Use the Model Registry
Model Registry in FlowAI
Use the Model Registry to configure large language model (LLM) profiles for your FlowAI agents.
Before you begin
Prerequisites depend on whether you’re bringing your own provider or using an Itential-managed one.
Bring your own provider
Itential-managed
Confirm an active Gateway cluster
Ensure that an active Itential Gateway cluster is configured in your environment. The cluster routes LLM API requests from Itential to your provider. Only clusters running Itential Gateway version 5.5 or later are supported. The cluster is set at profile creation and can’t be changed afterward. For information about creating a cluster, see Creating clusters.
Store your credentials
Obtain API credentials for your provider and securely store them. Plaintext passwords aren’t supported.
Create permission groups
Create one or more permission groups in Admin Essentials. Groups define which users can select this profile when creating an agent or a workflow. For information, see Groups.
Access Model Registry
You can access the Model Registry from Platform.
Create a profile
A profile:
- Defines a connection to an LLM provider
- Specifies which models from that provider are enabled
- Controls which groups can select it when creating an agent. At least one active profile with at least one enabled model must exist before you can create an agent.
Profiles are environment-specific. Configure them independently for development, staging, and production environments. Unlike agents, profiles stay in the environment where you configure them. Configure a profile here first, then proceed through the rest of the FlowAI workflow. See Get started with FlowAI for more information.
Bring your own provider
Itential-managed
Select a Provider type, such as Anthropic or OpenAI. You can’t change the provider after you save the profile. See Supported provider types for the providers you can use.
Select a Gateway Cluster. The default cluster configured for the environment is pre-selected. Only clusters running Itential Gateway version 5 or later are available. You can’t change the cluster after you save the profile.
Enter a Name. The name must be unique within the environment.
Using the same profile name across environments makes it easier to resolve LLM references when you import agent projects. For example, anthropic-primary in development, staging, and production.
Enter the required Provider Credentials fields for the selected provider:
- API key: Enter your provider’s API key.
- Endpoint: Enter your provider’s endpoint.
Click Fetch Models. This validates the credential and endpoint and retrieves the list of available models. See Validate credentials.
Optionally, configure Model Variables for each enabled model. See Model variables.
Supported provider types
When you create a bring-your-own-provider profile, you select one of the following provider types. The provider type determines which credential fields you enter, and you can’t change it after you save the profile.
Profile visibility
When a user selects a model for an agent, they see only the profiles their access groups or agent project role permits. For each profile, they see the name and enabled models. Itential never exposes credentials, endpoint URLs, model variables, or profile IDs.
Model variables
On-prem onlyModel Variables is an optional JSON field available per enabled model for on-prem profiles. It lets you pass model-specific configuration parameters, such as temperature, max tokens, or timeout, directly to the provider’s API at request time. Itential stores the JSON as-is and passes it to the provider without modification.
The JSON editor validates syntax inline and flags invalid JSON before you save. However, Itential doesn’t validate whether the provider accepts the parameters at save time. If the provider rejects a parameter at runtime, the error appears in Agent Sessions with a message identifying the model variables configuration on that profile as the cause.
Consult your provider’s API documentation before configuring model variables. Invalid parameters don’t cause a save-time error but cause agent sessions to fail at runtime.
View profiles
The profile list shows each profile’s name, provider type, enabled models, agent count, Itential Gateway cluster, and creation date. You can search by name, filter by provider type or Itential Gateway cluster, and sort by name or creation date. For Itential-managed profiles, the Itential Gateway cluster column displays as N/A.
The Agent Count for each profile links to a filtered view of all agents currently referencing that profile. Use this as a guide before making changes to understand the impact on builders and running agents.
Edit a profile
All profile properties are editable after creation except the provider type and Itential Gateway cluster. To use a different provider or cluster, create a new profile.
- Name: Renaming a profile doesn’t break any agent that references it. Agents reference profiles by internal ID, not by name.
- Updating credentials (on-prem): Entering a new API key or endpoint triggers a new Fetch Models validation. If the updated credential returns a different model list, models that are no longer available are flagged. Models with no associated agents are removed without a confirmation prompt; models with agents require explicit admin confirmation before removal.
- Updating builder groups: Changes take effect immediately for new agent configurations.
- Updating Model Variables: You can update model variables at any time. The same syntax validation applies on save.
- Cloud (Itential-managed): The model list and connection are managed by Itential and aren’t editable by the LLM Admin.
Validate credentials
Clicking Fetch Models validates your credential and endpoint and retrieves the list of available models for the selected provider. Itential runs this automatically during profile creation after you enter credentials, and again when you update a credential or endpoint on an existing profile.
On success, the available models appear for selection. On failure, an error message distinguishes between a network or endpoint issue and an authentication failure. The profile isn’t updated until you address the error and retry.
If Fetch Models returns fewer models than the profile currently has enabled:
- Itential removes models with no associated agents without a confirmation prompt.
- Models with associated agents require your confirmation before removal.
- The profile isn’t updated until you confirm.
If Fetch Models returns zero models, a warning appears. Itential saves the profile, but it’s unavailable for new agent sessions until you re-enable at least one model.
To check whether a stored credential is still valid without updating the model list, click Fetch Models”. Use this after a key rotation or to confirm a connectivity issue has been resolved.
Credential validation and fetch are available on on-prem profiles only.
Delete a profile
Before deletion, Itential displays a list of agents currently referencing the profile. Deletion proceeds even if agents reference it. Affected agents can’t run until you assign a replacement model for each profile. Deletion is permanent.
Deleting a profile immediately prevents all agents that reference it from starting new sessions. Builders must assign a replacement profile to each affected agent before those agents can run.
Access control
Each Model Registry action requires an application-level permission. An admin assigns these permissions in Admin Essentials → Authorization on-prem, or through Cloud Hub role management on cloud. Access to profiles is governed in two places.
Model Registry UI - Application-level permissions control who can view and manage profiles. They apply to all profiles at once; you can’t show or hide individual profiles in this UI.
Agent Projects - Group-based filtering controls which profiles a builder can select for an agent. A builder who isn’t in any of a profile’s permission groups doesn’t see it as selectable. Itential checks group membership when the builder configures the agent and doesn’t re-evaluate it when the agent runs, so removing a group affects only new agent configurations. Groups are created in Admin Essentials; see Groups. For what a builder sees, see Profile visibility.
For the full list of permissions, see FlowAI roles.