Included AI profile (admin)

GET|PUT /api/admin/credentials                  # shared profile + daily-check state (incl. tmdb_using_builtin); AI writes test before commit
DELETE  /api/admin/credentials/{key}            # erase one shared API key
GET     /api/admin/ai/codex/status              # shared OpenAI OAuth status + admin-only usage metadata
POST    /api/admin/ai/codex/device/begin        # begin shared OpenAI OAuth device authorization
GET     /api/admin/ai/codex/device/{flowID}     # initiating admin polls the pending shared flow
DELETE  /api/admin/ai/codex/device/{flowID}     # initiating admin cancels the pending shared flow
DELETE  /api/admin/ai/codex                     # unlink the shared OpenAI OAuth account

GET     /api/admin/ai/grok/status               # shared xAI Grok OAuth status + admin-only metadata
POST    /api/admin/ai/grok/device/begin         # begin shared xAI Grok device authorization
GET     /api/admin/ai/grok/device/{flowID}      # initiating admin polls the pending shared flow
DELETE  /api/admin/ai/grok/device/{flowID}      # initiating admin cancels the pending shared flow
DELETE  /api/admin/ai/grok                      # unlink the shared xAI Grok account

The included profile supports the same Anthropic, OpenAI, Gemini, xAI Grok, OpenAI (OAuth), and xAI Grok (OAuth) choices as a personal profile. The settings write additionally accepts the endpoint settings keys local_openai_base_url (an absolute http/https URL, required while the local provider is selected), openai_reasoning_effort, local_openai_reasoning_effort (closed effort set, empty = auto/clear), and local_openai_use_proxy (true/false, default false: whether that endpoint is an internet host and therefore rides the outbound proxy). The GET response echoes them as flat ai.* fields, the catalog entries advertise supports_base_url/supports_reasoning_effort/supports_proxy_opt_in/shared_only, and an endpoint, effort, or proxy change while its provider is selected re-runs the save-time turn: a proxy change re-proves the endpoint over the route it just switched to: with a pinned effort leading the validation ladder. OpenAI OAuth exposes the recommended Codex model plus GPT-5.6 Sol, Terra, and Luna; both xAI providers expose the same Grok model catalog. Grants are independent of roles and are changed per user. The initial admin starts granted, newly invited users start without a grant, and the one-time migration keeps existing users enabled to preserve the former global-provider behavior. Shared account identity, plan, rate-limit windows, and authorization stay admin-only; granted users learn only that their effective source is included. Codex execution separates the singleton credential identity from the requesting Cantinarr identity: refresh state serializes against the shared account, while tool permissions always use the actual caller’s current user ID and role. Interactive tool dispatch rechecks the current user, device, role, and (for included AI) shared grant at execution time; a revoked or invalid actor terminates the turn instead of being converted into a model-visible tool error.

Every shared provider/model/API-key save, remediation-model override, and completed OAuth selection performs one real, tool-free, low-reasoning message-response turn before success is reported. The probe uses a bounded response budget, retries only transient failures that occur before any output, and returns a redacted actionable category for invalid credentials/connections, unsupported model access, quota/rate limits, temporary upstream failures, or invalid responses. The settings endpoint commits a candidate profile atomically only after all supplied AI credentials pass. A remediation override is tested with the live shared provider and credential and stored with that provider binding; if the global provider later changes, runs safely fall back to its global model until an override is tested for the new provider. A separate shared-model monitor defaults on and runs at most once every 24 hours; its durable last-check timestamp prevents restart-driven usage. Failure creates or refreshes one source=system admin-only issue, and the next successful scheduled or save-time turn resolves it with resolution_kind=ai_health_restored. Admins can disable only this background monitor; save-time validation remains mandatory. Neither the monitor nor its issue enters the remediation job queue, and the remediation runner continues to resolve only the admin-global provider and credential without user settings or grants.

The chat request accepts an optional conversation_id; the server replays its provider-neutral stored transcript (including tool results and provider-signed continuation state) so follow-up turns keep full grounding across Anthropic, OpenAI, Gemini, xAI Grok, and Codex. A transcript is bound to the Cantinarr user, personal/included source, provider account or one-way credential fingerprint, selected model, and the current in-memory OAuth connection generation; changing any of those starts a fresh conversation. Signed provider state is kept atomic and byte-for-byte or the oversized turn is discarded; it is never truncated into an invalid signature pair. Transcripts are byte-bounded and kept only in process memory: they become inaccessible after four hours of inactivity, are evicted by later chat activity, and disappear on restart or a failed provider turn. Prompts, conversation context, and scrubbed tool results are sent to the selected provider (OpenAI for Codex, xAI for both Grok paths). SSE frames: {conversation_id}, {text}, {tool_start: {name, label}}, {tool_end: {name, ok}}, {media_results}, {error}, then [DONE].

View the maintained source for this page.