Pleaxy

Raise purchase orders, approve and pay invoices, and set up your workspace.

API reference

AI providers

AI providers connected directly with a read-only key, and the AI invoicers you can add as suppliers.

More about this resource

New with AI spend controls. Besides the AI lines on your cloud bills, Pleaxy reads the cost and usage reports of the AI providers you pay directly. OpenAI and Anthropic take a read-only admin key; Mistral too, where the organization has its Admin API (an Enterprise feature); OpenRouter a management key; CoreWeave an API access token with the Billing Viewer role; Databricks a service principal's OAuth secret; Snowflake gets a key pair Pleaxy generates, whose public key you assign to a service user. Lambda, Nebius, Crusoe and the seat-based invoicers (Cursor, GitHub, Microsoft) have no billing API Pleaxy can read: add them as suppliers and their invoices are held to the contract. The key is checked with one read before anything is saved, stored encrypted, never returned (only its last four characters, keyHint) and never used to change anything at the provider. Each connected provider's lines are read daily and show in AI spend as their own invoicer, against the purchase orders raised to its supplier entry. Each AI invoicer has a supplier entry Pleaxy pre-creates, which you can add without connecting: its invoices and orders then work like any supplier's. A connected provider counts toward the plan's provider limit, as a cloud account does. Each provider's connector is switched on per region; until it is, connecting answers 404 and adding the supplier still works.

Endpoints

List AI providers

Lists the workspace's connected AI providers.

GET/v1/workspaces/{regionId}/ai-providers

Returns

200 OK with the object shown in the response.

More details

Every direct AI provider connection in the workspace, connected or pending: who it is, the account it reads, the key's last four characters, when it was last synced and how that went. The key itself is never returned. Needs 'view' access to suppliers or to invoices.

Response fields

  • accountLabelstring

    What the provider calls the organization or account the key reads.

  • keyHintstring

    The key's last four characters, the only trace of it Pleaxy shows. Absent for Snowflake, whose key pair Pleaxy generated.

  • statusstring

    connected, or pending for a Snowflake key pair whose public key hasn't been assigned to the service user yet: SyncAiProvider checks it and finishes connecting.

  • snowflakeobject

    Snowflake only: the account identifier, service user, warehouse and optional role the key pair signs in as, and the public key (PEM) and its fingerprint to assign with ALTER USER ... SET RSA_PUBLIC_KEY.

  • creditPriceobject

    Snowflake only: your contract's price per credit, which turns credits into money. Without it the provider's AI lines stay in credits, with currency credits, and are never summed with money.

  • supplierConnectionIdstring

    The supplier entry the provider is seated on; purchase orders raised to it are what AI spend sets its lines against.

  • currencystring

    The provider's billing currency, as its cost report gives it.

  • lastSyncStatusstring

    How the last read went: ok, error (lastSyncError says why, lastSyncErrorCode is access_revoked when the key no longer works) or throttled (the provider asked Pleaxy to wait; the next run tries again).

Errors

  • 401 Unauthorized - No credential was presented, or the Bearer token / X-Api-Key value is missing, invalid, expired, or revoked.
  • 403 Forbidden - The caller's Bearer token or API key doesn't grant access to this workspace (regionId), or lacks the required role.
GET /v1/workspaces/{regionId}/ai-providers
Request
curl "$PLEAXY_API_BASE_URL/v1/workspaces/{regionId}/ai-providers" \
  -H "X-Api-Key: $PLEAXY_API_KEY"
Response · 200 OK
[
   {
      "id": "string",
      "provider": "openai" | "anthropic" | "mistral" | "snowflake" | "openrouter" | "databricks" | "coreweave",
      "accountLabel": "string",
      "keyHint": "string",
      "status": "connected" | "pending",
      "connectedAt": "string",
      "connectedBy": "string",
      "snowflake": { "account": "string", "user": "string", "warehouse": "string", "role": "string", "publicKeyPem": "string", "publicKeyFingerprint": "string" },
      "creditPrice": { "amount": number, "currency": "string", "kind": "on_demand" | "capacity" | "commit" },
      "supplierConnectionId": "string",
      "currency": "string",
      "lastSyncedAt": "string",
      "lastSyncStatus": "ok" | "error" | "throttled",
      "lastSyncError": "string",
      "lastSyncErrorCode": "string"
   }
]

Create AI provider

Connects an AI provider with a read-only key.

POST/v1/workspaces/{regionId}/ai-providers

Body

  • provider"openai" | "anthropic" | "mistral" | "snowflake" | "openrouter" | "databricks" | "coreweave"Required

    The provider to connect. Its connector must be switched on in the region.

  • keystring

    Every provider but Snowflake, required: a read-only key. OpenAI's admin key starts with sk-admin- (Organization settings › Admin keys); Anthropic's with sk-ant-admin (Claude Console, Settings › Admin keys); Mistral's is an Admin API key; OpenRouter's management key starts with sk-or-; CoreWeave's is an API access token; Databricks' is the service principal's OAuth secret. Never logged and never returned.

