---
title: Provider Connections
summary: These endpoints allow you to create and manage provider connections, which supply the credentials <a href="https://www.fastly.com/documentation/reference/api/ai-runtime-control">AI Runtime Control</a> uses to reach an AI provider on your behalf. A provider connection is authenticated either with a provider API key or, for Amazon Bedrock, an AWS Identity and Access Management (IAM) role. Each customer account is limited to 25 provider connections.
url: https://www.fastly.com/documentation/reference/api/ai-runtime-control/provider-connections
---

These endpoints allow you to create and manage provider connections, which supply the credentials <a href="https://www.fastly.com/documentation/reference/api/ai-runtime-control">AI Runtime Control</a> uses to reach an AI provider on your behalf. A provider connection is authenticated either with a provider API key or, for Amazon Bedrock, an AWS Identity and Access Management (IAM) role. Each customer account is limited to 25 provider connections.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `auth_type` | string | The authentication type for this connection. |
| `base_url` | string | The base URL of the provider's API. Present only for <code>api-key</code> connections. |
| `created_at` | string | The date and time the connection was created, in RFC 3339 format. (Read-only) |
| `id` | string | The unique identifier of the provider connection. (Read-only) |
| `models` | array | The AI model identifiers this connection is allowed to use. |
| `name` | string | The display name of the provider connection. |
| `region` | string | The AWS region for Bedrock API requests. Present only for <code>aws-iam</code> connections. |
| `secret_id` | string | An opaque identifier for the secret material backing this connection. Not the secret itself. (Read-only) |
| `updated_at` | string | The date and time the connection was last updated, in RFC 3339 format. (Read-only) |
| `virtual_key_ids` | array | The IDs of the active virtual keys whose failover policy references this connection. Empty if no virtual key references it. (Read-only) |
| `api_key` | string | The provider's secret API key. |
| `customer_role_arn` | string | The ARN of the IAM role in your AWS account that AI Runtime Control assumes to access Bedrock. See <a href="https://www.fastly.com/documentation/reference/api/ai-runtime-control/providers#arc-get-bedrock-setup">get Bedrock setup information</a> for the role ARN and external ID your trust policy must reference. |
| `deleted_at` | string | The date and time the connection was deleted, in RFC 3339 format. Present only for deleted connections, which are returned only when <code>include_deleted</code> is <code>true</code>. (Read-only) |
| `sort` | string | The <code>sort</code> value used when making the request. |
| `total` | integer | The count of results matching the request. |
| `meta` | object | Metadata about the request. |

## API endpoints

### List provider connections

**GET** `/ai-runtime-control/v1/provider-connections`

List the provider connections belonging to your account.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `include_deleted` | boolean | query | No | Include deleted provider connections in the results. Deleted connections have a <code>deleted_at</code> value. |
| `sort` | string | query | No | Sort field. Prefix with <code>-</code> for descending order (e.g., <code>sort=-name</code>). |

### Create a provider connection

**POST** `/ai-runtime-control/v1/provider-connections`

Create a provider connection. Set <code>auth_type</code> to <code>api-key</code> (the default) to connect
with a provider's own API key, or to <code>aws-iam</code> to connect to Amazon Bedrock using an
AWS IAM role.
Accounts are limited to 25 provider connections. Creating a 26th connection returns a
409 response.

### Get a provider connection

**GET** `/ai-runtime-control/v1/provider-connections/{id}`

Retrieve a single provider connection.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `id` | string | path | Yes | The ID of the provider connection. |

### Delete a provider connection

**DELETE** `/ai-runtime-control/v1/provider-connections/{id}`

Delete a provider connection. Returns a 409 response if the connection is still
referenced by a virtual key's failover policy.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `id` | string | path | Yes | The ID of the provider connection. |

### Update a provider connection

**PATCH** `/ai-runtime-control/v1/provider-connections/{id}`

Update the attributes of a provider connection. Only the fields you include are
changed. Which fields you can set depends on the connection's existing <code>auth_type</code>:
<code>base_url</code> and <code>api_key</code> apply only to <code>api-key</code> connections, and <code>customer_role_arn</code>
and <code>region</code> apply only to <code>aws-iam</code> connections. <code>auth_type</code> itself cannot be changed.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `id` | string | path | Yes | The ID of the provider connection. |