> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt > Use this file to discover all available pages before exploring further. # Update configuration > Updates the Bifrost configuration. Supports hot-reloading of certain settings like drop_excess_requests. Some settings may require a restart to take effect. Creating the very first admin account requires auth_config.setup_token. When an admin account already exists but dashboard authentication is disabled, a request that re-enables it or changes admin_username / admin_password must carry either auth_config.current_password (the stored admin password) or a valid auth_config.setup_token; otherwise it is refused with 403. A genuinely authenticated session needs neither. Changing client_config.mcp_oauth_private_allowlist also requires an authenticated admin session and is refused with 403 while dashboard authentication is off. **Required Permissions** | Permission | Granted via | | - | - | | `Settings:Update` | RBAC role or API key scope | [How permissions work](/api/procuring-api-keys#required-permissions) ## OpenAPI ````yaml /openapi/openapi.json put /api/config openapi: 3.1.0 info: title: Bifrost API description: > Bifrost HTTP Transport API for AI model inference and gateway management. This API provides a unified interface for interacting with multiple AI providers including OpenAI, Anthropic, Bedrock, Gemini, and more through a single API, along with comprehensive management APIs for configuring and monitoring the gateway. ## API Structure ### Unified Inference API (`/v1/*`) The primary API using Bifrost's unified format. Model parameters use the format `provider/model` (e.g., `openai/gpt-4`, `anthropic/claude-3-opus`). ### Async Inference API (`/v1/async/*`) Submit inference requests for asynchronous execution. Returns a job ID immediately and allows polling for results. Supports all inference types except batches, files, and containers. ### Provider Integration APIs Native provider-format APIs for drop-in compatibility: - `/openai/*` - OpenAI-compatible API - `/anthropic/*` - Anthropic-compatible API - `/genai/*` - Google GenAI (Gemini) compatible API - `/bedrock/*` - AWS Bedrock compatible API - `/cohere/*` - Cohere compatible API ### Framework Integration APIs Multi-provider proxy endpoints for AI frameworks: - `/litellm/*` - LiteLLM proxy with all provider formats - `/langchain/*` - LangChain compatible endpoints - `/pydanticai/*` - PydanticAI compatible endpoints ### Management APIs (`/api/*`) APIs for managing and monitoring the Bifrost gateway: - `/api/config` - Configuration management - `/api/providers` - Provider and API key management - `/api/plugins` - Plugin management - `/api/governance/*` - Virtual keys, teams, customers, budgets, rate limits, routing rules, and pricing overrides - `/api/logs` - Log search and analytics - `/api/mcp/*` - MCP (Model Context Protocol) client management - `/api/session/*` - Authentication and session management - `/api/cache/*` - Cache management - `/health` - Health check endpoint ## Fallbacks Requests can include fallback models that will be tried if the primary model fails. version: 1.0.0 contact: name: Contact Us url: https://getmaxim.ai/bifrost license: name: Apache 2.0 url: https://opensource.org/licenses/Apache-2.0 servers: - url: '{baseUrl}' description: Your Bifrost instance variables: baseUrl: default: http://localhost:8080 description: Base URL of your Bifrost instance (e.g. https://bifrost.mycompany.com) security: - BearerAuth: [] - BasicAuth: [] - ApiKeyAuth: [] tags: - name: Agent Gateway description: >- Agent registrations, A2A protocol calls, push callbacks, and operation history - name: Models description: Model listing and information - name: Chat Completions description: Chat-based text generation - name: Text Completions description: Text completion generation - name: Responses description: OpenAI Responses API compatible endpoints - name: OCR description: Optical character recognition for documents and images - name: Rerank description: Document reranking by relevance to a query - name: Decisions description: Structured decisions evaluated against annotated function-tool definitions - name: Embeddings description: Text embedding generation - name: Images description: Image generations, editing, and variations - name: Videos description: Video generation and management - name: Audio description: Speech synthesis and transcription - name: Count Tokens description: Token counting utilities - name: Batch description: Batch processing operations - name: Files description: File management operations - name: Containers description: Container management operations - name: Async Jobs description: Asynchronous job submission and retrieval endpoints - name: Realtime description: Realtime WebSocket and WebRTC endpoints - name: