Managing endpoints in Serverless AI

How to create an endpoint

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console. To deploy an AI model, create an endpoint. Serverless AI endpoints are based on containers over virtual machines (VMs) in Compute. Your model runs in a container over VM, and you can access the model by using the endpoint.

Web console
CLI

In the sidebar, go to Serverless AI → Endpoints.
Click Create endpoint.
Specify the endpoint name.
Configure Endpoint settings:
1. In Image path, set the path to the container image.
2. If you use a private registry, click Add registry and provide the details for your registry.
3. In Ports, set the container ports for the endpoint. You can add multiple ports.
4. (Optional) In Entrypoint command, specify the entrypoint command for the container. If you need to pass container arguments, specify them in this field as well.
5. (Optional) In Environment variables, specify environment variables in key-value pairs.
6. (Optional) In Authentication, enable token authentication if the endpoint serves production traffic. The system generates a token. Copy and save the token securely before proceeding. If you are prototyping or testing, you can leave authentication disabled.
(Optional) Configure the Computing resources section:
1. Select whether the VM should have GPUs.
2. Specify the VM type: regular or preemptible. VMs without GPUs only support the regular type.
3. Select the platform and preset.
(Optional) Configure Storage settings:
- Set the container disk size. See how disk performance depends on disk size.
- Attach a bucket or a filesystem to provide storage. You can create a bucket or filesystem, or use an existing one. To create a new bucket, see Bucket parameters. To create a new filesystem, see Volume parameters.
(Optional) In the Access section, add an SSH key for the VM’s user so you can connect to the VM. You can add new credentials or select existing ones. If you decide to use an existing credential, make sure that the SSH key is stored for the nebius username.
Configure the Network section:
- Select a subnet or create a new one.
- Select the IP address type: Public static IP or Private IP. If you want to connect to the resource from the internet, select Public static IP.
Click Create.

With the command below, you specify all values directly in the command. This is useful for scripts, configuration-driven workflows, continuous integration (CI) and agents. Alternatively, you can run nebius ai create to use the interactive flow where the CLI prompts you for parameter values step by step.

To create an endpoint, run the following command:

nebius ai endpoint create \
  --name <endpoint_name> \
  --image <image_path> \
  --registry-username <username> \
  --registry-password <password> \
  --container-command "<command>" \
  --container-port <port> \
  --args "<arguments>" \
  --env "<key=value>" \
  --auth token \
  --token <token> \
  --volume "<source:container_path[:mode]|s3://bucket:/container_path[:mode[:profile]]>" \
  --inject-file "<local_path>:<absolute_container_path>" \
  --subnet-id <subnet_ID> \
  --platform <platform_ID> \
  --preset <preset> \
  --disk-size <size> \
  --shm-size <size> \
  --ssh-key "$(cat <path_to_SSH_public_key>)" \
  --public

Endpoint creation example

nebius ai endpoint create \
  --name my-chatbot \
  --image vllm/vllm-openai:latest \
  --container-command "python3 -m vllm.entrypoints.openai.api_server" \
  --container-port 8000 \
  --env MODEL=llama-3-70b \
  --auth token \
  --token df88e*** \
  --volume "storagebucket-e***:/output:rw" \
  --inject-file "config.yaml:/etc/app/config.yaml" \
  --subnet-id vpcsubnet-e*** \
  --platform gpu-h100-sxm \
  --preset 1gpu-16vcpu-200gb \
  --disk-size 250Gi \
  --shm-size 128Mi \
  --ssh-key "$(cat ~/.ssh/id_ed25519.pub)" \
  --public

In the command, specify the following parameters:

