AethosHub
PricingRequest Demo

DocumentationAgent Access Manager

Providers & model catalog

Providers & model catalog

The catalog is your per-org map of "what models exist and where they come from." It has two layers, split by sensitivity on purpose: providers hold vendor connections and master credentials (admin-grade), deployments map model aliases to those providers (operator-grade).

Dashboard: Operate ▸ Catalog. API: /admin/providers, /admin/deployments (see Admin API). Everyone in the org can read the catalog.

Providers — the vendor connections

A provider is a base URL, a protocol, and the master credential for a vendor. Creating or editing one requires MANAGE_PROVIDERS because it stores a secret.

  • The credential is AES-256-GCM encrypted at rest; the application refuses to start without its master key. Applications never see it — the gateway injects the decrypted credential per request.
  • Editing a provider supports key rotation: re-encrypt and swap the credential, effective on the next request.
  • Deleting a provider cascades to its deployments.

The protocol selects the outbound adapter:

protocolCoversAuth used upstream
openaiOpenAI and anything OpenAI-compatible: Groq, Ollama, vLLM, LiteLLM, Azure-style serversAuthorization: Bearer
anthropicAnthropic Messages APIx-api-key + anthropic-version
geminiGoogle Gemini generateContentx-goog-api-key
vertexGemini on Vertex AI (regional)GCP token minted from a service-account JSON
vertex-anthropicClaude on Vertex AIGCP token

Deployments — the model aliases

A deployment maps a model alias (what your apps ask for) to a provider plus an upstream model (what the vendor runs), with optional pricing. Defining one requires MANAGE_DEPLOYMENTS.

  • Alias vs upstream. Your apps call the alias (fast-cheap); the deployment points it at, say, gpt-4o-mini. Re-point it later — different vendor, different model — with zero application changes. Budgets and reports key on the alias, so they stay stable too.
  • Pricing is per-token in the org's base currency: inputCostPerToken, outputCostPerToken, and optionally cachedInputCostPerToken and cacheWriteCostPerToken. If set, every call gets a computed cost that flows into budgets, the audit trail, and reports. Without pricing, usage is still metered in tokens.
  • dropParams strips named request parameters a particular upstream rejects, so a known-unsupported parameter degrades the call instead of failing it.
  • Load balancing is implicit. Register two or more deployments under the same alias and the gateway automatically spreads requests across them and falls back between them. The catalog flags this as load-balanced ×N.
Priced deployment
Command
# A priced deployment
curl -s -u admin:PASSWORD -X POST https://aam.example.com/admin/deployments \
  -H "Content-Type: application/json" \
  -d '{
    "alias": "chat",
    "providerName": "openai",
    "upstreamModel": "gpt-4o-mini",
    "inputCostPerToken": 0.00000015,
    "outputCostPerToken": 0.0000006,
    "currency": "USD"
  }'

Ceilings

Registration is bounded by always-on caps — by default 50 providers per org and 100 deployments per provider. A breach returns 409.

What applications see

GET /v1/models (with a virtual key) lists the org's registered aliases — a direct catalog read, no upstream call. This is what populates model menus in OpenAI-compatible clients pointed at the gateway.