> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt > Use this file to discover all available pages before exploring further. # Rotate virtual key > Generates a new credential value for the virtual key while leaving its configuration, assignments, budgets, and rate limits unchanged. On the node handling the request, the previous credential value is invalidated before a successful response is returned. In a clustered deployment, peer invalidation is asynchronous. Until each peer processes the cluster update and reloads the virtual key, that peer may continue to accept the previous value. There is no fixed upper bound when a peer is unavailable, so wait for cluster convergence before treating the previous credential as revoked cluster-wide. The new credential is returned in `virtual_key.value`. Store it securely and update clients that use the previous value. ## OpenAPI ````yaml /openapi/openapi.json post /api/governance/virtual-keys/{vk_id}/rotate openapi: 3.1.0 info: title: Bifrost API description: > Bifrost HTTP Transport API for AI model inference and gateway management. This API provides a unified interface for interacting with multiple AI providers including OpenAI, Anthropic, Bedrock, Gemini, and more through a single API, along with comprehensive management APIs for configuring and monitoring the gateway. ## API Structure ### Unified Inference API (`/v1/*`) The primary API using Bifrost's unified format. Model parameters use the format `provider/model` (e.g., `openai/gpt-4`, `anthropic/claude-3-opus`). ### Async Inference API (`/v1/async/*`) Submit inference requests for asynchronous execution. Returns a job ID immediately and allows polling for results. Supports all inference types except batches, files, and containers. ### Provider Integration APIs Native provider-format APIs for drop-in compatibility: - `/openai/*` - OpenAI-compatible API - `/anthropic/*` - Anthropic-compatible API - `/genai/*` - Google GenAI (Gemini) compatible API - `/bedrock/*` - AWS Bedrock compatible API - `/cohere/*` - Cohere compatible API ### Framework Integration APIs Multi-provider proxy endpoints for AI frameworks: - `/litellm/*` - LiteLLM proxy with all provider formats - `/langchain/*` - LangChain compatible endpoints - `/pydanticai/*` - PydanticAI compatible endpoints ### Management APIs (`/api/*`) APIs for managing and monitoring the Bifrost gateway: - `/api/config` - Configuration management - `/api/providers` - Provider and API key management - `/api/plugins` - Plugin management - `/api/governance/*` - Virtual keys, teams, customers, budgets, rate limits, routing rules, and pricing overrides - `/api/logs` - Log search and analytics - `/api/mcp/*` - MCP (Model Context Protocol) client management - `/api/session/*` - Authentication and session management - `/api/cache/*` - Cache management - `/health` - Health check endpoint ## Fallbacks Requests can include fallback models that will be tried if the primary model fails. version: 1.0.0 contact: name: Contact Us url: https://getmaxim.ai/bifrost license: name: Apache 2.0 url: https://opensource.org/licenses/Apache-2.0 servers: - url: '{baseUrl}' description: Your Bifrost instance variables: baseUrl: default: http://localhost:8080 description: Base URL of your Bifrost instance (e.g. https://bifrost.mycompany.com) security: - BearerAuth: [] - BasicAuth: [] - ApiKeyAuth: [] tags: - name: Models description: Model listing and information - name: Chat Completions description: Chat-based text generation - name: Text Completions description: Text completion generation - name: Responses description: OpenAI Responses API compatible endpoints - name: OCR description: Optical character recognition for documents and images - name: Rerank description: Document reranking by relevance to a query - name: Embeddings description: Text embedding generation - name: Images description: Image generations, editing, and variations - name: Videos description: Video generation and management - name: Audio description: Speech synthesis and transcription - name: Count Tokens description: Token counting utilities - name: Batch description: Batch processing operations - name: Files description: File management operations - name: Containers description: Container management operations - name: Async Jobs description: Asynchronous job submission and retrieval endpoints - name: Realtime description: Realtime WebSocket and WebRTC endpoints - name: OpenAI Integration description: OpenAI-compatible API endpoints (/openai/*) - name: Azure Integration description: Azure OpenAI integration endpoints - name: Anthropic Integration description: Anthropic-compatible API endpoints (/anthropic/*) - name: GenAI Integration description: Google GenAI (Gemini) compatible API endpoints (/genai/*) - name: Bedrock Integration description: AWS Bedrock compatible API endpoints (/bedrock/*) - name: Cohere Integration description: Cohere compatible API endpoints (/cohere/*) - name: LiteLLM Integration description: LiteLLM proxy endpoints with multi-provider support (/litellm/*) - name: