ts ai endpoint

Show, create, update, or delete an AI model endpoint — the provider connection the server sends model requests through. ts ai endpoints lists them all.

Usage

ts ai endpoints [--csv] [--no-trunc]
ts ai endpoint <name>
ts ai endpoint new <name> --kind=KIND [--credential=KEY] [--base-url=URL] [--model=MODEL] [--default]
ts ai endpoint new <name> --kind=Bedrock --access-key-id=ID --secret-access-key=SECRET --region=REGION [--model=MODEL] [--default]
ts ai endpoint set <name> <property> <value>
ts ai endpoint set <name> [--access-key-id=ID --secret-access-key=SECRET] [--region=REGION]
ts ai endpoint delete <name> [--force]

Description

An endpoint is one connection to a model provider: a kind, an optional base URL, a default model, and a credential.

ts ai endpoints prints every endpoint configured on the server, disabled ones included, so a feature that stopped working because its endpoint was switched off is visible here rather than mysterious. KIND is the endpoint's provider kind. MODEL is the endpoint's default model, used when a caller does not name one. DEFAULT marks the endpoint chat uses wherever a workspace names none; at most one endpoint carries it, and the default sorts to the top of the list with the rest alphabetical below it. A list where no row says yes means nothing has been designated, which is worth fixing.

ts ai endpoint <name> prints one endpoint in full, including the base URL and default model the table clips. Pass the name the listing shows in NAME, or the endpoint's id if you prefer. Two endpoints sharing a name is refused rather than resolved to one of them, because acting on the wrong endpoint silently repoints live traffic — pass the id in that case.

Credentials are write-only. The server never returns an API key, so both the listing and the single-endpoint view show only whether one is stored plus a four-character cue: …a1b2 when a key is configured, - when none is, and …set in the rare case where a key exists but no cue could be derived. For a Bedrock endpoint the cue is the last four characters of the secret access key, not the access key id.

Creating One

new needs --kind, one of the kinds this server has an implementation for: Anthropic, OpenAI, OpenAICompatible, Bedrock, Gemini, Ollama, TogetherAI, Groq, Cerebras, Fireworks, HuggingFace, OpenRouter, ZAI, and DeepInfra. Any other kind is refused. What else new needs depends on the kind. OpenAICompatible requires --base-url and treats the credential as optional, which is what a keyless vLLM or LM Studio server needs. Ollama takes no credential at all. Bedrock takes --access-key-id, --secret-access-key, and --region instead of --credential, all three required. Every other kind requires --credential at creation. A --base-url that is not an http or https URL is rejected.

--default makes the new endpoint the default and clears the flag on every other endpoint. A secret value may be a ${TURBO_AI_NAME} reference, which the server resolves against its own environment, so the key need not appear on the command line; a reference to a variable without the TURBO_AI_ prefix, or one that is not set, is refused.

Changing One

set writes one property per invocation, named in kebab-case: credential, base-url, default-model, enabled, is-default. true and false go out as booleans, so set <name> enabled false does what it reads like. A property that is not on that list is refused before anything is written, and every write except credential is read back afterwards and fails if the server did not keep the value. set <name> is-default true makes the endpoint the default and clears the flag on every other one.

The kind is fixed at creation: changing it would drop the stored credential, so set <name> kind … is refused. Create a new endpoint instead.

A stored credential is never sent to a new address. A base-url that names another address therefore drops an OpenAICompatible endpoint's credential, so set it again afterwards, and is refused for a kind that needs a key, because set cannot carry the new key in the same write. Change such an endpoint's base URL in the Administration site under Intelligence → Endpoints, which takes both at once, or create a new endpoint.

Rotating a key is the everyday use: set <name> credential <key> replaces the stored value and reports nothing about it. A Bedrock endpoint's key pair is rotated with set <name> --access-key-id=… --secret-access-key=…, always both together, and its region with --region; these flags take no property and value.

delete soft-deletes, and prompts first unless you pass --force. Run non-interactively without --force and it fails rather than guessing.

Creates, updates, and deletes are recorded in the audit log as AIProviderConnectionCreated, AIProviderConnectionUpdated, and AIProviderConnectionDeleted.

