PUT
/api/agent-network/providers/{providerId}Update an Agent Network Provider
Update an existing Agent Network AI provider.
When the upstream URL, the API key or the catalog provider changes, the record is checked against the vendor before the change is stored, and a refusal returns 422 without replacing what was there. Switching TLS verification back on is the fourth trigger: a provider exempt from the check was stored unverified, so the edit that ends the exemption is the first opportunity to check it. Where one of the four does fire, an update that omits the API key is checked against the stored one. Edits touching none of them — a rename, model rows, price edits — are stored without a check, as are the cases the create description lists as unverifiable.
providerIdstringrequired
The unique identifier of an Agent Network provider
Provider update request
api_keystringoptional
Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
enabledbooleanoptional
Whether the provider is enabled. Defaults to true on create.
extra_valuesobjectoptional
Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
identity_header_groupsstringoptional
Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
identity_header_user_idstringoptional
Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
metadata_disabledbooleanoptional
Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
modelsarray<object>optional
Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
namestringrequired
Display name for the provider.
provider_idstringrequired
Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
skip_tls_verificationbooleanoptional
Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
upstream_urlstringrequired
Full upstream URL (with scheme) that NetBird forwards traffic to.
200Provider updated
created_atstringrequired
Timestamp when the provider was created.
enabledbooleanrequired
Whether the provider is enabled.
extra_valuesobjectoptional
Operator-typed values for catalog-declared extra headers. Keys are wire header names (e.g. `x-portkey-config`); values are the strings the proxy stamps on every upstream request to this provider. Catalog (AgentNetworkCatalogProvider.extra_headers) declares which keys are accepted; values not declared by the catalog are ignored at synth time. Empty / missing values mean no header stamped.
idstringrequired
Provider ID
identity_header_groupsstringrequired
Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
identity_header_user_idstringrequired
Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
metadata_disabledbooleanrequired
Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
modelsarray<object>required
Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
namestringrequired
Display name shown in the dashboard.
provider_idstringrequired
Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
skip_tls_verificationbooleanrequired
Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
updated_atstringrequired
Timestamp when the provider was last updated.
upstream_urlstringrequired
Full upstream URL (with scheme) that NetBird forwards traffic to.
400Bad Request
401Requires authentication
403Forbidden
404Resource not found
409Conflict
messagestringoptional
A human-readable error message.
422Validation failed
500Internal Server Error
Error handling
A 400 is returned: Bad Request. A 401 is returned: Requires authentication. A 403 is returned: Forbidden. A 404 is returned: Resource not found. A 409 is returned: Conflict. A 422 is returned: Validation failed. A 500 is returned: Internal Server Error.