# Get API Key Model Access Policy - Documentation

> For the complete documentation index, see [llms.txt](/llms.txt). Markdown is available with `Accept: text/markdown` and `.md` URL variants.

Source: /docs/api-reference/key-get-model-access-policy

# Get API Key Model Access Policy

Copy pageCopy page

Copy pageCopy page

GET

/

openapi

/

v2

/

user

/

key

/

{stringId}

/

model-access-policy

Try it

```
curl --request GET \
--url https://api.novita.ai/openapi/v2/user/key//model-access-policy \
--header 'Authorization: Bearer '
```

200 (selected)

200 (default)

```
{
"stringId": "key_xxx",
"policy": {
"schemaVersion": 1,
"productScope": "model_api",
"mode": "selected",
"allowedModels": [
{
"type": "llm",
"id": "deepseek/deepseek-v3"
}
],
"excludedModels": [],
"source": {
"type": "private_policy"
}
},
"policyStatus": "active",
"allowedModelCount": 1,
"excludedModelCount": 0,
"updatedAt": 1783764000,
"updatedBy": "user_uuid_xxx"
}
```

```
{
"stringId": "key_xxx",
"policy": {
"schemaVersion": 1,
"productScope": "model_api",
"mode": "all_enabled",
"allowedModels": [],
"excludedModels": [],
"source": {
"type": "default"
}
},
"policyStatus": "active",
"allowedModelCount": 0,
"excludedModelCount": 0,
"updatedAt": 0,
"updatedBy": ""
}
```

Retrieve the current model access policy of a single API key. If the key has never been configured, the default policy (`mode=all_enabled`) is returned.

`allowedModels` / `excludedModels` may be returned as `null` or an empty array; callers should treat both as an empty array.

##

[​](#permissions)

Permissions

RoleAccessOwner / AdminCan query the full policy of any API key in the team.DeveloperCan query only keys they own, and the response omits the `allowedModels` / `excludedModels` details.

The target API key must belong to the caller’s team.

##

[​](#request-headers)

Request Headers

[​](#param-authorization)

Authorization

string

required

Bearer authentication format, for example: Bearer {{API Key}}.

##

[​](#path-parameters)

Path Parameters

[​](#param-string-id)

stringId

string

required

The stringId of the target API key.

##

[​](#response-parameters)

Response Parameters

[​](#param-string-id-1)

stringId

string

required

The stringId of the API key.

[​](#param-policy)

policy

object

required

The model access policy object.

Hide properties

[​](#param-schema-version)

schemaVersion

int32

required

Policy schema version. Currently `1`.

[​](#param-product-scope)

productScope

string

required

Product scope the policy applies to. Currently only `model_api`.

[​](#param-mode)

mode

string

required

Access mode. Possible values: `all_enabled` (can access all enabled models), `selected` (can access only the specified models).

[​](#param-allowed-models)

allowedModels

object[]

Accessible models. Meaningful only when `mode=selected`; empty when `mode=all_enabled`. Not returned in detail for Developer queries.

Show properties

[​](#param-type)

type

string

required

Model type. Possible values: `llm`, `multimodal`.

[​](#param-id)

id

string

required

Model identifier, for example `deepseek/deepseek-v3`.

[​](#param-excluded-models)

excludedModels

object[]

Excluded models. Meaningful only when `mode=all_enabled`; empty when `mode=selected`. Same structure as `allowedModels`. Not returned in detail for Developer queries.

[​](#param-source)

source

object

Policy source, returned by the server and ignored on write.

Show properties

[​](#param-type-1)

type

string

required

Source type. Possible values: `default` (never configured, default policy returned), `private_policy` (policy embedded on this key).

[​](#param-policy-id)

policyId

string

Associated policy ID, returned only when applicable.

[​](#param-policy-status)

policyStatus

string

required

Policy status. `active` means the policy is effective; `no_available_models` means no accessible model remains (for example, all selected models are offline).

[​](#param-allowed-model-count)

allowedModelCount

int32

required

Number of accessible models.

[​](#param-excluded-model-count)

excludedModelCount

int32

required

Number of excluded models.

[​](#param-updated-at)

updatedAt

int64

required

Last update time, as a Unix timestamp in seconds. `0` for the default policy.

[​](#param-updated-by)

updatedBy

string

required

Identifier of the user who last updated the policy. Empty string for the default policy.

```
curl --request GET \
--url https://api.novita.ai/openapi/v2/user/key//model-access-policy \
--header 'Authorization: Bearer '
```

200 (selected)

200 (default)

```
{
"stringId": "key_xxx",
"policy": {
"schemaVersion": 1,
"productScope": "model_api",
"mode": "selected",
"allowedModels": [
{
"type": "llm",
"id": "deepseek/deepseek-v3"
}
],
"excludedModels": [],
"source": {
"type": "private_policy"
}
},
"policyStatus": "active",
"allowedModelCount": 1,
"excludedModelCount": 0,
"updatedAt": 1783764000,
"updatedBy": "user_uuid_xxx"
}
```

```
{
"stringId": "key_xxx",
"policy": {
"schemaVersion": 1,
"productScope": "model_api",
"mode": "all_enabled",
"allowedModels": [],
"excludedModels": [],
"source": {
"type": "default"
}
},
"policyStatus": "active",
"allowedModelCount": 0,
"excludedModelCount": 0,
"updatedAt": 0,
"updatedBy": ""
}
```

Last modified on July 22, 2026