Set API Key Model Access Policy

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      { "type": "llm", "id": "deepseek/deepseek-v3" }
    ]
  }'

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled"
  }'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

PUT

openapi

user

key

{stringId}

model-access-policy

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      { "type": "llm", "id": "deepseek/deepseek-v3" }
    ]
  }'

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled"
  }'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

Set or update the model access policy of a single API key. The request body is the policy object itself.

Permissions

Only the team Owner / Admin can call this endpoint. Developer, Basic, and Billing members cannot set the policy. The target API key must belong to the caller’s team.

Request Headers

string

erforderlich

Enum: application/json

string

erforderlich

Bearer authentication format, for example: Bearer {{API Key}}.

Path Parameters

string

erforderlich

The stringId of the target API key.

Request Body

int32

Policy schema version. Currently 1.

string

Product scope the policy applies to. Only model_api is supported when provided.

string

erforderlich

Access mode. Possible values: all_enabled (can access all enabled models), selected (can access only the specified models).

object[]

Accessible models. Required when mode=selected and must contain at least one model; ignored when mode=all_enabled.

Anzeigen properties

string

erforderlich

Model type. Possible values: llm, multimodal.

string

erforderlich

Model identifier, for example deepseek/deepseek-v3.

object[]

Excluded models. Applies when mode=all_enabled; ignored when mode=selected. Same structure as allowedModels.

Write constraints:

mode must be all_enabled or selected.
When mode=selected, allowedModels must contain at least one model.
Every model written must be within the team’s enabled model range and currently available; requests containing offline, unavailable, or not-enabled models are rejected.
Model arrays that do not apply to the current mode are normalized to empty, and duplicate models are deduplicated. The response reflects the server-normalized object.
source is managed by the server and ignored on write.

Response

The response has the same structure as Get API Key Model Access Policy and reflects the latest, normalized policy object.

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      { "type": "llm", "id": "deepseek/deepseek-v3" }
    ]
  }'

curl --request PUT \
  --url https://api.novita.ai/openapi/v2/user/key/<stringId>/model-access-policy \
  --header 'Authorization: Bearer <API_KEY>' \
  --header 'Content-Type: application/json' \
  --data '{
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "all_enabled"
  }'

{
  "stringId": "key_xxx",
  "policy": {
    "schemaVersion": 1,
    "productScope": "model_api",
    "mode": "selected",
    "allowedModels": [
      {
        "type": "llm",
        "id": "deepseek/deepseek-v3"
      }
    ],
    "excludedModels": [],
    "source": {
      "type": "private_policy"
    }
  },
  "policyStatus": "active",
  "allowedModelCount": 1,
  "excludedModelCount": 0,
  "updatedAt": 1783764000,
  "updatedBy": "user_uuid_xxx"
}

Zuletzt geändert am 10. August 2026

⌘I

Overview

Basic

Quota

Team Budget

API Key Model Access

Model APIs

GPUs

Set API Key Model Access Policy

Permissions

Request Headers

Path Parameters

Request Body

Response

​Permissions

​Request Headers

​Path Parameters

​Request Body

​Response

Permissions

Request Headers

Path Parameters

Request Body

Response