Set API Key Model Access Policy

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      { "type": "llm", "id": "deepseek/deepseek-v3" }
    ]
  }'

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled"
  }'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

PUT

openapi

user

key

{stringId}

model-access-policy

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      { "type": "llm", "id": "deepseek/deepseek-v3" }
    ]
  }'

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled"
  }'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

Set or update the model access policy of a single API key. The request body is the policy object itself.

Permissions

Only the team Owner / Admin can call this endpoint. Developer, Basic, and Billing members cannot set the policy. The target API key must belong to the caller’s team.

Request Headers

Content-Type

string

required

Enum: application/json

Authorization

string

required

Bearer authentication format, for example: Bearer {{API Key}}.

Path Parameters

stringId

string

required

The stringId of the target API key.

Request Body

schemaVersion

int32

Policy schema version. Currently 1.

productScope

string

Product scope the policy applies to. Only model_api is supported when provided.

mode

string

required

Access mode. Possible values: all_enabled (can access all enabled models), selected (can access only the specified models).

allowedModels

object[]

Accessible models. Required when mode=selected and must contain at least one model; ignored when mode=all_enabled.

Show properties

type

string

required

Model type. Possible values: llm, multimodal.

string

required

Model identifier, for example deepseek/deepseek-v3.

excludedModels

object[]

Excluded models. Applies when mode=all_enabled; ignored when mode=selected. Same structure as allowedModels.

Write constraints:

mode must be all_enabled or selected.
When mode=selected, allowedModels must contain at least one model.
Every model written must be within the team’s enabled model range and currently available; requests containing offline, unavailable, or not-enabled models are rejected.
Model arrays that do not apply to the current mode are normalized to empty, and duplicate models are deduplicated. The response reflects the server-normalized object.
source is managed by the server and ignored on write.

Response

The response has the same structure as Get API Key Model Access Policy and reflects the latest, normalized policy object.

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      { "type": "llm", "id": "deepseek/deepseek-v3" }
    ]
  }'

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled"
  }'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

Last modified on July 22, 2026

Get API Key Model Access Policy Reset API Key Model Access Policy

⌘I

Overview

Basic

Quota

Team Budget

API Key Model Access

Model APIs

GPUs

Set API Key Model Access Policy

Permissions

Request Headers

Path Parameters

Request Body

Response

​Permissions

​Request Headers

​Path Parameters

​Request Body

​Response

Permissions

Request Headers

Path Parameters

Request Body

Response