@@ -9995,6 +9995,12 @@ components:
           type:
             - 'boolean'
             - 'null'
+        enforce_first_party_harness_models:
+          description: 'Whether coding harnesses list only their vendor''s own models: Codex lists OpenAI models and Claude Code and Claude Desktop list Anthropic models. Affects only the model list those harnesses request from GET /models; a model the client names directly is still routed. Any true across the workspace default, member, and API key guardrails applies.'
+          example: false
+          type:
+            - 'boolean'
+            - 'null'
         enforce_zdr:
           deprecated: true
           description: 'Deprecated. Use enforce_zdr_anthropic, enforce_zdr_openai, enforce_zdr_google, enforce_zdr_xai, and enforce_zdr_other instead. When provided, its value is copied into any of those per-provider fields that are not explicitly specified on the request.'
@@ -13702,6 +13708,12 @@ components:
           type:
             - 'boolean'
             - 'null'
+        enforce_first_party_harness_models:
+          description: 'Whether coding harnesses list only their vendor''s own models: Codex lists OpenAI models and Claude Code and Claude Desktop list Anthropic models. Affects only the model list those harnesses request from GET /models; a model the client names directly is still routed. Any true across the workspace default, member, and API key guardrails applies.'
+          example: false
+          type:
+            - 'boolean'
+            - 'null'
         enforce_zdr:
           deprecated: true
           description: 'Deprecated. Use enforce_zdr_anthropic, enforce_zdr_openai, enforce_zdr_google, enforce_zdr_xai, and enforce_zdr_other instead. When provided, its value is copied into any of those per-provider fields that are not explicitly specified on the request.'
@@ -22938,7 +22950,7 @@ components:
           example: 'org_2dHFtVWx2n56w6HkM0000000000'
           type: 'string'
         is_filtered_model_catalog_enabled:
-          description: 'When true, `GET /api/v1/models` called with one of the organization''s API keys returns only the models that key can use (the `/api/v1/models/user` catalog), and the signed-in dashboard shows the same list. Anonymous requests always receive the public catalog.'
+          description: 'When true, the signed-in dashboard lists only the models the organization can use. `GET /api/v1/models` called with an API key always returns only the models that key can use, whatever this setting says; anonymous requests receive the public catalog.'
           example: true
           type: 'boolean'
       required:
@@ -31888,6 +31900,12 @@ components:
           type:
             - 'boolean'
             - 'null'
+        enforce_first_party_harness_models:
+          description: 'Whether coding harnesses list only their vendor''s own models: Codex lists OpenAI models and Claude Code and Claude Desktop list Anthropic models. Affects only the model list those harnesses request from GET /models; a model the client names directly is still routed. Any true across the workspace default, member, and API key guardrails applies.'
+          example: true
+          type:
+            - 'boolean'
+            - 'null'
         enforce_zdr:
           deprecated: true
           description: 'Deprecated. Use enforce_zdr_anthropic, enforce_zdr_openai, enforce_zdr_google, enforce_zdr_xai, and enforce_zdr_other instead. When provided, its value is copied into any of those per-provider fields that are not explicitly specified on the request.'
@@ -32108,7 +32126,7 @@ components:
       additionalProperties: false
       properties:
         is_filtered_model_catalog_enabled:
-          description: 'When true, `GET /api/v1/models` called with one of the organization''s API keys returns only the models that key can use (the `/api/v1/models/user` catalog), and the signed-in dashboard shows the same list. Anonymous requests always receive the public catalog.'
+          description: 'When true, the signed-in dashboard lists only the models the organization can use. `GET /api/v1/models` called with an API key always returns only the models that key can use, whatever this setting says; anonymous requests receive the public catalog.'
           example: true
           type: 'boolean'
       required:
@@ -44468,6 +44486,16 @@ paths:
               schema:
                 $ref: '#/components/schemas/BadRequestResponse'
           description: 'Bad Request - Invalid request parameters or malformed input'
+        '401':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 401
+                  message: 'Missing Authentication header'
+              schema:
+                $ref: '#/components/schemas/UnauthorizedResponse'
+          description: 'Unauthorized - Authentication required or invalid credentials'
         '403':
           content:
             application/json:
@@ -44478,6 +44506,46 @@ paths:
               schema:
                 $ref: '#/components/schemas/ForbiddenResponse'
           description: 'Forbidden - Authentication successful but insufficient permissions'
+        '404':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 404
+                  message: 'Resource not found'
+              schema:
+                $ref: '#/components/schemas/NotFoundResponse'
+          description: 'Not Found - Resource does not exist'
+        '408':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 408
+                  message: 'Operation timed out. Please try again later.'
+              schema:
+                $ref: '#/components/schemas/RequestTimeoutResponse'
+          description: 'Request Timeout - Operation exceeded time limit'
+        '409':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 409
+                  message: 'Resource conflict. Please try again later.'
+              schema:
+                $ref: '#/components/schemas/ConflictResponse'
+          description: 'Conflict - Resource conflict or concurrent modification'
+        '429':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 429
+                  message: 'Rate limit exceeded'
+              schema:
+                $ref: '#/components/schemas/TooManyRequestsResponse'
+          description: 'Too Many Requests - Rate limit exceeded'
         '500':
           content:
             application/json:
@@ -44840,6 +44908,36 @@ paths:
               schema:
                 $ref: '#/components/schemas/NotFoundResponse'
           description: 'Not Found - Resource does not exist'
+        '408':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 408
+                  message: 'Operation timed out. Please try again later.'
+              schema:
+                $ref: '#/components/schemas/RequestTimeoutResponse'
+          description: 'Request Timeout - Operation exceeded time limit'
+        '409':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 409
+                  message: 'Resource conflict. Please try again later.'
+              schema:
+                $ref: '#/components/schemas/ConflictResponse'
+          description: 'Conflict - Resource conflict or concurrent modification'
+        '429':
+          content:
+            application/json:
+              example:
+                error:
+                  code: 429
+                  message: 'Rate limit exceeded'
+              schema:
+                $ref: '#/components/schemas/TooManyRequestsResponse'
+          description: 'Too Many Requests - Rate limit exceeded'
         '500':
           content:
             application/json: