# The ModelProviderService object

A governed external model-provider connection stored in Unity Catalog (e.g.
 an OpenAI API account, an Azure OpenAI deployment, an Amazon Bedrock
 account). Owns the provider type and the auth/configuration the platform
 needs to invoke that provider, and is referenced from
 `ExternalModelConfig.model_provider_service` on a ModelService.

 One ModelProviderService can back many ModelServices (e.g. an `openai_prod`
 provider serving multiple models); a single ModelService can fan out across
 multiple ModelProviderServices for traffic split or failover.

## Attributes

- `name` (string, Beta)
  Resource name of the provider service.
   Format: `model-provider-services/{catalog}.{schema}.{model_provider_service}`.
   Each `{...}` component is capped at 255 characters individually.
    Server-derived on Create from `parent` +
   `model_provider_service_id`; required and immutable on Update/Get/Delete.
- `owner` (string, Beta)
  The owner of the model provider service. Write-only; read owner via
   effective_owner.
- `effective_owner` (string, Beta)
  The resolved owner of the model provider service. Falls back to the
   caller's identity when `owner` is not explicitly set on creation.
- `metastore_id` (string, Beta)
  Metastore hosting the provider service.
- `create_time` (string, Beta)
  When the provider service was created.
- `created_by` (string, Beta)
  Creator identity.
- `update_time` (string, Beta)
  When the provider service was last modified.
- `updated_by` (string, Beta)
  Identity of the last updater.
- `comment` (string, Beta)
  User-provided description.
  Constraints: `<= 65536 characters`
- `etag` (string, Beta)
  Optimistic concurrency control token. Server-generated from the
   entity's state and returned on every read. To use it as an if-match
   precondition on a mutation, echo the last-read value back via the dedicated
   `etag` field on the Update / Delete request; the server rejects the mutation
   if the stored etag differs.
- `config` (object, Beta)
  Behavioral configuration: provider connection, model catalog, and
   passthrough policy. See `ModelProviderServiceConfig` for the per-field
   contract. Required on CreateModelProviderService; on Update it is required
   only when `config` (or a `config.*` subpath) appears in `update_mask`.
  - `provider_type` (string, Beta)
    Provider type discriminator. Required at create time; immutable after.
     Determines which variant of the `provider` oneof must be set. May not be
     changed via Update; attempts to include `config.provider_type` in
     `UpdateModelProviderServiceRequest.update_mask` are rejected.
    
