Provider credentials

Method	Path	Description
GET	/api/organizations/{orgId}/ai-provider	Which providers and auth methods are configured, and the default model.
PUT	/api/organizations/{orgId}/ai-provider	Set credentials or the default model. Admin only.
DELETE	/api/organizations/{orgId}/ai-provider?provider=&authMethod=	Remove credentials for one auth method. Admin only.
POST, DELETE	/api/organizations/{orgId}/auth-sandbox	Create or tear down the sandbox used to complete a claude_code or codex login. Body { provider }.
POST	/api/organizations/{orgId}/auth-sandbox/check	Check whether the login completed. Body { sandboxId, provider }.
POST	/api/organizations/{orgId}/auth-sandbox/clear	Clear a stored OAuth login. Body { provider }.

PUT /ai-provider takes a discriminated union on operation:

operation	Other fields
default_model	model
anthropic_api_key	anthropicApiKey, optional model
anthropic_aws_bedrock	region, bedrockApiKey, optional model
anthropic_claude_code	none, the login happens in an auth sandbox
openai_api_key	openaiApiKey, optional model
openai_codex	none, the login happens in an auth sandbox