dome model

dome model registers LLM upstreams the gateway proxies — Anthropic, OpenAI, Azure OpenAI, Google, Bedrock, hosted OpenAI-compatible vendors (Groq, Mistral, Together, Fireworks, DeepSeek, xAI, Perplexity, Cohere, OpenRouter, Cerebras, NVIDIA, DeepInfra, SambaNova, AI21, Databricks), and self-hosted endpoints — and groups them into routing pools that fan out across providers with priority, weighting, and failover.

Command
List	`dome model list [workspace-id-or-slug]`
Get	`dome model get <name>`
Add	`dome model add <name>`
Update	`dome model update <name>`
Remove	`dome model rm <name>`
OAuth connect	`dome model oauth-connect <name>`
OAuth disconnect	`dome model oauth-disconnect <name>`
Pool create	`dome model pool create <name>`
Pool list	`dome model pool list [workspace-id-or-slug]`
Pool get	`dome model pool get <name>`
Pool update	`dome model pool update <name>`
Pool set default	`dome model pool set-default <name>`
Pool move	`dome model pool move <name> --before \| --after <anchor>`
Pool remove	`dome model pool rm <name>`
Pool gateways	`dome model pool gateways list\|add\|remove <pool> [gateway]`
Pool member add	`dome model pool member add <pool> <model>`
Pool member list	`dome model pool member list <pool>`
Pool member update	`dome model pool member update <pool> <model>`
Pool member remove	`dome model pool member rm <pool> <model>`
Quota list	`dome model quota list`
Quota set	`dome model quota set --subject … --limit <usd>`
Quota remove	`dome model quota rm <quota-id>`

List

dome model list [workspace-id-or-slug] List LLM models in the workspace. Aliases: ls.

Get

dome model get <name> Show details for one model, including provider config and Cedar attributes.

Add

dome model add <name> Register an LLM model upstream. The shared API key, when supplied, is stored under the provider’s managed auth header — Authorization: Bearer … for OpenAI, Bedrock, and OpenAI-compatible hosted vendors; x-api-key for Anthropic; api-key for Azure OpenAI; x-goog-api-key for Google. When --endpoint is omitted, the CLI prefills the vendor’s default base URL from the provider registry.

Flag	Type	Required	Default	Description
`--provider`	string	Yes	—	`openai`, `anthropic`, `google`, `bedrock`, `azure_openai`, `mistral`, `groq`, `together`, `fireworks`, `deepseek`, `xai`, `perplexity`, `cohere`, `openrouter`, `cerebras`, `nvidia`, `deepinfra`, `sambanova`, `ai21`, `databricks`, `openai_compatible`, `custom`. Refer to Supported providers reference.
`--model`	string	No	—	Model id (e.g. `gpt-4o-mini`, `claude-3-5-sonnet-20241022`)
`--endpoint`	string	No	registry default	Provider endpoint URL. Required for `azure_openai`, `bedrock`, `databricks`, `openai_compatible`, and `custom`.
`--auth-method`	string	No	`api-key`	`none`, `api-key`, `oauth`
`--credential-type`	string	No	`shared`	`none`, `shared`, `per-user`
`--api-key`	string	No	—	API key (use with `--auth-method=api-key --credential-type=shared`)
`--provider-config`	JSON	No	—	Full `provider_config` as JSON; merges with `--model`/`--endpoint`
`--attributes`	JSON	No	—	Cedar attributes as JSON object
`--filter-window-bytes`	uint32	No	`0`	Outbound filter window in bytes for this connection. `0` inherits the workspace floor; the engine takes the max of workspace, connection, and per-request.
`--filter-window-tokens`	uint32	No	`0`	Outbound filter window in tokens for this connection. `0` inherits the workspace floor.
`--gateway`	string (repeatable)	No	—	Attach directly to the named Gateway (name or ID). Without it the model is unreachable until attached.

Anthropic shared API key

dome model add claude-sonnet \
  --provider anthropic \
  --model claude-3-5-sonnet-20241022 \
  --api-key "$ANTHROPIC_API_KEY"

Groq (endpoint prefilled from registry)

dome model add fast-groq \
  --provider groq \
  --model llama-3.3-70b-versatile \
  --api-key "$GROQ_API_KEY"

Azure OpenAI

dome model add gpt-4o \
  --provider azure_openai \
  --model gpt-4o \
  --endpoint https://my-resource.openai.azure.com \
  --api-key "$AZURE_OPENAI_KEY" \
  --provider-config '{"api_version":"2024-08-01-preview","deployment":"gpt-4o-prod"}'

Update

dome model update <name> Update a model. Only provided flags change. Provider is immutable post-create — switch by adding a new connection.

