# Set API Key Model Access Policy - Documentation

> For the complete documentation index, see [llms.txt](/llms.txt). Markdown is available with `Accept: text/markdown` and `.md` URL variants.

Source: /docs/api-reference/key-put-model-access-policy

# Set API Key Model Access Policy

Copy pageCopy page

Copy pageCopy page

PUT

/

openapi

/

v2

/

user

/

key

/

{stringId}

/

model-access-policy

Try it

Selected models

All enabled models

```
curl --request PUT \
--url https://api.novita.ai/openapi/v2/user/key//model-access-policy \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"schemaVersion": 1,
"productScope": "model_api",
"mode": "selected",
"allowedModels": [
{ "type": "llm", "id": "deepseek/deepseek-v3" }
]
}'
```

```
curl --request PUT \
--url https://api.novita.ai/openapi/v2/user/key//model-access-policy \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"schemaVersion": 1,
"productScope": "model_api",
"mode": "all_enabled"
}'
```

200

```
{
"stringId": "key_xxx",
"policy": {
"schemaVersion": 1,
"productScope": "model_api",
"mode": "selected",
"allowedModels": [
{
"type": "llm",
"id": "deepseek/deepseek-v3"
}
],
"excludedModels": [],
"source": {
"type": "private_policy"
}
},
"policyStatus": "active",
"allowedModelCount": 1,
"excludedModelCount": 0,
"updatedAt": 1783764000,
"updatedBy": "user_uuid_xxx"
}
```

Set or update the model access policy of a single API key. The request body is the `policy` object itself.

##

[​](#permissions)

Permissions

Only the team Owner / Admin can call this endpoint. Developer, Basic, and Billing members cannot set the policy. The target API key must belong to the caller’s team.

##

[​](#request-headers)

Request Headers

[​](#param-content-type)

Content-Type

string

required

Enum: `application/json`

[​](#param-authorization)

Authorization

string

required

Bearer authentication format, for example: Bearer {{API Key}}.

##

[​](#path-parameters)

Path Parameters

[​](#param-string-id)

stringId

string

required

The stringId of the target API key.

##

[​](#request-body)

Request Body

[​](#param-schema-version)

schemaVersion

int32

Policy schema version. Currently `1`.

[​](#param-product-scope)

productScope

string

Product scope the policy applies to. Only `model_api` is supported when provided.

[​](#param-mode)

mode

string

required

Access mode. Possible values: `all_enabled` (can access all enabled models), `selected` (can access only the specified models).

[​](#param-allowed-models)

allowedModels

object[]

Accessible models. Required when `mode=selected` and must contain at least one model; ignored when `mode=all_enabled`.

Show properties

[​](#param-type)

type

string

required

Model type. Possible values: `llm`, `multimodal`.

[​](#param-id)

id

string

required

Model identifier, for example `deepseek/deepseek-v3`.

[​](#param-excluded-models)

excludedModels

object[]

Excluded models. Applies when `mode=all_enabled`; ignored when `mode=selected`. Same structure as `allowedModels`.

Write constraints:

- `mode` must be `all_enabled` or `selected`.

- When `mode=selected`, `allowedModels` must contain at least one model.

- Every model written must be within the team’s enabled model range and currently available; requests containing offline, unavailable, or not-enabled models are rejected.

- Model arrays that do not apply to the current mode are normalized to empty, and duplicate models are deduplicated. The response reflects the server-normalized object.

- `source` is managed by the server and ignored on write.

##

[​](#response)

Response

The response has the same structure as [Get API Key Model Access Policy](/docs/api-reference/key-get-model-access-policy) and reflects the latest, normalized policy object.

Selected models

All enabled models

```
curl --request PUT \
--url https://api.novita.ai/openapi/v2/user/key//model-access-policy \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"schemaVersion": 1,
"productScope": "model_api",
"mode": "selected",
"allowedModels": [
{ "type": "llm", "id": "deepseek/deepseek-v3" }
]
}'
```

```
curl --request PUT \
--url https://api.novita.ai/openapi/v2/user/key//model-access-policy \
--header 'Authorization: Bearer ' \
--header 'Content-Type: application/json' \
--data '{
"schemaVersion": 1,
"productScope": "model_api",
"mode": "all_enabled"
}'
```

200

```
{
"stringId": "key_xxx",
"policy": {
"schemaVersion": 1,
"productScope": "model_api",
"mode": "selected",
"allowedModels": [
{
"type": "llm",
"id": "deepseek/deepseek-v3"
}
],
"excludedModels": [],
"source": {
"type": "private_policy"
}
},
"policyStatus": "active",
"allowedModelCount": 1,
"excludedModelCount": 0,
"updatedAt": 1783764000,
"updatedBy": "user_uuid_xxx"
}
```

Last modified on July 22, 2026