     Required on CreateModelProviderService and immutable thereafter.
    Possible values: `EXTERNAL_MODEL_PROVIDER_TYPE_OPENAI`, `EXTERNAL_MODEL_PROVIDER_TYPE_AZURE_OPENAI`, `EXTERNAL_MODEL_PROVIDER_TYPE_ANTHROPIC`, `EXTERNAL_MODEL_PROVIDER_TYPE_AMAZON_BEDROCK`, `EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM`, `EXTERNAL_MODEL_PROVIDER_TYPE_MICROSOFT_FOUNDRY`, `EXTERNAL_MODEL_PROVIDER_TYPE_GEMINI_ENTERPRISE`
  - `openai` (object, Beta)
    - `direct` (object, Beta)
      - `api_key` (object, Beta)
        OpenAI API key. Required on Create. Supplied as inline plaintext via
         `ProviderSecret.plaintext`.
      - `organization` (string, Beta)
        Optional OpenAI organization ID. When set, the platform forwards it as
         the `OpenAI-Organization` header.
      - `base_url` (string, Beta)
        Optional custom base URL. Defaults to `https://api.openai.com/v1`. Use for
         OpenAI-API-compatible third-party endpoints or in-network proxies.
  - `azure_openai` (object, Beta)
    - `direct` (object, Beta)
      - `base_url` (string, Beta)
        Full Azure OpenAI endpoint base URL, e.g.
         `https://myresource.openai.azure.com`. Required on Create.
      - `api_key` (object, Beta)
        Azure OpenAI API key. Mutually exclusive with the Entra and
         service-credential modes. Supplied as inline plaintext via
         `ProviderSecret.plaintext`.
      - `service_credential` (object, Beta)
        Reference to a UC service credential authorizing Azure OpenAI requests. On
         Create the caller supplies `service_credential.name` in the AIP-122
         resource-name form `credentials/{name}`. Required on Create when using
         UC-service-credential auth; mutually exclusive with `api_key` and
         `entra_service_principal`. The credential is
         referenced by name; its value is not carried here. On read the resolved `id`
         and `is_deleted` are also populated. Only supported on Azure-hosted
         workspaces; Create requests from other clouds are rejected with
         INVALID_PARAMETER_VALUE.
      - `entra_service_principal` (object, Beta)
        Entra ID (service principal) auth. Mutually exclusive with `api_key` and
         `service_credential`.
  - `anthropic` (object, Beta)
    - `direct` (object, Beta)
      Direct (inline-credentials) form: caller supplies the API key in the
       request body. Required on Create unless `relayed` is set.
      - `api_key` (object, Beta)
        Anthropic API key. Required on Create. Sent as the `x-api-key` header on
         outbound requests. Supplied as inline plaintext via
         `ProviderSecret.plaintext`.
    - `relayed` (object, Beta)
      Relayed (credential-less) form: no Anthropic credential is stored. Each
       inference request instead carries the caller's own OAuth token, which the
       platform forwards to Anthropic on outbound requests. Mutually exclusive
       with `direct`; no `api_key` is required or persisted.
      - `plan_type` (string, Beta)
        Which Anthropic subscription tier the relayed token belongs to. Optional;
         when unset the MPS gets the full governance surface (see TEAM_ENTERPRISE).
         Immutable after Create, so the tier cannot be flipped in place.
        Possible values: `ANTHROPIC_RELAYED_PLAN_TYPE_MAX`, `ANTHROPIC_RELAYED_PLAN_TYPE_TEAM_ENTERPRISE`
  - `amazon_bedrock` (object, Beta)
    - `direct` (object, Beta)
      - `region` (string, Beta)
        AWS region where the Bedrock endpoint is hosted (e.g., `us-east-1`).
         Required on Create.
      - `service_credential` (object, Beta)
        Reference to a UC service credential authorizing Bedrock requests. On
         Create the caller supplies `service_credential.name` in the AIP-122
         resource-name form `credentials/{name}`. Required on Create when using
         UC-service-credential auth; mutually exclusive with `aws_access_key`. The
         credential is referenced by name; its value is not carried here. On read the
         resolved `id` and `is_deleted` are also populated. Only supported on AWS-hosted
         workspaces; Create requests from other clouds are rejected with
         INVALID_PARAMETER_VALUE.
      - `aws_access_key` (object, Beta)
        AWS access-key-pair auth. Mutually exclusive with `service_credential`.
  - `custom` (object, Beta)
    - `direct` (object, Beta)
      - `base_url` (string, Beta)
        Endpoint URL of the OpenAI-compatible service (e.g.,
         `https://api.example.com/v1`). Required on Create.
      - `api_key` (object, Beta)
        Bearer token forwarded as the `Authorization: Bearer ...` header on
         outbound requests. Supplied as inline plaintext via
         `ProviderSecret.plaintext`. Set this for bearer-token auth.
  - `microsoft_foundry` (object, Beta)
    - `direct` (object, Beta)
      - `base_url` (string, Beta)
        Microsoft AI Foundry endpoint URL. Required on Create.
      - `api_key` (object, Beta)
        Microsoft AI Foundry API key. Mutually exclusive with the Entra and
         service-credential modes. Supplied as inline plaintext via
         `ProviderSecret.plaintext`.
      - `service_credential` (object, Beta)
        Reference to a UC service credential authorizing Microsoft Foundry requests.
         On Create the caller supplies `service_credential.name` in the AIP-122
         resource-name form `credentials/{name}`. Required on Create when using
         UC-service-credential auth; mutually exclusive with `api_key` and
         `entra_service_principal`. The credential is
         referenced by name; its value is not carried here. On read the resolved `id`
         and `is_deleted` are also populated. Only supported on Azure-hosted
         workspaces; Create requests from other clouds are rejected with
         INVALID_PARAMETER_VALUE.
      - `entra_service_principal` (object, Beta)
        Entra ID (service principal) auth. Mutually exclusive with `api_key` and
         `service_credential`.
  - `gemini_enterprise` (object, Beta)
    - `direct` (object, Beta)
      - `api_key` (object, Beta)
        Google Gemini Enterprise API key. Required on Create when using API-key
         auth; mutually exclusive with `service_credential`. Supplied as inline
         plaintext via `ProviderSecret.plaintext`.
      - `project_id` (string, Beta)
        GCP project ID hosting the Gemini Enterprise endpoint. Required on Create.
      - `region` (string, Beta)
        GCP region of the Gemini Enterprise endpoint (e.g., `us-central1`).
         Required on Create.
  - `allow_all_targets` (boolean, Beta)
    When true, accepts any model exposed by the upstream provider; `targets`