  • snowflakeobject

    Snowflake, required: { account, user, warehouse, role? }: the account identifier (orgname-account_name), the service user, the warehouse the usage query runs on and an optional role.

  • databricksobject

    Databricks, required: { host, clientId, warehouseId }: the workspace host (a Databricks domain), the service principal's OAuth client id and the SQL warehouse the billing reads run on; key is the principal's OAuth secret. The principal needs SELECT on system.billing (and system.serving for token counts).

  • creditPriceobject

    Snowflake and Databricks, optional: { amount, currency, kind } with kind on_demand, capacity or commit, your contract's price per credit (Snowflake) or DBCU (Databricks). Without it Snowflake's lines stay in credits and Databricks' are at the account's list price.

Returns

201 Created with the object shown in the response.

More details

Connects a direct AI provider. For OpenAI, Anthropic and Mistral send the read-only admin key: Pleaxy makes one read with it, and only if that works stores it encrypted, adds the provider's supplier entry to your suppliers and returns the connection. For Snowflake send where to sign in: Pleaxy generates a key pair and returns the connection pending, with the public key to assign to the service user; SyncAiProvider then checks it. Five failed checks per provider in an hour, then wait. Needs 'create' access to suppliers.

Errors

  • 400 Bad Request - Validation failed; the key is missing or isn't that provider's admin key; the provider didn't accept it (unauthorized, forbidden, no Admin API, busy or unreachable, and nothing was saved); five failed checks in the last hour; or the region's plan has reached its provider limit.
  • 404 Not Found - Unknown provider, or its connector isn't switched on in this region.
  • 409 Conflict - The provider is already connected in the workspace.
  • 401 Unauthorized - No credential was presented, or the Bearer token / X-Api-Key value is missing, invalid, expired, or revoked.
  • 403 Forbidden - The caller's Bearer token or API key doesn't grant access to this workspace (regionId), or lacks the required role.
POST /v1/workspaces/{regionId}/ai-providers
Request
POST /v1/workspaces/reg_01k5x8p9j3q7vn2mhb4tzc6rde.buyer/ai-providers

{ "provider": "anthropic", "key": "sk-ant-admin01-…" }
Response · 201 Created
{
   "id": "aip_01k8q2m4xv7c9n3p5t6r8w0yzb",
   "provider": "anthropic",
   "accountLabel": "Northwind Labs",
   "keyHint": "f3Qa",
   "status": "connected",
   "connectedAt": "2026-10-30T09:12:44.000Z",
   "supplierConnectionId": "sc_01k8q2m5a1b2c3d4e5f6g7h8j9"
}

Sync AI provider

Reads an AI provider's cost and usage now.

POST/v1/workspaces/{regionId}/ai-providers/{id}/sync

Parameters

  • idstringRequired

    The AI provider connection id.

Returns

201 Created with the object shown in the response.

More details

Reads one provider's cost and usage reports now instead of waiting for the daily run, and returns the connection with its new sync state. For a pending Snowflake connection it first checks the key pair signs in, and marks it connected. Once every 15 minutes per provider. Takes no body. Needs 'create' access to suppliers or 'edit' access to invoices.

Errors

  • 400 Bad Request - Synced less than 15 minutes ago, or a pending Snowflake key pair still doesn't sign in (nothing changed).
  • 404 Not Found - No such connection in the workspace, or the provider's connector was switched off.
  • 401 Unauthorized - No credential was presented, or the Bearer token / X-Api-Key value is missing, invalid, expired, or revoked.
  • 403 Forbidden - The caller's Bearer token or API key doesn't grant access to this workspace (regionId), or lacks the required role.
POST /v1/workspaces/{regionId}/ai-providers/{id}/sync
Request
curl -X POST "$PLEAXY_API_BASE_URL/v1/workspaces/{regionId}/ai-providers/{id}/sync" \
  -H "X-Api-Key: $PLEAXY_API_KEY"
Response · 201 Created
{
   "id": "string",
   "provider": "openai" | "anthropic" | "mistral" | "snowflake" | "openrouter" | "databricks" | "coreweave",
   "status": "connected" | "pending",
   "lastSyncedAt": "string",
   "lastSyncStatus": "ok" | "error" | "throttled",
   "lastSyncError": "string"
}

Delete AI provider

Disconnects an AI provider.

DELETE/v1/workspaces/{regionId}/ai-providers/{id}

Parameters

  • idstringRequired

    The AI provider connection id.

Returns

200 OK with the object shown in the response.

More details

Disconnects a direct AI provider: the connection and its encrypted key are deleted, and who disconnected it is recorded. The AI lines already read stay as history, and the supplier entry stays. Revoke the key at the provider too (for Snowflake, unset the user's public key).

