> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Gateway Profile > Manage an LLM Gateway access profile and its atomic provider route plan with Terraform. `forge_llm_gateway_access_profile` manages the same durable access profile and route plan used by the Forge console and LLM Gateway runtime. One apply sends the profile and every declared route as a single route-plan update. The resource does not manage provider credentials, gateway keys, or budgets. Routes reference an existing Forge provider by exact display name. After apply, create a gateway key in **Forge Console → LLM Gateway → Gateway keys** and select this access profile. The key—not the profile—assigns a caller identity and profile at runtime. See [LLM Gateway keys](/secure/llm-gateway#gateway-keys). ## Profile schema | Attribute | Type | Behavior | | ------------------ | ----------------------------- | ---------------------------------------------------------------------------- | | `id` | Required string | Stable profile identifier. Changing it replaces the resource. | | `name` | Required string | Mutable display name. | | `description` | Optional string | Profile description. | | `state` | Optional/computed enum | `draft`, `active`, `disabled`, or `archived`. | | `enforcement_mode` | Optional/computed enum | `monitor`, `simulate`, `enforce`, or `break_glass`. | | `model_patterns` | Optional/computed set(string) | Requested model names or trailing-wildcard patterns allowed by the profile. | | `data_classes` | Optional/computed set(string) | Up to 256 gateway data-class selectors. | | `policy_hooks` | Optional set(enum) | `prompt`, `pre_tool_use`, and `post_tool_use`. | | `version` | Computed integer | Current server version used for optimistic concurrency. | | `adopt_existing` | Optional boolean | Explicitly claim an existing Console-managed profile at its current version. | | `management_mode` | Computed enum | `forge` or `terraform`; Console cannot mutate Terraform-owned profiles. | `monitor` records decisions without changing traffic. `simulate` evaluates and returns simulated outcomes. `enforce` applies policy results. `break_glass` bypasses enforcement while retaining audit evidence. Terraform plans are validated by Forge and bound to the exact profile version, route plan, Terraform manager, and service-account principal. Apply presents the short-lived signed token created by that exact plan; if it expires or the profile changes, create a new plan. ## Route schema Declare one or more `route` blocks when the profile owns routing. If present, the list must contain at least one route. | Attribute | Type | Behavior | | ------------------------- | ------------------------- | ----------------------------------------------------------------------------- | | `id` | Optional/computed string | Stable route ID. Forge supplies one when omitted. | | `name` | Required string | Route display name. | | `provider` | Required string | Exact configured Forge provider name; zero or multiple matches fail. | | `requested_model_pattern` | Required string | Requested model selector evaluated for the route. | | `upstream_model` | Optional string | Provider model sent upstream after selection. | | `api_surface` | Required enum | Provider protocol surface; values are listed below. | | `strategy` | Optional/computed enum | Selection within a tier: `fixed`, `weighted`, `policy`, `cost`, or `latency`. | | `route_priority` | Optional/computed integer | Tier priority. Lower numbers are tried first; later tiers are fallbacks. | | `traffic_percentage` | Optional/computed integer | Traffic share from 1–100 within the route's priority tier. | | `rollout_state` | Optional/computed enum | `draft`, `monitor`, `simulate`, `enforce`, `paused`, or `archived`. | | `enforcement_mode` | Optional/computed enum | Route override: `monitor`, `simulate`, `enforce`, or `break_glass`. | | `policy_hooks` | Optional set(enum) | Route-specific `prompt`, `pre_tool_use`, and `post_tool_use` checkpoints. | | `tool_deny_behavior` | Optional/computed enum | `hard_block` rejects; `rewrite_refusal` returns a refusal-shaped result. | | `config_json` | Optional JSON object | Native route configuration. Secret and endpoint override fields are rejected. | Routes with the same priority form one tier and use the same strategy. Forge uses eligible destinations in that tier before moving to the next priority. Fallback is expressed with a later tier, not a `fallback` strategy value. Supported `api_surface` values: ```text theme={"system"} openai_chat_completions openai_responses anthropic_messages openai_completions openai_embeddings openai_images openai_audio openai_models openai_files openai_batches openai_fine_tuning openai_moderations openai_realtime rerank provider_passthrough bedrock_converse gemini_generate_content custom ``` `config_json` cannot contain credential or endpoint keys such as `api_key`, `authorization`, `token`, `client_secret`, `api_base`, or `base_url`. Configure those through the provider credential lifecycle in Forge. ## Fixed route ```hcl theme={"system"} resource "forge_llm_gateway_access_profile" "engineering" { id = "engineering-gateway" name = "Engineering gateway" state = "active" enforcement_mode = "enforce" policy_hooks = ["prompt", "pre_tool_use", "post_tool_use"] model_patterns = ["gpt-*"] route { id = "engineering-openai" provider = "OpenAI production" name = "Primary OpenAI" requested_model_pattern = "gpt-*" upstream_model = "gpt-5" api_surface = "openai_responses" strategy = "fixed" route_priority = 1 rollout_state = "enforce" enforcement_mode = "enforce" policy_hooks = ["prompt", "pre_tool_use"] tool_deny_behavior = "hard_block" config_json = jsonencode({ timeoutSeconds = 30 }) } } ``` ## Fallback plan Routes in one resource are updated atomically: ```hcl theme={"system"} resource "forge_llm_gateway_access_profile" "support" { id = "support-gateway" name = "Support gateway" state = "active" enforcement_mode = "enforce" model_patterns = ["claude-*"] route { id = "support-anthropic-primary" provider = "Anthropic production" name = "Anthropic primary" requested_model_pattern = "claude-*" upstream_model = "claude-sonnet-4-5" api_surface = "anthropic_messages" strategy = "fixed" route_priority = 1 rollout_state = "enforce" } route { id = "support-bedrock-fallback" provider = "AWS Bedrock" name = "Bedrock fallback" requested_model_pattern = "claude-*" upstream_model = "anthropic.claude-sonnet-4-5" api_surface = "bedrock_converse" strategy = "fixed" route_priority = 2 rollout_state = "enforce" } } ``` ## Import Import by the stable profile ID: ```bash theme={"system"} terraform import forge_llm_gateway_access_profile.engineering engineering-gateway ``` After import, run `terraform plan` and copy the exact remote route plan into HCL before applying. Route order is meaningful because the resource uses a list. Do not approve a plan that removes routes merely because they were omitted from the imported configuration.