> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airctrl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Create one independently managed protection for an external provider key



## OpenAPI

````yaml /api-reference/openapi.json post /oauth/protections
openapi: 3.0.0
info:
  title: AIRCTRL API
  description: >-
    Programmatic access to AIRCTRL. Record values are encrypted by the client,
    so the API stores ciphertext and encrypted keys instead of plaintext record
    values.
  version: '1'
  contact: {}
servers:
  - url: https://api.airctrl.dev/v1
    description: Production
  - url: https://api.staging.airctrl.dev/v1
    description: QA
security: []
tags:
  - name: Context
    description: Find the accounts available to the caller.
  - name: Projects
    description: Create and manage projects.
  - name: Records
    description: Store and use client-encrypted records.
  - name: Audit
    description: Read record activity and access history.
  - name: Providers
    description: Discover supported AI providers.
  - name: Provider Credentials
    description: Manage encrypted provider credentials.
  - name: Gateways
    description: Create and operate AI gateways.
  - name: Usage
    description: Read gateway usage and spend data.
  - name: Service Accounts
    description: Read Service Account metadata and grant records.
paths:
  /oauth/protections:
    post:
      tags:
        - OAuth
      summary: Create one independently managed protection for an external provider key
      parameters:
        - in: header
          name: Idempotency-Key
          required: true
          schema:
            type: string
            minLength: 16
            maxLength: 200
          description: >-
            Caller-generated operation key. Same key and request replay the same
            result; a different request returns 409.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - externalResourceId
                - providerId
                - providerKey
                - gatewayName
                - models
              properties:
                externalResourceId:
                  type: string
                  minLength: 1
                  maxLength: 255
                providerId:
                  type: string
                  format: uuid
                providerKey:
                  type: string
                  writeOnly: true
                  minLength: 1
                  maxLength: 2000
                credentialLabel:
                  type: string
                  minLength: 1
                  maxLength: 100
                gatewayName:
                  type: string
                  minLength: 3
                  maxLength: 100
                models:
                  type: array
                  minItems: 1
                  uniqueItems: true
                  items:
                    type: string
                settings:
                  type: object
                  properties:
                    spendLimit:
                      type: number
                      minimum: 0
                      multipleOf: 0.01
                      nullable: true
                    spendWindow:
                      type: string
                      enum:
                        - daily
                        - weekly
                        - monthly
                    rateLimitPerMin:
                      type: integer
                      minimum: 1
                      nullable: true
                    loggingEnabled:
                      type: boolean
                    logBodies:
                      type: boolean
                    guardrailMode:
                      type: string
                      enum:
                        - 'off'
                        - flag
                        - redact
                        - block
                  additionalProperties: false
                otel:
                  type: object
                  required:
                    - enabled
                    - endpoint
                  properties:
                    enabled:
                      type: boolean
                    endpoint:
                      type: string
                      format: uri
                      pattern: ^https://
                      maxLength: 2048
                      description: >-
                        Public HTTPS OTLP/HTTP base URL; private, loopback and
                        unsafe upstreams are rejected.
                    exportMetrics:
                      type: boolean
                    exportTraces:
                      type: boolean
                    exportBodies:
                      type: boolean
                    headers:
                      type: object
                      nullable: true
                      maxProperties: 32
                      additionalProperties:
                        maxLength: 2048
                        type: string
                      description: >-
                        At most 32 HTTP token-name headers. Host and
                        Content-Length are forbidden. Omit on PATCH to preserve
                        encrypted headers; null or an empty object clears them.
                  additionalProperties: false
              additionalProperties: false
      responses:
        '201':
          description: >-
            Protection metadata bound to one external resource. Provider secrets
            are never returned; creation, runtime-token rotation and
            reactivation include the new runtime token plaintext once.