Signed-in session with 'edit' access to suppliers; an API key gets 403.

Errors

  • 403 Forbidden - The caller is an API key or lacks 'edit' on suppliers.
  • 404 Not Found - No such connection in the workspace.
  • 401 Unauthorized - No credential was presented, or the Bearer token / X-Api-Key value is missing, invalid, expired, or revoked.
DELETE /v1/workspaces/{regionId}/ai-providers/{id}
Request
curl -X DELETE "$PLEAXY_API_BASE_URL/v1/workspaces/{regionId}/ai-providers/{id}" \
  -H "X-Api-Key: $PLEAXY_API_KEY"
Response · 200 OK
{
   "id": "string",
   "provider": "openai" | "anthropic" | "mistral" | "snowflake" | "openrouter" | "databricks" | "coreweave"
}

Add AI provider supplier

Adds an AI invoicer as a supplier without connecting.

POST/v1/workspaces/{regionId}/ai-providers/{provider}/supplier

Parameters

  • providerstringRequired

    One of openai, anthropic, mistral, cohere, xai, openrouter, snowflake, databricks, coreweave, lambda, nebius, crusoe, cursor, github or microsoft (ListAiInvoicers lists them).

Returns

201 Created with the object shown in the response.

More details

Adds an AI invoicer to your suppliers list from the entry Pleaxy pre-creates, without connecting anything, so you can raise purchase orders to it and record its invoices. Works for every AI invoicer, including those Pleaxy can't read (their spend comes from their invoices). Returns the existing entry if there is one, and connecting later links to the same entry. Takes no body. Needs 'create' access to suppliers.

Errors

  • 404 Not Found - Unknown AI invoicer.
  • 409 Conflict - Code SUPPLIER_ALREADY_LISTED: a supplier with that name already has an onboarding under way or approved.
  • 401 Unauthorized - No credential was presented, or the Bearer token / X-Api-Key value is missing, invalid, expired, or revoked.
  • 403 Forbidden - The caller's Bearer token or API key doesn't grant access to this workspace (regionId), or lacks the required role.
POST /v1/workspaces/{regionId}/ai-providers/{provider}/supplier
Request
curl -X POST "$PLEAXY_API_BASE_URL/v1/workspaces/{regionId}/ai-providers/{provider}/supplier" \
  -H "X-Api-Key: $PLEAXY_API_KEY"
Response · 201 Created
{
   "id": "string",
   "buyerOrgId": "string",
   "supplierName": "string",
   "aiProvider": "string",
   "status": "pending_invite" | "invited" | "in_progress" | "submitted" | "approved" | "rejected",
   "createdAt": "string"
}

List AI invoicers

Lists the AI invoicers Pleaxy pre-creates as suppliers.

GET/v1/workspaces/{regionId}/ai-invoicers

Returns

200 OK with the object shown in the response.

More details

The AI invoicers Pleaxy keeps a supplier entry for: their names, the legal entities they invoice from by region, the currencies they bill in, whether they bill by invoice, prepaid credits or both, the domains their invoice emails come from, how Pleaxy reads their spend, and whether that reader is switched on in your region (connectable). Pleaxy maintains the list; legal entities and domains are a hint for the bill-to, never a check. Needs 'view' access to suppliers or to invoices.

Response fields

  • legalEntitiesArray<object>

    The entity that invoices a buyer in each region, default for every region not listed, with its country.

  • credentialstring

    How Pleaxy reads the invoicer's spend: admin_key (a read-only key you paste), key_pair (a key pair Pleaxy generates) or none (no reading API; its spend comes from its invoices).

  • shapestring

    What its lines are metered in: tokens, credits (Snowflake, Databricks) or capacity (GPU hours).

  • connectableboolean

    Whether CreateAiProvider can connect it in this region now.

Errors

  • 401 Unauthorized - No credential was presented, or the Bearer token / X-Api-Key value is missing, invalid, expired, or revoked.
  • 403 Forbidden - The caller's Bearer token or API key doesn't grant access to this workspace (regionId), or lacks the required role.
GET /v1/workspaces/{regionId}/ai-invoicers
Request
curl "$PLEAXY_API_BASE_URL/v1/workspaces/{regionId}/ai-invoicers" \
  -H "X-Api-Key: $PLEAXY_API_KEY"
Response · 200 OK
[
   {
      "id": "string",
      "name": "string",
      "legalEntities": [ { "region": "us" | "eu" | "default", "name": "string", "country": "string" } ],
      "billingCurrencies": [ "string" ],
      "billing": [ "invoice" | "prepaid_credits" ],
      "senderDomains": [ "string" ],
      "credential": "admin_key" | "key_pair" | "none",
      "tier": "direct" | "data_platform" | "host" | "neocloud" | "seats",
      "shape": "tokens" | "credits" | "capacity" | "seats",
      "contactHint": "string",
      "connectable": boolean
   }
]
Talk to us