Keep the model catalog current
Enterprise Tier
Providers release, reprice, and retire models faster than any deployment upgrades. Tetrate publishes the provider and model data in a public repository, and tare api catalog sync reconciles a deployment against it, reporting by default and writing only under an explicit opt-in.
Persona: Platform operator. The one-shot sync runs anywhere the tare CLI reaches the management plane; the scheduled CronJob applies where the management plane is customer-managed.
Estimated time: 10 minutes for a first dry run; one review cycle before allowing writes.
Where the catalog data comes from
The published catalog lives at github.com/tetrateio/agent-router-models: providers.json lists the providers, and each provider has one JSON file carrying its models with their prices, limits, capabilities, and lifecycle (deprecation and retirement markers). The record formats are defined in the repository's schemas/, and CHANGELOG.md records every update as a dated block, so when a price or a limit changed is answerable from the history. The repository is public: reading it needs no credential.
What a sync does, and deliberately does not do
A sync fetches the published catalog, compares every entry with the management plane, and classifies each difference:
| Action | Meaning |
|---|---|
create | The published entry does not exist in the deployment yet |
update | The entry exists and a field differs (price, limits, capabilities) |
disable | The published catalog marks the model deprecated or past its retirement date, so it is turned off, with the reason in the report |
unchanged | Already matching; counted in the report, never listed |
The disable action is the one that prevents the worst surprise: a model the provider has retired no longer stays selectable until it fails at request time.
Three safety properties are deliberate:
- A sync never deletes anything, and it reports without writing unless
--applyis passed. - Models the published catalog does not mention are left alone. A deployment's catalog is not required to be a subset of Tetrate's: self-hosted models and operator-added entries never appear in the published catalog, and disabling them automatically would break the deployment's own routing. They are listed in the report, and turned off only under the explicit
--disable-absentopt-in. - A sync never enables a model an operator disabled. An entry the published catalog would enable is surfaced in the report as staged, and stays off until an operator acts.
Whether a synced model is callable is still governed by enablement and project grants, exactly as for a hand-provisioned one; see Add providers and models to projects.
Run a one-shot sync
Sources are passed explicitly, one --models per provider file, and the run is a dry run unless --apply is added:
tare api catalog sync \
--providers https://raw.githubusercontent.com/tetrateio/agent-router-models/main/providers.json \
--models https://raw.githubusercontent.com/tetrateio/agent-router-models/main/anthropic.json \
--models https://raw.githubusercontent.com/tetrateio/agent-router-models/main/openai.json
The report leads with the shape of the run, then lists only what would change:
providers: 0 create, 1 update, 11 unchanged
models: 4 create, 7 update, 2 disable, 668 unchanged
update provider deepinfra (endpoint)
create model openai/gpt-6-astra
disable model gemini/gemini-1.5-pro -- retired 2026-06-30
dry run: nothing written. 14 entr(ies) would change; pass --apply to write.
Re-run with --apply to write. The management key behind the CLI session needs the models:edit, providers:edit, and config:edit scopes; failures on individual entries are collected and reported rather than aborting the run.
To review updates before they are ever fetchable, pin the URLs to a tag or commit SHA of the published repository instead of main.
Schedule it
Where the management plane is customer-managed, its chart ships a catalog-sync CronJob that runs the same sync nightly. It is off by default, behind two separate opt-ins so it can be watched before it is trusted:
| Helm value | What it does |
|---|---|
catalog-sync.enabled | Renders the CronJob. Alone, this buys a nightly dry-run report in the job's logs, and writes nothing |
catalog-sync.apply | Lets the job write |
catalog-sync.apiKey.secretName | Names the secret holding an admin-scoped management key with models:edit, providers:edit, and config:edit |
catalog-sync.proxy | Outbound proxy for a cluster that egresses through one |
catalog-sync.source | Where to read the catalog: the published repository's main by default, a pinned tag or SHA for review-first change control, or mounted files for a cluster with no egress |
The rollout pattern the defaults are built for: enable the job, read a cycle of nightly reports in kubectl logs, and only then allow apply.
Air-gapped clusters
Both sources accept a local file path in place of a URL. Download the published catalog out of band, then apply it from files:
tare api catalog sync --providers ./providers.json --models ./anthropic.json --apply
--models-sha256 pins a digest per models document, in the same order as the --models flags, for pipelines that verify what they fetched.
Where to go next