     is not required and does not restrict routability. When false, only
     models listed in `targets` are routable.
  - `targets` (array of object, Beta)
    Routing targets this provider service exposes (provider-side model
     identifier + unified API types per entry). Required (>=1) when
     `allow_all_targets = false`; optional and additive when
     `allow_all_targets = true`. References from `ExternalModelConfig.target`
     must match an entry here unless `allow_all_targets = true`.
    - `model` (string, Beta)
      Provider-side model identifier (e.g. "gpt-5", "claude-opus-4-7"). This is
       a string on the LLM provider's side, not a UC entity. The UC governance
       hook for external destinations is the ModelProviderService referenced by
       `ExternalModelConfig.model_provider_service`, not the model itself.
    - `native_api_types` (array of string, Beta)
      Provider-native API types the model supports (e.g.
       "openai/v1/chat/completions"). Used by the platform for request/response
       translation from the unified API type. At most 64 entries of at most 256
       characters each; the list is persisted into the destination binding's
       bounded storage envelope.
  - `forward_headers` (boolean, Beta)
    Whether to forward incoming request headers to the upstream provider.
     Applies to managed (multi-model) requests as well as passthrough requests
     served by this provider service. Governance-level decision by the provider
     service owner; not selectable per inference call.
  - `forward_query_parameters` (boolean, Beta)
    Whether to forward incoming request query parameters to the upstream
     provider. Same trust-boundary semantics as `forward_headers`.
  - `forward_unmanaged_paths` (boolean, Beta)
    Whether to forward request paths that fall outside this service's managed
     API set to the upstream provider as opaque passthrough. When true,
     requests addressed to subpaths not recognized by the managed API surface
     are proxied to the upstream provider over the same provider connection.
     When false, only managed-API paths are served. Governance-level decision
     by the provider service owner; expanding this expands the trust boundary
     that the ModelProviderService exposes.
  - `rate_limits` (array of object, Beta)
    Rate limits applied when this provider service is invoked directly. When
     it is invoked through a model service, the model service's own
     `rate_limits` apply instead. Mirrors `ModelServiceConfig.rate_limits` /
     `McpServiceConfig.rate_limits`.
    - `key` (string, Beta)
      Scope key. Determines whether `principal` is required.
      Possible values: `RATE_LIMIT_KEY_USER`, `RATE_LIMIT_KEY_USER_GROUP`, `RATE_LIMIT_KEY_SERVICE_PRINCIPAL`, `RATE_LIMIT_KEY_SERVICE`, `RATE_LIMIT_KEY_USER_DEFAULT`, `RATE_LIMIT_KEY_REQUEST_TAG`
    - `renewal_period` (string, Beta)
      Renewal period.
      Possible values: `RATE_LIMIT_RENEWAL_PERIOD_MINUTE`, `RATE_LIMIT_RENEWAL_PERIOD_HOUR`
    - `principal` (string, Beta)
      Principal this limit applies to: user email, group name, or service
       principal application ID. Required unless `key` is
       `RATE_LIMIT_KEY_SERVICE`, `RATE_LIMIT_KEY_USER_DEFAULT`, or
       `RATE_LIMIT_KEY_REQUEST_TAG` (which must not set a principal).
    - `requests` (int64, Beta)
      Max requests allowed within a renewal period. Leave unset for no request limit.
    - `tokens` (int64, Beta)
      Max tokens allowed within a renewal period. Leave unset for no token limit.
    - `request_tag_key` (string, Beta)
      Request tag key this limit applies to. Required when `key` is
       `RATE_LIMIT_KEY_REQUEST_TAG`, forbidden otherwise.
    - `request_tag_value` (string, Beta)
      Request tag value this limit applies to. Only valid when `key` is
       `RATE_LIMIT_KEY_REQUEST_TAG`. Leave unset to apply the limit to every
       value of `request_tag_key` (an any-value default); a set value is a
       specific override for that value.
  - `inference_table` (object, Beta)
    Inference table configuration for payload logging when this provider
     service is invoked directly. When it is invoked through a model service,
     the model service's own inference table captures the invocation instead.
     Mirrors `ModelServiceConfig.inference_table` /
     `AgentServiceConfig.inference_table`.
    - `parent` (string, Beta)
      Parent UC schema where the inference table is created.
       Format: `schemas/{catalog}.{schema}`. Set at create time and immutable
       thereafter; changing it on an existing service is rejected.
    - `table_name_prefix` (string, Beta)
      Prefix for the inference-table's UC-registered name. The actual leaf name UC
       stores is `<table_name_prefix>_payload`; the `_payload` suffix is appended
       automatically. To find the actual UC table after Create, read the `table`
       field on the response. Defaults to `<model_service_name>_payload` when unset.
       Set at create time and immutable thereafter; changing it on an existing
       service is rejected.
    - `disabled` (boolean, Beta)
      Indicates whether payload logging is disabled (opt-out). Unset means that
       payload logging is active (the on-by-default state coincides with the proto
       zero-value, so the server never fills this field for a client that leaves it
       unset). Set `disabled = true` to pause runtime logging while keeping the
       sub-message attached (preserving `parent` and `table_name_prefix` for a
       later flip back to active). `parent` remains required either way.
    - `table` (string, Beta)
      Resolved UC table for payload logs.
       Format: `tables/{catalog}.{schema}.{table}`.
    - `is_deleted` (boolean, Beta)
      True when the bound inference TABLE has been deleted but the parent
       service still references it. The dangling reference is surfaced (not
       silently dropped) so callers can see the broken dependency. AI Gateway
       payload logging fails closed in this state.

## Example

```json
{
  "name": "string",
  "owner": "string",
  "effective_owner": "string",
  "metastore_id": "string",
  "create_time": "string",
  "created_by": "string",
  "update_time": "string",
  "updated_by": "string",
  "comment": "string",
  "etag": "string",
  "config": {
    "provider_type": "string",
    "openai": {},
    "azure_openai": {},
    "anthropic": {},
    "amazon_bedrock": {},
    "custom": {},
    "microsoft_foundry": {},
    "gemini_enterprise": {},
    "allow_all_targets": true,
    "targets": [
      {}
    ],
    "forward_headers": true,
    "forward_query_parameters": true,
    "forward_unmanaged_paths": true,
    "rate_limits": [
      {}
    ],
    "inference_table": {}
  }
}
```