DELETE and PUT /v1/admin/byok/{tenant_id}/{provider_id}

Part of the API reference; this page is generated from the OpenAPI document that the gateway builds from its own route tables.

Provenance

• Contract version: 1.10.0
• Contract title: acumen gateway API
• Source: acumen:docs/openapi/acumen-v1.openapi.json

Operations

DELETE /v1/admin/byok/{tenant_id}/{provider_id}

Delete a tenant’s BYOK provider credential

Removes the sealed credential. Operator (admin) scope.

• Operation id: deleteV1AdminByokTenantIdProviderId
• Scope: admin
• Exposure: operator
• Mutating: yes
• Auth: bearerAuth, operatorSession

Responses

• 204: deleted
• 400: schema_invalid — the request body or parameter failed validation
  • application/problem+json: Problem: Problem (object)
• 401: auth_missing — no virtual key or operator session
  • application/problem+json: Problem: Problem (object)
• 403: auth_scope — the credential lacks the route’s scope
  • application/problem+json: Problem: Problem (object)
• 404: resource_not_found — the addressed object does not exist
  • application/problem+json: Problem: Problem (object)
• 405: method_not_allowed — the path exists for another verb
  • application/problem+json: Problem: Problem (object)
• 429: rate_limited — the per-key or per-IP bucket is exhausted
  • application/problem+json: Problem: Problem (object)
• 500: internal — the store or process failed
  • application/problem+json: Problem: Problem (object)
• 501: not_implemented — the route is declared but not wired in this build
  • application/problem+json: Problem: Problem (object)
• 503: store_unavailable — the dependency is down; retryable
  • application/problem+json: Problem: Problem (object)

PUT /v1/admin/byok/{tenant_id}/{provider_id}

Store or rotate a tenant’s BYOK provider credential

Seals the tenant’s own provider credential (envelope encryption, AAD bound to tenant, provider and row). The value is accepted only in this body and never returned. Without a configured custody key the write is refused 503 rather than storing plaintext. A virtual key with byok_only routes only through these credentials and fails closed when one is missing or unusable; the platform credential is never substituted for a provider whose BYOK credential fails. Tenant-bound keys are refused 403. Operator (admin) scope.

• Operation id: putV1AdminByokTenantIdProviderId
• Scope: admin
• Exposure: operator
• Mutating: yes
• Auth: bearerAuth, operatorSession

Request

• Request body (application/json, required): BYOKPut: BYOKPut (object)

Field	Type	Required	Notes
enabled	boolean	no
label	string	no
secret	string	yes	the provider credential; sealed on receipt and never returned

Responses

• 200: OK
  • application/json: BYOKCredential: BYOKCredential (object)
• 400: schema_invalid — the request body or parameter failed validation
  • application/problem+json: Problem: Problem (object)
• 401: auth_missing — no virtual key or operator session
  • application/problem+json: Problem: Problem (object)
• 403: auth_scope — the credential lacks the route’s scope
  • application/problem+json: Problem: Problem (object)
• 404: resource_not_found — the addressed object does not exist
  • application/problem+json: Problem: Problem (object)
• 405: method_not_allowed — the path exists for another verb
  • application/problem+json: Problem: Problem (object)
• 429: rate_limited — the per-key or per-IP bucket is exhausted
  • application/problem+json: Problem: Problem (object)
• 500: internal — the store or process failed
  • application/problem+json: Problem: Problem (object)
• 501: not_implemented — the route is declared but not wired in this build
  • application/problem+json: Problem: Problem (object)
• 503: store_unavailable — the dependency is down; retryable
  • application/problem+json: Problem: Problem (object)