Models and providers
BYOK catalog, workspace provider configs, model overrides, and local discovery.
AI models are configured per workspace as provider configs that point at a credential name. The same catalog powers Settings → Models, Settings → BYOK, and the AI Providers API. Knowledge Base indexing does not use these keys; see BYOK.
Settings
| Section | Path | Behavior |
|---|---|---|
| Models | /confluye/{slug}/settings/models | Read-only catalog cards (defaults, credential name, org-locked models, connection status). Add Key / Overrides jump to BYOK. |
| BYOK | /confluye/{slug}/settings/byok | Add or update a provider key, live test, and workspace model overrides (enable/disable models, then Save). |
Status on a card is configured when a matching AiProviderConfig exists (matched by provider, or by credentialName when provider is custom so Ollama/vLLM/custom do not collide).
Catalog providers
Hosted: openai, anthropic, google, azure, openrouter, deepseek, mistral, groq, perplexity, together, fireworks, xai, cohere, custom.
Local catalog keys ollama and vllm persist as provider: "custom" with credential names OLLAMA_API_KEY / VLLM_API_KEY. They require http/https baseUrl (loopback allowed). API keys are optional. Discovery (session catalog only) uses Ollama {origin}/api/tags and vLLM {origin}/v1/models, ~60s cache, and never throws — empty models plus a warning on failure.
Organization-locked models (cannot be re-enabled in the workspace UI): for example OpenAI gpt-4.5-preview, Anthropic claude-2, Google gemini-pro-vision. Workspace disabledModels on the provider config are additional.
Create and update
Required: provider, defaultModel, credentialName. Optional: baseUrl, apiVersion, disabledModels.
Session POST /api/ai-providers rejects non-http(s) baseUrl. v1 POST /api/v1/ai-providers does not run that validation.
POST .../ai-providers/test uses an inline apiKey or resolves credentialName in the workspace. HTTP 400 + { result } when the live check fails (ok: false). tRPC settings.testAiProvider throws BAD_REQUEST on failure.
There is no DELETE provider route. To change a key, patch credentialName or update the credential.
Authorization
Session routes require workspace membership (create action on POST). v1 routes require a workspace
API key and scope configs to that key's workspace; unknown ids return 404. Viewer reads receive the
workspace-safe.v1 provider projection without credentialName, baseUrl, or apiVersion. Keys with
workspace.secret.read or workspace.write retain the full provider contract. Mutations require
workspace.write.