---
title: "Update configuration"
method: PUT
path: "/api/config"
tags: ["Configuration"]
---

# Update configuration

`PUT /api/config`

Updates the Bifrost configuration. Supports hot-reloading of certain settings
like drop_excess_requests. Some settings may require a restart to take effect.

## Request body

- UpdateConfigRequest — Update configuration request
  - `client_config` object — Client configuration
    - `drop_excess_requests` boolean — Whether to drop excess requests when rate limited
    - `prometheus_labels` string[] — Custom Prometheus labels
    - `allowed_origins` string[] — Allowed CORS origins
    - `initial_pool_size` integer — Initial connection pool size
    - `enable_logging` boolean — Whether logging is enabled
    - `disable_content_logging` boolean — Whether content logging is disabled
    - `allow_per_request_content_storage_override` boolean — Allow individual requests to override content storage via the x-bf-disable-content-logging header or context key. When false (default), per-request overrides are ignored.
    - `allow_per_request_raw_override` boolean — Allow individual requests to override raw request/response visibility via the x-bf-send-back-raw-request and x-bf-send-back-raw-response headers. When false (default), provider-level settings are authoritative and per-request overrides are ignored.
    - `enforce_auth_on_inference` boolean — Whether to enforce virtual key authentication on inference requests
    - `enforce_governance_header` boolean — Deprecated: use enforce_auth_on_inference instead
    - `max_request_body_size_mb` integer — Maximum request body size in MB
    - `compat` object — Compat plugin configuration
      - `convert_text_to_chat` boolean — Convert text completion requests to chat
      - `convert_chat_to_responses` boolean — Convert chat completion requests to responses
      - `should_drop_params` boolean — Drop unsupported parameters based on model catalog
      - `should_convert_params` boolean — Converts model parameter values that are not supported by the model
    - `log_retention_days` integer — Number of days to retain logs
    - `header_filter_config` object — Header filter configuration
      - `allowlist` string[]
      - `denylist` string[]
    - `mcp_agent_depth` integer — Depth of MCP agent
    - `mcp_tool_execution_timeout` integer — Timeout for MCP tool execution in seconds
    - `mcp_code_mode_binding_level` string — Binding level for MCP code mode
    - `required_headers` string[] — Headers that must be present on every request. Requests missing any of these headers are rejected with 400. Case-insensitive matching.
    - `logging_headers` string[] — Headers to capture in log metadata. Values are extracted from incoming requests and stored in the metadata field of log entries. Case-insensitive matching. No restart required.
    - `mcp_external_client_url` union — Public base URL Bifrost uses as the redirect_uri when acting as an OAuth client to upstream MCP servers (Notion, Jira, etc.). Set when Bifrost's callback endpoint is reached via a different URL than its server-side metadata. Supports env var syntax ("env.MY_VAR").
      - string — Plain URL or env var reference (e.g. "env.MY_VAR")
      - object
        - `value` string
        - `env_var` string
        - `from_env` boolean
    - `mcp_server_auth_mode` 'headers' | 'both' | 'oauth' — How /mcp authenticates inbound MCP clients. 'headers' (default): VK/api-key/session headers only, discovery disabled. 'both': accepts header credentials and Bifrost-issued JWTs, discovery enabled. 'oauth': Bifrost JWTs only — disables VK/header MCP access.
    - `oauth2_server_config` object — OAuth2 authorization server settings for /mcp. Only relevant when mcp_server_auth_mode is 'both' or 'oauth'.
      - `issuer_url` union — Stable public URL advertised as the OAuth2 AS issuer in discovery documents and the JWT iss claim. Required for multi-host deployments; single-host can omit it (falls back to the request Host header). Supports env var syntax ("env.MY_VAR").
        - string — Plain URL or env var reference (e.g. "env.MY_VAR")
        - object
          - `value` string
          - `env_var` string
          - `from_env` boolean
      - `auth_code_ttl` integer — Lifetime of the single-use authorization code in seconds (default 300, max 900 = 15 minutes).
      - `access_token_ttl` integer — Lifetime of the issued JWT Bearer token in seconds (default 600).
      - `disable_vk_identity` boolean — Require identity-provider login: virtual-key identity is removed from the consent flow, and existing virtual-key-mode grants are rejected at /mcp and denied on refresh. Only meaningful when mcp_server_auth_mode is 'oauth' and an identity provider is configured. Anonymous session identity is governed separately by enforce_auth_on_inference.
  - `framework_config` object — Framework configuration
    - `id` integer — Unique identifier for the framework config
    - `pricing_url` string — URL for pricing data
    - `pricing_sync_interval` integer — Pricing sync interval in seconds
  - `auth_config` object — Authentication configuration
    - `admin_username` string
    - `admin_password` string — Password (redacted as <redacted> in responses)
    - `is_enabled` boolean
    - `disable_auth_on_inference` boolean — Deprecated and ignored. Use client_config.enforce_auth_on_inference instead.

## Response `200`

Configuration updated successfully

- SuccessResponse — Generic success response
  - `status` string
  - `message` string

## Other responses

- `400` — Bad request
- `500` — Internal server error

---

[API](https://skmtc.net/getbifrost/apis/bifrost-api.md) · [All operations](https://skmtc.net/getbifrost/apis/bifrost-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getbifrost/bifrost-api/versions/f8cab88f64ea/schema)