Permissions & model scope
Why some models are unavailable
A MODEL_NOT_ALLOWED response means your plan or your API key can't reach that
model. Three things decide it:
- Your subscription plan — each model requires an access tier (
FREE,PAID,TRUSTED,ENTERPRISE), and your plan grants a set of tiers. Crucially, plans grant different tiers to the Playground and to API keys: on Starter the Playground can use every public model while an API key can only call the free model. See Subscription plans. - The key's allowed models — a key carries its own model list, chosen when you create it. A model outside that list is rejected even if your plan allows it.
- Per-user override — an administrator can individually ALLOW or DENY a specific model for an account, for whitelisting or gradual rollout.
While signup bonus remains in your wallet, paid models are temporarily unlocked so you can try them; the restriction returns once the bonus is spent.
Enforcement is at the data plane
A key's allowed-model scope is synced down to the gateway, so putting a model
in the request body cannot bypass it — the call is rejected before it reaches a
provider, and nothing is charged.
Endpoint must match the model
Each model belongs to one API surface. Calling a model on the wrong endpoint
(for example an embeddings model on /v1/chat/completions) is rejected with
model_api_surface_mismatch before the provider is called. See
API surfaces.
Beta models
INTERNAL_BETA models are hidden from ordinary users and available only to
whitelisted accounts. They don't appear in the public model catalogue.