Providers
Table for storing external service providers with API keys and configuration per herd
| Column Name | Data Type | Constraints |
|---|---|---|
| id | bigint | NOT NULL |
| created_at | timestamp with time zone | DEFAULT now() NOT NULL |
| type | text | NOT NULL |
| key | text | |
| source | text | NOT NULL |
| herd_id | bigint | NOT NULL |
| sensitivity_tier | integer | |
| timestamp_expiration | timestamp with time zone |
Security Policies (RLS)
RLS enabled. Herd scope: Herd from providers.herd_id.
| Operation | has_herd_ability ability key | Other paths |
|---|---|---|
| SELECT | providers.read | Device API keys in herd |
| INSERT | providers.write | — |
| UPDATE | providers.write | — |
| DELETE | providers.write | — |
Platform superadmin: FOR ALL bypass where defined.
key is not selectable by the authenticated role (column-level grant), so signed-in users, superadmins included, read every column except the credential; scout-core selects PROVIDER_COLUMNS and returns IProviderRow. Inserting and updating key is still allowed. Only the service role and device API keys read it; platform superadmins can fetch a single key through get_provider_key(provider_id) (get_provider_key in scout-core).