OpenAI Integration description: OpenAI-compatible API endpoints (/openai/*) - name: Azure Integration description: Azure OpenAI integration endpoints - name: Anthropic Integration description: Anthropic-compatible API endpoints (/anthropic/*) - name: GenAI Integration description: Google GenAI (Gemini) compatible API endpoints (/genai/*) - name: Bedrock Integration description: AWS Bedrock compatible API endpoints (/bedrock/*) - name: Cohere Integration description: Cohere compatible API endpoints (/cohere/*) - name: Typesafe Integration description: Typesafe compatible API endpoints (/typesafe/*) - name: LiteLLM Integration description: LiteLLM proxy endpoints with multi-provider support (/litellm/*) - name: LangChain Integration description: LangChain compatible endpoints with multi-provider support (/langchain/*) - name: PydanticAI Integration description: >- PydanticAI compatible endpoints with multi-provider support (/pydanticai/*) - name: Health description: Health check endpoints - name: Configuration description: Configuration management endpoints - name: Session description: Session and authentication endpoints - name: Providers description: Provider management endpoints - name: Plugins description: Plugin management endpoints - name: MCP description: Model Context Protocol endpoints - name: Governance description: Virtual keys, teams, and customers management - name: Routing description: Routing rules and complexity analyzer configuration - name: Logging description: Log search and management endpoints - name: Cache description: Cache management endpoints - name: Vault description: Vault secret management endpoints - name: Skills description: Skills Repository management, marketplace, and download endpoints - name: Audit Logs description: >- CADF-compliant audit log search, export, and signature verification endpoints - name: Webhooks description: Webhook endpoint management and signed async-job delivery history - name: Notifications description: >- Role-targeted dashboard notifications, delivered over the dashboard WebSocket - name: News Feeds description: >- RSS and Atom news sources shown in the News tab of the dashboard notification tray - name: Background Jobs description: >- Status, progress and cancellation of durable background jobs (cost recalculation, Warp log indexing, and others) - name: Warp description: >- Configuration for Warp, the dashboard agent that answers questions about the deployment's own telemetry paths: /api/config: put: tags: - Configuration summary: Update configuration description: > Updates the Bifrost configuration. Supports hot-reloading of certain settings like drop_excess_requests. Some settings may require a restart to take effect. Creating the very first admin account requires auth_config.setup_token. When an admin account already exists but dashboard authentication is disabled, a request that re-enables it or changes admin_username / admin_password must carry either auth_config.current_password (the stored admin password) or a valid auth_config.setup_token; otherwise it is refused with 403. A genuinely authenticated session needs neither. Changing client_config.mcp_oauth_private_allowlist also requires an authenticated admin session and is refused with 403 while dashboard authentication is off. operationId: updateConfig requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/UpdateConfigRequest' responses: '200': description: Configuration updated successfully content: application/json: schema: $ref: '#/components/schemas/SuccessResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BifrostError' '403': description: >- auth_config was changed without the required proof: the first admin account needs a valid setup_token, and re-enabling authentication or changing the admin credentials while dashboard authentication is disabled needs current_password or a valid setup_token; or client_config.mcp_oauth_private_allowlist was changed without an authenticated admin session '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/BifrostError' security: - ManagementBearerAuth: [] - BasicAuth: [] components: schemas: UpdateConfigRequest: type: object description: Update configuration request properties: client_config: type: object description: Client configuration properties: drop_excess_requests: type: boolean description: Whether to drop excess requests when rate limited prometheus_labels: type: array items: type: string description: Custom Prometheus labels allowed_origins: type: array items: type: string description: Allowed CORS origins initial_pool_size: type: integer description: Initial connection pool size enable_logging: type: boolean description: Whether logging is enabled disable_content_logging: type: boolean description: Whether content logging is disabled allow_per_request_content_storage_override: