Gateway Profile

forge_llm_gateway_access_profile manages the same durable access profile and route plan used by the Forge console and LLM Gateway runtime. One apply sends the profile and every declared route as a single route-plan update. The resource does not manage provider credentials, gateway keys, or budgets. Routes reference an existing Forge provider by exact display name. After apply, create a gateway key in Forge Console → LLM Gateway → Gateway keys and select this access profile. The key—not the profile—assigns a caller identity and profile at runtime. See LLM Gateway keys.

Profile schema

Attribute	Type	Behavior
`id`	Required string	Stable profile identifier. Changing it replaces the resource.
`name`	Required string	Mutable display name.
`description`	Optional string	Profile description.
`state`	Optional/computed enum	`draft`, `active`, `disabled`, or `archived`.
`enforcement_mode`	Optional/computed enum	`monitor`, `simulate`, `enforce`, or `break_glass`.
`model_patterns`	Optional/computed set(string)	Requested model names or trailing-wildcard patterns allowed by the profile.
`data_classes`	Optional/computed set(string)	Up to 256 gateway data-class selectors.
`policy_hooks`	Optional set(enum)	`prompt`, `pre_tool_use`, and `post_tool_use`.
`version`	Computed integer	Current server version used for optimistic concurrency.
`adopt_existing`	Optional boolean	Explicitly claim an existing Console-managed profile at its current version.
`management_mode`	Computed enum	`forge` or `terraform`; Console cannot mutate Terraform-owned profiles.

monitor records decisions without changing traffic. simulate evaluates and returns simulated outcomes. enforce applies policy results. break_glass bypasses enforcement while retaining audit evidence. Terraform plans are validated by Forge and bound to the exact profile version, route plan, Terraform manager, and service-account principal. Apply presents the short-lived signed token created by that exact plan; if it expires or the profile changes, create a new plan.

Route schema

Declare one or more route blocks when the profile owns routing. If present, the list must contain at least one route.

Attribute	Type	Behavior
`id`	Optional/computed string	Stable route ID. Forge supplies one when omitted.
`name`	Required string	Route display name.
`provider`	Required string	Exact configured Forge provider name; zero or multiple matches fail.
`requested_model_pattern`	Required string	Requested model selector evaluated for the route.
`upstream_model`	Optional string	Provider model sent upstream after selection.
`api_surface`	Required enum	Provider protocol surface; values are listed below.
`strategy`	Optional/computed enum	Selection within a tier: `fixed`, `weighted`, `policy`, `cost`, or `latency`.
`route_priority`	Optional/computed integer	Tier priority. Lower numbers are tried first; later tiers are fallbacks.
`traffic_percentage`	Optional/computed integer	Traffic share from 1–100 within the route’s priority tier.
`rollout_state`	Optional/computed enum	`draft`, `monitor`, `simulate`, `enforce`, `paused`, or `archived`.
`enforcement_mode`	Optional/computed enum	Route override: `monitor`, `simulate`, `enforce`, or `break_glass`.
`policy_hooks`	Optional set(enum)	Route-specific `prompt`, `pre_tool_use`, and `post_tool_use` checkpoints.
`tool_deny_behavior`	Optional/computed enum	`hard_block` rejects; `rewrite_refusal` returns a refusal-shaped result.
`config_json`	Optional JSON object	Native route configuration. Secret and endpoint override fields are rejected.

Routes with the same priority form one tier and use the same strategy. Forge uses eligible destinations in that tier before moving to the next priority. Fallback is expressed with a later tier, not a fallback strategy value. Supported api_surface values:

openai_chat_completions
openai_responses
anthropic_messages
openai_completions
openai_embeddings
openai_images
openai_audio
openai_models
openai_files
openai_batches
openai_fine_tuning
openai_moderations
openai_realtime
rerank
provider_passthrough
bedrock_converse
gemini_generate_content
custom

config_json cannot contain credential or endpoint keys such as api_key, authorization, token, client_secret, api_base, or base_url. Configure those through the provider credential lifecycle in Forge.

Fixed route

resource "forge_llm_gateway_access_profile" "engineering" {
  id               = "engineering-gateway"
  name             = "Engineering gateway"
  state            = "active"
  enforcement_mode = "enforce"
  policy_hooks     = ["prompt", "pre_tool_use", "post_tool_use"]

  model_patterns = ["gpt-*"]

  route {
    id                      = "engineering-openai"
    provider                = "OpenAI production"
    name                    = "Primary OpenAI"
    requested_model_pattern = "gpt-*"
    upstream_model          = "gpt-5"
    api_surface             = "openai_responses"
    strategy                = "fixed"
    route_priority          = 1
    rollout_state           = "enforce"
    enforcement_mode        = "enforce"
    policy_hooks            = ["prompt", "pre_tool_use"]
    tool_deny_behavior      = "hard_block"
    config_json             = jsonencode({ timeoutSeconds = 30 })
  }
}

Fallback plan

Routes in one resource are updated atomically:

resource "forge_llm_gateway_access_profile" "support" {
  id               = "support-gateway"
  name             = "Support gateway"
  state            = "active"
  enforcement_mode = "enforce"

  model_patterns = ["claude-*"]

  route {
    id                      = "support-anthropic-primary"
    provider                = "Anthropic production"
    name                    = "Anthropic primary"
    requested_model_pattern = "claude-*"
    upstream_model          = "claude-sonnet-4-5"
    api_surface             = "anthropic_messages"
    strategy                = "fixed"
    route_priority          = 1
    rollout_state           = "enforce"
  }

  route {
    id                      = "support-bedrock-fallback"
    provider                = "AWS Bedrock"
    name                    = "Bedrock fallback"
    requested_model_pattern = "claude-*"
    upstream_model          = "anthropic.claude-sonnet-4-5"
    api_surface             = "bedrock_converse"
    strategy                = "fixed"
    route_priority          = 2
    rollout_state           = "enforce"
  }
}

Import

Import by the stable profile ID:

terraform import forge_llm_gateway_access_profile.engineering engineering-gateway

After import, run terraform plan and copy the exact remote route plan into HCL before applying. Route order is meaningful because the resource uses a list. Do not approve a plan that removes routes merely because they were omitted from the imported configuration.

Guides

REST API

Gateway Profile

Profile schema

Route schema

Fixed route

Fallback plan

Import

​Profile schema

​Route schema

​Fixed route

​Fallback plan

​Import

Profile schema

Route schema

Fixed route

Fallback plan

Import