subako model-provider

Model providers: the upstream a published agent version runs against

`subako model-provider`

Model providers: the upstream a published agent version runs against

Usage

Usage: subako model-provider <COMMAND>

Subcommands

subako model-provider create
subako model-provider workload-identity
subako model-provider list
subako model-provider formats
subako model-provider show
subako model-provider update
subako model-provider delete

`subako model-provider create`

Create a provider in the selected workspace. Its API key is read from stdin, so it stays out of your shell history and the process list – unless it reaches Bedrock as a role in your own AWS account (--aws-role-arn), the Claude API under a federation rule in your own Anthropic organization (--anthropic-federation-rule-id), or the OpenAI API through a workload identity provider in your own OpenAI organization (--openai-identity-provider-id), which take no key at all. At most one of the three is named

Usage

Usage: subako model-provider create [OPTIONS] --format <FORMAT> --display-name <DISPLAY_NAME> --base-url <BASE_URL>

Options

`--format <FORMAT>`

Upstream protocol the provider speaks. An agent version may only publish against a provider matching its model’s format

Required.
Possible values:
- anthropic
- openai_responses

`--display-name <DISPLAY_NAME>`

Label describing the provider

Required.

`--base-url <BASE_URL>`

Upstream base URL, spelled the way this format’s own client spells it (e.g. https://api.anthropic.com)

Required.

`--description <DESCRIPTION>`

Longer note about the provider. Empty when absent

`--aws-role-arn <AWS_ROLE_ARN>`

An IAM role in your AWS account to call Bedrock as, instead of an API key. Its trust policy must admit this workspace’s subject alone; model-provider workload-identity prints what to trust

`--aws-region <AWS_REGION>`

The region the role’s calls are signed for, which --base-url’s host must name

`--anthropic-federation-rule-id <ANTHROPIC_FEDERATION_RULE_ID>`

A federation rule in your Anthropic organization (fdrl_...) to call the Claude API under, instead of an API key. Its match must admit this workspace’s subject alone; model-provider workload-identity prints what to match

`--anthropic-organization-id <ANTHROPIC_ORGANIZATION_ID>`

The Anthropic organization the rule belongs to, a UUID

`--anthropic-service-account-id <ANTHROPIC_SERVICE_ACCOUNT_ID>`

The service account (svac_...) the calls act as

`--anthropic-workspace-id <ANTHROPIC_WORKSPACE_ID>`

The Anthropic workspace (wrkspc_...) the calls are scoped to; required when the rule is enabled for more than one

`--openai-identity-provider-id <OPENAI_IDENTITY_PROVIDER_ID>`

A workload identity provider in your OpenAI organization to call the OpenAI API through, instead of an API key. Its mapping to the service account must admit this workspace’s subject alone; model-provider workload-identity prints what to map

`--openai-service-account-id <OPENAI_SERVICE_ACCOUNT_ID>`

The service account the calls act as, in the project they bill to

`--profile <PROFILE>`

Credential profile to act as. Defaults to the current one

`--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

`--help`

Print help

Short option: -h.

`subako model-provider workload-identity`

Print what an AWS account or an Anthropic or OpenAI organization registers and trusts so that a provider can reach Bedrock, the Claude API, or the OpenAI API as the selected workspace, with no key handed over

Usage

Usage: subako model-provider workload-identity [OPTIONS]

Options

`--profile <PROFILE>`

Credential profile to act as. Defaults to the current one

`--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

`--help`

Print help

Short option: -h.

`subako model-provider list`

List the providers the selected workspace may publish against

Usage

Usage: subako model-provider list [OPTIONS]

Options

`--profile <PROFILE>`

Credential profile to act as. Defaults to the current one

`--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

`--help`

Print help

Short option: -h.

`subako model-provider formats`

List the formats this server accepts, which --format must name one of

Usage

Usage: subako model-provider formats [OPTIONS]

Options

`--profile <PROFILE>`

Credential profile to act as. Defaults to the current one

`--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

`--help`

Print help

Short option: -h.

`subako model-provider show`

Read one provider as the selected workspace sees it. Never its credential

Usage

Usage: subako model-provider show [OPTIONS] <MODEL_PROVIDER_ID>

Arguments

`<MODEL_PROVIDER_ID>`

Provider id, as model-provider list shows it

Required.

Options

`--profile <PROFILE>`

Credential profile to act as. Defaults to the current one

`--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

`--help`

Print help

Short option: -h.

`subako model-provider update`

Change a provider’s label, description, endpoint, or API key. What is not named is left as it stands

Usage

Usage: subako model-provider update [OPTIONS] <MODEL_PROVIDER_ID>

Arguments

`<MODEL_PROVIDER_ID>`

Provider id, as model-provider list shows it

Required.

Options

`--name <NAME>`

New label for the provider

`--description <DESCRIPTION>`

New note about the provider

`--base-url <BASE_URL>`

New upstream base URL, spelled the way this format’s own client spells it

`--rotate-key`

Replace the stored API key with one read from stdin, so it stays out of your shell history and the process list. The provider keeps its id, so published agent versions go on resolving

Default: false.

`--profile <PROFILE>`

Credential profile to act as. Defaults to the current one

`--credentials-file <CREDENTIALS_FILE>`

Path to the credentials file. Defaults to SUBAKO_CREDENTIALS_FILE, then ~/.config/subako/credentials.json.

`--help`

Print help

Short option: -h.

`subako model-provider delete`

Permanently delete a provider, taking its stored API key with it. Existing sessions remain; further calls using this provider are refused

Usage

Usage: subako model-provider delete [OPTIONS] <MODEL_PROVIDER_ID>

Arguments

`<MODEL_PROVIDER_ID>`

Provider id, as model-provider list shows it

Required.

Options

`--yes`

Skip the typed confirmation. For scripts that have already asked

Default: false.

Short option: -h.