> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Add an extra virtual key under a user's access profile (deprecated) (deprecated path)
> Issues an additional virtual key for the user.
Virtual keys are scoped to the **user**, not to one access profile: what a request may do with
the key is resolved at request time from whichever of the user's active profiles grant it. So
`profile_id` is ignored — the key minted is the same whichever profile is named, and it is not
bound to that profile or removed with it. The user must hold at least one access profile.
This path is deprecated and will be removed in the following major release.
Use `/api/governance/users/{user_id}/virtual-keys` instead.
This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.
**Deprecated.** Use [`POST /api/governance/users/{user_id}/virtual-keys`](/api-reference/governance/mint-an-extra-virtual-key-for-a-user)
instead. This path still works and behaves identically, but will be removed in a future major release.
## OpenAPI
````yaml /openapi/openapi.json post /api/users/{user_id}/access-profiles/{profile_id}/virtual-keys
openapi: 3.1.0
info:
title: Bifrost API
description: >
Bifrost HTTP Transport API for AI model inference and gateway management.
This API provides a unified interface for interacting with multiple AI
providers
including OpenAI, Anthropic, Bedrock, Gemini, and more through a single API,
along with comprehensive management APIs for configuring and monitoring the
gateway.
## API Structure
### Unified Inference API (`/v1/*`)
The primary API using Bifrost's unified format. Model parameters use the
format
`provider/model` (e.g., `openai/gpt-4`, `anthropic/claude-3-opus`).
### Async Inference API (`/v1/async/*`)
Submit inference requests for asynchronous execution. Returns a job ID
immediately
and allows polling for results. Supports all inference types except batches,
files,
and containers.
### Provider Integration APIs
Native provider-format APIs for drop-in compatibility:
- `/openai/*` - OpenAI-compatible API
- `/anthropic/*` - Anthropic-compatible API
- `/genai/*` - Google GenAI (Gemini) compatible API
- `/bedrock/*` - AWS Bedrock compatible API
- `/cohere/*` - Cohere compatible API
### Framework Integration APIs
Multi-provider proxy endpoints for AI frameworks:
- `/litellm/*` - LiteLLM proxy with all provider formats
- `/langchain/*` - LangChain compatible endpoints
- `/pydanticai/*` - PydanticAI compatible endpoints
### Management APIs (`/api/*`)
APIs for managing and monitoring the Bifrost gateway:
- `/api/config` - Configuration management
- `/api/providers` - Provider and API key management
- `/api/plugins` - Plugin management
- `/api/governance/*` - Virtual keys, teams, customers, budgets, rate
limits, routing rules, and pricing overrides
- `/api/logs` - Log search and analytics
- `/api/mcp/*` - MCP (Model Context Protocol) client management
- `/api/session/*` - Authentication and session management
- `/api/cache/*` - Cache management
- `/health` - Health check endpoint
## Fallbacks
Requests can include fallback models that will be tried if the primary model
fails.
version: 1.0.0
contact:
name: Contact Us
url: https://getmaxim.ai/bifrost
license:
name: Apache 2.0
url: https://opensource.org/licenses/Apache-2.0
servers:
- url: '{baseUrl}'
description: Your Bifrost instance
variables:
baseUrl:
default: http://localhost:8080
description: Base URL of your Bifrost instance (e.g. https://bifrost.mycompany.com)
security:
- BearerAuth: []
- BasicAuth: []
- ApiKeyAuth: []
tags:
- name: Models
description: Model listing and information
- name: Chat Completions
description: Chat-based text generation
- name: Text Completions
description: Text completion generation
- name: Responses
description: OpenAI Responses API compatible endpoints
- name: OCR
description: Optical character recognition for documents and images
- name: Rerank
description: Document reranking by relevance to a query
- name: Embeddings
description: Text embedding generation
- name: Images
description: Image generations, editing, and variations
- name: Videos
description: Video generation and management
- name: Audio
description: Speech synthesis and transcription
- name: Count Tokens
description: Token counting utilities
- name: Batch
description: Batch processing operations
- name: Files
description: File management operations
- name: Containers
description: Container management operations
- name: Async Jobs
description: Asynchronous job submission and retrieval endpoints
- name: Realtime
description: Realtime WebSocket and WebRTC endpoints
- name: OpenAI Integration
description: OpenAI-compatible API endpoints (/openai/*)
- name: Azure Integration
description: Azure OpenAI integration endpoints
- name: Anthropic Integration
description: Anthropic-compatible API endpoints (/anthropic/*)
- name: GenAI Integration
description: Google GenAI (Gemini) compatible API endpoints (/genai/*)
- name: Bedrock Integration
description: AWS Bedrock compatible API endpoints (/bedrock/*)
- name: Cohere Integration
description: Cohere compatible API endpoints (/cohere/*)
- name: LiteLLM Integration
description: LiteLLM proxy endpoints with multi-provider support (/litellm/*)
- name: LangChain Integration
description: LangChain compatible endpoints with multi-provider support (/langchain/*)
- name: PydanticAI Integration
description: >-
PydanticAI compatible endpoints with multi-provider support
(/pydanticai/*)
- name: Health
description: Health check endpoints
- name: Configuration
description: Configuration management endpoints
- name: Session
description: Session and authentication endpoints
- name: Providers
description: Provider management endpoints
- name: Plugins
description: Plugin management endpoints
- name: MCP
description: Model Context Protocol endpoints
- name: Governance
description: Virtual keys, teams, and customers management
- name: Routing
description: Routing rules and complexity analyzer configuration
- name: Logging
description: Log search and management endpoints
- name: Cache
description: Cache management endpoints
- name: Vault
description: Vault secret management endpoints
- name: Skills
description: Skills Repository management, marketplace, and download endpoints
- name: Audit Logs
description: >-
CADF-compliant audit log search, export, and signature verification
endpoints
- name: Webhooks
description: Webhook endpoint management and signed async-job delivery history
- name: Notifications
description: >-
Role-targeted dashboard notifications, delivered over the dashboard
WebSocket
paths:
/api/users/{user_id}/access-profiles/{profile_id}/virtual-keys:
post:
tags:
- Access Profiles
summary: >-
Add an extra virtual key under a user's access profile (deprecated)
(deprecated path)
description: >
Issues an additional virtual key for the user.
