Skip to main content
PUT
Error
This endpoint is available in Bifrost Enterprise only.
Required Permissions How permissions work

Authorizations

​
Authorization
string
header
required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

  • a Bifrost management API key,
  • a dashboard session token issued by POST /api/session/login,
  • base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Path Parameters

​
project_id
string
required

Body

application/json

Read-then-patch. A field this body omits is left as stored. For description, expires_at, rate_limit, budgets, provider_configs, mcp_configs and virtual_mcps, an explicit null clears what is stored, and for the four list fields that means deleting every stored child. The remaining fields cannot be cleared: null reads the same as omitted. Child lists are matched to their stored rows by id, so restate the ids you read; a stored child the body does not name is deleted. A members field is ignored rather than refused.

​
name
string
​
description
string | null
​
is_active
boolean
​
expires_at
string<date-time> | null
​
access_rule
enum<string>

How the project's own access composes with the access the caller already holds. intersect permits only what both allow, so a project with no provider config permits nothing. union leaves the caller's access untouched and adds to it, so a project with no provider or MCP config only attributes and caps spend.

Available options:
intersect,
union
​
membership_mode
enum<string>
default:explicit

explicit admits only the users on the roster. open admits every authenticated caller and has no membership rows, which is why it cannot divide a budget between members.

Available options:
explicit,
open
​
accounting_mode
enum<string>
default:both

Which ledgers a request's spend lands on. both charges the project and the caller. project_only takes the request off everything the caller funds, including the teams and business units above them. principal_only leaves the project's caps on record but checks and charges none of them. The deployment's own global caps always apply.

Available options:
both,
project_only,
principal_only
​
split_policy
enum<string>
default:none

none keeps the project's caps shared, and individual members can still be capped by hand. equal gives every member an equal slice of every budget and rate limit the project holds, at every tier, as a second cap within it.

Available options:
none,
equal
​
calendar_aligned
boolean
​
allow_all_providers
boolean

When true, grants access to every provider, including ones without a provider_configs entry and providers added later. Listed providers keep their own model, key, budget, and rate-limit rules. Omit to leave unchanged.

​
budgets
object[] | null
​
rate_limit
object | null

A token and request rate limit on a project, on a provider inside it, or on a model under that provider. The two dimensions run independent windows, and a cap is enforced only together with its window.

​
provider_configs
object[] | null
​
mcp_configs
object[] | null
​
virtual_mcps
object[] | null

A Virtual MCP assigned to the project. A scoped request can reach each one at its /mcp/<slug> endpoint. Assignments are a set, so a repeat collapses rather than doubling, and the list is replaced wholesale on update rather than diffed.

​
reset_budget_usage
boolean

Clears recorded spend on the budgets this body restates that the project already held, and on each member's slice of them. A budget the edit introduces has no spend to clear, and one the body does not name is left alone.

Response

Project updated

​
project
object

A per-request access scope and accounting ledger that callers opt into with a header.

​
redivision_job_id
string

Present only when the edit queued a redivision, which happens on a project with split_policy: equal whose roster or divided caps changed. A pending job for the same project is reused rather than queued behind, so this may name a job an earlier request created. Progress is reported on the redivision_progress WebSocket channel under this id.