LangChain Integration description: LangChain compatible endpoints with multi-provider support (/langchain/*) - name: PydanticAI Integration description: >- PydanticAI compatible endpoints with multi-provider support (/pydanticai/*) - name: Health description: Health check endpoints - name: Configuration description: Configuration management endpoints - name: Session description: Session and authentication endpoints - name: Providers description: Provider management endpoints - name: Plugins description: Plugin management endpoints - name: MCP description: Model Context Protocol endpoints - name: Governance description: Virtual keys, teams, and customers management - name: Routing description: Routing rules and complexity analyzer configuration - name: Logging description: Log search and management endpoints - name: Cache description: Cache management endpoints - name: Vault description: Vault secret management endpoints - name: Skills description: Skills Repository management, marketplace, and download endpoints - name: Audit Logs description: >- CADF-compliant audit log search, export, and signature verification endpoints - name: Webhooks description: Webhook endpoint management and signed async-job delivery history - name: Notifications description: >- Role-targeted dashboard notifications, delivered over the dashboard WebSocket paths: /api/governance/virtual-keys/{vk_id}/rotate: post: tags: - Governance summary: Rotate virtual key description: > Generates a new credential value for the virtual key while leaving its configuration, assignments, budgets, and rate limits unchanged. On the node handling the request, the previous credential value is invalidated before a successful response is returned. In a clustered deployment, peer invalidation is asynchronous. Until each peer processes the cluster update and reloads the virtual key, that peer may continue to accept the previous value. There is no fixed upper bound when a peer is unavailable, so wait for cluster convergence before treating the previous credential as revoked cluster-wide. The new credential is returned in `virtual_key.value`. Store it securely and update clients that use the previous value. operationId: rotateVirtualKey parameters: - name: vk_id in: path required: true description: Virtual key ID schema: type: string responses: '200': description: Virtual key rotated successfully content: application/json: schema: $ref: '#/components/schemas/VirtualKeyResponse' '404': description: Virtual key not found content: application/json: schema: $ref: '#/components/schemas/BifrostError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/BifrostError' security: - ManagementBearerAuth: [] components: schemas: VirtualKeyResponse: type: object description: Virtual key operation response required: - message - virtual_key properties: message: type: string virtual_key: $ref: '#/components/schemas/VirtualKey' BifrostError: type: object description: Error response from Bifrost properties: event_id: type: string type: type: string is_bifrost_error: type: boolean status_code: type: integer error: $ref: '#/components/schemas/ErrorField' extra_fields: $ref: '#/components/schemas/BifrostErrorExtraFields' VirtualKey: type: object description: Virtual key configuration required: - id - name - value - is_active - provider_configs - mcp_configs - calendar_aligned - config_hash - created_at - updated_at properties: id: type: string name: type: string value: type: string description: type: string is_active: type: boolean expires_at: type: - string - 'null' format: date-time description: >- Expiry timestamp. Requests using this virtual key are rejected once it passes. Null or absent means the key never expires. provider_configs: type: array items: $ref: '#/components/schemas/VirtualKeyProviderConfig' mcp_configs: type: array items: $ref: '#/components/schemas/VirtualKeyMCPConfig' team_id: type: string customer_id: type: string rate_limit_id: type: string calendar_aligned: type: boolean team: $ref: '#/components/schemas/Team' customer: $ref: '#/components/schemas/Customer' budgets: type: array description: Budget quotas assigned directly to this virtual key items: $ref: '#/components/schemas/Budget' rate_limit: $ref: '#/components/schemas/RateLimit' config_hash: type: string created_by_user_id: type: string description: User that created this virtual key, when available created_at: type: string format: date-time updated_at: type: string format: date-time ErrorField: type: object properties: type: type: string code: type: string message: type: string param: type: string event_id: type: string BifrostErrorExtraFields: type: object properties: provider: $ref: '#/components/schemas/ModelProvider' model_requested: type: string request_type: type: string VirtualKeyProviderConfig: type: object description: Provider configuration for a virtual key required: - id - virtual_key_id - provider - weight - allowed_models - blacklisted_models - allow_all_keys - keys properties: id: type: integer virtual_key_id: type: string provider: