Managing endpoints in Serverless AI

Prerequisites

Web console
CLI
REST API

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Install and configure the Nebius AI Cloud CLI. Check that your project ID is saved in the Nebius AI Cloud CLI profile configuration:
cat ~/.nebius/config.yaml

Install jq to parse JSON output:

sudo apt-get install jq

brew install jq

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

Get an access token to authenticate to the REST API.

Install jq to parse JSON output:

sudo apt-get install jq

brew install jq

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console.

How to create an endpoint

To deploy an AI model, create an endpoint. Serverless AI endpoints run on Compute container virtual machines (VMs) managed by Serverless AI. You can access your model by using the endpoint.

Web console
CLI
REST API

In the sidebar, go to Serverless AI → Endpoints.
Click Create endpoint.
Specify the endpoint name.
In Configuration, select Custom.
Configure Endpoint settings:
1. In Image path, set the path to the container image.
2. If you use a private registry, in Private registry, select an existing registry or click Add and provide the details for your registry.
3. In Ports, set the container ports for the endpoint. You can add multiple ports.
4. (Optional) In Entrypoint command, specify the entrypoint command for the container. If you need to pass container arguments, specify them in this field as well.
5. (Optional) In Environment variables, specify environment variables in key-value pairs.
6. (Optional) In Secret environment variables, click Create secret to store a sensitive value in SecretStash and inject it as an environment variable. In the window that opens, specify the Key (environment variable name) and Value (secret data), then click Create.
7. (Optional) In Authentication, enable token authentication if the endpoint serves production traffic. The system generates a token. Copy and save the token securely before proceeding. If you are prototyping or testing, you can leave authentication disabled.
(Optional) Configure the Computing resources section:
1. Select whether the container VM should have GPUs.
2. Specify the VM type: regular or preemptible. VMs without GPUs only support the regular type.
3. Select the platform and preset.
(Optional) Configure Storage settings:
- Under Container disk, set Size. See how disk performance depends on disk size.
- Under Mounted volumes, click Attach volume to attach a bucket or a filesystem. You can create a bucket or filesystem, or use an existing one. To create a new bucket, see Bucket parameters. To create a new filesystem, see Volume parameters.
(Optional) In the Files section, add one or more small configuration files to inject into the container at launch:
- Select Upload files to upload files from your machine, or Create text files to enter the file content and click Create file.
- In Mount path, specify the absolute path to the file in the container, for example, /mnt/files/config.yaml. Injected files are read-only and limited to 64 KiB each.
(Optional) In the Access section, configure User name and SSH key to connect to the running workload for debugging. You can create new credentials or select existing ones. If you decide to use an existing credential, make sure that the SSH key is stored for the nebius username.
Configure the Network section:
- Select a subnet or create a new one.
- Select the IP address type: Public static IP or Private IP. If you want to connect to the resource from the internet, select Public static IP.
Click Create endpoint.

With the command below, you specify all values directly in the command. This is useful for scripts, configuration-driven workflows, continuous integration (CI) and agents. Alternatively, you can run nebius ai create to use the interactive flow where the CLI prompts you for parameter values step by step.

To create an endpoint, run the following command:

nebius ai endpoint create \
  --name <endpoint_name> \
  --image <image_path> \
  --registry-username <username> \
  --registry-password <password> \
  --container-command "<command>" \
  --container-port <port> \
  --args "<arguments>" \
  --env "<key=value>" \
  --env-secret <key=secret_selector> \
  --auth token \
  --token <token> \
  --volume "<source:container_path[:mode]|s3://bucket:/container_path[:mode[:profile]]>" \
  --inject-file "<local_path>:<absolute_container_path>" \
  --subnet-id <subnet_ID> \
  --platform <platform_ID> \
  --preset <preset> \
  --disk-size <size> \
  --shm-size <size> \
  --ssh-key "$(cat <path_to_SSH_public_key>)" \
  --preemptible \
  --public

Endpoint creation example

nebius ai endpoint create \
  --name my-chatbot \
  --image vllm/vllm-openai:latest \
  --container-command "python3 -m vllm.entrypoints.openai.api_server" \
  --container-port 8000 \
  --env MODEL=llama-3-70b \
  --auth token \
  --token df88e*** \
  --volume "storagebucket-e***:/output:rw" \
  --inject-file "config.yaml:/etc/app/config.yaml" \
  --subnet-id vpcsubnet-e*** \
  --platform gpu-h100-sxm \
  --preset 1gpu-16vcpu-200gb \
  --disk-size 250Gi \
  --shm-size 128Mi \
  --ssh-key "$(cat ~/.ssh/id_ed25519.pub)" \
  --public

