Skip to content

LLM Configuration (BYOM)

Availability: marketed as Enterprise · Tenant admins only

All four /tenant/llm-config routes, including the read, require a tenant admin: an organization admin who also holds the tenant-admin role. An admin of one organization without it, a service account and a static API key cannot configure, read, clear or test BYOM. See the Tier & Scope Matrix for why "marketed" and "enforced" differ here.

VirtualSutra AI supports Bring Your Own Model (BYOM) - you can supply your own LLM API key to use a specific model for AI-powered features such as WAF pillar recommendations and executive summaries.

Note

The LLM Configuration panel is only shown when DEPLOYMENT_PROFILE is not airgap. In air-gapped deployments, the platform uses the locally-deployed Ollama instance.

Configuring your LLM

You need to be a tenant admin. The configuration is shared by every organization of the tenant, so an admin of one organization who is not a tenant admin is refused by the API with tenant_admin_required.

  1. Go to Settings → LLM Configuration in the VirtualSutra AI Console.
  2. Select a Provider: Anthropic, OpenAI, Azure OpenAI, or any OpenAI-compatible endpoint (Ollama, vLLM).
  3. Enter your API Key. The key is stored AES-256-GCM encrypted; it is never returned in plaintext via any API response.
  4. Optionally set a Base URL for self-hosted or Azure OpenAI endpoints.
  5. Select a Model (e.g. claude-haiku-4-5-20251001, gpt-4o-mini, llama3.2).
  6. Click Save.

Supported providers

Provider provider value Notes
Anthropic anthropic Requires ANTHROPIC_API_KEY or BYOM key
OpenAI openai-compatible Standard OpenAI endpoint
Azure OpenAI openai-compatible Set Base URL to your Azure endpoint
Ollama openai-compatible Set Base URL to http://ollama:11434/v1
vLLM openai-compatible Set Base URL to your vLLM endpoint

Fallback chain

When an LLM call is needed, VirtualSutra AI uses this priority order:

  1. Tenant BYOM key - your configured key, provider, and model
  2. Platform Anthropic key - ANTHROPIC_API_KEY env var on the platform
  3. Air-gapped Ollama - LLM_BASE_URL env var (e.g. http://ollama:11434/v1)
  4. No LLM - AI enrichment is skipped; run is marked enrichment_skipped=true

Security

  • The API key is encrypted at rest using AES-256-GCM before storage in the database.
  • The key is decrypted in-memory only when needed and is never written to Redis, logs, or any API response.
  • To remove your BYOM key, click Delete in the LLM Configuration panel. The platform falls back to its default LLM provider.