AI Model Providers

The model is yours, not ours#

Abrq DIP ships no AI model and calls no vendor by default. AI-assisted features — today, the DW Generator — only work after an admin registers a provider under Settings → AI Models, pointing the platform at an endpoint the customer controls: a commercial API account you own, or an in-network model server.

Only schema metadata is ever sent to a provider by the DW Generator — table and column structure, never row data and never stored secrets. Privacy is under your control: point the provider at an in-network endpoint and nothing leaves your network.

Supported provider types#

Registering a provider#

1. Open Settings → AI Models and add a provider.
2. Fill in:
   • Display name.
   • Provider — one of the types above.
   • Base URL / endpoint — required for the Azure, OpenAI-compatible, custom, and on-prem types; optional for the hosted vendors (their default endpoints are used).
   • API key — optional: leave it empty for endpoints that don't enforce authentication (common for in-network model servers). When set, it is encrypted into the platform's secrets store and never returned by the API — the UI only shows whether a key is stored. Clearing or replacing it is an explicit action on edit.
   • Default model, and optionally an allowed models list to restrict which models may be used.
   • Organization / Project / Tenant ID and deployment name — only where the provider type calls for them (deployment name is required for Azure OpenAI).
   • Enabled and default flags — the default provider is the one the DW Generator uses.
3. Use Test to probe reachability and authentication; the outcome (status, message, time) is stored on the provider row so the last-known state is always visible. A models refresh action lists the models the endpoint exposes.

Tip. For a fully offline deployment, run an OpenAI-compatible server (Ollama, vLLM, or similar) inside your network and register it with the Internal on-prem type and no API key.

Configuration knobs#

The provider registry lives in the database, encrypted where needed — there are no per-provider environment variables. The only environment variable in the AI subsystem is the request timeout:

See Environment variables.

Network and trust considerations#

Requests to a provider originate from the backend and go directly to the configured base URL with the timeout above. The base URL is admin-supplied deployment configuration — point it only at endpoints you trust, and prefer in-network endpoints when data-governance rules require it. The deployment's outbound-traffic policy is described in Transport and egress.

Audit trail#

Provider creation, updates, deletion, and connection tests are audited; the audit records carry the provider's non-secret fields only — never the API key. See Audit.