tier reference phrase lists. Returns built-in defaults if none have been configured. - [Update complexity analyzer config](https://docs.getbifrost.ai/api-reference/routing/update-complexity-analyzer-config.md): Replaces the full complexity analyzer runtime config and hot-reloads the routing plugin. Changing the embedding configuration or reference phrases triggers a background re-warm of the classifier; unchanged phrases are not re-embedded. Setting semantic.fallback to llm requires the llm block to be pre… - [Reset complexity analyzer config](https://docs.getbifrost.ai/api-reference/routing/reset-complexity-analyzer-config.md): Restores the built-in reference phrase lists and hot-reloads the routing plugin. The saved embedding provider, model, storage configuration, and llm fallback configuration are preserved. - [Get complexity classifier status](https://docs.getbifrost.ai/api-reference/routing/get-complexity-classifier-status.md): Returns the runtime status of the semantic complexity classifier (disabled, warming, ready, or failed), including warmup progress and whether a previous generation is still serving. When the llm fallback block is configured, also returns its readiness and the shipped default classification prompt. - [Retry failed complexity classifier warmup](https://docs.getbifrost.ai/api-reference/routing/retry-failed-complexity-classifier-warmup.md): Restarts the saved semantic classifier warmup only when its current state is failed. The retry runs asynchronously and does not change the saved configuration. ### Deprecated #### Virtual Keys - [List users attached to a virtual key (deprecated path)](https://docs.getbifrost.ai/api-reference/virtual-keys/list-users-attached-to-a-virtual-key-deprecated-path.md) - [Attach users to a virtual key (deprecated path)](https://docs.getbifrost.ai/api-reference/virtual-keys/attach-users-to-a-virtual-key-deprecated-path.md) - [Detach a user from a virtual key (deprecated path)](https://docs.getbifrost.ai/api-reference/virtual-keys/detach-a-user-from-a-virtual-key-deprecated-path.md) #### Teams - [List customers attached to a team (deprecated path)](https://docs.getbifrost.ai/api-reference/teams/list-customers-attached-to-a-team-deprecated-path.md) - [Attach a customer to a team (deprecated path)](https://docs.getbifrost.ai/api-reference/teams/attach-a-customer-to-a-team-deprecated-path.md) - [Detach a customer from a team (deprecated path)](https://docs.getbifrost.ai/api-reference/teams/detach-a-customer-from-a-team-deprecated-path.md) - [List team members (deprecated path)](https://docs.getbifrost.ai/api-reference/teams/list-team-members-deprecated-path.md): Returns all members of a team with their user details and membership source. - [Add team member (deprecated path)](https://docs.getbifrost.ai/api-reference/teams/add-team-member-deprecated-path.md): Adds a user to a team. Both the team and user must exist. - [Remove team member (deprecated path)](https://docs.getbifrost.ai/api-reference/teams/remove-team-member-deprecated-path.md): Removes a user from a team. #### Customers - [List teams attached to a customer (deprecated path)](https://docs.getbifrost.ai/api-reference/customers/list-teams-attached-to-a-customer-deprecated-path.md) #### RBAC - [List roles (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/list-roles-deprecated-path.md): Returns all roles visible to the caller, scoped by data access control. - [Create role (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/create-role-deprecated-path.md): Creates a custom role with the specified data access control scope. If `dac` is omitted, defaults to `all-data`. - [Get role by ID (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/get-role-by-id-deprecated-path.md) - [Update role (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/update-role-deprecated-path.md): Partial update. Omitted fields preserve the current value. Notable: omitting `dac` preserves the current scope (does not default to `all-data`). - [Delete role (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/delete-role-deprecated-path.md): Deletes a custom role. Built-in system roles cannot be deleted and return 403. - [List permissions assigned to a role (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/list-permissions-assigned-to-a-role-deprecated-path.md) - [Replace the permission set on a role (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/replace-the-permission-set-on-a-role-deprecated-path.md): Replaces the permission set assigned to the role. Send the complete list of permission IDs that should be active for the role. - [List RBAC resources (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/list-rbac-resources-deprecated-path.md): Returns the set of resource names that permissions can target. - [List RBAC operations (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/list-rbac-operations-deprecated-path.md): Returns the set of operation names that permissions can grant. - [List all RBAC permissions (deprecated path)](https://docs.getbifrost.ai/api-reference/rbac/list-all-rbac-permissions-deprecated-path.md): Returns every (resource, operation) pair that can be granted to a role. #### Users - [List users (deprecated path)](https://docs.getbifrost.ai/api-reference/users/list-users-deprecated-path.md): Returns a paginated list of users with optional search. - [Create user (deprecated path)](https://docs.getbifrost.ai/api-reference/users/create-user-deprecated-path.md): Manually creates a new user in the organization. - [Get user (deprecated path)](https://docs.getbifrost.ai/api-reference/users/get-user-deprecated-path.md): Returns a single Enterprise user. - [Delete user (deprecated path)](https://docs.getbifrost.ai/api-reference/users/delete-user-deprecated-path.md): Permanently removes a user from the organization. This cascades to delete the user's governance settings (budget/rate limits), team memberships, access profiles, and OIDC sessions. Cannot delete yourself. - [Get current user permissions (deprecated path)](https://docs.getbifrost.ai/api-reference/users/get-current-user-permissions-deprecated-path.md): Returns the RBAC permissions for the authenticated user. When SCIM is not enabled, returns full permissions for all resources. Otherwise returns the permissions associated with the user's assigned role. - [Assign role to user (deprecated path)](https://docs.getbifrost.ai/api-reference/users/assign-role-to-user-deprecated-path.md): Assigns an RBAC role to a user. This also auto-assigns the default access profile for the new role and reloads the RBAC permission cache. - [Get user's teams (deprecated path)](https://docs.getbifrost.ai/api-reference/users/get-users-teams-deprecated-path.md): Returns the list of teams a user belongs to, including the membership source. - [Update user's team assignments (deprecated path)](https://docs.getbifrost.ai/api-reference/users/update-users-team-assignments-deprecated-path.md): Replaces the user's manual team assignments. Synced team memberships (from SCIM providers) are preserved and cannot be removed via this endpoint. - [Get user's virtual keys by email (deprecated path)](https://docs.getbifrost.ai/api-reference/users/get-users-virtual-keys-by-email-deprecated-path.md): **Enterprise only.** Returns all virtual keys associated with a user, looked up by email address. Returns an empty `virtual_keys` array when the user exists but has no virtual keys assigned. Intended for MDM and credential-helper integrations that need to resolve a user's keys without knowing their… - [Get user by email (deprecated path)](https://docs.getbifrost.ai/api-reference/users/get-user-by-email-deprecated-path.md): Returns a single Enterprise user resolved by URL-encoded email address. - [List virtual keys available to a user (deprecated path)](https://docs.getbifrost.ai/api-reference/users/list-virtual-keys-available-to-a-user-deprecated-path.md): Returns every virtual key assigned to the user, independent of access profiles, so directly-assigned standalone keys are visible alongside profile-issued ones. #### Governance - [List teams (deprecated path)](https://docs.getbifrost.ai/api-reference/governance/list-teams-deprecated-path.md): Returns a list of all teams. - [Create team (deprecated path)](https://docs.getbifrost.ai/api-reference/governance/create-team-deprecated-path.md): Creates a new team. - [Get team (deprecated path)](https://docs.getbifrost.ai/api-reference/governance/get-team-deprecated-path.md): Returns a specific team by ID. - [Update team (deprecated path)](https://docs.getbifrost.ai/api-reference/governance/update-team-deprecated-path.md): Updates an existing team. - [Delete team (deprecated path)](https://docs.getbifrost.ai/api-reference/governance/delete-team-deprecated-path.md): Deletes a team. #### Access Profiles - [List access profiles (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/list-access-profiles-deprecated-path.md): Returns access profiles visible to the caller. - [Create access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/create-access-profile-deprecated-path.md): Creates a new access profile template. The profile is inactive until attached to a role. No size limits are enforced on create; the limits apply on update. - [Get access profile by ID (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/get-access-profile-by-id-deprecated-path.md): Returns the profile plus its role attachments and the count of users holding a copy. - [Update access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/update-access-profile-deprecated-path.md): Partial update. Omitted fields preserve the current value. `rate_limit: null` explicitly clears the existing rate limit. Size limits enforced: max 100 provider_configs, max 100 budgets, max 50 tags. - [Delete access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/delete-access-profile-deprecated-path.md): Blocked with 409 if any users still hold copies. Detach role attachments or remove user assignments first. - [Activate access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/activate-access-profile-deprecated-path.md): Sets the profile active. Idempotent. - [Deactivate access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/deactivate-access-profile-deprecated-path.md): Sets