Flag	Type	Description
`--name`	string	New connection name
`--model`	string	New model id
`--endpoint`	string	New endpoint URL
`--auth-method`	string	New auth method
`--credential-type`	string	New credential scope
`--api-key`	string	Replace the shared API key
`--provider-config`	JSON	Replace `provider_config` wholesale
`--attributes`	JSON	Replace Cedar attributes (pass `'{}'` to clear)
`--filter-window-bytes`	uint32	Per-connection outbound filter window in bytes. `0` clears back to the workspace floor.
`--filter-window-tokens`	uint32	Per-connection outbound filter window in tokens. `0` clears back to the workspace floor.

Remove

dome model rm <name> Remove an LLM model. Aliases: remove, delete.

OAuth connect

dome model oauth-connect <name> Begin the shared-OAuth admin consent flow for a model configured with --auth-method=oauth --credential-type=shared: Anthropic OAuth, Azure AAD/Entra service principal, Google Workload Identity for Vertex. Prints a one-shot URL valid for ~10 minutes. Open it in a browser to complete consent — Dome stores the tokens on the callback. Per-user OAuth models do not use this command; consent is gateway-triggered on each end user’s first call.

OAuth disconnect

dome model oauth-disconnect <name> Revoke shared OAuth credentials. The OAuth client configuration is preserved, so a subsequent oauth-connect reuses the same client. Idempotent.

Pool create

dome model pool create <name> Create a logical pool that fans out across one or more model connections.

Flag	Type	Default	Description
`--description`	string	—	Pool description
`--match-when`	JSON	—	Predicate selecting this pool by request shape (e.g. `'{"prompt_tokens":{"gt":100000}}'`). Refer to match_when predicates reference.
`--default`	bool	`false`	Mark as workspace default (or use `set-default` later)
`--cache-ttl-secs`	int32	`0`	Exact-match cache TTL (`0` disables)
`--cache-scope`	string	`workspace`	`workspace` or `caller`
`--routing-strategy`	string	`priority_weighted`	`priority_weighted`, `round_robin`, `least_loaded`. Refer to Routing strategies reference.
`--strategy-scope`	string	`workspace`	Scope of stateful routing counters: `workspace` or `caller`. Ignored by `priority_weighted`.
`--failover-max`	string	`all`	Failover ceiling. `all` walks every member; integer `N` gives primary + N retries (`0` disables failover).
`--gateway`	string (repeatable)	—	Attach to the named Gateway (name or ID). Without it the pool is unreachable until attached.

Pool with two providers and weighted distribution

dome model pool create default --failover-max 2
dome model pool member add default claude-sonnet --priority 0 --weight 3
dome model pool member add default gpt-4o --priority 0 --weight 1
dome model pool member add default claude-haiku --priority 1
dome model pool set-default default

Pool list

dome model pool list [workspace-id-or-slug] List pools. Aliases: ls.

Pool get

dome model pool get <name> Show pool config and its members.

Pool update

dome model pool update <name> Update a pool. Only provided flags change. Pass --match-when '{}' to clear the match predicate.

Flag	Type	Description
`--name`	string	Rename the pool
`--description`	string	New description
`--match-when`	JSON	Replace match predicate (pass `'{}'` to clear)
`--cache-ttl-secs`	int32	New cache TTL (`0` disables)
`--cache-scope`	string	New cache scope
`--routing-strategy`	string	`priority_weighted`, `round_robin`, or `least_loaded`
`--strategy-scope`	string	`workspace` or `caller`
`--failover-max`	string	`all` (walk every member) or non-negative integer `N`. Omit to leave unchanged.

Pool set default

dome model pool set-default <name> Mark this pool as the workspace default. Replaces any prior default.

Pool move

dome model pool move <name> --before <anchor> or --after <anchor> Reposition a pool in its workspace’s match_when evaluation order. Pools with non-empty predicates evaluate in ascending sort_key; the first match wins. Refer to Pool order reference.

Flag	Type	Description
`--before`	string	Anchor pool name; the moved pool lands immediately before it
`--after`	string	Anchor pool name; the moved pool lands immediately after it

Exactly one of --before or --after is required.

