Get API Key Model Access Policy

curl --request GET \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled",
    "allowedModels": [],
    "excludedModels": [],
    "source": {
      "type": "default"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 0,
  "excludedModelCount": 0,
  "updatedAt": 0,
  "updatedBy": ""
}

GET

openapi

user

key

{stringId}

model-access-policy

curl --request GET \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled",
    "allowedModels": [],
    "excludedModels": [],
    "source": {
      "type": "default"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 0,
  "excludedModelCount": 0,
  "updatedAt": 0,
  "updatedBy": ""
}

Retrieve the current model access policy of a single API key. If the key has never been configured, the default policy (mode=all_enabled) is returned.

allowedModels / excludedModels may be returned as null or an empty array; callers should treat both as an empty array.

Permissions

Role	Access
Owner / Admin	Can query the full policy of any API key in the team.
Developer	Can query only keys they own, and the response omits the `allowedModels` / `excludedModels` details.

The target API key must belong to the caller’s team.

Request Headers

Authorization

string

required

Bearer authentication format, for example: Bearer {{API Key}}.

Path Parameters

stringId

string

required

The stringId of the target API key.

Response Parameters

stringId

string

required

The stringId of the API key.

policy

object

required

The model access policy object.

Hide properties

schemaVersion

int32

required

Policy schema version. Currently 1.

productScope

string

required

Product scope the policy applies to. Currently only model_api.

mode

string

required

Access mode. Possible values: all_enabled (can access all enabled models), selected (can access only the specified models).

allowedModels

object[]

Accessible models. Meaningful only when mode=selected; empty when mode=all_enabled. Not returned in detail for Developer queries.

Show properties

type

string

required

Model type. Possible values: llm, multimodal.

string

required

Model identifier, for example deepseek/deepseek-v3.

excludedModels

object[]

Excluded models. Meaningful only when mode=all_enabled; empty when mode=selected. Same structure as allowedModels. Not returned in detail for Developer queries.

source

object

Policy source, returned by the server and ignored on write.

Show properties

type

string

required

Source type. Possible values: default (never configured, default policy returned), private_policy (policy embedded on this key).

policyId

string

Associated policy ID, returned only when applicable.

policyStatus

string

required

Policy status. active means the policy is effective; no_available_models means no accessible model remains (for example, all selected models are offline).

allowedModelCount

int32

required

Number of accessible models.

excludedModelCount

int32

required

Number of excluded models.

updatedAt

int64

required

Last update time, as a Unix timestamp in seconds. 0 for the default policy.

updatedBy

string

required

Identifier of the user who last updated the policy. Empty string for the default policy.

curl --request GET \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled",
    "allowedModels": [],
    "excludedModels": [],
    "source": {
      "type": "default"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 0,
  "excludedModelCount": 0,
  "updatedAt": 0,
  "updatedBy": ""
}

Last modified on July 22, 2026

List API Keys (with Model Access Summary)Set API Key Model Access Policy

⌘I

Overview

Basic

Quota

Team Budget

API Key Model Access

Model APIs

GPUs

Get API Key Model Access Policy

Permissions

Request Headers

Path Parameters

Response Parameters

​Permissions

​Request Headers

​Path Parameters

​Response Parameters

Permissions

Request Headers

Path Parameters

Response Parameters