---
title: "Create a private endpoint"
method: POST
path: "/private-endpoints"
tags: ["Private Endpoints"]
---

# Create a private endpoint

`POST /private-endpoints`

Create a private endpoint as a draft. Drafts are not routable: validate one with `POST /private-endpoints/{id}/validate`, then activate it with `POST /private-endpoints/{id}/activate`. Pass `activate` to do all three in one call; if validation fails the draft is kept and returned with the failed checks. Send an `Idempotency-Key` header to make retries safe: a repeated key with the same request returns the endpoint the first request created; reusing it with different fields returns 422 `idempotency_key_reused`. [Management key](/docs/guides/overview/auth/management-api-keys) required.

## Headers

- `idempotency-key` string — Retry-safe create: a repeated create with the same key from the same organization returns the endpoint the first request created instead of creating another. The endpoint is returned as it is now. Reusing a key with a different request body (model, provider, base URL, upstream model ID, declared ZDR or region, or pricing) is rejected with 422 `idempotency_key_reused`. `activate` is not compared, and later edits to the endpoint do not affect the comparison.

## Request body

- CreatePrivateEndpointRequest
  - `activate` PrivateEndpointActivation — Validate and activate in the same call. On a failed validation the draft is kept and returned with a 422, so fix it and call `/validate` and `/activate` instead of creating it again.
    - `workspace_id` string, uuid, required — Workspace whose BYOK credential is used for the live validation call. The workspace must belong to your account.
  - `base_url` string — HTTPS base URL of your deployment. Required unless the provider derives its URL from the BYOK credential (Azure, Amazon Bedrock, Google Vertex).
  - `declared_region` 'global' | 'europe' | 'us' | 'null', nullable — Attest where this deployment processes data.
  - `declared_zdr` boolean, nullable — Attest that this deployment retains no prompt or completion data.
  - `model_permaslug` string, required — Permanent slug of the model this endpoint serves.
  - `pricing` PrivateEndpointPricing — Negotiated per-token rates reported for requests routed to this endpoint.
    - `completion` string, required — USD per completion token, as a decimal string.
    - `prompt` string, required — USD per prompt token, as a decimal string.
  - `provider_slug` string, required — Slug of the upstream provider.
  - `upstream_model_id` string, required — Model or deployment identifier sent to the upstream provider.

## Response `201`

The created endpoint: a draft, or active when `activate` was passed

- ManagedPrivateEndpointResponse
  - `data` ManagedPrivateEndpoint, required
    - `created_at` string, required — ISO timestamp of when the endpoint was created.
    - `id` string, uuid, required — Stable identifier of the private endpoint.
    - `model_name` string, nullable, required — Display name of the model, or `null` when the model is no longer listed.
    - `model_permaslug` string, required — Permanent slug of the model this endpoint serves.
    - `model_slug` string, nullable, required — Public model slug, or `null` when the model is no longer listed.
    - `provider_name` string, required — Display name of the upstream provider.
    - `status` 'draft' | 'active' | 'disabled', required — Lifecycle state. `draft` endpoints are not routable until validated and activated; `disabled` endpoints are activated but temporarily not routable.
    - `declared_region` 'global' | 'europe' | 'us' | 'null', nullable, required — Where you attest this deployment processes data. `global` means not regional; `null` means undeclared.
    - `declared_zdr` boolean, nullable, required — Whether you attest this deployment retains no prompt or completion data. `null` means undeclared.

## Other responses

- `400` — Bad Request - Invalid request parameters or malformed input
- `401` — Unauthorized - Authentication required or invalid credentials
- `403` — Forbidden - Authentication successful but insufficient permissions
- `404` — The model, provider, or validation workspace was not found. When `activate` was passed and the draft was created, `data` carries it and any validation checks.
- `408` — Request Timeout - Operation exceeded time limit
- `409` — The request conflicts with the endpoint state, such as a stale validation. When `activate` was passed and the draft was created, `data` carries it and any validation checks.
- `422` — The request was invalid, or validation failed. When `activate` was passed and the draft was created, `data` carries it and any validation checks.
- `500` — Internal server error. When `activate` was passed and the draft was created, `data` carries it and any validation checks.
- `502` — An upstream dependency failed. When `activate` was passed and the draft was created, `data` carries it and any validation checks.

## Changes

- **2026-09-28** `057102d53272` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/openrouterteam/apis/openrouter-api/changes/private-endpoints/post.md)

---

[API](https://skmtc.dev/openrouterteam/apis/openrouter-api.md) · [All operations](https://skmtc.dev/openrouterteam/apis/openrouter-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openrouterteam/apis/openrouter-api/revisions/ae97b5c6983d?raw)