> ## Documentation Index > Fetch the complete documentation index at: https://docs.aireserve.com/llms.txt > Use this file to discover all available pages before exploring further. # Create an authenticated endpoint > Creates a bearer- or mTLS-authenticated endpoint. Credential material is returned once in this response. Requires compute `manage` access. ## OpenAPI ````yaml /api-reference/openapi.json post /v1/sandboxes/{id}/endpoints openapi: 3.0.3 info: title: AI Reserve Gateway API description: >- The AI Reserve API surface — inference, durable environments, workspaces, sandboxes, executions, agent runs, GPU infrastructure, and fine-tuning — all behind one endpoint and one API key. version: 1.0.0 servers: - url: https://api.aireserve.com security: - bearerAuth: [] tags: - name: Customers description: >- Per-end-customer usage, cost, and billable amounts for organizations that tag requests with their own customers. - name: Dedicated GPU endpoints description: >- OpenAI-compatible inference on your organization's own dedicated HuggingFace vLLM deployments, called with an ordinary AI Reserve API key. GPU time is billed from the wallet; requests add no per-token charge. - name: GPU Infrastructure description: >- Provision and manage provider-hidden GPU instances. The recommended Instances API accepts workload requirements and an hourly price ceiling; AI Reserve handles provider placement internally. Every mutation is asynchronous and returns an operation to poll. - name: Environments description: Immutable, versioned runtime definitions. - name: Workspaces description: Durable project storage pinned to one environment version. - name: Sandboxes description: >- Ephemeral provider-disclosed compute allocated from sealed quotes. Requests remain provider-neutral. - name: Executions description: Durable asynchronous operations and command, service, or agent executions. - name: Agent Runs description: Durable Agent SDK runs with replayable events and external artifacts. - name: Customer keys description: >- Mint, list, and revoke API keys pinned to your own end customers (and their organizations), so spend splits per customer without per-request tagging. - name: AWS CLI login description: >- Browser-authorization endpoints consumed by `aws login --profile …` (AWS CLI v2.32.0+). All three routes are unauthenticated — the caller has no credential until `/v1/token` succeeds. - name: Fine-tuning description: >- Fine-tune open models on your own data. Data lives in an S3 bucket inside your organization's AWS hub account; you name a base, LoRA or full, a price ceiling and how the result must be servable, and AI Reserve places the run on a backend internally. The result is a model in your bucket you can deploy or download. - name: 'Admin: Catalog' description: Discover the operations available to this token. - name: 'Admin: Analytics' description: Usage, spend and attribution reads. - name: 'Admin: API Keys' description: Organization and team inference keys. - name: 'Admin: Billing' description: Wallet, ledger and invoice reads. - name: 'Admin: Compute' description: GPU machines and persistent storage (quote, launch, inspect, stop). - name: 'Admin: Compute Runtime' description: >- Portable environments, workspaces, sandboxes, executions, operations and durable agent runs. - name: 'Admin: Containers' description: The organization's AWS account, ECS services, logs and secrets. - name: 'Admin: Files' description: Organization shared files. - name: 'Admin: Members' description: 'People in the organization: invite, profile, team, access, role.' - name: 'Admin: Models & Routing' description: Model availability, defaults, fallbacks and routing. - name: 'Admin: Organization' description: Retention, logging, branding, sign-in domains, classification. - name: 'Admin: Personal' description: The caller's own usage, budget, API keys and preferences. - name: 'Admin: Teams & Budgets' description: Teams, spend caps and allocations. - name: 'Admin: Training' description: Fine-tuning datasets, runs, models and deployments. paths: /v1/sandboxes/{id}/endpoints: post: tags: - Sandboxes summary: Create an authenticated endpoint description: >- Creates a bearer- or mTLS-authenticated endpoint. Credential material is returned once in this response. Requires compute `manage` access. operationId: createSandboxEndpoint parameters: - name: id in: path required: true schema: format: uuid type: string - name: Idempotency-Key in: header required: true description: >- Client-selected key of 8–180 characters `[A-Za-z0-9:_-]`. Reusing it for the same action and canonical request replays the original result. Reusing it with a different request returns `409 idempotency_conflict`. schema: type: string minLength: 