Update any of the model-access fields
Every field is optional — only sent fields change; an empty body returns current state. Non-API models the org enabled in-app are preserved by the merge.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
Validation for PUT /v1/model-access — the public control-plane mirror of
the in-app Settings → Models page (Settings\UpdateModelAccessRequest).
Every field is optional (partial update): a client sends only what it wants
to change, and an empty body is a no-op. The accepted model vocabulary is
scoped to models exposing the api surface — the only ones a public API
consumer can invoke — while non-api models the org enabled in-app are
preserved untouched by the merge in {@see resolvedState()}.
All cross-field consistency (default ∈ enabled, no disabled-provider default, manual-mode chain rules) is checked against the resolved post-merge state, not the raw request body, so a partial change can't leave the org in an inconsistent state.
Not restricted to API-surface ids: the resolved default must be in the (post-merge) enabled list, which is enforced in withValidator(). Keeping it a bare string lets a client echo back a non-API default that is already enabled in-app without the round-trip 422-ing.
off, auto, manual claude-haiku-4-5, claude-opus-4-6, claude-opus-4-7, claude-sonnet-4-6, gpt-5.3-codex, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.5-pro anthropic, openai claude-haiku-4-5, claude-opus-4-6, claude-opus-4-7, claude-sonnet-4-6, gpt-5.3-codex, gpt-5.4, gpt-5.4-mini, gpt-5.5, gpt-5.5-pro