type: string weight: type: - number - 'null' description: >- Weight for provider load balancing. Null means excluded from weighted routing. allowed_models: type: array items: type: string blacklisted_models: type: array items: type: string allow_all_keys: type: boolean rate_limit_id: type: string budgets: type: array description: Budget quotas assigned to this provider config items: $ref: '#/components/schemas/Budget' rate_limit: $ref: '#/components/schemas/RateLimit' keys: type: - array - 'null' description: > Associated API keys for this provider config. **Always null in the quota endpoint** — keys are intentionally not loaded here to keep the response lean and avoid exposing sensitive credentials. Use the admin virtual-key API to inspect actual key assignments. items: $ref: '#/components/schemas/TableKey' VirtualKeyMCPConfig: type: object description: MCP configuration for a virtual key required: - id - virtual_key_id - mcp_client_id - mcp_client - tools_to_execute properties: id: type: integer virtual_key_id: type: string mcp_client_id: type: integer mcp_client: $ref: '#/components/schemas/MCPClientConfig' tools_to_execute: type: array items: type: string Team: type: object description: Team configuration properties: id: type: string name: type: string customer_id: type: string customer: $ref: '#/components/schemas/Customer' budgets: type: array description: Budgets owned by this team items: $ref: '#/components/schemas/Budget' virtual_keys: type: - array - 'null' description: > Virtual keys assigned to this team. This field may be omitted or returned as null in some responses (for example, when a team is embedded inside a virtual-key response) to avoid nested `virtual_keys` recursion. items: $ref: '#/components/schemas/VirtualKey' profile: type: object additionalProperties: true config: type: object additionalProperties: true claims: type: object additionalProperties: true config_hash: type: - string - 'null' created_at: type: string format: date-time updated_at: type: string format: date-time Customer: type: object description: Customer configuration properties: id: type: string name: type: string budget_id: type: string budget: $ref: '#/components/schemas/Budget' teams: type: array items: $ref: '#/components/schemas/Team' virtual_keys: type: - array - 'null' description: > Virtual keys owned by this customer. Omitted or returned as null by the paginated list endpoint (`GET /api/governance/customers` with `limit`/`offset`/`search`), which reports `virtual_key_count` instead; use the single-customer endpoint to retrieve the keys themselves. items: $ref: '#/components/schemas/VirtualKey' virtual_key_count: type: integer description: Number of virtual keys owned by this customer. Always populated. config_hash: type: string created_at: type: string format: date-time updated_at: type: string format: date-time Budget: type: object description: Budget configuration required: - id - max_limit - reset_duration - last_reset - current_usage - config_hash - created_at - updated_at properties: id: type: string max_limit: type: number description: Maximum budget in dollars reset_duration: type: string description: Reset duration (e.g., "30s", "5m", "1h", "1d", "1w", "1M", "1Q") reset_config: type: object description: > Window settings the reset duration cannot express. Only valid when reset_duration is quarterly (`1Q`); the API rejects it on any other window. properties: quarter_start_month: type: integer minimum: 1 maximum: 12 description: > First month of Q1 as 1-12, so a fiscal year opening in April (4) gives Apr-Jun / Jul-Sep / Oct-Dec / Jan-Mar. Omitted means January. Quarter boundaries repeat every three months, so only the value modulo 3 changes the reset dates: January, April, July and October all reset on calendar quarters and differ only in which quarter is labelled Q1. additionalProperties: false calendar_aligned: type: boolean description: >- When true, resets align to calendar period boundaries in UTC (not rolling from last reset) default: false last_reset: type: string format: date-time current_usage: type: number override_amount: type: number description: >- Additional spend added on top of `max_limit` while the override is active. Omitted when no override is set. override_mode: type: string description: > How long the override stays active. `cycles` keeps it active for a finite number of reset windows; `forever` keeps it active until it is removed. Omitted when no override is set. enum: - cycles - forever override_cycles_remaining: type: integer description: > Reset windows the override is still valid for, including the current one. Positive only for `cycles` mode; recomputed from the original grant on every reset, never decremented in place. override_cycles_total: type: integer description: >- Number of reset windows the current `cycles` override was granted for. Immutable for the life of the grant. override_anchor_reset: type: string format: date-time description: >- Reset-window boundary at which the current `cycles` override was granted. Immutable for