8 maxLength: 180 pattern: ^[A-Za-z0-9:_-]+$ requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateEndpointRequest' responses: '202': description: Accepted. headers: Location: description: Canonical path of the created resource or accepted operation. schema: type: string Idempotency-Replayed: description: >- True when this response replays the result of an earlier request with the same key. schema: type: boolean content: application/json: schema: $ref: '#/components/schemas/EndpointAccepted' '400': description: >- Invalid request, malformed event cursor, missing Idempotency-Key, or schema violation. content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '401': description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '403': description: The key lacks compute `manage` access. content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '404': description: Resource not found or owned by another organization. content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '409': description: >- State or retry conflict (`idempotency_conflict`, `invalid_state`, `operation_conflict`, `quote_mismatch`, or `quote_consumed`). content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '429': description: Rate limit exceeded. headers: Retry-After: description: Whole seconds before the caller should retry. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '500': description: Unexpected control-plane error (`internal_error`). content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' '503': description: >- No eligible capacity is available or the selected provider is temporarily unavailable. headers: Retry-After: description: Whole seconds before the caller should retry. schema: type: integer minimum: 1 content: application/json: schema: $ref: '#/components/schemas/ComputeRuntimeError' security: - bearerAuth: [] - apiKeyAuth: [] components: schemas: CreateEndpointRequest: type: object properties: name: type: string minLength: 1 maxLength: 120 protocol: type: string enum: - https - wss - tcp targetPort: type: integer minimum: 1 maximum: 65535 auth: oneOf: - type: object properties: mode: type: string enum: - bearer expiresInSeconds: type: integer minimum: 60 maximum: 604800 required: - mode - expiresInSeconds additionalProperties: false - type: object properties: mode: type: string enum: - mtls expiresInSeconds: type: integer minimum: 60 maximum: 604800 required: - mode - expiresInSeconds additionalProperties: false expiresInSeconds: type: integer minimum: 60 maximum: 604800 required: - name - protocol - targetPort - auth additionalProperties: false description: >- Every public endpoint is authenticated; unauthenticated mode does not exist. EndpointAccepted: type: object properties: operation: type: object properties: id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ object: type: string enum: - operation resource: type: object properties: type: type: string enum: - environment - workspace - sandbox - execution - endpoint - agent_run - artifact id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ parent: type: object properties: type: type: string enum: - environment - workspace - sandbox - execution - endpoint - agent_run - artifact id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ required: - type - id additionalProperties: false description: >- The public containing resource for resolving nested resource APIs. required: - type - id additionalProperties: false description: >- The affected public resource. Nested resources include their public parent; provider-native identifiers are never returned. action: type: string enum: - environment.create - environment.activate - environment.deprecate - environment.retire - workspace.create - workspace.suspend - workspace.resume - workspace.delete - sandbox.create - sandbox.start - sandbox.stop - sandbox.pause - sandbox.resume - sandbox.terminate - execution.create - execution.stdin - execution.kill - endpoint.create - endpoint.revoke - agent_run.create - agent_run.steer - agent_run.cancel idempotencyKey: type: string minLength: 8 maxLength: 180 pattern: ^[A-Za-z0-9:_-]+$ description: >- Client-selected retry key. Reuse with the same action and canonical request replays the original result; reuse with a different request returns `idempotency_conflict`. status: type: string enum: - pending - in_progress - retry_wait - succeeded - failed - cancelled step: nullable: true type: string minLength: 1 maxLength: 128 attemptCount: type: integer minimum: 0 maximum: 9007199254740991 maxAttempts: type: integer minimum: 0 exclusiveMinimum: true maximum: 9007199254740991 error: nullable: true type: object properties: message: type: string minLength: 1 maxLength: 4096 type: type: string enum: - invalid_request_error - authentication_error - permission_error - not_found_error - conflict_error - rate_limit_error - api_error param: nullable: true type: string maxLength: 255 code: type: string enum: - invalid_request - authentication_failed - permission_denied - not_found - idempotency_conflict - invalid_state - unsupported_action - quote_expired - quote_mismatch - quote_consumed - no_capacity - insufficient_funds - operation_conflict - rate_limit_exceeded - provider_unavailable - internal_error details: type: object additionalProperties: {} required: - message - type - param - code additionalProperties: false terminalAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - id - object - resource - action - idempotencyKey - status - step - attemptCount - maxAttempts - error - terminalAt - createdAt - updatedAt additionalProperties: false endpoint: type: object properties: id: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ object: type: string enum: - endpoint workspaceId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ sandboxId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ name: type: string minLength: 1 maxLength: 120 protocol: type: string enum: - https - wss - tcp status: type: string enum: - provisioning - ready - revoked - failed url: nullable: true type: string format: uri auth: type: object properties: mode: type: string enum: - bearer - mtls expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - mode - expiresAt additionalProperties: false expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ lastUsedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ revokedAt: nullable: true type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ error: nullable: true type: object properties: message: type: string minLength: 1 maxLength: 4096 type: type: string enum: - invalid_request_error - authentication_error - permission_error - not_found_error - conflict_error - rate_limit_error - api_error param: nullable: true type: string maxLength: 255 code: type: string enum: - invalid_request - authentication_failed - permission_denied - not_found - idempotency_conflict - invalid_state - unsupported_action - quote_expired - quote_mismatch - quote_consumed - no_capacity - insufficient_funds - operation_conflict - rate_limit_exceeded - provider_unavailable - internal_error details: type: object additionalProperties: {} required: - message - type - param - code additionalProperties: false createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - id - object - workspaceId - sandboxId - name - protocol - status - url - auth - expiresAt - lastUsedAt - revokedAt - error - createdAt - updatedAt additionalProperties: false credential: oneOf: - type: object properties: mode: type: string enum: - bearer token: type: string minLength: 32 maxLength: 8192 description: Shown once. Do not log or persist in client source. expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - mode - token - expiresAt additionalProperties: false - type: object properties: mode: type: string enum: - mtls certificatePem: type: string minLength: 1 maxLength: 65536 privateKeyPem: type: string minLength: 1 maxLength: 65536 description: Shown once. Do not log. caCertificatePem: type: string minLength: 1 maxLength: 65536 expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ required: - mode - certificatePem - privateKeyPem - caCertificatePem - expiresAt additionalProperties: false required: - operation - endpoint - credential additionalProperties: false ComputeRuntimeError: type: object properties: error: type: object properties: message: type: string minLength: 1 maxLength: 4096 type: type: string enum: - invalid_request_error - authentication_error - permission_error - not_found_error - conflict_error - rate_limit_error - api_error param: nullable: true type: string maxLength: 255 code: type: string enum: - invalid_request - authentication_failed - permission_denied - not_found - idempotency_conflict - invalid_state - unsupported_action - quote_expired - quote_mismatch - quote_consumed - no_capacity - insufficient_funds - operation_conflict - rate_limit_exceeded - provider_unavailable - internal_error details: type: object additionalProperties: {} required: - message - type - param - code additionalProperties: false required: - error additionalProperties: false description: OpenAI-shaped error envelope returned for every JSON error response. securitySchemes: bearerAuth: type: http scheme: bearer description: >- Your AI Reserve API key (aireserve_api_…) from the API Keys page in the portal (https://portal.aireserve.com/keys). apiKeyAuth: type: apiKey in: header name: x-api-key description: The same API key sent as an `x-api-key` header. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.