> ## Documentation Index
> Fetch the complete documentation index at: https://gateway.forceaisecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# UI Settings reference

> Every toggle on Admin Settings -> UI Settings: what it does, the underlying flag, and when to turn it on.

The UI Settings tab holds admin flags that shape what non-admin (internal) users can do in the dashboard, how the gateway forwards headers, and which pages internal users see. Find it at **Admin Settings -> UI Settings**. Each toggle writes a single flag and takes effect immediately; the Projects toggle also refreshes the page

<Info>
  These are proxy-wide flags set by an admin. "Internal users" means any signed-in user who is not a proxy admin. Team admins are internal users with extra powers on the teams they manage, which is why two toggles have a team-admin exemption
</Info>

## Access control for internal users

| Toggle                                   | Flag                                       | Effect when on                                                                                                                                            |
| ---------------------------------------- | ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Disable model add for internal users     | `disable_model_add_for_internal_users`     | Internal users cannot add models from the UI                                                                                                              |
| Disable team admin delete team user      | `disable_team_admin_delete_team_user`      | Team admins cannot remove users from teams they manage. Use when team membership is provisioned externally through SCIM                                   |
| Require authentication for public AI Hub | `require_auth_for_public_ai_hub`           | The public AI Hub page requires a login instead of being open                                                                                             |
| Disable agents for internal users        | `disable_agents_for_internal_users`        | Internal users cannot reach the agent management endpoints or the Agents page                                                                             |
| Allow agents for team admins             | `allow_agents_for_team_admins`             | Exempts team admins from the agents restriction. Only has an effect while "Disable agents for internal users" is on, so the switch is inactive until then |
| Disable vector stores for internal users | `disable_vector_stores_for_internal_users` | Internal users cannot reach the vector store endpoints or the Vector Stores page                                                                          |
| Allow vector stores for team admins      | `allow_vector_stores_for_team_admins`      | Exempts team admins from the vector store restriction. Only has an effect while "Disable vector stores for internal users" is on                          |
| Scope user search to organization        | `scope_user_search_to_org`                 | The user search endpoint returns only users in the caller's organization. When off, any authenticated user can search all users                           |
| Disable custom Virtual key values        | `disable_custom_api_keys`                  | Users cannot supply their own key value; every key must be auto-generated                                                                                 |

<Warning>
  The two "Allow ... for team admins" switches are dependent: they do nothing on their own and stay disabled in the UI until their parent "Disable ..." toggle is on. Turn the restriction on first, then grant the team-admin exemption
</Warning>

## Header forwarding (Claude Code and BYOK)

These two are independent of each other and of any deployment-configured key. Turn on only the ones you need

| Toggle                            | Flag                                | Effect when on                                                                                                                                                                                                                                            |
| --------------------------------- | ----------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Forward client headers to LLM API | `forward_client_headers_to_llm_api` | Forwards client headers (`Authorization`, `anthropic-beta`, and `x-*` custom headers) to the upstream LLM. Enable for Claude Code on a Max subscription, which forwards the OAuth token, or to pass custom and tracing headers through to the provider    |
| Forward LLM provider auth headers | `forward_llm_provider_auth_headers` | Forwards provider auth headers (`x-api-key`, `x-goog-api-key`, `api-key`, `ocp-apim-subscription-key`) to the upstream LLM, overriding any deployment-configured key for that request. Enable for Claude Code BYOK, where clients bring their own API key |

<Warning>
  Forwarding provider auth headers lets a caller override the gateway's configured key with their own for that request. Turn it on only when you intend clients to bring their own key
</Warning>

## Experimental

| Toggle                  | Flag                 | Effect when on                                                                                                             |
| ----------------------- | -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| \[BETA] Enable Projects | `enable_projects_ui` | Shows the Projects feature in the sidebar and adds the project field to key management. Saving this one refreshes the page |

## Page visibility for internal users

Below the toggles, the **Page Visibility** control (`enabled_ui_pages_internal_users`) picks exactly which sidebar pages internal users can open. Leaving it unset shows the default set; selecting pages restricts internal users to just those. Admins always see every page

## Setting these by API

The toggles are a thin wrapper over one admin endpoint. Each switch sends its single flag:

```bash theme={null}
curl -X PATCH http://localhost:4001/update/ui_settings \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"disable_model_add_for_internal_users": true}'
```

Send any flag from the tables above. Booleans for the toggles, and an array of page names for `enabled_ui_pages_internal_users`. The current values are readable at `GET /get/ui_settings`