the life of the grant. team_id: type: string description: Team that owns this budget, when the budget is team-scoped virtual_key_id: type: string description: >- Virtual key that owns this budget, when the budget is virtual-key-scoped provider_config_id: type: integer description: >- Provider config that owns this budget, when the budget is provider-config-scoped config_hash: type: - string - 'null' created_at: type: string format: date-time updated_at: type: string format: date-time RateLimit: type: object description: Rate limit configuration required: - id - token_current_usage - token_last_reset - request_current_usage - request_last_reset - config_hash - created_at - updated_at properties: id: type: string token_max_limit: type: integer format: int64 token_reset_duration: type: string token_current_usage: type: integer format: int64 token_last_reset: type: string format: date-time request_max_limit: type: - integer - 'null' format: int64 request_reset_duration: type: - string - 'null' request_current_usage: type: integer format: int64 request_last_reset: type: string format: date-time config_hash: type: - string - 'null' created_at: type: string format: date-time updated_at: type: string format: date-time ModelProvider: type: string description: AI model provider identifier enum: - openai - azure - anthropic - bedrock - cohere - vertex - vllm - mistral - ollama - groq - sgl - parasail - perplexity - replicate - cerebras - deepseek - gemini - openrouter - elevenlabs - huggingface - nebius - xai - runway - fireworks TableKey: type: object description: Table key configuration properties: id: type: integer name: type: string provider_id: type: integer provider: type: string key_id: type: string value: type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value models: type: array items: type: string weight: type: - number - 'null' enabled: type: - boolean - 'null' default: true use_for_batch_api: type: - boolean - 'null' default: false created_at: type: string format: date-time updated_at: type: string format: date-time config_hash: type: - string - 'null' azure_endpoint: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' azure_client_id: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' azure_client_secret: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' azure_tenant_id: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' vertex_project_id: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' vertex_project_number: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' vertex_region: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' vertex_auth_credentials: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' bedrock_access_key: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' bedrock_secret_key: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' bedrock_session_token: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' bedrock_region: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' bedrock_arn: oneOf: - type: object description: > A secret-capable value. Serialized as an object with the resolved `value` plus reference metadata; on input, a bare string is also accepted — plain text, `env.VAR_NAME`, or `vault.path/to/secret` (references resolve at runtime and only the reference is persisted). properties: value: type: string description: Resolved value (redacted in GET responses for secret fields) ref: type: string description: >- Source reference (`env.VAR_NAME` or `vault.path`); empty for plain-text values type: type: string enum: - plain_text - env - vault description: Source type of the value - type: 'null' MCPClientConfig: type: object description: Full MCP client configuration (used in responses) properties: client_id: type: string description: Unique identifier for the MCP client name: type: string description: Display name for the MCP client is_code_mode_client: type: boolean description: Whether this client is available in code mode connection_type: type: string enum: - http - stdio - sse - inprocess description: Connection type for MCP client connection_string: type: string description: HTTP or SSE URL (required for HTTP or SSE connections) stdio_config: type: object description: STDIO configuration for MCP client properties: command: type: string description: Executable command to run args: type: array items: type: string description: Command line arguments envs: type: array items: type: string description: Environment variables required tls_config: type: object description: TLS configuration for HTTP and SSE connections. properties: insecure_skip_verify: type: boolean description: Disable TLS certificate verification. Development/testing only. ca_cert_pem: type: string description: > PEM-encoded CA certificate. Supports env.VAR_NAME syntax for input. Responses return a redacted placeholder rather than the raw PEM value. auth_type: type: string enum: - none - headers - oauth - per_user_oauth - per_user_headers - token_exchange description: Authentication type for the MCP connection oauth_config_id: type: string