What you can do here

Everything below uses the public management API. Pick a region, paste a management key, and every action shows the request it sends.

Apps and credentialsCreate apps, change settings, attach providers, issue and revoke gateway keys.Providers and quota poolsConfigure shared providers, test models and discover what an upstream offers.BudgetsReview spend, adjust limits and grant temporary headroom.Routing and failoverRoutes, weighted destinations, failover and constraints, with dry runs, history and restore.Rate limitsRequest and token limits, request guards, temporary raises and effective limits.IncidentsMark a provider down during an outage, check it applied, then restore it.Bootstrap accessNo management key yet? Enable management and issue one with a tenant-admin token.API ExplorerBrowse every operation with its schema, then send it and copy cURL, Python or JavaScript.

Scopes

Management keys carry explicit scopes. No scope implies another.

Scope	Allows
read	Capabilities and the spec, app, provider, quota pool and key metadata, prompts, history, audit, catalogs and operation status.
config:write	App settings and availability, provider attachments and conversion, prompts, configuration rollback and operation recovery.
providers:write	Create, update, enable, disable and delete shared providers, manage quota pools, and run provider tests and model discovery.
credentials:write	Issue gateway keys, change their expiry and revoke them. Creating an app needs this and config:write.
credentials:read	Reveal the secret of one active gateway key, on explicit request.
budgets:read	Budgets, usage, subjects, grants, pricing, exemptions, alerts and budget events.
budgets:policy	Budget, pricing and exemption edits (each publishes a policy revision) and alert destinations.
budgets:grant	Create, change and revoke time-boxed budget grants.
routing:read	Routes, destinations, failover, routing constraints, model access, provider references, revision history and rollout, and the routing diagnostics. Does not need read.
routing:write	Change routes, destinations, failover profiles, rules and default, and model access (each write publishes a policy revision).
routing:constraints	Change routing constraints.
limits:read	Rate limits, request guards, model limits, exemptions, limit responses, live usage, grants and effective limits. Does not need read.
limits:write	Change rate limits, request guards, model limits, exemptions and limit responses (each write publishes a policy revision).
limits:grant	Issue and revoke temporary rate limit raises.
incidents:read	Read incident mark-downs and status (read or incidents:write also allow these reads).
incidents:write	Mark providers down, preview, restore, reset cooldowns and drop session pins. Never a policy revision.

Operations by area

Counts exclude alias routes. Open the API Explorer for the full list.

Area	Operations	Your key can call
Reference	2	-
Apps	8	-
Providers	10	-
Quota pools	5	-
Credentials	6	-
Prompts	4	-
Budgets	27	-
Routing	48	-
Limits	31	-
Incidents	8	-
Catalogs	4	-
History	6	-
Administration	6	Tenant-admin token