the profile inactive. Idempotent. User copies are preserved; the profile is hidden from selection menus. - [Clone an access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/clone-an-access-profile-deprecated-path.md): Creates a fresh copy of the profile under a new name. The clone has no role attachments or user copies. - [Propagate template changes to user copies (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/propagate-template-changes-to-user-copies-deprecated-path.md): Pushes selected fields from the template to every user that holds a copy. Use `dry_run: true` to preview the impact. By default, accumulated usage is preserved. - [Attach roles to access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/attach-roles-to-access-profile-deprecated-path.md): Attaches one or more roles. Setting `is_default: true` makes the profile the role's default for new users. `apply_to_existing: true` provisions the profile to users already in the role. - [Detach role from access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/detach-role-from-access-profile-deprecated-path.md) - [List version snapshots for an access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/list-version-snapshots-for-an-access-profile-deprecated-path.md) - [Get a single version snapshot (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/get-a-single-version-snapshot-deprecated-path.md) - [List audit log entries for a single profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/list-audit-log-entries-for-a-single-profile-deprecated-path.md) - [List workspace-wide audit log entries (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/list-workspace-wide-audit-log-entries-deprecated-path.md) - [List access profiles held by a user (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/list-access-profiles-held-by-a-user-deprecated-path.md) - [Set a user's access-profile budget override (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/set-a-users-access-profile-budget-override-deprecated-path.md): Sets or replaces the spending override on one budget of a single user's copy of an access profile. The override is additive — while it is active the budget is enforced against `max_limit + override_amount` — and it leaves the budget's base limit, current usage, and reset schedule untouched. Only thi… - [Remove a user's access-profile budget override (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/remove-a-users-access-profile-budget-override-deprecated-path.md): Removes any active override from the user's budget, so it is enforced against its base `max_limit` again. The budget's current usage and reset schedule are unchanged, and the removal is permanent — a cleared grant cannot be re-derived. Safe to call on a budget that has no override. - [Detach a user's access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/detach-a-users-access-profile-deprecated-path.md): Removes the profile from the user and deletes every virtual key it produced. Fails closed if a virtual key cannot be deleted. - [Add an extra virtual key under a user's access profile (deprecated) (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/add-an-extra-virtual-key-under-a-users-access-profile-deprecated-deprecated-path.md): Issues an additional virtual key for the user. - [Delete a virtual key from a user's access profile (deprecated path)](https://docs.getbifrost.ai/api-reference/access-profiles/delete-a-virtual-key-from-a-users-access-profile-deprecated-path.md) #### Audit Logs - [List audit logs (deprecated path)](https://docs.getbifrost.ai/api-reference/audit-logs/list-audit-logs-deprecated-path.md): Retrieves CADF-compliant audit log events with filtering, search, and pagination via query parameters. Most filter dimensions accept either a single value (singular parameter, e.g. `action`) or a JSON-encoded array of values (plural parameter, e.g. `actions`); when both are supplied the plural array… - [Get audit log filter data (deprecated path)](https://docs.getbifrost.ai/api-reference/audit-logs/get-audit-log-filter-data-deprecated-path.md): Returns the distinct values available for each audit log filter dimension, used to populate filter dropdowns in the dashboard. - [Export audit logs (deprecated path)](https://docs.getbifrost.ai/api-reference/audit-logs/export-audit-logs-deprecated-path.md): Streams audit log events matching the supplied filters as a downloadable file. Accepts the same filter query parameters as `GET /api/audit-logs`. The response is returned as an attachment with a generated filename. - [Get audit log by ID (deprecated path)](https://docs.getbifrost.ai/api-reference/audit-logs/get-audit-log-by-id-deprecated-path.md): Retrieves a single audit log event by its unique ID. - [Verify audit log signature (deprecated path)](https://docs.getbifrost.ai/api-reference/audit-logs/verify-audit-log-signature-deprecated-path.md): Recomputes the HMAC-SHA256 signature for a single audit log event and compares it (in constant time) against the stored signature to detect tampering. ## OpenAPI Specs - [openapi](/openapi/openapi.json)