# TenantProviders

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/http-api/tenantproviders/
> Summary: The tenantproviders endpoints of the Tracon HTTP API — 6 operations.

6 operations. `{prefix}` is the route prefix passed to
`MapTracon`; the template uses `/tracon`.

## GET {prefix}/api/tenants/{tenantId}/egress

**Operation ID:** `TraconGetTenantEgressPolicy`

**Returns a tenant's model provider egress policy.**

'allowedProviders: null' means the tenant is UNRESTRICTED (no policy saved); an empty or populated array means the tenant may call only those providers. A tenant other than the caller's own requires platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → [`TenantEgressPolicyResponse`](/http-api/schemas/tenantegresspolicyresponse/) | — |

## PUT {prefix}/api/tenants/{tenantId}/egress

**Operation ID:** `TraconSaveTenantEgressPolicy`

**Creates or replaces a tenant's egress policy.**

Saving a policy is an ADDITIVE restriction: a tenant with no policy is unrestricted, and this call is the only way that changes. An agent definition naming a provider outside the saved list is rejected at compile time, not only at call time. An empty 'allowedProviders' array allows NO provider — it is not the same as having no policy; use DELETE to return to unrestricted. The 'tenantId' route value is folded to lower case before the policy is saved, so a policy written for 'Acme' is the policy the runtime finds for 'acme'. A tenant other than the caller's own requires platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |

**Request body** (required):

- `application/json` → [`TenantEgressPolicyRequest`](/http-api/schemas/tenantegresspolicyrequest/)

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → [`TenantEgressPolicyResponse`](/http-api/schemas/tenantegresspolicyresponse/) | — |

## DELETE {prefix}/api/tenants/{tenantId}/egress

**Operation ID:** `TraconDeleteTenantEgressPolicy`

**Deletes a tenant's egress policy.**

After deletion the tenant is unrestricted again — the same state as before any policy was ever saved. A tenant other than the caller's own requires platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **204** No Content | — | — |

## GET {prefix}/api/tenants/{tenantId}/providers

**Operation ID:** `TraconListTenantProviderBindings`

**Lists a tenant's model provider bindings.**

The response carries neither the credential value nor its configuration key's value — only the key's NAME and whether it currently resolves ('resolved'). This is the diagnosis path for 'I set the key but it does not work'. The 'tenantId' route value is matched case-insensitively: it is folded to lower case before it reaches the store, so 'Acme' and 'acme' are one tenant on every storage engine. A tenant other than the caller's own requires platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → array of [`TenantProviderBindingResponse`](/http-api/schemas/tenantproviderbindingresponse/) | — |

## PUT {prefix}/api/tenants/{tenantId}/providers/{provider}

**Operation ID:** `TraconSaveTenantProviderBinding`

**Creates or replaces a tenant's binding for a provider.**

The body carries only the configuration key's NAME the value is read from at call time, never the value itself. The name must be under the configured allowed prefix and inside the tenant's own key space — '{prefix}{tenantId}:...'; a flat name directly under the prefix belongs to the default tenant (400 otherwise). The provider must be allowed by the tenant's egress policy, if one is defined (400 otherwise). A tenant other than the caller's own requires platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |
| `provider` | path | yes | `string` | — |

**Request body** (required):

- `application/json` → [`TenantProviderBindingRequest`](/http-api/schemas/tenantproviderbindingrequest/)

| Response | Body | Headers |
|---|---|---|
| **200** OK | `application/json` → [`TenantProviderBindingResponse`](/http-api/schemas/tenantproviderbindingresponse/) | — |

## DELETE {prefix}/api/tenants/{tenantId}/providers/{provider}

**Operation ID:** `TraconDeleteTenantProviderBinding`

**Deletes a tenant's binding for a provider.**

After deletion, calls for that provider use the setup-time global credential again. A tenant other than the caller's own requires platform authority (403 otherwise).

**Authorization:** bearer authentication; `Admin` role policy when that policy is registered; `SecurityAdmin` API-key scope.

| Parameter | In | Required | Type | Description and rules |
|---|---|---|---|---|
| `tenantId` | path | yes | `string` | — |
| `provider` | path | yes | `string` | — |

| Response | Body | Headers |
|---|---|---|
| **204** No Content | — | — |