Skip to main content
PUT
/
api
/
v1
/
agent-configs
/
{kind}
/
byok-key
Set (or rotate) the BYOK key for one agent kind. Orchestrates the probe → encrypt → store sequence in a single atomic call so a client that skips `validate-key` still gets a safe error on bad input.
curl --request PUT \
  --url https://api.backside.app/api/v1/agent-configs/{kind}/byok-key \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "api_key": "<string>"
}
'
{
  "agent_kind": "<string>",
  "byok_status": "<string>",
  "created_at": "2023-11-07T05:31:56Z",
  "guardrails": "<unknown>",
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "tenant_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "updated_at": "2023-11-07T05:31:56Z",
  "budget_default_cents": 123,
  "byok_last_probed_at": "2023-11-07T05:31:56Z",
  "byok_status_reason": "<string>",
  "deadline_default_seconds": 123,
  "schedule": "<string>"
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

​
kind
string
required

Agent kind identifier

Body

application/json

Request body for POST /agent-configs/validate-key and PUT /agent-configs/{kind}/byok-key. Shared because both endpoints just take a raw provider API key.

​
api_key
string
required

Plaintext Anthropic API key. Transported over TLS + never logged.

Response

Key probed, encrypted, stored

A single agent_configs row as exposed over the REST API. Deliberately omits byok_key_ref and byok_key_version — those never cross the API boundary.

​
agent_kind
string
required
​
byok_status
string
required
​
created_at
string<date-time>
required
​
guardrails
any
required
​
id
string<uuid>
required
​
tenant_id
string<uuid>
required
​
updated_at
string<date-time>
required
​
budget_default_cents
integer<int64> | null
​
byok_last_probed_at
string<date-time> | null
​
byok_status_reason
string | null
​
deadline_default_seconds
integer<int32> | null
​
schedule
string | null