<!-- source: https://modelux.ai/docs/api/management-providers -->

> Add, rotate, and monitor provider credentials.

# Providers API

Provider credentials are the upstream API keys Modelux uses to proxy your
requests. Stored encrypted; Modelux never logs plaintext keys.

## List providers

```
GET /manage/v1/providers
```

Returns all provider credentials for the organization.

**Response**

```json
{
  "data": [
    {
      "id": "prov_01HXY...",
      "vendor": "openai",
      "name": "OpenAI Production",
      "base_url": null,
      "status": "active",
      "health": {
        "state": "healthy",
        "p50_latency_ms": 320,
        "last_check_at": "2026-04-14T12:00:00Z"
      },
      "created_at": "2026-04-01T10:00:00Z"
    }
  ]
}
```

## Add a provider

```
POST /manage/v1/providers
```

**Request body**

```json
{
  "vendor": "openai",
  "name": "OpenAI Production",
  "api_key": "sk-...",
  "base_url": null
}
```

Valid vendors: `openai`, `anthropic`, `google`, `azure`, `bedrock`, `groq`, `fireworks`.

For Azure OpenAI, set `base_url` to your resource endpoint. For Bedrock, pass
IAM credentials instead of an API key (see the Bedrock section below).

## Get a provider

```
GET /manage/v1/providers/{provider_id}
```

## Update a provider (rotate key)

```
PATCH /manage/v1/providers/{provider_id}
```

**Request body**

```json
{
  "api_key": "sk-new..."
}
```

Modelux verifies the new key before swapping it atomically. In-flight
requests finish with the old key.

## Delete a provider

```
DELETE /manage/v1/providers/{provider_id}
```

Fails if any routing config still references this provider directly. Detach
first, then delete.

## Health

```
GET /manage/v1/providers/{provider_id}/health
```

Returns latency percentiles and success rate over rolling windows.

## Bedrock credentials

For AWS Bedrock, send IAM credentials as the `api_key` field:

```json
{
  "vendor": "bedrock",
  "name": "Bedrock US-West",
  "api_key": "AKIA...::wJalrXUtnFEMI...::us-west-2",
  "base_url": null
}
```

Format: `ACCESS_KEY_ID::SECRET_ACCESS_KEY::REGION`. Optional `::SESSION_TOKEN`
suffix for STS temporary credentials.

## MCP tools

| Tool | Maps to |
|---|---|
| `list_providers` | `GET /manage/v1/providers` |
| `get_provider` | `GET /manage/v1/providers/{id}` |
| `add_provider` | `POST /manage/v1/providers` |
| `update_provider` | `PATCH /manage/v1/providers/{id}` |
| `delete_provider` | `DELETE /manage/v1/providers/{id}` |
| `get_provider_health` | `GET /manage/v1/providers/{id}/health` |

## See also

- [Providers (concept)](/docs/concepts/providers)