Endpoint characteristics:
- --name: Endpoint name.
- --image: Container image reference in the registry/path:tag or registry/path@digest format. Use an image from a public registry or your authenticated private registry.
- --registry-username, --registry-password (optional): Credentials to authenticate if you pull an image from a private registry. Alternatively, use --registry-secret for credentials stored in MysteryBox.
  - --registry-username: Username.
  - --registry-password: Personal access token, password or an API key. Depends on where your registry is hosted. It can be Docker Hub, Microsoft Azure, GitHub, NVIDIA or a custom registry.
  If you pull an image from a public registry or from Container Registry in the same project, you don’t need to specify credentials.
- --registry-secret (optional): MysteryBox secret selector with REGISTRY_USERNAME and REGISTRY_PASSWORD payload keys. You can specify a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***.
- --container-command (optional): Entrypoint command for the container.
- --args (optional): Arguments for docker run to pass to the entrypoint command.
- --env (optional): Environment variables for the container. Set them in the key=value format where the key is the environment variable and the value is the value of this variable. If you need to set several variables, list the key=value pairs separated by commas.
- --env-secret (optional): Environment variables loaded from a MysteryBox secret in the key=value format. The value can be a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***. If you need to set several variables, list the pairs separated by commas.
- --container-port (optional): Port on which the application listens in the container. Each HTTP port is available through the endpoint’s managed HTTPS URL.
- --auth (optional): Authentication method. If the parameter isn’t set (default), no authentication is required. Useful when you want to create an endpoint prototype and test it. If you set --auth token, you enable authentication. Useful for production purposes. When you call the endpoint, specify the token in the "Authorization: Bearer <token>" HTTP header. Use --token or --token-secret to configure the token. If you don’t provide either, the CLI generates a random token.
  - --token (optional): Token for authentication. To generate one manually, run openssl rand -hex 32. If you don’t provide --token, the CLI generates one for you.
  - --token-secret (optional): MysteryBox secret selector with the AUTH_TOKEN payload key. You can specify a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***.
- --inject-file (optional): Mount a local file into the endpoint container at launch. Use the format <local_path>:<absolute_container_path>. To inject multiple files, repeat the parameter. The mounted file is read-only and limited to 64 KiB.
- --volume (optional): Bucket or shared filesystem to mount to the endpoint container. You can use volumes to store model files and other endpoint artifacts. Specify the value in either format:
  - source:container_path[:mode] for mounting Nebius shared filesystems and existing bucket or volume resources by ID or name.
  - s3://bucket:/container_path[:mode[:profile]] for mounting an Object Storage bucket with AWS profile credentials or S3 credentials stored in MysteryBox. The profile is the AWS credentials profile to use. If you manage your credentials with MysteryBox, use profile@<secret_selector>, where <secret_selector> is a secret name, secret ID, version ID or a combined secret/version selector such as mbsec-e00***@mbsecver-e00***
  The supported modes are ro, read only, and rw, read-write (default). Repeat for multiple volumes. For example:
  --volume 'computefilesystem-e***:/input:ro' \ --volume 'storagebucket-e***:/output:rw' \ --volume 's3://training-results:/output:rw:default'
In source, you can specify either the volume ID or its name.
Underlying container over VM characteristics:
- --subnet-id: Subnet ID. Required if the project has multiple subnets.
- --platform: VM platform. See available platforms in Types of virtual machines and GPUs in Nebius AI Cloud.
- --preset: Number of GPUs, vCPUs and RAM allocated to the container. The preset must match the selected platform. See available presets in Presets for GPU platforms.
- --disk-size: Disk size of the container over VM. Specify the value such as 100Gi, 500Gi or 1Ti. The default value is 250Gi. See how disk performance depends on disk size.
- --shm-size (optional): Shared memory size of /dev/shm. Specify the value such as 64Mi, 128Mi or 1Gi. The default value is 16Gi.
- --ssh-key (optional): SSH key to access the container over VM by SSH. When you add an SSH key, a public dynamic IP address is assigned. Before you add the key, check the quota on the number of public IP addresses in the web console.
- --public (optional): Assigns a public IP address to the container over VM. Not required to reach the endpoint from the internet, because each HTTP port is available through the endpoint’s managed HTTPS URL.

The endpoint creation takes approximately five minutes.