description: | OAuth config ID for OAuth authentication. References the oauth_configs table. Only set when auth_type is "oauth". headers: type: object additionalProperties: type: string description: | Custom headers to include in requests. Only used when auth_type is "headers". tools_to_execute: type: array items: type: string description: | Include-only list for tools. ["*"] => all tools are included [] => no tools are included ["tool1", "tool2"] => include only the specified tools tools_to_auto_execute: type: array items: type: string description: | List of tools that can be auto-executed without user approval. Must be a subset of tools_to_execute. ["*"] => all executable tools can be auto-executed [] => no tools are auto-executed ["tool1", "tool2"] => only specified tools can be auto-executed tool_pricing: type: object additionalProperties: type: number format: double description: | Per-tool cost in USD for execution. Key is the tool name, value is the cost per execution. Example: {"read_file": 0.001, "write_file": 0.002} allow_on_all_virtual_keys: type: boolean default: false description: > When true, this MCP client's tools are accessible to all virtual keys without requiring explicit per-key assignment. All tools are allowed by default. If a virtual key has an explicit MCP config for this client, that config takes precedence and overrides this behaviour. per_user_header_keys: type: array items: type: string description: > For `per_user_headers` clients only. The list of header names each end-user must supply via the inline-401 flow. Header values themselves are stored per-user in a separate table (surfaced on `/api/mcp/sessions`). token_exchange: type: object required: - audience properties: audience: type: string minLength: 1 description: >- Resource identifier this server is scoped to at the identity provider (e.g. "api://jira-mcp") use_idp_credentials: type: boolean description: > When true, performs the exchange as the SSO login application itself instead of client_id/client_secret below, which are then ignored. Some providers require this: Microsoft Entra ID's on-behalf-of grant only accepts an assertion audienced to the exchanging application, and the SSO login flow always requests a token self-audienced to the SSO application, so a separate exchange application can never receive a usable one. client_id: type: string minLength: 1 description: > The identity-provider application authorized to perform exchanges for this audience — typically a dedicated registration carrying the token-exchange (or on-behalf-of) grant, separate from the SSO login application. Required unless use_idp_credentials is true. Supports env.VAR_NAME and vault.path references. Redacted in API responses. client_secret: type: string description: > Secret for the exchange application; omit for public clients. Ignored when use_idp_credentials is true. Supports env.VAR_NAME and vault.path references. Redacted in API responses. scopes: type: array items: type: string description: > Optional scopes to request on the exchanged token. Include "offline_access" (where the identity provider supports it) so the retained admin discovery credential gets a refresh token and stays self-renewing. authorization_server_url: type: string description: > Overrides the Authorization Server the exchange request is sent to. Only needed when the audience is registered on a different Authorization Server than the one used for SSO login (e.g. Okta's per-resource Custom Authorization Servers). Leave unset to use the deployment's SSO login issuer, which is correct for providers with a single tenant-wide token endpoint (Entra, Auth0). allOf: - if: not: properties: use_idp_credentials: const: true required: - use_idp_credentials then: required: - client_id description: > client_id is required unless use_idp_credentials is true, in which case the exchange uses the SSO login application's own credentials instead. additionalProperties: false description: > For `token_exchange` clients only. `client_id` and `client_secret` are redacted in this response. disabled: type: boolean default: false description: > Whether the client is intentionally disabled. When true, the client has no active connection or workers and its tools are not available for inference. securitySchemes: BearerAuth: type: http scheme: bearer description: > Bearer token authentication. Use your provider API key or Bifrost authentication token. Virtual keys (prefixed with `sk-bf-`) can also be passed here. BasicAuth: type: http scheme: basic description: | Basic authentication using username and password. ApiKeyAuth: type: apiKey in: header name: x-api-key description: | API key authentication via the `x-api-key` header. Virtual keys (prefixed with `sk-bf-`) can also be passed here. ManagementBearerAuth: type: http scheme: bearer description: > Management API authentication for `/api/*` endpoints. Use the `Authorization` header with `Bearer `. Virtual keys, dashboard/user/session tokens, and `x-api-key` headers are not supported on management APIs. ````