In the command, specify the following parameters:

Endpoint characteristics:
- --name: Endpoint name.
- --image: Container image reference in the registry/path:tag or registry/path@digest format. Use an image from a public registry or your authenticated private registry.
- --registry-username, --registry-password (optional): Credentials to authenticate if you pull an image from a private registry. Alternatively, use --registry-secret for credentials stored in SecretStash.
  - --registry-username: Username.
  - --registry-password: Personal access token, password or an API key. Depends on where your registry is hosted. It can be Docker Hub, Microsoft Azure, GitHub, NVIDIA or a custom registry.
  If you pull an image from a public registry or from Container Registry in the same project, you don’t need to specify credentials.
- --registry-secret (optional): SecretStash secret selector with registry_username and registry_password payload keys. You can specify a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***.
- --container-command (optional): Entrypoint command for the container.
- --args (optional): Arguments for docker run to pass to the entrypoint command.
- --env (optional): Environment variables for the container. Set them in the key=value format where key is the environment variable and the value is the value of this variable. If you need to set several variables, list the key=value pairs separated by commas.
- --env-secret (optional): Environment variables loaded from a SecretStash secret. Set them in the key=secret_selector format, where key is the environment variable name and must match a payload key in the secret, and secret_selector is a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***. If you need to set several variables, list the pairs separated by commas. You cannot use the same key in both --env and --env-secret.
- --container-port (optional): Port on which the application listens in the container. Each HTTP port is available through the endpoint’s managed HTTPS URL.
- --auth (optional): Authentication method. If the parameter isn’t set (default), no authentication is required. Useful when you want to create an endpoint prototype and test it. If you set --auth token, you enable authentication. Useful for production purposes. When you call the endpoint, specify the token in the "Authorization: Bearer <token>" HTTP header. Use --token or --token-secret to configure the token. If you don’t provide either, the CLI generates a random token.
  - --token (optional): Token for authentication. To generate one manually, run openssl rand -hex 32. If you don’t provide --token, the CLI generates one for you.
  - --token-secret (optional): SecretStash secret selector with the AUTH_TOKEN payload key. You can specify a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***.
- --inject-file (optional): Mount a local file into the endpoint container at launch. Use the format <local_path>:<absolute_container_path>. To inject multiple files, repeat the parameter. The mounted file is read-only and limited to 64 KiB.
- --volume (optional): Bucket or shared filesystem to mount to the endpoint container. You can use volumes to store model files and other endpoint artifacts. Specify the value in either format:
  - source:container_path[:mode] for mounting Nebius shared filesystems and existing bucket or volume resources by ID or name.
  - s3://bucket:/container_path[:mode[:profile]] for mounting an Object Storage bucket with AWS profile credentials or S3 credentials stored in SecretStash. The profile is the AWS credentials profile to use. If you manage your credentials with SecretStash, use profile@<secret_selector>, where <secret_selector> is a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***
  The supported modes are ro, read only, and rw, read-write (default). Repeat for multiple volumes. For example:
  --volume 'computefilesystem-e***:/input:ro' \ --volume 'storagebucket-e***:/output:rw' \ --volume 's3://training-results:/output:rw:default'
In source, you can specify either the volume ID or its name.
Underlying container VM characteristics:
- --subnet-id: Subnet ID. Required if the project has multiple subnets.
- --platform: VM platform. See available platforms in Types of virtual machines and GPUs in Nebius AI Cloud.
- --preset: Number of GPUs, vCPUs and RAM allocated to the container. The preset must match the selected platform. See available presets in Presets for GPU platforms.
- --disk-size: Disk size of the container VM. Specify the value such as 100Gi, 500Gi or 1Ti. The default value is 250Gi. See how disk performance depends on disk size.
- --shm-size (optional): Shared memory size of /dev/shm. Specify the value such as 64Mi, 128Mi or 1Gi. The default value is 16Gi.
- --ssh-key (optional): SSH key to access the container VM by SSH. When you add an SSH key, a public dynamic IP address is assigned. Before you add the key, check the quota on the number of public IP addresses in the web console.
- --preemptible (optional): Use a preemptible VM. Preemptible VMs are cheaper but can be stopped by Compute at any time. Only GPU platforms offer preemptible VMs. If you omit this parameter, the container runs on a regular VM.
- --public (optional): Assigns a public IP address to the container VM. Not required to reach the endpoint from the internet, because each HTTP port is available through the endpoint’s managed HTTPS URL.