Pool remove

dome model pool rm <name> Remove a pool. Aliases: remove, delete.

Pool gateways

dome model pool gateways <list|add|remove> <pool-name-or-id> [gateway-name-or-id] Manage the pool’s membership in Gateways from the pool side. Mirrors dome gateway model-pools.

list <pool> — Gateways this pool belongs to. Alias: ls.
add <pool> <gateway> — expose the pool’s models at the Gateway’s /gateways/<id>/v1 endpoint.
remove <pool> <gateway> — detach. Alias: rm.

Pool member add

dome model pool member add <pool> <model> Add a model to a pool. Failover walks ascending priority; within a bucket, requests distribute by weight.

Flag	Type	Default	Description
`--priority`	int32	`0`	Priority (`0` = primary; failover walks ascending)
`--weight`	int32	`1`	Weight within the priority bucket
`--enabled`	bool	`true`	Whether the member is included in routing

Pool member list

dome model pool member list <pool> List members of a pool with priority, weight, and enabled state. Aliases: ls.

Pool member update

dome model pool member update <pool> <model> Update a member’s priority, weight, or enabled flag.

Flag	Type	Description
`--priority`	int32	New priority
`--weight`	int32	New weight
`--enabled`	bool	New enabled flag

Pool member remove

dome model pool member rm <pool> <model> Remove a member from a pool. Aliases: remove, delete.

Quota list

dome model quota list List LLM cost quotas in the workspace with their subject, USD limit, window, and enabled state. Aliases: ls. Refer to Cost quotas for what each subject covers.

Quota set

dome model quota set --subject <kind> --limit <usd> Create a USD spend cap. The --subject flag decides what the cap covers; the gateway enforces it in-memory and either spills routing (per-model budgets) or rejects with 429 (total caps).

Flag	Type	Required	Default	Description
`--subject`	string	Yes	—	`workspace`, `agent`, `act-as`, `pool`, `model`, or `gateway`
`--limit`	string	Yes	—	Cap in US dollars (e.g. `500` or `12.50`)
`--window`	string	No	`monthly`	Reset window: `daily` or `monthly`
`--name`	string	No	—	Optional human-readable label
`--model`	string	Conditional	—	Model connection name (`--subject model`)
`--pool`	string	Conditional	—	Pool name (`--subject pool`, or to scope a model quota to one pool)
`--agent`	string	Conditional	—	Agent id (`--subject agent`)
`--act-as`	string	Conditional	—	Verified end-user OIDC subject (`--subject act-as`)
`--gateway`	string	Conditional	—	Gateway name or id (`--subject gateway`). `dome gateway quota set` is the Gateway-first spelling of the same cap.
`--per-caller`	bool	No	`false`	Apply the limit independently to each agent and verified end user (`--subject model` only)
`--disabled`	bool	No	`false`	Create disabled; no enforcement until enabled

Workspace-wide monthly cap

dome model quota set --subject workspace --limit 5000 --window monthly

Pool spill-over budget for one model

# Caps claude-sonnet spend inside the production pool at $1000/month.
# When exhausted, the pool spills to the next member.
dome model quota set \
  --subject model --model claude-sonnet --pool production \
  --limit 1000 --window monthly

Per-caller daily cap

dome model quota set \
  --subject model --model gpt-4o --per-caller \
  --limit 25 --window daily

Quota remove

dome model quota rm <quota-id> Remove a quota by id (from dome model quota list). Aliases: remove, delete.

Overview

Connect

Govern

Operate

Settings

Developer

Session

Standalone

List

Get

Add

Update

Remove

OAuth connect

OAuth disconnect

Pool create

Pool list

Pool get

Pool update

Pool set default

Pool move

Pool remove

Pool gateways

Pool member add

Pool member list

Pool member update

Pool member remove

Quota list

Quota set

Quota remove

​List

​Get

​Add

​Update

​Remove

​OAuth connect

​OAuth disconnect

​Pool create

​Pool list

​Pool get

​Pool update

​Pool set default

​Pool move

​Pool remove

​Pool gateways

​Pool member add

​Pool member list

​Pool member update

​Pool member remove

​Quota list

​Quota set

​Quota remove

List

Get

Add

Update

Remove

OAuth connect

OAuth disconnect

Pool create

Pool list

Pool get

Pool update

Pool set default

Pool move

Pool remove

Pool gateways

Pool member add

Pool member list

Pool member update

Pool member remove

Quota list

Quota set

Quota remove