type: boolean default: false description: >- Allow individual requests to override content storage via the x-bf-disable-content-logging header or context key. When false (default), per-request overrides are ignored. allow_per_request_raw_override: type: boolean default: false description: >- Allow individual requests to override raw request/response visibility via the x-bf-send-back-raw-request and x-bf-send-back-raw-response headers. When false (default), provider-level settings are authoritative and per-request overrides are ignored. enforce_auth_on_inference: type: boolean description: >- Whether to enforce virtual key authentication on inference requests extra_fields_placement: type: string enum: - body - headers default: body description: >- Where inference responses carry Bifrost's extra_fields metadata. 'body' (default) keeps the extra_fields object in the JSON body. 'headers' removes extra_fields from the body (and from every streaming chunk) and sends its scalar fields as x-bifrost-* response headers. In 'headers' mode the large and nested fields are dropped and not sent anywhere: raw_request, raw_response, routing_metadata, guardrail_debug, parse_errors, and on errors key_statuses, billed_usage and mcp_auth_required. Streaming responses only carry the fields known before the first chunk (routing identity, fallback index, cache lookup); per-chunk latency, chunk_index and final totals are dropped. vk_rotation_cooldown: type: - string - integer minimum: 0 maximum: 2592000000000000 default: 0 description: >- Cooldown after virtual key rotation - grace period during which the previous key value still authenticates. Writes accept a Go duration string (e.g. "5m", "1h"); integer values and API responses are nanoseconds (Go duration encoding). 0 or an empty string disables the grace period, revoking the previous value immediately on the next rotation. Maximum 30 days. enforce_governance_header: type: boolean deprecated: true description: 'Deprecated: use enforce_auth_on_inference instead' max_request_body_size_mb: type: integer description: Maximum request body size in MB compat: type: object description: Compat plugin configuration properties: convert_text_to_chat: type: boolean description: Convert text completion requests to chat convert_chat_to_responses: type: boolean description: Convert chat completion requests to responses should_drop_params: type: boolean description: Drop unsupported parameters based on model catalog should_convert_params: type: boolean default: false description: >- Converts model parameter values that are not supported by the model azure_deepseek: type: boolean default: false description: >- Convert Azure DeepSeek responses requests to chat completions so reasoning is preserved for coding harnesses force_reasoning_only_models_to_responses: type: boolean default: true description: >- Convert chat completion requests to responses for models whose datasheet sets supports_reasoning_with_tool_calls to false, so reasoning is kept instead of being forced off convert_decision_to_responses: type: boolean default: false description: >- Emulate decision requests through the model's Responses API (a forced function tool) when the provider does not serve the model on a native decisions endpoint. Off by default: without it, such requests fail with unsupported_operation additionalProperties: false log_retention_days: type: integer description: Number of days to retain logs delete_expired_virtual_keys: type: boolean default: false description: >- Delete expired virtual keys automatically. A daily cleanup job removes every key whose expiry has passed unless the key sets delete_after_expire to false; keys with delete_after_expire true are removed regardless. header_filter_config: type: object description: Header filter configuration properties: allowlist: type: array items: type: string denylist: type: array items: type: string mcp_agent_depth: type: integer description: Depth of MCP agent mcp_tool_execution_timeout: type: integer description: Timeout for MCP tool execution in seconds mcp_tool_sync_interval: type: integer minimum: 0 description: > Global tool-list sync interval in minutes for MCP clients. Applies to clients whose per-client tool_sync_interval is 0 or omitted; a per-client positive value overrides it. When 0 or unset, a 10-minute default applies. mcp_code_mode_binding_level: type: string description: Binding level for MCP code mode mcp_max_instructions_per_client: type: integer minimum: 0 default: 0 description: > Byte bound on a single MCP server's forwarded instructions. Longer text is truncated on a rune boundary with a notice. 0 uses the built-in default of 4096. mcp_max_instructions_total: type: integer minimum: 0 default: 0 description: > Byte bound on the whole forwarded aggregate across every MCP server the caller can see. This rides on every MCP-bearing request that carries tools, so raising it raises per-request tokens. 