How to call an endpoint

Make sure you are in a group that has at least the viewer role within your tenant; for example, the default viewers group. You can check this in the Administration → IAM section of the web console. You can call an endpoint when you want to interact with an AI model hosted in this endpoint; for example, when you want to chat with the model. Each HTTP port is available through a managed https:// URL. gRPC also uses the managed HTTPS URL. For TCP ports, use the managed tls://<host>:443 URL with a TLS client. Endpoints support managed public URLs, shown in Public endpoints as https://.... For some previously created endpoints, Public endpoints can show IP:port instead. To call the endpoint:

Get the endpoint’s managed HTTPS URL:
- Web console
- CLI
1. In the sidebar, go to Serverless AI → Endpoints.
2. Open the page of the required endpoint.
3. Wait until the endpoint is running. Then, in the Network section, copy the public endpoint from the Public endpoints field. Depending on how the endpoint is exposed, this field can show either a managed https://... URL or IP:port.
1. To get the endpoint ID, list all endpoints:
  nebius ai endpoint list
  In the output, copy the ID of the required endpoint.
2. Get the endpoint’s managed HTTPS URL:
  nebius ai endpoint get <endpoint_ID> --format json \ | jq -r '.status.public_endpoints[] | select(startswith("https://"))' | head -1

Call the endpoint by using an HTTP client. For example, with curl:

curl "<endpoint_URL>/v1/chat/completions" \
   -H "Authorization: Bearer <token>" \
   -H "Content-Type: application/json" \
   -d '{
      "model": "llama-3-70b",
      "messages": [
         {"role": "user", "content": "Tell a joke about AI."}
      ]
   }'

In the command, specify the following parameters:

<endpoint_URL>: Managed HTTPS URL that you copied earlier.
<token>: Authentication token that you specified when you created the endpoint. If you didn’t specify any token, don’t use the Authorization HTTP header.
model: AI model that is hosted in the endpoint and that you chat with.
content: Message that you want to send to the model.

The response looks like the following:

{
  "choices": [
    {
      "message": {
        "role": "assistant",
        "content": "Why did the AI cross the road? Because it learned the optimal path after 10,000 epochs."
      }
    }
  ]
}

How to stop or start an endpoint

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console. If you don’t currently need your endpoint but you want to preserve it, you can stop the endpoint and then start it later. Computing resources of stopped endpoints aren’t charged. However, if you mounted a volume to the endpoint, you are charged for the volume even if the endpoint is stopped.

Web console
CLI

In the sidebar, go to Serverless AI → Endpoints.
Locate the endpoint and then click → Stop or Start.
In the window that opens, confirm the action.

To get the endpoint ID, list all endpoints:
nebius ai endpoint list
In the output, copy the ID of the required endpoint.

To stop an endpoint, run the following command:

nebius ai endpoint stop --id <endpoint_ID>

To start an endpoint, run the following command:

nebius ai endpoint start --id <endpoint_ID>

How to delete an endpoint

Make sure you are in a group that has at least the editor role within your tenant or project; for example, the default editors group. You can check this in the Administration → IAM section of the web console. When you delete an endpoint, Serverless AI automatically deletes its VM and container (boot) disk. If you no longer need the endpoint, delete it:

Web console
CLI

In the sidebar, go to Serverless AI → Endpoints.
Locate the endpoint and then click → Delete.
In the window that opens, confirm the deletion.

To get the endpoint ID, list all endpoints:
nebius ai endpoint list
In the output, copy the ID of the required endpoint.
Delete the endpoint:
nebius ai endpoint delete --id <endpoint_ID>
If a static IP address is assigned to the endpoint, the prompt asks to confirm the address release. Enter y to confirm or n to keep the address allocated in a pool.

AI services in Nebius AI Cloud

Serverless AI

Managed Service for MLflow

Applications in Nebius AI Cloud

Tutorials

Third-party integrations

Managing endpoints in Serverless AI

How to create an endpoint

How to call an endpoint

How to stop or start an endpoint

How to delete an endpoint

​How to create an endpoint

​How to call an endpoint

​How to stop or start an endpoint

​How to delete an endpoint

How to create an endpoint

How to call an endpoint

How to stop or start an endpoint

How to delete an endpoint