ts ai endpoint

Show, create, update, or delete an AI model endpoint — the provider connection the server sends model requests through. ts ai endpoints lists them all.

Usage

ts ai endpoints [--csv] [--no-trunc]
ts ai endpoint <name>
ts ai endpoint new <name> --kind=KIND [--credential=KEY] [--base-url=URL] [--model=MODEL]
ts ai endpoint set <name> <property> <value>
ts ai endpoint delete <name> [--force]

Description

An endpoint is one connection to a model provider: a kind, an optional base URL, a default model, and a credential.

ts ai endpoints prints every endpoint configured on the server, disabled ones included, so a feature that stopped working because its endpoint was switched off is visible here rather than mysterious. KIND is the provider kind the server recognises — Anthropic, OpenAI, OpenAICompatible, AzureOpenAI, Bedrock, Gemini, Ollama, and the rest of the supported set. MODEL is the endpoint's default model, used when a caller does not name one. DEFAULT marks the endpoint the server falls back to when nothing else is selected; at most one endpoint carries it, and the default sorts to the top of the list with the rest alphabetical below it. A list where no row says yes means nothing has been designated, which is worth fixing.

ts ai endpoint <name> prints one endpoint in full, including the base URL and default model the table clips. Pass the name the listing shows in NAME, or the endpoint's id if you prefer. Two endpoints sharing a name is refused rather than resolved to one of them, because acting on the wrong endpoint silently repoints live traffic — pass the id in that case.

Credentials are write-only. The server never returns an API key, so both the listing and the single-endpoint view show only whether one is stored plus a four-character cue: …a1b2 when a key is configured, - when none is, and …set in the rare case where a key exists but no cue could be derived. For a Bedrock endpoint the cue is the last four characters of the secret access key, not the access key id.

Creating One

new needs --kind, and what else it needs depends on the kind. OpenAICompatible requires --base-url and treats the credential as optional, which is what a keyless vLLM or LM Studio server needs. Ollama takes no credential at all. Every other kind requires --credential at creation. A --base-url that is not an http or https URL is rejected, as is a kind the server does not recognise.

Bedrock is the one kind you cannot create here: it needs a region and an access-key/secret-access-key pair, and ts has no flags for any of the three. Create Bedrock endpoints in the Administration site under Intelligence → Endpoints.

Changing One

set writes one property per invocation, named in kebab-case: kind, credential, base-url, default-model, enabled. true and false go out as booleans, so set <name> enabled false does what it reads like. A property that is not on that list is refused before anything is written.

Two things set deliberately cannot do. It cannot mark an endpoint as the default — default is not settable, so promoting a different endpoint stays an Administration site task. And it cannot change the kind and the credential in one go, which matters: changing an endpoint's kind clears the stored secret, because sending the old kind's key to the new kind's API is worse than having no key. Run set <name> kind … and set <name> credential … back to back, and expect the endpoint to be broken in between.

Rotating a key is the everyday use: set <name> credential <key> replaces the stored value and reports nothing about it. On a Bedrock endpoint that write is silently a no-op, because the key pair is not what credential carries.

delete soft-deletes, and prompts first unless you pass --force. Run non-interactively without --force and it fails rather than guessing.

Creates, updates, and deletes are recorded in the audit log as AIProviderConnectionCreated, AIProviderConnectionUpdated, and AIProviderConnectionDeleted.

Options

Flag	Description	Default/Values	Notes
--kind	Provider kind for a new endpoint.	Anthropic, OpenAI, OpenAICompatible, Ollama, …	Required by new.
--credential	API key for a new endpoint.		new only; use set … credential to rotate.
--base-url	Provider base URL.	http or https URL	new only. Required for OpenAICompatible.
--model	Default model for a new endpoint.		new only. The settable property is default-model.
--force, -f	Delete without confirming.		delete only.
--csv	Tab-separated output, nothing truncated.		ts ai endpoints only.
--no-trunc	Do not truncate columns.		ts ai endpoints only.

Examples

# Which providers are wired up, and which one is the default?
ts ai endpoints

# One endpoint in full — base URL, default model, credential state
ts ai endpoint Primary

# Add a keyless local Ollama endpoint for development
ts ai endpoint new "Local dev" --kind=Ollama --base-url=http://localhost:11434 --model=llama3.1

# Add a hosted endpoint with its key
ts ai endpoint new Primary --kind=Anthropic --credential=sk-ant-… --model=claude-sonnet-4-5

# Rotate a key after a leak
ts ai endpoint set Primary credential sk-ant-…

# Point an endpoint at a different default model
ts ai endpoint set Primary default-model claude-sonnet-4-5

# Take an endpoint out of service without deleting it
ts ai endpoint set "Local dev" enabled false

# Remove one for good
ts ai endpoint delete "Local dev" --force

# Changing the kind clears the stored credential, so the endpoint is dead
# until the second command lands. Run them together.
ts ai endpoint set Primary kind OpenAI
ts ai endpoint set Primary credential sk-…

# A stored key that is wrong looks exactly like a stored key that is right —
# the cue only proves something is set. Check whether calls actually succeed.
ts ai usage --since=2026-08-01

Output

ts ai endpoints:

NAME        KIND       MODEL                  KEY      DEFAULT  ENABLED  ID
Primary     Anthropic  claude-sonnet-4-5      …a1b2    yes      yes      3f9c1a4e-...
Local dev   Ollama     llama3.1               -        no       no       7b20e5d1-...

- in KEY means no credential is stored. That is expected for a local Ollama endpoint and a problem for anything else.

ts ai endpoint <name>:

Name:           Local dev
Id:             7b20e5d1-3c84-4f19-b6a0-15d7e9c28a44
Kind:           Ollama
Base URL:       http://localhost:11434
Default model:  llama3.1
Credential:     not set
Default:        False
Enabled:        True

Fields the endpoint does not have print blank rather than as a placeholder, so an Anthropic endpoint shows an empty Base URL line.

With --format=json you get every field the server returns rather than the seven table columns — baseUrl, region, credentialConfigured, credentialLast4, created, and updated included. That is the form to use from a script.

Exit Codes

0 on success, including when no endpoints are configured — an empty AI configuration is not an error, and the command says so in words. -1 when the server rejects the write (an unrecognised kind, a base URL that is not http or https, a missing credential for a kind that requires one, a missing region for Bedrock), when --kind is absent on new, when the property is not settable, when the name matches more than one endpoint, or when you decline the delete prompt. -2 when set is given fewer than three positionals. -3 when the server cannot be reached. -4 when no account is signed in or the ticket has expired. -5 when the account is not a Server Administrator; the whole AI administration surface is administrator-only. -6 when no endpoint has that name or id.

Related Commands

• ts ai — The rest of the namespace.
• ts ai tools — The tools models are allowed to call.
• ts ai connectors — MCP servers reachable from the AI pipe.
• ts ai usage — Calls, errors, and token totals per provider and model.
• ts ai transcripts — Individual model calls, including failures.
• ts audit — Endpoint creates, updates, and deletes, recorded as they happen.