oz0 provider pool add
For: Operators and developers looking up a command.
Add a deployment to a provider record's pool, or change the member of that ID: its own --base-url, and what it does not share with the record (its key secret, region, whether it keeps data, its auth).
--rpm, --input-tpm and --output-tpm declare its limits per minute where its provider's headers do not say them; --price sets its own price for a model, in dollars per million input, output, cache-read and cache-write tokens, where its region is priced differently: a price left out keeps the record's, and without a price on the record give the cache prices too.
A record that calls its own base_url keeps calling it as a member (--record-member, primary by default); --preset starts a new pooled record from a shipped preset. Pool only what your contracts with the provider allow.
Usage
oz0 provider pool add <provider> <member> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--access-key-secret | string | the tenant secret with SigV4's access key ID; --key-secret holds the secret access key | |
--audience | string | the JWT bearer assertion's audience (the token URL when empty) | |
--auth-header | string | the header its key goes in, when it differs from the record's | |
--auth-kind | string | how calls are signed: header (a key in --auth-header, the default), oauth2_client_credentials, oauth2_jwt_bearer, sigv4 or federated (no stored key) | |
--auth-prefix | string | what comes before its key in that header, such as "Bearer " | |
--aws-region | string | the region SigV4 signs for, such as eu-north-1 | |
--aws-role | string | with --cloud aws: the IAM role's ARN the calling agent assumes (with --aws-region and --aws-service) | |
--aws-service | string | the service SigV4 signs for, such as bedrock | |
--base-url | string | the member's own endpoint, which a call's path is appended to: https, or http to this machine or on a record cluster admins own | |
--client-auth | string | how the client secret is sent to the token URL: post (the default) or basic | |
--client-id | string | the OAuth2 client (client credentials), or a bare PEM key's issuer (JWT bearer) | |
--cloud | string | with --auth-kind federated: aws, gcp or entra, the cloud that trusts the tenant's issuer | |
--entra-directory | string | with --cloud entra: the directory (tenant ID or domain) of the app registration (--client-id) | |
--gcp-service-account | string | with --cloud gcp: a service account the federated token impersonates | |
--gcp-workload-provider | string | with --cloud gcp: the workload identity pool provider, //iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider> | |
--input-tpm | int | its input tokens per minute, where its provider's headers do not say | |
--key-secret | string | the tenant secret with the member's key; empty takes the record's | |
--output-tpm | int | its output tokens per minute, where its provider's headers do not say | |
--preset | string | start a new pooled record from a shipped preset, such as azure-openai or bedrock | |
--price | stringArray | its own price for a model as <model>=<input>,<output>[,<cache read>[,<cache write>]] in $/MTok, such as claude-sonnet-5=3.3,16.5,0.33,4.125; repeatable | |
--record-member | string | primary | for a record that calls its own base_url: the member that endpoint becomes |
--region | string | where the member processes data, such as eu-north; empty takes the record's | |
--retains-data | bool | the member keeps prompts or answers after a call; unset takes the record's | |
--rpm | int | its requests per minute, where its provider's headers do not say | |
--scope | string | what an OAuth2 token is for, such as https://ai.azure.com/.default | |
--session-token-secret | string | the tenant secret with a SigV4 session token, for temporary credentials | |
--shared | bool | the record every tenant sees (cluster admins) | |
--tenant | string | default | tenant whose own record it is |
--token-url | string | where the OAuth2 kinds get tokens; the edge calls it (an outbound connection) | |
--weight | float | its share among members with the same headroom (1 when not given) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.