endpoint model discovery and proxy integration

shared/management/http/api/openapi.yml

@@ -5280,6 +5280,51 @@ components:
         - id
         - input_per_1k
         - output_per_1k
+    AgentNetworkDiscoveredModel:
+      type: object
+      description: A model reported by the provider's persisted upstream endpoint.
+      properties:
+        id:
+          type: string
+          description: Exact model identifier accepted by the upstream endpoint.
+          example: "llama3.2:latest"
+        label:
+          type: string
+          description: Human-friendly label reported by the endpoint. Falls back to the model identifier.
+          example: "llama3.2:latest"
+      required:
+        - id
+        - label
+    AgentNetworkModelDiscoveryResponse:
+      type: object
+      description: |
+        Result of an explicit model-discovery probe executed by a connected
+        proxy in the account's selected Agent Network cluster. Discovered
+        models are not persisted until the provider is updated.
+      properties:
+        models:
+          type: array
+          description: Normalized, deduplicated models reported by the upstream.
+          items:
+            $ref: '#/components/schemas/AgentNetworkDiscoveredModel'
+        source:
+          type: string
+          description: Upstream API shape used to obtain the result.
+          enum: [openai_v1_models, ollama_api_tags]
+          example: "openai_v1_models"
+        proxy_cluster:
+          type: string
+          description: Proxy cluster from which the endpoint was queried.
+          example: "eu.proxy.netbird.io"
+        request_id:
+          type: string
+          description: Correlation identifier for the management-to-proxy probe.
+          example: "b7ef7da0-78cc-4583-8c4f-55f2ce72015f"
+      required:
+        - models
+        - source
+        - proxy_cluster
+        - request_id
     AgentNetworkCatalogModel:
       type: object
       properties:
@@ -5356,6 +5401,10 @@ components:
             "custom" — generic OpenAI-compatible self-hosted endpoint catch-all.
           enum: [provider, gateway, custom]
           example: "provider"
+        supports_model_discovery:
+          type: boolean
+          description: Whether models can be loaded from a persisted endpoint through the selected proxy cluster.
+          example: false
         extra_headers:
           type: array
           description: |
@@ -5379,6 +5428,7 @@ components:
         - default_content_type
         - brand_color
         - kind
+        - supports_model_discovery
         - models
     AgentNetworkCatalogIdentityInjection:
       type: object
@@ -14039,6 +14089,48 @@ paths:
           "$ref": "#/components/responses/not_found"
         '500':
           "$ref": "#/components/responses/internal_error"
+  /api/agent-network/providers/{providerId}/discover-models:
+    post:
+      summary: Discover models from an Agent Network provider
+      description: |
+        Executes a bounded, read-only model-list probe from a connected proxy
+        in the account's selected Agent Network cluster. The probe uses the
+        provider's persisted endpoint, TLS setting, and stored credential.
+        Returned models are not persisted by this operation.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: providerId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a persisted Agent Network provider
+      responses:
+        '200':
+          description: Models discovered successfully
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkModelDiscoveryResponse'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '412':
+          description: The provider cannot be queried or no capable proxy is connected
+          content: { }
+        '429':
+          description: A discovery probe is already running or was requested too recently
+          content: { }
+        '500':
+          "$ref": "#/components/responses/internal_error"
   /api/agent-network/policies:
     get:
       summary: List all Agent Network Policies