Options

Flag	Description	Default/Values	Notes
--kind	Provider kind for a new endpoint.	Anthropic, OpenAI, OpenAICompatible, Bedrock, Ollama, …	Required by new.
--credential	API key for a new endpoint.		new only; use set … credential to rotate.
--base-url	Provider base URL.	http or https URL	new only. Required for OpenAICompatible.
--model	Default model for a new endpoint.		new only. The settable property is default-model.
--default	Make the new endpoint the default.		new only. Use set … is-default true for an existing one.
--access-key-id	Bedrock access key id.		new, or set to rotate, together with --secret-access-key.
--secret-access-key	Bedrock secret access key.		new, or set to rotate, together with --access-key-id.
--region	Bedrock region.		Required by new for Bedrock; set changes it.
--force, -f	Delete without confirming.		delete only. Required when there is no terminal.
--csv	Tab-separated output, nothing truncated.		ts ai endpoints only.
--no-trunc	Do not truncate columns.		ts ai endpoints only.

Examples

# Which providers are wired up, and which one is the default?
ts ai endpoints

# One endpoint in full — base URL, default model, credential state
ts ai endpoint Primary

# Add a keyless local Ollama endpoint for development
ts ai endpoint new "Local dev" --kind=Ollama --base-url=http://localhost:11434 --model=llama3.1

# Add a hosted endpoint with its key, and make it the default
ts ai endpoint new Primary --kind=Anthropic --credential=sk-ant-… --model=claude-sonnet-4-5 --default

# Add a Bedrock endpoint, its key read from the server's TURBO_AI_ variables
ts ai endpoint new Bedrock --kind=Bedrock --region=us-east-1 \
  --access-key-id='${TURBO_AI_AWS_ACCESS_KEY_ID}' --secret-access-key='${TURBO_AI_AWS_SECRET}'

# Rotate a Bedrock key pair
ts ai endpoint set Bedrock --access-key-id=AKIAEXAMPLE --secret-access-key="$AWS_SECRET"

# Rotate a key after a leak
ts ai endpoint set Primary credential sk-ant-…

# Point an endpoint at a different default model
ts ai endpoint set Primary default-model claude-sonnet-4-5

# Take an endpoint out of service without deleting it
ts ai endpoint set "Local dev" enabled false

# Make another endpoint the default
ts ai endpoint set Primary is-default true

# Remove one for good
ts ai endpoint delete "Local dev" --force

# A stored key that is wrong looks exactly like a stored key that is right —
# the cue only proves something is set. Check whether calls actually succeed.
ts ai usage --since=2026-08-01

Output

ts ai endpoints:

NAME        KIND       MODEL                  KEY      DEFAULT  ENABLED  ID
Primary     Anthropic  claude-sonnet-4-5      …a1b2    yes      yes      3f9c1a4e-...
Local dev   Ollama     llama3.1               -        no       no       7b20e5d1-...

- in KEY means no credential is stored. That is expected for a local Ollama endpoint and a problem for anything else.

ts ai endpoint <name>:

Name:           Local dev
Id:             7b20e5d1-3c84-4f19-b6a0-15d7e9c28a44
Kind:           Ollama
Base URL:       http://localhost:11434
Default model:  llama3.1
Credential:     not set
Default:        False
Enabled:        True

Fields the endpoint does not have print blank rather than as a placeholder, so an Anthropic endpoint shows an empty Base URL line.

With --format=json you get every field the server returns rather than the seven table columns — baseUrl, summaryModel, region, credentialConfigured, credentialLast4, isSummaryEndpoint, created, and updated included. That is the form to use from a script.

Exit Codes

0 on success, including when no endpoints are configured — an empty AI configuration is not an error, and the command says so in words. -1 when the server rejects the write (a kind this server has no implementation for, a base URL that is not http or https, a missing credential for a kind that requires one, a missing region or key pair for Bedrock, a new base URL for a kind that needs a key, a ${…} reference that cannot be resolved), when --kind is absent on new, when the property is not settable or is kind, when only one of --access-key-id and --secret-access-key is given, when a write does not read back as the value sent, when the name matches more than one endpoint, or when you decline the delete prompt. -2 when set is given fewer than three positionals and no Bedrock flags, when it is given both a property and Bedrock flags, and when --default is passed to anything but new. -3 when the server cannot be reached. -4 when no account is signed in or the ticket has expired. -5 when the account is not a Server Administrator; the whole AI administration surface is administrator-only. -6 when no endpoint has that name or id.

Related Commands

• ts ai — The rest of the namespace.
• ts ai tools — The tools models are allowed to call.
• ts ai connectors — MCP servers reachable from the AI pipe.
• ts ai usage — Calls, errors, and token totals per provider and model.
• ts ai transcripts — Individual model calls, including failures.
• ts audit — Endpoint creates, updates, and deletes, recorded as they happen.