From cd20cddac59b13999e973899ca51cef945504f59 Mon Sep 17 00:00:00 2001 From: Maycon Santos Date: Sun, 23 Aug 2026 21:02:59 +0200 Subject: [PATCH] Correct model loading against the merged backend and UI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The section was written before netbird#7246/#7250 and dashboard#767 merged, and describes behaviour neither shipped. - Loading fills the model picker; it does not write rows. Say so, and point at Add More, which is how a loaded model reaches the form. - Only a model the catalog already prices arrives priced. Drop the claim that every loaded model is pre-filled with the rate NetBird would bill. - "Gateways have no listing endpoint" is not the boundary: only OpenAI, Anthropic, Bedrock and Vertex declare one, so Azure OpenAI, Mistral, Kimi and custom endpoints fall back to the catalog too. - A $0 model adds nothing to the spend cap, but its tokens still count toward the token cap. The old text implied it escaped limits entirely. - The Bedrock prefix is a cross-region geography, not the configured region, and AWS offers the same model under several — an operator sees eu. and global. rows for one model and reads it as a bug. Pricing keys on the geography-stripped id (shared/llm/model.go), so the duplicates cost the same. Example id replaced with one the code attests. - Vertex lists the Anthropic publisher's catalog specifically, and returns version-pinned ids. - Credential wording made provider-neutral, naming the Vertex service account key, and the upstream URL added to what invalidates stored-key reuse. Discovery is gated on the create-provider permission. --- src/pages/agent-network/providers.mdx | 61 ++++++++++++++++----------- 1 file changed, 36 insertions(+), 25 deletions(-) diff --git a/src/pages/agent-network/providers.mdx b/src/pages/agent-network/providers.mdx index 99b04cd5..e8c3a685 100644 --- a/src/pages/agent-network/providers.mdx +++ b/src/pages/agent-network/providers.mdx @@ -55,8 +55,8 @@ and budgets (see [How It Works](/agent-network/how-it-works#llm-apis-and-ai-gate 3. Paste the provider's **API key**. It is stored encrypted server-side and never sent to callers. 4. _(Optional)_ Restrict the **allowed models** and set **per-model pricing** used for cost - estimates in usage and logs. On supported providers, **Load models from provider** fills - this in from the vendor — see [Load Models from the Provider](#load-models-from-the-provider). + estimates in usage and logs. On supported providers, **Load models from provider** offers + the vendor's own list — see [Load Models from the Provider](#load-models-from-the-provider). 5. _(Optional, gateways)_ Fill any gateway-specific fields (for example a Portkey config ID) and the identity headers used for attribution. 6. Save the provider. @@ -144,38 +144,50 @@ your organization is entitled to, which Bedrock inference profiles exist in your region, or which Vertex AI models your project has enabled. The catalog also drifts as vendors retire models. -On the **Models** tab, **Load models from provider** asks the vendor which models your own -credential can actually reach and turns the answer into editable rows, each pre-filled with -the price NetBird would bill it at. +On the **Models** tab, **Load models from provider** asks the vendor which models it offers +this provider's credential, and adds the answer to the model picker. Nothing is written to +the form on its own: the models already listed keep the rates you gave them, and you pick +the ones you want from **Add More**. -Available for **OpenAI**, **Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. AI -gateways expose no comparable listing endpoint, so the button reports that and the catalog -list is used instead. +Available for **OpenAI**, **Anthropic**, **Amazon Bedrock** and **Google Vertex AI**. Every +other entry in the catalog — Azure OpenAI, Mistral, Kimi, the AI gateways and custom +endpoints — publishes no listing NetBird can ask for, so the button reports that and the +catalog list is used instead. + +For a provider you are still filling in, the button stays disabled until the **Upstream URL** +and the credential are both filled in. A few details worth knowing: -- **Models already on the form are left alone.** A rate you set deliberately is not - overwritten by a reload. -- **Models NetBird can't price arrive at $0** and are highlighted, rather than being hidden. - The vendor says your credential can reach them, so leaving them out would hide models you - really have. Saving with any of them prompts for confirmation — usage against a $0 model is - tracked at zero and doesn't count toward [budget limits](/agent-network/policies/limits). -- **Editing a saved provider reuses the stored key.** The API key never returns to your - browser, so the refresh runs against the credential already on the record. Change the - provider, or type a replacement key over the masked one, and the values on screen are used - instead. -- **Bedrock ids are registered exactly as AWS issues them**, region prefix included - (`eu.anthropic.claude-sonnet-5-20260514-v1:0`), because that is the only form that works at - invoke time. Only `ACTIVE` inference profiles are offered. The listing comes from the +- **A model the catalog already prices arrives priced.** Anything else arrives with no input + or output rate: NetBird outlines the row and asks you to confirm before saving it, rather + than hiding the model — the vendor listed it, so leaving it out would hide a model you + really have. Set the rates yourself, or usage against it is costed at $0 and adds nothing + to the spend side of [token & budget limits](/agent-network/policies/limits). Its tokens + still count toward the token caps. +- **Editing a saved provider reuses the stored credential.** The API key (or, on Vertex AI, + the uploaded service account key) never returns to your browser, so the lookup runs against + the credential already on the record. Change the provider, the upstream URL, or the masked + credential and NetBird asks for a credential to use instead — the values on screen are + then used. +- **Bedrock ids are registered exactly as AWS issues them**, prefix included + (`eu.anthropic.claude-sonnet-4-5-20250929-v1:0`), because that is the only form that works + at invoke time. The prefix is a cross-region geography (`us.`, `eu.`, `apac.`, `global.`, + and so on) rather than the region you configured, and AWS routinely offers the same model + under more than one — so expect both an `eu.anthropic.…` and a `global.anthropic.…` entry + for it. Both are genuine, and both cost the same, since pricing keys on the model and not + the geography. Only `ACTIVE` inference profiles are offered. The listing comes from the Bedrock control plane, which is a different host from the runtime endpoint you configured — NetBird derives it from your upstream URL. -- **Vertex AI lists what the publisher offers**, not what your project has enabled, so treat - it as a suggestion alongside the catalog rather than a definitive list. +- **Vertex AI lists the Anthropic publisher's catalog**, not what your project has enabled, + so treat it as a suggestion alongside NetBird's catalog rather than a definitive list. Ids + come back version-pinned, in the `claude-sonnet-4-5@20250929` form Vertex addresses them by. The vendor call is made by NetBird's management service using the provider's credential, not from your browser and not over your agents' tunnels. It only ever dials public vendor -endpoints and does not follow redirects. +endpoints and does not follow redirects. Loading the list spends that credential against the +vendor, so it needs the same permission as creating a provider. ### Adding a Model Not in the Catalog @@ -201,4 +213,3 @@ first provider and reachable only over the NetBird overlay. Agents send normal provider requests to the endpoint without an API key; which identities may reach which providers is governed by [Policies](/agent-network/policies). -