0 uses the built-in default of 16384. mcp_oauth_private_allowlist: type: array items: type: string description: > Hostnames, IP addresses, or CIDR ranges (no scheme or port) that the MCP OAuth chain (discovery, dynamic client registration, token requests) may reach when they resolve to a loopback or private address. Applies only to MCP clients registered by an authenticated admin or declared in config.json. Link-local and cloud metadata addresses are always refused and cannot be listed. Omit to keep the current list; send [] to clear it. Changing it requires an authenticated admin session. a2a_private_allowlist: type: array items: type: string description: > Hosts, IP addresses, or CIDR ranges without a scheme or port that Agent Gateway card discovery, OAuth, and runtime HTTP or gRPC calls may reach when they resolve to private or loopback addresses. Link-local and cloud metadata addresses are always blocked. Applies to agents registered by an authenticated administrator or declared in config.json. Registrations created with dashboard authentication bypassed cannot use private permissions. Omit to keep the current list; send [] to clear it. Changing this setting requires dashboard authentication. mcp_code_mode_limits: type: object description: > Limits applied to each code mode (executeToolCode) execution. Omit the object to keep the current limits; send {} to reset every limit to its default. Any field omitted or set to 0 uses its default. There is no limit on concurrent executions. properties: max_source_bytes: type: integer minimum: 0 description: >- Maximum submitted code size in bytes. 0 uses the default of 65536. max_steps: type: integer minimum: 0 description: >- Maximum interpreter computation steps per execution. 0 uses the default of 1000000. max_memory_bytes: type: integer minimum: 0 description: >- Estimated allocation budget per execution in bytes. 0 uses the default of 67108864. max_log_bytes: type: integer minimum: 0 description: >- Maximum log output per execution in bytes, including newlines. 0 uses the default of 65536. max_tool_calls: type: integer minimum: 0 description: >- Maximum nested MCP tool calls per execution. 0 uses the default of 64. max_value_bytes: type: integer anyOf: - const: 0 - minimum: 1024 description: >- Size budget for each tool payload and converted result in bytes. Must be 0 (default of 1048576) or at least 1024. max_nesting_depth: type: integer minimum: 0 maximum: 1000 description: >- Maximum nesting depth of values crossing the tool boundary. 0 uses the default of 64. required_headers: type: array items: type: string description: >- Headers that must be present on every request. Requests missing any of these headers are rejected with 400. Case-insensitive matching. logging_headers: type: array items: type: string description: >- Headers to capture in log metadata. Values are extracted from incoming requests and stored in the metadata field of log entries. Case-insensitive matching. No restart required. a2a_external_client_url: anyOf: - type: string - type: object properties: value: type: string ref: type: string type: type: string enum: - plain_text - env - vault env_var: type: string from_env: type: boolean additionalProperties: false description: >- Bifrost's public base URL for the Agent Gateway, used in served agent cards and push-notification callback URLs. Required to enable Agent Gateway protocol endpoints. When unset, agent traffic is rejected while management APIs remain available. Supports env var syntax: "env.MY_VAR". skills_external_client_url: anyOf: - type: string - type: object properties: value: type: string ref: type: string type: type: string enum: - plain_text - env - vault env_var: type: string from_env: type: boolean additionalProperties: false description: >- Public base URL for Skills Repository marketplaces. Required to enable Claude Code and Codex marketplace serving; skill management and downloads remain available when unset. Supports env var and vault references. mcp_external_client_url: oneOf: - type: string description: Plain URL or env var reference (e.g. "env.MY_VAR") - type: object properties: value: type: string env_var: type: string from_env: type: boolean additionalProperties: false description: > Public base URL Bifrost uses as the redirect_uri when acting as an OAuth client to upstream MCP servers (Notion, Jira, etc.). Set when Bifrost's callback endpoint is reached via a different URL than its server-side metadata. Supports env var syntax ("env.MY_VAR"). mcp_server_auth_mode: type: string enum: - headers - both - oauth default: headers description: > How /mcp authenticates inbound MCP clients. 