Skip to main content
GET
Error
Required Permissions How permissions work

Authorizations

Authorization
string
header
required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <token>, where <token> is one of:

  • a Bifrost management API key,
  • a dashboard session token issued by POST /api/session/login,
  • base64 of <admin-username>:<admin-password> (legacy equivalent of BasicAuth).

Virtual keys (sk-bf-*) and the x-api-key header are not accepted on management APIs - the sole exception is GET /api/governance/virtual-keys/quota, which is virtual-key-only.

Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a Required Permissions table (Resource:Operation, for example Dashboard:View) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with 403 Forbidden.

A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint.

OSS setup lock. On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (/health, /api/version, /api/session/is-auth-enabled, /api/session/login, ...) requires the operator's setup token in the X-Bifrost-Setup-Token header, in place of Authorization. The token is set with setup_token in config.json or the BIFROST_SETUP_TOKEN environment variable. A missing header returns 401, a wrong token 403. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly bifrost_setup_session cookie via POST /api/session/setup. See Required permissions for how permissions are derived and which endpoints are exempt.

Path Parameters

name
string
required

Relay name

Response

The relay

A relay as returned by the API - the stored configuration with every secret redacted, plus the path callers use.

name
string
required

Served at /relay/{name}. Immutable once created.

Pattern: ^[A-Za-z0-9._-]{1,64}$
base_url
string<uri>
required

Upstream origin and base path every relayed request is pinned under. http or https, no query, fragment or user info.

url
string
required

The path callers send requests to, /relay/{name}.

description
string
auth
object

How the relay presents its credential to the upstream.

credential
object

The one secret the relay signs in with. value is used by every auth type except aws_sigv4, which reads aws. Omit for auth.type: none. In responses every secret is redacted; an update that sends a redacted placeholder back keeps the stored value.

extra_headers
object

Headers sent on every upstream request. A caller cannot replace them. Credential-bearing headers are redacted in responses.

network
object

Timeouts and connection limits towards the upstream.

proxy_config
object

Outbound proxy for this relay. Omit to inherit the global proxy when it is enabled for inference.

usage
object

How a call is measured and priced. The endpoint-level block is inherited by every route; a route's usage overrides it field by field. Paths are gjson paths into a JSON body (usage.pages, DocumentMetadata.Pages). Cost is cost_per_request + extracted cost + billed units * cost_per_unit.

streaming
object

Which requests are relayed as streams rather than buffered.

routes
object[]
skip_route_check
boolean
default:false

Relay requests that match no routes[] entry instead of refusing them with 404. Such calls use the method default for billing and the endpoint usage mapping.

ignore_upstream_cost
boolean
default:false

Drop values read at cost_path. The operator's fee and unit pricing still apply.