> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update any of the model-access fields

> Every field is optional — only sent fields change; an empty body
returns current state. Non-API models the org enabled in-app are
preserved by the merge.



## OpenAPI

````yaml /openapi/v1.json patch /model-access
openapi: 3.1.0
info:
  title: HASP AI API
  version: '2026-07-12'
  description: >-
    The HASP Public AI API is the regulated-AI substrate for healthcare and
    other

    regulated industries — identity, policy, audit, compliance, and PHI handling

    for AI inference, exposed via two surfaces:


    - **Native (`/v1/ai/*`)**: HASP-native chat with full event taxonomy, run
    lifecycle,
      and PHI metadata.
    - **Anthropic-compat (`/v1/messages`)**: Drop-in replacement for
    `@anthropic-ai/sdk` —
      change only `baseURL`. All Gateway compliance checks (BAA, credits, PHI policy) apply.

    All requests require an API key (`Authorization: Bearer
    hasp_api_live_<key>`). See

    [Authentication](https://docs.usehasp.com/ai-api/authentication) for key
    management.
servers:
  - url: https://api.usehasp.com/v1
    description: Production
security:
  - http: []
paths:
  /model-access:
    patch:
      tags:
        - ModelAccess
      summary: Update any of the model-access fields
      description: |-
        Every field is optional — only sent fields change; an empty body
        returns current state. Non-API models the org enabled in-app are
        preserved by the merge.
      operationId: v1.control.model_access.update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateModelAccessRequest'
      responses:
        '200':
          description: Updated model-access settings.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  data:
                    type: object
                    properties:
                      allowed_model_ids:
                        type: array
                        items:
                          type: string
                      default_model_id:
                        type:
                          - string
                          - 'null'
                      disallowed_providers:
                        type: array
                        items:
                          type: string
                      fallback_mode:
                        type: string
                      fallback_chain:
                        type: array
                        items:
                          type: string
                    required:
                      - allowed_model_ids
                      - default_model_id
                      - disallowed_providers
                      - fallback_mode
                      - fallback_chain
                required:
                  - success
                  - data
        '401':
          description: Bearer token is missing, malformed, or revoked.
          content:
            application/json:
              schema:
                type: object
                example:
                  success: false
                  error:
                    type: authentication
                    code: INVALID_API_KEY
                    message: Bearer token is missing, malformed, or revoked.
                    param: null
                    details: null
                    retryable: false
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
                  meta:
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
        '403':
          description: >-
            The caller is authenticated but lacks the scope or capability this
            route requires.
          content:
            application/json:
              schema:
                type: object
                example:
                  success: false
                  error:
                    type: permission
                    code: MISSING_SCOPE
                    message: >-
                      The caller is authenticated but lacks the scope or
                      capability this route requires.
                    param: null
                    details: null
                    retryable: false
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
                  meta:
                    request_id: 01JQREQ7XZQK5N6PZ1VVXHYB8T
        '422':
          $ref: '#/components/responses/ValidationException'
components:
  schemas:
    UpdateModelAccessRequest:
      type: object
      description: >-
        Validation for `PUT /v1/model-access` — the public control-plane mirror
        of

        the in-app Settings → Models page (`Settings\UpdateModelAccessRequest`).


        Every field is optional (partial update): a client sends only what it
        wants

        to change, and an empty body is a no-op. The accepted model vocabulary
        is

        scoped to models exposing the `api` surface — the only ones a public API

        consumer can invoke — while non-`api` models the org enabled in-app are

        preserved untouched by the merge in {@see resolvedState()}.


        All cross-field consistency (default ∈ enabled, no disabled-provider
        default,

        manual-mode chain rules) is checked against the *resolved* post-merge
        state,

        not the raw request body, so a partial change can't leave the org in an

        inconsistent state.
      properties:
        default_model_id:
          type: string
          description: |-
            Not restricted to API-surface ids: the resolved default must be in
            the (post-merge) enabled list, which is enforced in withValidator().
            Keeping it a bare string lets a client echo back a non-API default
            that is already enabled in-app without the round-trip 422-ing.
        fallback_mode:
          type: string
          enum:
            - 'off'
            - auto
            - manual
        allowed_model_ids:
          type: array
          items:
            type: string
            enum:
              - claude-haiku-4-5
              - claude-opus-4-6
              - claude-opus-4-7
              - claude-sonnet-4-6
              - gpt-5.3-codex
              - gpt-5.4
              - gpt-5.4-mini
              - gpt-5.5
              - gpt-5.5-pro
        disallowed_providers:
          type: array
          items:
            type: string
            enum:
              - anthropic
              - openai
        fallback_chain:
          type: array
          items:
            type: string
            enum:
              - claude-haiku-4-5
              - claude-opus-4-6
              - claude-opus-4-7
              - claude-sonnet-4-6
              - gpt-5.3-codex
              - gpt-5.4
              - gpt-5.4-mini
              - gpt-5.5
              - gpt-5.5-pro
      title: UpdateModelAccessRequest
  responses:
    ValidationException:
      description: Validation error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
                description: Errors overview.
              errors:
                type: object
                description: A detailed description of each field that failed validation.
                additionalProperties:
                  type: array
                  items:
                    type: string
            required:
              - message
              - errors
  securitySchemes:
    http:
      type: http
      scheme: bearer

````