'headers' (default): VK/api-key/session headers only, discovery disabled. 'both': accepts header credentials and Bifrost-issued JWTs, discovery enabled. 'oauth': Bifrost JWTs only — disables VK/header MCP access. oauth2_server_config: type: object description: > OAuth2 authorization server settings for /mcp. Only relevant when mcp_server_auth_mode is 'both' or 'oauth'. properties: issuer_url: oneOf: - type: string description: Plain URL or env var reference (e.g. "env.MY_VAR") - type: object properties: value: type: string env_var: type: string from_env: type: boolean additionalProperties: false description: > Stable public URL advertised as the OAuth2 AS issuer in discovery documents and the JWT iss claim. Required whenever mcp_server_auth_mode is 'both' or 'oauth'. A config.json that enables one of those modes without it fails validation at startup; a PUT /api/config that does the same is refused with HTTP 400. The issuer is never derived from the request Host header while OAuth is enabled. Supports env var syntax ("env.MY_VAR"). auth_code_ttl: type: integer minimum: 1 maximum: 900 default: 300 description: >- Lifetime of the single-use authorization code in seconds (default 300, max 900 = 15 minutes). access_token_ttl: type: integer minimum: 1 default: 600 description: >- Lifetime of the issued JWT Bearer token in seconds (default 600). allowed_redirect_uris: type: array items: type: string format: uri description: >- Exact administrator-approved remote callback URIs; remote callbacks are denied unless listed. disable_vk_identity: type: boolean default: false description: > Require identity-provider login: virtual-key identity is removed from the consent flow, and existing virtual-key-mode grants are rejected at /mcp and denied on refresh. Only meaningful when mcp_server_auth_mode is 'oauth' and an identity provider is configured. Anonymous session identity is governed separately by enforce_auth_on_inference. additionalProperties: false framework_config: type: object description: Framework configuration properties: id: type: integer description: Unique identifier for the framework config pricing_url: type: string description: URL for pricing data pricing_sync_interval: type: integer format: int64 description: Pricing sync interval in seconds auth_config: allOf: - type: object description: Authentication configuration properties: admin_username: type: string admin_password: type: string description: Password (redacted as in responses) is_enabled: type: boolean disable_auth_on_inference: type: boolean deprecated: true description: >- Deprecated and ignored. Use client_config.enforce_auth_on_inference instead. - type: object properties: setup_token: type: string description: >- Available starting in Bifrost 2.0.0-prerelease3. Bootstrap token, required only when this request creates the very first admin account (i.e. no admin account exists yet). Must match the setup token configured by the operator via setup_token in config.json (or the BIFROST_SETUP_TOKEN environment variable); never persisted or returned by GET /api/config. If the operator hasn't configured a setup token, requests that would create the first admin account are rejected until they do. Once an admin account exists it is also accepted, as an alternative to current_password, when auth_config is changed while dashboard authentication is disabled (see current_password). current_password: type: string description: >- The currently stored admin password. Required (unless a valid setup_token is supplied) when an admin account exists, dashboard authentication is disabled, and this request re-enables it or changes admin_username / admin_password. Such requests reach the API without any credential check, so one of the two proofs must be presented or the request is refused with 403. Ignored when the request is genuinely authenticated or when no admin account exists yet. Never persisted or returned by GET /api/config. example: auth_config: admin_username: admin admin_password: env.BIFROST_ADMIN_PASSWORD is_enabled: true setup_token: SuccessResponse: type: object description: Generic success response properties: status: type: string example: success message: type: string example: Operation completed successfully BifrostError: type: object description: Error response from Bifrost properties: event_id: type: string type: type: string is_bifrost_error: type: boolean status_code: type: integer error: $ref: '#/components/schemas/ErrorField' extra_fields: $ref: '#/components/schemas/BifrostErrorExtraFields' ErrorField: type: object properties: type: type: string code: type: string message: type: string param: type: string event_id: type: string BifrostErrorExtraFields: type: object properties: routing_info: $ref: '#/components/schemas/RoutingInfo' provider: $ref: '#/components/schemas/ModelProvider' deprecated: