Docs
...
Service endpoints

Managing the watsonx.ai Runtime service endpoint

Last updated: Apr 17, 2025
Managing the watsonx.ai Runtime service endpoint

You can use IBM Cloud connectivity options for accessing cloud services securely by using service endpoints. When you provision a watsonx.ai Runtime service instance, you can choose if you want to access your service through the public internet, which is the default setting, or over the IBM Cloud private network.

How you access service endpoints depends on the Cloud platform you are using.

Accessing endpoints on IBM Cloud

You can use the Service provisioning page to choose a default endpoint from the following options:

For more information, refer to IBM Cloud service endpoints.

Public network

You can use public network endpoints to connect to watsonx.ai Runtime service instance on the public network. Your environment needs to have internet access to connect.

Private network

You can use private network endpoints to connect to your IBM watsonx.ai Runtime service instance over the IBM Cloud Private network. After you configure your watsonx.ai Runtime service to use private endpoints, the service is not accessible from the public internet.

Private URLs for watsonx.ai Runtime

Private URLs for watsonx.ai Runtime for each region are as follows:

Using IBM Cloud service to enable private endpoints

Follow these steps to enable private network endpoints on your clusters:

  1. Use IBM Cloud CLI to enable your account to use IBM Cloud service endpoints.
  2. Provision a watsonx.ai Runtime service instance with private endpoints.

Provisioning with service endpoints (Dallas, Frankfurt, Tokyo, London)

You can provision a watsonx.ai Runtime service instance with service endpoint by using IBM Cloud UI or IBM Cloud CLI.

Provisioning a service endpoint with IBM Cloud UI

To configure the endpoints of your IBM watsonx.ai Runtime service instance, you can use the Endpoints field on the IBM Cloud catalog page. You can configure a public, private, or a mixed network.

Configure endpoint from the service catalog

IBM Cloud CLI

If you provision an IBM watsonx.ai Runtime service instance by using the IBM Cloud CLI, use the command-line option service-endpoints to configure the watsonx.ai Runtime endpoints. You can specify the value public (the default value), private, or public-and-private:

ibmcloud resource service-instance-create <service instance name> pm-20 <plan_name> <region>  --service-endpoints <private/public/public-and-private>

For example:

ibmcloud resource service-instance-create wml-instance pm-20 standard us-south -p  --service-endpoints private

or

ibmcloud resource service-instance-create wml-instance pm-20 standard us-south --service-endpoints public-and-private

Provisioning a service endpoint (Sydney and Toronto)

To provision a service endpoint for a watsonx.ai Runtime instance in either the Sydney or Toronto region, you must request access to a Private Catalog. After the request is approved, you can share the endpoint as a Virtual Private Endpoint.

Requesting access to a private catalog

To request access to a Private Catalog, follow these steps:

  1. Use IBM Cloud CLI to enable your account to use IBM Cloud service endpoints.
  2. Contact IBM Support and submit a request, asking the watsonx.ai Runtime team provide you with access to a Private Catalog. You must supply your IBM Cloud accountID with the request.
  3. When the watsonx.ai Runtime team provides access to the Private Catalog to customers account ID, you can view the completed request and catalog details from Manage>Catalogs>Share requests in the IBM Cloud console. You can then create a virtual private endpoint gateway.
  4. Select Virtual Private Endpoint as the catalog type. For example: Sharing a request from the IBM Cloud console
  5. Follow the steps to create a Virtual private endpoint gateways for VPC. Use the following as the Private Catalog display names for the Sydney and Toronto data centers:
    • SYDNEY : mcsp-wml-sydprod
    • TORONTO : mcsp-wml-torprod

Reviewing a share request

To review the share request from the IBM Cloud CLI, use the following command:

{
"first": "/api/v1-beta/shareapproval/vpe/access/source/pending?limit=100",
"limit": 100,
"resource_count": 1,
"resources": [
{
"_id": "-acct-fc3acf288b1b451e8cb981b2b9423b14:apr-acct:ba083c5877a64197a36b55d259812dfa:vpe:account",
"_rev": "1-6703f335f8ca2330aa22a7e542700d58",
"account": "fc3acf288b1b451e8cb981b2b9423b14",
"account_type": 3,
"approval_state": "pending",
"created": "2025-02-26T01:15:21.513749288-05:00",
"id": "-acct-fc3acf288b1b451e8cb981b2b9423b14",
"target_account": "ba083c5877a64197a36b55d259812dfa",
"target_kind": "vpe"
}
]
}

Approving a share request

For approving share requests, you can use the IBM Cloud UI or CLI. If the option to approve share requests is not available in the UI, you can use IBM Cloud CLI to approve the request.

To approve a share request from the IBM Cloud CLI, use the following command:

ibmcloud catalog account set-approval-state-source --object-kind vpe --approval-state approved -account-ids "<account ID>"

Verifying approval

To verify that the customer has accepted the share request, use the following command:

ibmcloud catalog account get-approval-list-source --object-kind vpe --approval-state approved
{
"first": "/api/v1-beta/shareapproval/vpe/access/source/approved?limit=100",
"limit": 100,
"resource_count": 1,
"resources": [
{
"_id": "<account id>",
"_rev": "2-93907d1b7d449c1a82914dfde604f316",
"account": "fc3acf288b1b451e8cb981b2b9423b14",
"account_type": 3,
"created": "2025-02-26T01:15:21.513749288-05:00",
"id": "<account id>",
"target_account": "ba083c5877a64197a36b55d259812dfa",
"target_kind": "vpe"
}
]
}

This command returns a list of approved requests, including the account ID and target account ID.

Parent topic: Deploying and managing AI assets