TenantModelKey

One of the tenant’s own provider API keys (“bring your own key”), used when a run calls that provider’s models and the run was not started with a key of its own. Keys are looked up at each model call, so disabling, replacing or deleting one takes effect on the next call of every run.

For each model call Maitento tries the keys supplied with the run, then the tenant’s enabled keys for the provider by ascending priority, then Maitento’s own key, but only when the run allows it and the tenant does not forbid it (forbidMaitentoCredentials).

Kind: an object, used in responses.

Fields

Every field is present in a response; empty ones are null.

Field	Type	Description
provider	ModelKeyProvider	The vendor the key authenticates with.
label	string	A name for the key, chosen by the tenant (at most 100 characters).
keyHint	string	The key’s last four characters, so a person can tell keys apart without the key being served.
baseUrl	string | null	The endpoint to call instead of the provider’s default, such as an Azure OpenAI resource or a regional Qwen host. Null for the provider’s own endpoint. Always an absolute https URL to a public host.
modelNameOverrides	map<string, string> | null	Maps a model’s id at the provider (such as gpt-4.1-mini) to the name this key’s endpoint serves it under, such as an Azure deployment name. Null or empty: model names are sent unchanged.
priority	integer	The order the tenant’s keys for one provider are tried in; lower first.
isDisabled	boolean	Whether the key is disabled. A disabled key is kept but never used.
userCreatedById	uuid	The id of the user who created it. A call made with an API key is recorded as the key’s user.
tenantId	uuid	The id of the tenant it belongs to.
id	uuid	The unique id. Use it in by-id routes and wherever another object refers to this one.
dateCreated	datetime	When it was created, in UTC.
dateUpdated	datetime	When it was last changed, in UTC.

Example

{
  "provider": "Anthropic",
  "label": "...",
  "keyHint": "...",
  "baseUrl": "...",
  "modelNameOverrides": {
    "key": "..."
  },
  "priority": 0,
  "isDisabled": false,
  "userCreatedById": "3f2b8c1e-5d4a-4e6b-9c7d-2a1b0c9d8e7f",
  "tenantId": "3f2b8c1e-5d4a-4e6b-9c7d-2a1b0c9d8e7f",
  "id": "3f2b8c1e-5d4a-4e6b-9c7d-2a1b0c9d8e7f",
  "dateCreated": "2026-10-26T12:00:00.0000000Z",
  "dateUpdated": "2026-10-26T12:00:00.0000000Z"
}

Where it’s used

• modelKeys.create (POST /tenants/self/model-keys)
• modelKeys.list (GET /tenants/self/model-keys)
• modelKeys.update (PUT /tenants/self/model-keys/by-id/{id})