If this is specific to the Red Hat provider (although maybe it applies to distributor generated manifests?), why not break this out to it's own API that is a bit clearer that shouldn't try to send a custom provider ID. Or perhaps limit this to something like `/organizations/:id/providers/red_hat/refresh_products`