          content:
            application/json:
              schema:
                type: object
                required:
                  - ok
                  - data
                properties:
                  ok:
                    type: boolean
                    enum:
                      - true
                  data:
                    type: object
                    required:
                      - protectionId
                      - externalResourceId
                      - project
                      - serviceAccount
                      - providerCredential
                      - gateway
                      - gatewayToken
                      - state
                      - accessRevokedAt
                      - connectionSuspendedAt
                      - createdAt
                    properties:
                      protectionId:
                        type: string
                        format: uuid
                      externalResourceId:
                        type: string
                      project:
                        type: object
                        required:
                          - id
                          - name
                        properties:
                          id:
                            type: string
                            format: uuid
                          name:
                            type: string
                      serviceAccount:
                        type: object
                        required:
                          - id
                          - name
                          - active
                        properties:
                          id:
                            type: string
                            format: uuid
                          name:
                            type: string
                          active:
                            type: boolean
                      providerCredential:
                        type: object
                        required:
                          - id
                          - providerId
                          - providerSlug
                          - label
                        properties:
                          id:
                            type: string
                            format: uuid
                          providerId:
                            type: string
                            format: uuid
                          providerSlug:
                            type: string
                          label:
                            type: string
                      gateway:
                        type: object
                        required:
                          - id
                          - slug
                          - name
                          - models
                          - settings
                        properties:
                          id:
                            type: string
                            format: uuid
                          slug:
                            type: string
                          name:
                            type: string
                          models:
                            type: array
                            items:
                              type: string
                          settings:
                            type: object
                            properties:
                              spendLimit:
                                type: number
                                minimum: 0
                                multipleOf: 0.01
                                nullable: true
                              spendWindow:
                                type: string
                                enum:
                                  - daily
                                  - weekly
                                  - monthly
                              rateLimitPerMin:
                                type: integer
                                minimum: 1
                                nullable: true
                              loggingEnabled:
                                type: boolean
                              logBodies:
                                type: boolean
                              guardrailMode:
                                type: string
                                enum:
                                  - 'off'
                                  - flag
                                  - redact
                                  - block
                            additionalProperties: false
                            required:
                              - spendLimit
                              - spendWindow
                              - rateLimitPerMin
                              - loggingEnabled
                              - logBodies
                              - guardrailMode
                      gatewayToken:
                        type: object
                        required:
                          - id
                          - prefix
                        properties:
                          id:
                            type: string
                            format: uuid
                          prefix:
                            type: string
                          plaintext:
                            type: string
                            writeOnly: true
                            description: >-
                              Returned once on creation, rotation or
                              reactivation.
                      state:
                        type: string
                        enum:
                          - active
                          - connection_suspended
                          - revoked
                        description: >-
                          connection_suspended means the parent OAuth connection
                          was disconnected; revoked means this protection was
                          explicitly revoked.
                      accessRevokedAt:
                        type: string
                        format: date-time
                        nullable: true
                      connectionSuspendedAt:
                        type: string
                        format: date-time
                        nullable: true
                      createdAt:
                        type: string
                        format: date-time
                      replayed:
                        type: boolean
        '400':
          description: Invalid key, model or request.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
        '403':
          description: Scope, RBAC, subscription, entitlement or quota denial.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
        '409':
          description: Idempotency conflict, duplicate external resource or gateway slug.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
        '429':
          description: Provisioning rate limit exceeded.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
        '502':
          description: Provider validation/model discovery unavailable; no writes occurred.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    oneOf:
                      - type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          message:
                            type: string
                        required:
                          - code
                          - message
                  code:
                    type: string
                  message:
                    type: string
                  error_description:
                    type: string
                  requestId:
                    type: string
                additionalProperties: true
      security:
        - oauth2:
            - protections:provision
components:
  securitySchemes:
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://app.airctrl.dev/oauth/authorize
          tokenUrl: https://api.airctrl.dev/v1/oauth/token
          refreshUrl: https://api.airctrl.dev/v1/oauth/token
          scopes:
            protections:provision: >-
              Atomically create the disclosed AIRCTRL resources for a protected
              external key.
            protections:read: Read only resources created by this OAuth connection.
            protections:update: >-
              Update allowlisted settings only on gateways created by this OAuth
              connection.
            protections:manage: >-
              Revoke, reactivate or rotate secrets only for protections created
              by this OAuth connection.
            protections:read-logs: >-
              Read request metadata only for protections created by this OAuth
              connection.
            protections:read-spend: >-
              Read token usage and spend only for protections created by this
              OAuth connection.
            offline_access: Receive rotating refresh tokens.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.