Interface ModelProviderServiceConfig

When true, accepts any model exposed by the upstream provider; targets is not required and does not restrict routability. When false, only models listed in targets are routable.

Whether to forward incoming request headers to the upstream provider. Applies to managed (multi-model) requests as well as passthrough requests served by this provider service. Governance-level decision by the provider service owner; not selectable per inference call.

Whether to forward incoming request query parameters to the upstream provider. Same trust-boundary semantics as forward_headers.

Whether to forward request paths that fall outside this service's managed API set to the upstream provider as opaque passthrough. When true, requests addressed to subpaths not recognized by the managed API surface are proxied to the upstream provider over the same provider connection. When false, only managed-API paths are served. Governance-level decision by the provider service owner; expanding this expands the trust boundary that the ModelProviderService exposes.

Inference table configuration for payload logging when this provider service is invoked directly. When it is invoked through a model service, the model service's own inference table captures the invocation instead. Mirrors ModelServiceConfig.inference_table / AgentServiceConfig.inference_table.

Provider-specific configuration. Exactly one variant must be set, and it must match provider_type; a request whose active variant disagrees with provider_type is rejected with INVALID_PARAMETER_VALUE. Secret-bearing fields nested inside each *DirectConfig (api_key, aws_secret_access_key, service_account_key, ...) wrap a ProviderSecret: callers supply the value as ProviderSecret.plaintext on writes, and the platform stores it encrypted. Reads (Get and List) omit the plaintext; secret-bearing fields appear in the response only as a presence indicator that a secret is configured. Non-secret fields (base_url, region, organization, aws_access_key_id, ...) round-trip directly.

Declarative tooling (Terraform / DABs): the plaintext field is INPUT_ONLY and never round-trips on reads, so a Terraform config that supplies it will see a structural diff against the read state on every terraform plan unless mitigated. Mitigations, in order of preference: (a) use Terraform 1.11+ WriteOnly attribute on plaintext in the provider schema; (b) add provider DiffSuppressFunc for the secret field; (c) document lifecycle.ignore_changes = [<secret_field>] for callers. The stored secret is normally changed through UpdateModelProviderService.

(-- Secrets are persisted as the encrypted credential of a per-MPS UC SchemaConnection (CONNECTION_HTTP_BEARER). The auto-minted SchemaConnection is user-owned but hidden from the user, so it is not surfaced as a connection they manage directly even though the credential could in principle be changed out of band. --)

(-- Field-behavior on the per-provider config fields: (google.api.field_behavior) = OPTIONAL everywhere on the *DirectConfig descendants, with Create-time requirements enforced in the validator. Proto-level REQUIRED is deliberately not used per the proto-required-vs-update-mask guardrail: REQUIRED would reject sparse Update requests that legitimately omit a field whose value is unchanged, breaking AIP-134 partial-Update. The user-facing javadoc on each field states which fields are required on Create. --)

Provider type discriminator. Required at create time; immutable after. Determines which variant of the provider oneof must be set. May not be changed via Update; attempts to include config.provider_type in UpdateModelProviderServiceRequest.update_mask are rejected.

Required on CreateModelProviderService and immutable thereafter.

Rate limits applied when this provider service is invoked directly. When it is invoked through a model service, the model service's own rate_limits apply instead. Mirrors ModelServiceConfig.rate_limits / McpServiceConfig.rate_limits.

Routing targets this provider service exposes (provider-side model identifier + unified API types per entry). Required (>=1) when allow_all_targets = false; optional and additive when allow_all_targets = true. References from ExternalModelConfig.target must match an entry here unless allow_all_targets = true.