Skip to content

Read the AI inference subsystem configuration

GET
/admin/ai/config

Returns the operator-tuned AI subsystem snapshot: master enable switch, per-task routing preferences, fallback chains, privacy policy, default budget. Surfaces structural validation findings (missing concern in routing, lock-on- with-empty-local-providers, etc.) so the admin UI can render them inline.

Distinct from /admin/system/ai (the placeholder that holds the raw provider list). This is the typed config layer that drives the router + privacy gate

  • budget tracker.

Current AI config + validator findings

AI inference subsystem snapshot. Returned by GET /admin/ai/config; writable via PUT with the AIInferenceConfigWrite shape (the read shape carries findings + computed defaults that the write shape doesn’t include).

object
enabled
required

Master switch. Defaults to false on fresh install (operator opts in).

boolean
routing
required

Per-task default provider. Keys are concern names (complete | embed | transcribe | tag | caption); values are provider names registered via /admin/system/ai.

object
key
additional properties
string
fallback_chains
required

Ordered fallback list per concern. The router walks transient + rate-limit failures down the chain; permanent/budget/privacy errors short-circuit.

object
key
additional properties
Array<string>
privacy
required
object
lock_sensitive_to_local
required

When true, assets at sensitivity tier restricted or embargo route to local providers only. Defaults to true on fresh install.

boolean
local_providers
required

Provider names considered “local” for the gate above.

Array<string>
default_budget
required
object
soft_warning_usd
required

USD threshold at which a soft-warn audit event fires.

integer format: int64
hard_cap_usd
required

USD ceiling beyond which CheckBudgetBefore rejects calls with ai_budget_exhausted. Zero (the fresh-install default) fails-closed with cloud_budget_not_configured on the very first call until the operator raises it.

integer format: int64
findings

Validator findings against the current config (e.g. routing references a provider that isn’t registered). Empty when the config is clean.

Array<object>
object
code
required

Stable identifier (routing_missing_concern, privacy_lock_with_empty_local_list, routing_undefined_provider, etc.) the admin UI uses to render a localised message.

string
concern

Empty when the finding isn’t concern-specific.

string
Allowed values: complete embed transcribe tag caption
message
required

Operator-readable English fallback message.

string

Authentication required, missing, or invalid

object
error
required

Human-readable error summary

string
Example
the request could not be completed
Example
{
"error": "authentication required: sign in and retry with a valid session or API token"
}

Authenticated but missing required capabilities

object
error
required

Human-readable error summary

string
Example
the request could not be completed