true description: 'Deprecated: use routing_info.provider.' original_model_requested: type: string deprecated: true description: >- Deprecated: use routing_info.primary_model when routing_info.is_fallback is true, otherwise routing_info.model. For the model the caller asked for, read routing_info.requested_model. resolved_model_used: type: string deprecated: true description: >- Deprecated: use routing_info.resolved_key_alias.model_id when an alias matched, otherwise routing_info.model. request_type: type: string mcp_request_type: type: string a2a_request_type: type: string description: Agent Gateway operation, for A2A errors a2a_agent_name: type: string error_type: type: string description: >- Normalized, low-cardinality classification of why the request failed, declared by whichever component refused it. Prefixed by fault domain (caller_, policy_, provider_, bifrost_). Absent on failures that were not classified at source. retry_after_ms: type: integer format: int64 minimum: 1000 maximum: 300000 description: >- The provider's hint for how long to wait before retrying, in milliseconds, read from its retry-after-ms or Retry-After header or its google.rpc.RetryInfo error detail, and clamped to between 1000 and 300000. Absent when the provider gave no explicit hint. raw_request: description: Raw provider request, when raw request capture is enabled raw_response: description: Raw provider response, when raw response capture is enabled converted_request_type: type: string dropped_compat_plugin_params: type: array items: type: string latency: type: integer format: int64 description: Latency in milliseconds key_statuses: type: array description: >- Per-key results, for requests that ran on every key such as listing models items: type: object properties: key_id: type: string status: type: string enum: - success - list_models_failed provider: $ref: '#/components/schemas/ModelProvider' error: $ref: '#/components/schemas/BifrostError' mcp_auth_required: type: object description: >- Set when a per-user MCP tool needs the caller to complete an inline auth flow properties: kind: type: string mcp_client_id: type: string mcp_client_name: type: string message: type: string authorize_url: type: string session_id: type: string billed_usage: $ref: '#/components/schemas/BifrostLLMUsage' description: >- Usage the provider reported and billed even though the request failed RoutingInfo: type: object description: >- Which provider, model and key handled the attempt that produced this response or error, and what the caller asked for. Also sent as x-bifrost-routing-info-* response headers. properties: provider: $ref: '#/components/schemas/ModelProvider' description: Provider that ran the attempt model: type: string description: Model sent to that provider key: type: string description: Name of the stored key used, never its ID or secret resolved_key_alias: $ref: '#/components/schemas/ResolvedKeyAlias' is_fallback: type: boolean description: >- True when a fallback served the request or returned the error. Omitted when false. primary_provider: $ref: '#/components/schemas/ModelProvider' description: The primary attempt's provider. Set only when a fallback ran. primary_model: type: string description: The primary attempt's model. Set only when a fallback ran. requested_provider: $ref: '#/components/schemas/ModelProvider' description: >- Provider the caller asked for, before routing rules, load balancing or session affinity changed it. Omitted when the caller sent a bare model. requested_model: type: string description: Model the caller asked for, before anything changed it server_side_fallback_model: type: string description: Model that answered when Anthropic switched models inside one call ModelProvider: type: string description: AI model provider identifier enum: - anthropic - azure - bedrock - bedrock_mantle - cerebras - cohere - deepseek - gemini - groq - mistral - ollama - opencode-go - opencode-zen - openai - parasail - perplexity - sgl - vertex - openrouter - elevenlabs - huggingface - nebius - xai - replicate - vllm - runway - runware - fireworks - sarvam - wafer - databricks - cloudflare - typesafe BifrostLLMUsage: type: object description: Token usage information properties: prompt_tokens: type: integer description: > Total input tokens including any prompt-cache tokens (read + write). Subtract prompt_tokens_details.cached_read_tokens and prompt_tokens_details.cached_write_tokens to get the non-cached portion. prompt_tokens_details: $ref: '#/components/schemas/ChatPromptTokensDetails' completion_tokens: type: integer description: Number of output/completion tokens generated. completion_tokens_details: $ref: '#/components/schemas/ChatCompletionTokensDetails' total_tokens: type: integer tool_usage: type: object description: | Counts of provider-hosted (server-side) tool calls billed per call. properties: web_search: type: object properties: num_requests: type: integer description: Number of billable web search calls. cost: $ref: '#/components/schemas/BifrostCost' ResolvedKeyAlias: type: object description: Set only when the requested model matched a model alias on the key required: - model_id properties: model_id: type: string description: Model ID sent to the provider model_name: type: string description: Canonical model name, used for pricing and logs model_family: type: string description: Resolved model family ChatPromptTokensDetails: type: object properties: text_tokens: type: integer audio_tokens: type: integer image_tokens: type: integer cached_read_tokens: type: integer description: > Tokens served from the prompt cache (cache hit). These tokens are already included in prompt_tokens and are billed at the reduced cache-read rate. Populated for all providers that support prompt caching (Anthropic, Bedrock, OpenAI, Gemini, xAI, etc.). cached_write_tokens: type: integer description: > Tokens written to the prompt cache on this request (cache creation / write). These tokens are already included in prompt_tokens and are billed at the cache-creation rate. Populated for providers that separately report cache write tokens (Anthropic, Bedrock). ChatCompletionTokensDetails: type: object properties: text_tokens: type: integer accepted_prediction_tokens: type: integer audio_tokens: type: integer citation_tokens: type: integer num_search_queries: type: integer deprecated: true description: >- Deprecated, use tool_usage.web_search.num_requests. Will be removed in 3.0.0. reasoning_tokens: type: integer image_tokens: type: integer rejected_prediction_tokens: type: integer BifrostCost: type: object description: Cost breakdown for the request properties: input_tokens_cost: type: number output_tokens_cost: type: number reasoning_tokens_cost: type: number description: Cost for reasoning/thinking tokens (reasoning models) citation_tokens_cost: type: number description: Cost for citation tokens search_queries_cost: type: number description: Cost for web search queries request_cost: type: number total_cost: type: number securitySchemes: BearerAuth: type: http scheme: bearer description: > Bearer token authentication. Use your provider API key or Bifrost authentication token. Virtual keys (prefixed with `sk-bf-`) can also be passed here. BasicAuth: type: http scheme: basic description: > Basic authentication using the Bifrost admin username and password (`auth_config.admin_username` / `auth_config.admin_password`). Accepted on management APIs (`/api/*`, `/metrics`, `/ws`) only - the inference middleware never validates Basic credentials. ApiKeyAuth: type: apiKey in: header name: x-api-key description: | API key authentication via the `x-api-key` header. Virtual keys (prefixed with `sk-bf-`) can also be passed here. ManagementBearerAuth: type: http scheme: bearer description: > Management API authentication for `/api/*` endpoints. Use the `Authorization` header with `Bearer `, where `` is one of: - a Bifrost management API key, - a dashboard session token issued by `POST /api/session/login`, - base64 of `:` (legacy equivalent of `BasicAuth`). Virtual keys (`sk-bf-*`) and the `x-api-key` header are not accepted on management APIs - the sole exception is `GET /api/governance/virtual-keys/quota`, which is virtual-key-only. Authentication alone is not sufficient in Bifrost Enterprise: each operation page shows a **Required Permissions** table (`Resource:Operation`, for example `Dashboard:View`) above its Authorizations section, and the caller's RBAC role or management API key scopes must include what it lists, otherwise the request is rejected with `403 Forbidden`. A local admin — authenticated with the admin password, or any caller on a deployment with dashboard auth disabled — bypasses these checks and can call every management endpoint. **OSS setup lock.** On Bifrost OSS, while dashboard auth is not active (no admin account, or auth disabled), every management endpoint except the public ones (`/health`, `/api/version`, `/api/session/is-auth-enabled`, `/api/session/login`, ...) requires the operator's setup token in the `X-Bifrost-Setup-Token` header, in place of `Authorization`. The token is set with `setup_token` in `config.json` or the `BIFROST_SETUP_TOKEN` environment variable. A missing header returns `401`, a wrong token `403`. The header stops working once dashboard auth is enabled. The dashboard instead trades the token once for an HttpOnly `bifrost_setup_session` cookie via `POST /api/session/setup`. See [Required permissions](/api/procuring-api-keys#required-permissions) for how permissions are derived and which endpoints are exempt. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.