---
title: "Create access profile"
method: POST
path: "/api/access-profiles"
tags: ["Access Profiles"]
---

# Create access profile

`POST /api/access-profiles`

Creates a new access profile template. The profile is inactive until attached to a role.
No size limits are enforced on create; the limits apply on update.

## Request body

- object
  - `name` string, required
  - `description` string
  - `tags` string[]
  - `provider_configs` object[]
    - `id` integer
    - `provider_name` string, required — Provider identifier (`anthropic`, `openai`, `bedrock`, ...).
    - `all_models_allowed` boolean — If true, every model from this provider is allowed.
    - `allowed_models` string[] — Explicit model list. Empty array denies all models from the provider.
    - `budgets` object[]
      - `id` string
      - `max_limit` number, required — Cap in dollars (or tokens, depending on configured pricing).
      - `reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y', required — Reset duration for a budget or rate limit.
      - `scope` string — Set server-side. `total` for global budgets, `provider:<name>` for per-provider budgets.
      - `current_usage` number
      - `last_reset` string, date-time
    - `rate_limit` object
      - `id` string
      - `token_max_limit` number, nullable
      - `token_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
      - `request_max_limit` number, nullable
      - `request_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
      - `token_current_usage` number
      - `request_current_usage` number
  - `budgets` object[]
    - `id` string
    - `max_limit` number, required — Cap in dollars (or tokens, depending on configured pricing).
    - `reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y', required — Reset duration for a budget or rate limit.
    - `scope` string — Set server-side. `total` for global budgets, `provider:<name>` for per-provider budgets.
    - `current_usage` number
    - `last_reset` string, date-time
  - `rate_limit` object
    - `id` string
    - `token_max_limit` number, nullable
    - `token_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
    - `request_max_limit` number, nullable
    - `request_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
    - `token_current_usage` number
    - `request_current_usage` number
  - `calendar_aligned` boolean
  - `mcp_tool_groups` object[]
    - `tool_group_id` integer, required
  - `mcp_servers` object[]
    - `mcp_server_id` string, required
  - `mcp_tool_overrides` object[]
    - `mcp_client_id` string, required
    - `tool_name` string, required
    - `action` 'include' | 'exclude', required

## Response `201`

Profile created

- object
  - `access_profile` object
    - `id` integer
    - `name` string
    - `description` string, nullable
    - `is_active` boolean
    - `version` integer
    - `tags` string[]
    - `provider_configs` object[]
      - `id` integer
      - `provider_name` string, required — Provider identifier (`anthropic`, `openai`, `bedrock`, ...).
      - `all_models_allowed` boolean — If true, every model from this provider is allowed.
      - `allowed_models` string[] — Explicit model list. Empty array denies all models from the provider.
      - `budgets` object[]
        - `id` string
        - `max_limit` number, required — Cap in dollars (or tokens, depending on configured pricing).
        - `reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y', required — Reset duration for a budget or rate limit.
        - `scope` string — Set server-side. `total` for global budgets, `provider:<name>` for per-provider budgets.
        - `current_usage` number
        - `last_reset` string, date-time
      - `rate_limit` object
        - `id` string
        - `token_max_limit` number, nullable
        - `token_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
        - `request_max_limit` number, nullable
        - `request_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
        - `token_current_usage` number
        - `request_current_usage` number
    - `budgets` object[]
      - `id` string
      - `max_limit` number, required — Cap in dollars (or tokens, depending on configured pricing).
      - `reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y', required — Reset duration for a budget or rate limit.
      - `scope` string — Set server-side. `total` for global budgets, `provider:<name>` for per-provider budgets.
      - `current_usage` number
      - `last_reset` string, date-time
    - `rate_limit` object
      - `id` string
      - `token_max_limit` number, nullable
      - `token_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
      - `request_max_limit` number, nullable
      - `request_reset_duration` '1h' | '1d' | '1w' | '1M' | '1Y' — Reset duration for a budget or rate limit.
      - `token_current_usage` number
      - `request_current_usage` number
    - `calendar_aligned` boolean
    - `mcp_tool_groups` object[]
      - `tool_group_id` integer, required
    - `mcp_servers` object[]
      - `mcp_server_id` string, required
    - `mcp_tool_overrides` object[]
      - `mcp_client_id` string, required
      - `tool_name` string, required
      - `action` 'include' | 'exclude', required
    - `created_at` string, date-time
    - `updated_at` string, date-time

## Other responses

- `400` — Bad request
- `409` — A profile with the same name already exists.
- `500` — Internal server error

---

[API](https://skmtc.net/getbifrost/apis/bifrost-api.md) · [All operations](https://skmtc.net/getbifrost/apis/bifrost-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getbifrost/bifrost-api/versions/f8cab88f64ea/schema)