> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Mint an extra virtual key for a user
> Issues an additional virtual key for the user.
Virtual keys are scoped to the **user**, not to any one access profile: what a request may
do with the key is read from whichever of the user's active profiles grants it, and each of
those profiles is a separate routing candidate the request may be served by. The user must
therefore hold at least one access profile — the request returns 404 otherwise — but the key
is not tied to the profile that happened to be current when it was minted, and it survives
that profile being detached as long as the user still holds another.
This endpoint is available in [Bifrost Enterprise](https://www.getmaxim.ai/bifrost/enterprise) only.
## OpenAPI
````yaml /openapi/openapi.json post /api/governance/users/{user_id}/virtual-keys
openapi: 3.1.0
info:
title: Bifrost API
description: >
Bifrost HTTP Transport API for AI model inference and gateway management.
This API provides a unified interface for interacting with multiple AI
providers
including OpenAI, Anthropic, Bedrock, Gemini, and more through a single API,
along with comprehensive management APIs for configuring and monitoring the
gateway.
## API Structure
### Unified Inference API (`/v1/*`)
The primary API using Bifrost's unified format. Model parameters use the
format
`provider/model` (e.g., `openai/gpt-4`, `anthropic/claude-3-opus`).
### Async Inference API (`/v1/async/*`)
Submit inference requests for asynchronous execution. Returns a job ID
immediately
and allows polling for results. Supports all inference types except batches,
files,
and containers.
### Provider Integration APIs
Native provider-format APIs for drop-in compatibility:
- `/openai/*` - OpenAI-compatible API
- `/anthropic/*` - Anthropic-compatible API
- `/genai/*` - Google GenAI (Gemini) compatible API
- `/bedrock/*` - AWS Bedrock compatible API
- `/cohere/*` - Cohere compatible API
### Framework Integration APIs
Multi-provider proxy endpoints for AI frameworks:
- `/litellm/*` - LiteLLM proxy with all provider formats
- `/langchain/*` - LangChain compatible endpoints
- `/pydanticai/*` - PydanticAI compatible endpoints
### Management APIs (`/api/*`)
APIs for managing and monitoring the Bifrost gateway:
- `/api/config` - Configuration management
- `/api/providers` - Provider and API key management
- `/api/plugins` - Plugin management
- `/api/governance/*` - Virtual keys, teams, customers, budgets, rate
limits, routing rules, and pricing overrides
- `/api/logs` - Log search and analytics
- `/api/mcp/*` - MCP (Model Context Protocol) client management
- `/api/session/*` - Authentication and session management
- `/api/cache/*` - Cache management
- `/health` - Health check endpoint
## Fallbacks
Requests can include fallback models that will be tried if the primary model
fails.
version: 1.0.0
contact:
name: Contact Us
url: https://getmaxim.ai/bifrost
license:
name: Apache 2.0
url: https://opensource.org/licenses/Apache-2.0
servers:
- url: '{baseUrl}'
description: Your Bifrost instance
variables:
baseUrl:
default: http://localhost:8080
description: Base URL of your Bifrost instance (e.g. https://bifrost.mycompany.com)
security:
- BearerAuth: []
- BasicAuth: []
- ApiKeyAuth: []
tags:
- name: Models
description: Model listing and information
- name: Chat Completions
description: Chat-based text generation
- name: Text Completions
description: Text completion generation
- name: Responses
description: OpenAI Responses API compatible endpoints
- name: OCR
description: Optical character recognition for documents and images
- name: Rerank
description: Document reranking by relevance to a query
- name: Embeddings
description: Text embedding generation
- name: Images
description: Image generations, editing, and variations
- name: Videos
description: Video generation and management
- name: Audio
description: Speech synthesis and transcription
- name: Count Tokens
description: Token counting utilities
- name: Batch
description: Batch processing operations
- name: Files
description: File management operations
- name: Containers
description: Container management operations
- name: Async Jobs
description: Asynchronous job submission and retrieval endpoints
- name: Realtime
description: Realtime WebSocket and WebRTC endpoints
- name: OpenAI Integration
description: OpenAI-compatible API endpoints (/openai/*)
- name: Azure Integration
description: Azure OpenAI integration endpoints
- name: Anthropic Integration
description: Anthropic-compatible API endpoints (/anthropic/*)
- name: GenAI Integration
description: Google GenAI (Gemini) compatible API endpoints (/genai/*)
- name: Bedrock Integration
description: AWS Bedrock compatible API endpoints (/bedrock/*)
- name: Cohere Integration
description: Cohere compatible API endpoints (/cohere/*)
- name: LiteLLM Integration
description: LiteLLM proxy endpoints with multi-provider support (/litellm/*)
- name: LangChain Integration
description: LangChain compatible endpoints with multi-provider support (/langchain/*)
- name: PydanticAI Integration
description: >-
PydanticAI compatible endpoints with multi-provider support
(/pydanticai/*)
- name: Health
description: Health check endpoints
- name: Configuration
description: Configuration management endpoints
- name: Session
description: Session and authentication endpoints
- name: Providers
description: Provider management endpoints
- name: Plugins
description: Plugin management endpoints
- name: MCP
description: Model Context Protocol endpoints
- name: Governance
description: Virtual keys, teams, and customers management
- name: Routing
description: Routing rules and complexity analyzer configuration
- name: Logging
description: Log search and management endpoints
- name: Cache
description: Cache management endpoints
- name: Vault
description: Vault secret management endpoints
- name: Skills
description: Skills Repository management, marketplace, and download endpoints
- name: Audit Logs
description: >-
CADF-compliant audit log search, export, and signature verification
endpoints
- name: Webhooks
description: Webhook endpoint management and signed async-job delivery history
- name: Notifications
description: >-
Role-targeted dashboard notifications, delivered over the dashboard
WebSocket
paths:
/api/governance/users/{user_id}/virtual-keys:
post:
tags:
- Users
- Virtual Keys
summary: Mint an extra virtual key for a user
description: >
Issues an additional virtual key for the user.