Send the following request:

curl --request POST \
  --url 'https://api.nebius.cloud/ai/v1/endpoints' \
  --header "Authorization: Bearer <access_token>" \
  --header 'Content-Type: application/json' \
  --data '{
    "metadata": {
      "parentId": "<project_ID>",
      "name": "my-endpoint"
    },
    "spec": {
      "image": "<image_path>",
      "registryCredentials": {"username": "<username>", "password": "<password>"},
      "containerCommand": "<command>",
      "args": "<arguments>",
      "environmentVariables": [
        {
          "name": "<environment_variable_name>",
          "value": "<environment_variable_value>"
        }
      ],
      "ports": [
        {
          "containerPort": <port>,
          "protocol": "HTTP"
        }
      ],
      "authToken": "<token>",
      "volumes": [
        {
          "source": "<volume_ID_or_name>",
          "containerPath": "<absolute_container_path>",
          "mode": "<READ_ONLY_or_READ_WRITE>"
        }
      ],
      "injectedFiles": [
        {
          "containerPath": "<absolute_container_path>",
          "content": "<base64_encoded_file_content>"
        }
      ],
      "subnetId": "<subnet_ID>",
      "platform": "<platform_ID>",
      "preset": "<preset>",
      "disk": {
        "type": "NETWORK_SSD",
        "sizeBytes": "<disk_size_in_bytes>"
      },
      "shmSizeBytes": "<shared_memory_size_in_bytes>",
      "sshAuthorizedKeys": [
        "<SSH_public_key>"
      ],
      "preemptible": true,
      "publicIp": true
    }
  }'

Endpoint creation example

curl --request POST \
  --url 'https://api.nebius.cloud/ai/v1/endpoints' \
  --header "Authorization: Bearer <access_token>" \
  --header 'Content-Type: application/json' \
  --data '{
    "metadata": {
      "parentId": "<project_ID>",
      "name": "my-chatbot"
    },
    "spec": {
      "image": "vllm/vllm-openai:latest",
      "containerCommand": "python3 -m vllm.entrypoints.openai.api_server",
      "environmentVariables": [
        {
          "name": "MODEL",
          "value": "llama-3-70b"
        }
      ],
      "ports": [
        {
          "containerPort": 8000,
          "protocol": "HTTP"
        }
      ],
      "authToken": "df88e***",
      "volumes": [
        {
          "source": "storagebucket-e***",
          "containerPath": "/output",
          "mode": "READ_WRITE"
        }
      ],
      "injectedFiles": [
        {
          "containerPath": "/etc/app/config.yaml",
          "content": "'"$(base64 < config.yaml | tr -d '\n')"'"
        }
      ],
      "subnetId": "vpcsubnet-e***",
      "platform": "gpu-h100-sxm",
      "preset": "1gpu-16vcpu-200gb",
      "disk": {
        "type": "NETWORK_SSD",
        "sizeBytes": "268435456000"
      },
      "shmSizeBytes": "134217728",
      "sshAuthorizedKeys": [
        "'"$(cat ~/.ssh/id_ed25519.pub)"'"
      ],
      "publicIp": true
    }
  }'

In the Authorization header, replace <access_token> with the access token that you got in the prerequisites.The request includes the following parameters:

