OptionalallowWhen true, accepts any model exposed by the upstream provider; targets
is not required and does not restrict routability. When false, only
models listed in targets are routable. Defaults to false.
OptionalforwardWhether to forward incoming HTTP headers to the upstream provider. Defaults to false and is configured for the entire provider service, not per request. Upstream authentication is configured separately in the provider-specific configuration.
OptionalforwardWhether to forward incoming query parameters to the upstream provider. Defaults to false and is configured for the entire provider service, not per request.
OptionalforwardWhether to proxy paths that AI Gateway does not recognize as configured provider-native API types. Defaults to false. When true, these paths are forwarded unchanged to the upstream provider. When false, only recognized API paths are served. Enabling this broadens the upstream API surface exposed through the provider service.
OptionalinferencePayload logging configuration for requests sent directly to this provider service. Requests routed through a model service are captured by that model service's inference table instead.
OptionalproviderProvider-specific configuration. Exactly one variant must be set, and it
must match provider_type. Supply secret values in the nested plaintext
field. Secret values are stored encrypted and omitted from responses;
non-secret configuration fields are returned as stored.
(-- Declarative tooling must treat plaintext as write-only because it
never round-trips on reads. --)
(-- Secrets are persisted as the encrypted credential of a per-MPS UC
SchemaConnection (CONNECTION_HTTP_BEARER). The auto-minted
SchemaConnection is user-owned but hidden from the user, so it is not
surfaced as a connection they manage directly even though the
credential could in principle be changed out of band. --)
(-- Field-behavior on the per-provider config fields:
(google.api.field_behavior) = OPTIONAL everywhere on the
*DirectConfig descendants, with Create-time requirements enforced
in the validator. Proto-level REQUIRED is deliberately not used
per the proto-required-vs-update-mask guardrail: REQUIRED would
reject sparse Update requests that legitimately omit a field whose
value is unchanged, breaking AIP-134 partial-Update. The
user-facing javadoc on each field states which fields are required
on Create. --)
OptionalproviderExternal model provider. Required on Create and immutable thereafter. Set
the matching provider-specific configuration, such as openai,
azure_openai, or amazon_bedrock.
OptionalrateRate limits for requests sent directly to this provider service. Requests routed through a model service use that model service's rate limits instead.
OptionaltargetsModels and provider-native API types exposed by this provider service. Each
entry must include at least one native_api_types value. When
allow_all_targets is false, at least one entry is required and model
service destinations can reference only listed models. When
allow_all_targets is true, any upstream model is routable; entries in
this list provide API-type metadata without restricting other models.
Behavioral configuration for a ModelProviderService: provider authentication and provider-specific fields, the catalog of models this provider service can route to, and the passthrough policy that governs how request headers, query parameters, and unmanaged subpaths cross the trust boundary to the upstream provider.