Virtual keys are scoped to the **user**, not to any one access profile:
what a request may
do with the key is read from whichever of the user's active profiles
grants it, and each of
those profiles is a separate routing candidate the request may be served
by. The user must
therefore hold at least one access profile — the request returns 404
otherwise — but the key
is not tied to the profile that happened to be current when it was
minted, and it survives
that profile being detached as long as the user still holds another.
operationId: addUserVirtualKey
parameters:
- name: user_id
in: path
required: true
schema:
type: string
requestBody:
required: false
content:
application/json:
schema:
type: object
properties:
name:
type: string
description:
type: string
responses:
'200':
description: Virtual key created.
content:
application/json:
schema:
type: object
properties:
virtual_key:
type: object
properties:
id:
type: string
name:
type: string
value:
type: string
description: >-
The generated virtual key secret. Shown only once on
creation.
'404':
description: User has no access profiles
'409':
description: A virtual key with this name already exists
'500':
description: Internal server error
content:
application/json:
schema:
$ref: '#/components/schemas/BifrostError'
security:
- ManagementBearerAuth: []
components:
schemas:
BifrostError:
type: object
description: Error response from Bifrost
properties:
event_id:
type: string
type:
type: string
is_bifrost_error:
type: boolean
status_code:
type: integer
error:
$ref: '#/components/schemas/ErrorField'
extra_fields:
$ref: '#/components/schemas/BifrostErrorExtraFields'
ErrorField:
type: object
properties:
type:
type: string
code:
type: string
message:
type: string
param:
type: string
event_id:
type: string
BifrostErrorExtraFields:
type: object
properties:
provider:
$ref: '#/components/schemas/ModelProvider'
model_requested:
type: string
request_type:
type: string
ModelProvider:
type: string
description: AI model provider identifier
enum:
- anthropic
- azure
- bedrock
- bedrock_mantle
- cerebras
- cohere
- deepseek
- gemini
- groq
- mistral
- ollama
- opencode-go
- opencode-zen
- openai
- parasail
- perplexity
- sgl
- vertex
- openrouter
- elevenlabs
- huggingface
- nebius
- xai
- replicate
- vllm
- runway
- runware
- fireworks
- sarvam
- wafer
- databricks
securitySchemes:
BearerAuth:
type: http
scheme: bearer
description: >
Bearer token authentication. Use your provider API key or Bifrost
authentication token.
Virtual keys (prefixed with `sk-bf-`) can also be passed here.
BasicAuth:
type: http
scheme: basic
description: >
Basic authentication using the Bifrost admin username and password
(`auth_config.admin_username` / `auth_config.admin_password`).
Accepted on management APIs (`/api/*`, `/metrics`, `/ws`) only - the
inference
middleware never validates Basic credentials.
ApiKeyAuth:
type: apiKey
in: header
name: x-api-key
description: |
API key authentication via the `x-api-key` header.
Virtual keys (prefixed with `sk-bf-`) can also be passed here.
ManagementBearerAuth:
type: http
scheme: bearer
description: >
Management API authentication for `/api/*` endpoints. Use the
`Authorization` header
with `Bearer `, where `` is one of:
- a Bifrost management API key,
- a dashboard session token issued by `POST /api/session/login`,
- base64 of `:` (legacy equivalent of
`BasicAuth`).
Virtual keys (`sk-bf-*`) and the `x-api-key` header are not accepted on
management APIs -
the sole exception is `GET /api/governance/virtual-keys/quota`, which is
virtual-key-only.
````