Endpoint characteristics:
- metadata.parentId: Project ID.
- metadata.name: Endpoint name.
- spec.image: Container image reference in the registry/path:tag or registry/path@digest format. Use an image from a public registry or your authenticated private registry.
- spec.registryCredentials (optional): Credentials to authenticate if you pull an image from a private registry.
  - spec.registryCredentials.username: Username.
  - spec.registryCredentials.password: Personal access token, password or an API key. Depends on where your registry is hosted. It can be Docker Hub, Microsoft Azure, GitHub, NVIDIA or a custom registry.
  If you pull an image from a public registry or from Container Registry in the same project, you don’t need to specify credentials.
- spec.containerCommand (optional): Entrypoint command for the container.
- spec.args (optional): Arguments for docker run to pass to the entrypoint command.
- spec.environmentVariables (optional): Environment variables for the container.
  - spec.environmentVariables[].name: Environment variable name.
  - spec.environmentVariables[].value: Environment variable value.
- spec.ports (optional): Ports that the endpoint exposes.
  - spec.ports[].containerPort: Port on which the application listens in the container. Each HTTP port is available through the endpoint’s managed HTTPS URL.
  - spec.ports[].protocol: Protocol used by the exposed port.
- spec.authToken (optional): Token for authentication. To generate one manually, run openssl rand -hex 32. If omitted, authentication is disabled.
- spec.volumes (optional): Buckets or shared filesystems to mount to the endpoint container. You can use volumes to store model files and other endpoint artifacts.
  - spec.volumes[].source: Volume ID or name.
  - spec.volumes[].containerPath: Absolute path where the volume is mounted in the container.
  - spec.volumes[].mode: Mount mode: READ_ONLY or READ_WRITE.
- spec.injectedFiles (optional): Files to mount into the endpoint container at launch. To inject multiple files, add multiple items. Each mounted file is read-only and limited to 64 KiB.
  - spec.injectedFiles[].containerPath: Absolute path where the file is mounted in the container.
  - spec.injectedFiles[].content: Base64-encoded file content.
Underlying container VM characteristics:
- spec.subnetId: Subnet ID. Required if the project has multiple subnets.
- spec.platform: VM platform. See available platforms in Types of virtual machines and GPUs in Nebius AI Cloud.
- spec.preset: Number of GPUs, vCPUs and RAM allocated to the container. The preset must match the selected platform. See available presets in Presets for GPU platforms.
- spec.disk.type: Disk type for the container VM.
- spec.disk.sizeBytes: Disk size of the container VM in bytes. The default value is 250 GiB. See how disk performance depends on disk size.
- spec.shmSizeBytes (optional): Shared memory size of /dev/shm in bytes. The default value is 16 GiB.
- spec.sshAuthorizedKeys (optional): SSH public keys to access the container VM by SSH. When you add an SSH key, a public dynamic IP address is assigned. Before you add the key, check the quota on the number of public IP addresses in the web console.
- spec.preemptible (optional): Whether to use a preemptible VM. Preemptible VMs are cheaper but can be stopped by Compute at any time. Only GPU platforms offer preemptible VMs. If omitted or set to false, the container runs on a regular VM.
- spec.publicIp (optional): Whether to assign a public IP address to the container VM. A public IP address isn’t required to reach the endpoint through its managed HTTPS URL.

The endpoint creation takes approximately five minutes.

How to call an endpoint

For this operation, it’s enough to be in a group that has the viewer role within your tenant; for example, the default viewers group. You can check this in the Administration → IAM section of the web console. You can call an endpoint when you want to interact with an AI model hosted in this endpoint; for example, when you want to chat with the model. Each HTTP port is available through a managed https:// URL. gRPC also uses the managed HTTPS URL. For TCP ports, use the managed tls://<host>:443 URL with a TLS client. Endpoints support managed public URLs, shown in Public endpoints as https://.... For some previously created endpoints, Public endpoints can show IP:port instead. To call the endpoint:

Get the endpoint’s managed HTTPS URL:
- Web console
- CLI
- REST API
1. In the sidebar, go to Serverless AI → Endpoints.
2. Open the page of the required endpoint.
3. Wait until the endpoint is running. Then, in the Network section, copy the public endpoint from the Public endpoints field. Depending on how the endpoint is exposed, this field can show either a managed https://... URL or IP:port.
1. To get the endpoint ID, list all endpoints:
  nebius ai endpoint list
  In the output, copy the ID of the required endpoint.
2. Get the endpoint’s managed HTTPS URL:
  nebius ai endpoint get <endpoint_ID> --format json \ | jq -r '.status.public_endpoints[] | select(startswith("https://"))' | head -1
1. List endpoints:
  curl --request GET \ --url "https://api.nebius.cloud/ai/v1/endpoints?parentId=<project_ID>" \ --header "Authorization: Bearer <access_token>"
  In the request, specify:
  
  Your access token in the Authorization header.
  
  The project ID in the parentId query parameter.
  
  In the response, copy the metadata.id of the required endpoint.
2. Get the endpoint’s managed HTTPS URL:
  curl --request GET \ --url "https://api.nebius.cloud/ai/v1/endpoints/<endpoint_ID>" \ --header "Authorization: Bearer <access_token>" \ | jq -r '.status.publicEndpoints[] | select(startswith("https://"))' | head -1
  In the request, specify:
  
  Your access token in the Authorization header.
  
  The endpoint ID from metadata.id, in the request path.