Virtual keys are scoped to the **user**, not to one access profile: what
a request may do with
the key is resolved at request time from whichever of the user's active
profiles grant it. So
`profile_id` is ignored — the key minted is the same whichever profile
is named, and it is not
bound to that profile or removed with it. The user must hold at least
one access profile.
operationId: addUserAccessProfileVirtualKeyLegacy
parameters:
- name: user_id
in: path
required: true
schema:
type: string
- name: profile_id
in: path
required: true
description: >
Ignored. Kept so the path shape stays valid for existing clients;
keys are user-scoped, so any value produces the same result.
schema:
type: integer
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
name:
type: string
description:
type: string
responses:
'200':
description: Virtual key created.
content:
application/json:
schema:
type: object
properties:
virtual_key:
type: object
properties:
id:
type: string
name:
type: string
value:
type: string
description: >-
The generated virtual key secret. Shown only once on
creation.
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/BifrostError'
'404':
description: User has no access profiles
content:
application/json:
schema:
$ref: '#/components/schemas/ManagementErrorResponse'
'409':
description: A virtual key with this name already exists
'500':
description: Internal server error
content:
application/json:
schema:
$ref: '#/components/schemas/BifrostError'
deprecated: true
security:
- ManagementBearerAuth: []
- BasicAuth: []
components:
schemas:
BifrostError:
type: object
description: Error response from Bifrost
properties:
event_id:
type: string
type:
type: string
is_bifrost_error:
type: boolean
status_code:
type: integer
error:
$ref: '#/components/schemas/ErrorField'
extra_fields:
$ref: '#/components/schemas/BifrostErrorExtraFields'
ManagementErrorResponse:
$ref: '#/components/schemas/BifrostError'
type: object
description: Error response
ErrorField:
type: object
properties:
type:
type: string
code:
type: string
message:
type: string
param:
type: string
event_id:
type: string
BifrostErrorExtraFields:
type: object
properties:
provider:
$ref: '#/components/schemas/ModelProvider'
model_requested:
type: string
request_type:
type: string
ModelProvider:
type: string
description: AI model provider identifier
enum:
- anthropic
- azure
- bedrock
- bedrock_mantle
- cerebras
- cohere
- deepseek
- gemini
- groq
- mistral
- ollama
- opencode-go
- opencode-zen
- openai
- parasail
- perplexity
- sgl
- vertex
- openrouter
- elevenlabs
- huggingface
- nebius
- xai
- replicate
- vllm
- runway
- runware
- fireworks
- sarvam
- wafer
- databricks
securitySchemes:
BearerAuth:
type: http
scheme: bearer
description: >
Bearer token authentication. Use your provider API key or Bifrost
authentication token.
Virtual keys (prefixed with `sk-bf-`) can also be passed here.
BasicAuth:
type: http
scheme: basic
description: >
Basic authentication using the Bifrost admin username and password
(`auth_config.admin_username` / `auth_config.admin_password`).
Accepted on management APIs (`/api/*`, `/metrics`, `/ws`) only - the
inference
middleware never validates Basic credentials.
ApiKeyAuth:
type: apiKey
in: header
name: x-api-key
description: |
API key authentication via the `x-api-key` header.
Virtual keys (prefixed with `sk-bf-`) can also be passed here.
ManagementBearerAuth:
type: http
scheme: bearer
description: >
Management API authentication for `/api/*` endpoints. Use the
`Authorization` header
with `Bearer `, where `` is one of:
- a Bifrost management API key,
- a dashboard session token issued by `POST /api/session/login`,
- base64 of `:` (legacy equivalent of
`BasicAuth`).
Virtual keys (`sk-bf-*`) and the `x-api-key` header are not accepted on
management APIs -
the sole exception is `GET /api/governance/virtual-keys/quota`, which is
virtual-key-only.
````