The active provider's configuration — never the credential.
const url = 'https://example.com/api/v1/llm/config';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://example.com/api/v1/llm/config \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”The stored configuration (or null) and the provider choices
The GET /api/v1/llm/config body.
object
null until a provider has been configured — the normal state of a fresh installation.
object
True once a credential has been stored, so the form can show “set” without revealing it.
Whether this provider sends incident context outside the operator’s own cloud. Computed server-side so the warning the UI shows cannot drift from what the backend actually does.
Every provider the operator may choose, with its placeholders and its egress warning.
What the Settings form needs to render one provider choice.
Served from the backend rather than hardcoded in the WebUI so the egress warning cannot drift
from what the code actually does: [ProviderKind::leaves_operator_boundary] is the single
definition, and the checkbox that warns about it reads the same value the adapter obeys.
object
Whether the credential may be omitted (Vertex on GKE/GCE uses Workload Identity instead).
True when picking this sends hostnames, addresses, topology and syslog outside the operator’s own cloud.
Whether this provider needs a GCP project + region (Vertex) rather than just an API key.
Examplegenerated
{ "config": { "enabled": true, "has_api_key": true, "leaves_operator_boundary": true, "location": "example", "max_output_tokens": 1, "model": "example", "project": "example", "provider": "example", "updated_at": "example" }, "providers": [ { "credential_optional": true, "key": "example", "leaves_operator_boundary": true, "needs_project": true, "suggested_location": "example", "suggested_model": "example" } ]}No valid bearer token
The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI
document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies
undescribed — a client that has to guess the failure shape ends up parsing the success shape and
reading undefined.
object
object
Stable machine-readable code. Clients branch on this, never on the message.
Operator-facing sentence. Safe to display; never carries an internal error’s own text.
Examplegenerated
{ "error": { "code": "example", "message": "example" }}Role lacks the ManageConfig permission
The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI
document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies
undescribed — a client that has to guess the failure shape ends up parsing the success shape and
reading undefined.
object
object
Stable machine-readable code. Clients branch on this, never on the message.
Operator-facing sentence. Safe to display; never carries an internal error’s own text.
Examplegenerated
{ "error": { "code": "example", "message": "example" }}Skeleton mode: no configuration store
The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI
document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies
undescribed — a client that has to guess the failure shape ends up parsing the success shape and
reading undefined.
object
object
Stable machine-readable code. Clients branch on this, never on the message.
Operator-facing sentence. Safe to display; never carries an internal error’s own text.
Examplegenerated
{ "error": { "code": "example", "message": "example" }}