Call the endpoint by using an HTTP client. For example, with curl:

curl "<endpoint_URL>/v1/chat/completions" \
   -H "Authorization: Bearer <token>" \
   -H "Content-Type: application/json" \
   -d '{
      "model": "llama-3-70b",
      "messages": [
         {"role": "user", "content": "Tell a joke about AI."}
      ]
   }'

In the command, specify the following parameters:

<endpoint_URL>: Managed HTTPS URL that you copied earlier.
<token>: Authentication token that you specified when you created the endpoint. If you didn’t specify any token, don’t use the Authorization HTTP header.
model: AI model that is hosted in the endpoint and that you chat with.
content: Message that you want to send to the model.

The response looks like the following:

{
  "choices": [
    {
      "message": {
        "role": "assistant",
        "content": "Why did the AI cross the road? Because it learned the optimal path after 10,000 epochs."
      }
    }
  ]
}

How to stop or start an endpoint

If you don’t currently need your endpoint but you want to preserve it, you can stop the endpoint and then start it later. Computing resources of stopped endpoints aren’t charged. However, if you mounted a volume to the endpoint, you are charged for the volume even if the endpoint is stopped.

Web console
CLI
REST API

In the sidebar, go to Serverless AI → Endpoints.
Locate the endpoint and then click → Stop or Start.
In the window that opens, confirm the action.

To get the endpoint ID, list all endpoints:
nebius ai endpoint list
In the output, copy the ID of the required endpoint.

To stop an endpoint, run the following command:

nebius ai endpoint stop --id <endpoint_ID>

To start an endpoint, run the following command:

nebius ai endpoint start --id <endpoint_ID>

List endpoints:
curl --request GET \ --url "https://api.nebius.cloud/ai/v1/endpoints?parentId=<project_ID>" \ --header "Authorization: Bearer <access_token>"
In the request, specify:
- Your access token in the Authorization header.
- The project ID in the parentId query parameter.
In the response, copy the metadata.id of the required endpoint.

To stop the endpoint, send the following request:

curl --request POST \
  --url 'https://api.nebius.cloud/ai/v1/endpoints/stop' \
  --header "Authorization: Bearer <access_token>" \
  --header 'Content-Type: application/json' \
  --data '{
    "id": "<endpoint_ID>"
  }'

In the request, specify:

Your access token in the Authorization header.
<endpoint_ID>: Endpoint ID that you copied.

To start the endpoint, send the following request:

curl --request POST \
  --url 'https://api.nebius.cloud/ai/v1/endpoints/start' \
  --header "Authorization: Bearer <access_token>" \
  --header 'Content-Type: application/json' \
  --data '{
    "id": "<endpoint_ID>"
  }'

In the request, specify:

Your access token in the Authorization header.
<endpoint_ID>: Endpoint ID that you copied.

How to delete an endpoint

When you delete an endpoint, Serverless AI automatically deletes its VM and container (boot) disk. If you no longer need the endpoint, delete it:

Web console
CLI
REST API

In the sidebar, go to Serverless AI → Endpoints.
Locate the endpoint and then click → Delete.
In the window that opens, confirm the deletion.

To get the endpoint ID, list all endpoints:
nebius ai endpoint list
In the output, copy the ID of the required endpoint.
Delete the endpoint:
nebius ai endpoint delete --id <endpoint_ID>
If a static IP address is assigned to the endpoint, the prompt asks to confirm the address release. Enter y to confirm or n to keep the address allocated in a pool.

List endpoints:
curl --request GET \ --url "https://api.nebius.cloud/ai/v1/endpoints?parentId=<project_ID>" \ --header "Authorization: Bearer <access_token>"
In the request, specify:
- Your access token in the Authorization header.
- The project ID in the parentId query parameter.
In the response, copy the metadata.id of the required endpoint.

Delete the endpoint:

curl --request DELETE \
  --url "https://api.nebius.cloud/ai/v1/endpoints/<endpoint_ID>" \
  --header "Authorization: Bearer <access_token>"

In the request, specify:

Your access token in the Authorization header.
The endpoint ID that you copied in the request path.

AI services in Nebius AI Cloud

Serverless AI

Managed Service for MLflow

Applications in Nebius AI Cloud

Tutorials

Third-party integrations

Managing endpoints in Serverless AI

Prerequisites

How to create an endpoint

How to call an endpoint

How to stop or start an endpoint

How to delete an endpoint

​Prerequisites

​How to create an endpoint

​How to call an endpoint

​How to stop or start an endpoint

​How to delete an endpoint

Prerequisites

How to create an endpoint

How to call an endpoint

How to stop or start an endpoint

How to delete an endpoint