--- name: schematics-private-endpoint title: Using private endpoints description: Create and manage IBM Cloud Schematics workspaces on the private network by targeting the Schematics private service endpoint. last-updated: 2025-01-17 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/schematics?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Using private endpoints {: #private-endpoints} Create and manage IBM Cloud Schematics workspaces on the private network by targeting the Schematics private service endpoint. {: shortdesc} To get started, enable [virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&format=markdown){: external} for your IBM Cloud® account. After you enable VRF for your account, you can connect to IBM Cloud Schematics by using a private IP that is accessible only through the IBM Cloud Private network. To learn more about private connections on IBM Cloud, see [Service endpoints for private connections](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data&format=markdown#pi-location). To connect to IBM Cloud Schematics by using a [private network connection](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data&format=markdown#pi-location), you must use the Schematics API or the command-line plug-in. This capability is not available from the IBM Cloud console. {: note} ## Private service endpoints in Schematics {: #private-cse} The private service endpoints are available for Schematics. IBM Cloud Schematics CLI users can access their private network by specifying `private-us-south.schematics.cloud.ibm.com` as the API endpoint of IBM Cloud Schematics CLI. For more information, see [Using private Schematics endpoints](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data&format=markdown#pi-location). {: shortdesc} To access the private network, you need to first login to private network by using [`ibmcloud login -a private.cloud.ibm.com`]( https://github.com/IBM-Cloud/ibm-cloud-cli-sdk/blob/master/docs/plugin_developer_guide.md#9-private-endpoint-support). Access Schematics commands to interact with the private Schematics endpoint to automatically access the endpoint. {: important} ### Enable VRF and service endpoints for your account {: #private-network-prereqs} Enable your IBM Cloud account to work with private service endpoints. {: shortdesc} 1. Enable your IBM Cloud account for [virtual routing and forwarding (VRF)](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&interface=ui&format=markdown#vrf). When you enable VRF, a separate routing table is created for your account, and connections to and from your account's resources are routed separately on the IBM Cloud network. To learn more about VRF technology, see [Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&format=markdown){: external}. Enabling VRF permanently alters networking for your account. Be sure that you understand the impact to your account and resources. After you enable VRF, you cannot disable VRF again. {: important} 2. Enable your IBM Cloud account for [service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint&format=markdown#service-endpoint){: external}. After you enable VRF and service endpoints for your account, all existing and future Schematics workspaces become available from both the public and private service endpoints. {: note} 3. Verify that your account is enabled for VRF and service endpoints. 1. Log in to IBM Cloud. ```sh ibmcloud login ``` {: pre} If the login fails, run the `ibmcloud login --sso` command to try again. The `--sso` parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the command-line output to generate a one-time passcode. {: tip} 2. Show the details of your account. ```sh ibmcloud account show ``` {: pre} Example output ```text Retrieving account User's Account of user@email.com... OK Account ID: a111aaaa1aa1aaaaaaaaaaaa1a1aa111 Currently Targeted Account: true Linked Softlayer Account: 000000 VRF Enabled: true Service Endpoint Enabled: true ``` {: screen} ### Connect to the Schematics private service endpoint {: #configure-private-network} Prepare your VSI or test machine by configuring your routing table for the IBM Cloud Private network. 1. To connect to the private service endpoint, you must create a virtual server instance (VSI) first. You use this VSI to connect to the IBM Cloud Private network. You can create a [classic VSI](https://cloud.ibm.com/docs/virtual-servers?topic=virtual-servers-getting-started-tutorial&format=markdown) or [VPC VSI](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown). 2. After you are connected to the VSI, target the private service endpoint when you send API requests to the Schematics API server. The following example shows the supported Terraform and Helm versions of the Schematics engine. ```sh curl -X GET https://private-us-south.schematics.cloud.ibm.com/v1/version ``` {: pre} ## Virtual Private Endpoints Gateways for Schematics {: #endpoint-setup} A service instance can have a private network endpoint, a public network endpoint, or both. After your account is enabled for VPC and you connect Schematics service on the private network from Virtual Private Endpoint Gateways. {: shortdesc} - **Public:** A service endpoint on the IBM Cloud public network. - **Private:** A service endpoint that is accessible only on the IBM Cloud private network with no access from the public internet. - **Both public and private:** Service endpoints that allow access over both networks. Virtual Private Endpoint Gateways is only supported for the VPC Generation 2. {: note} ### Before you begin {: #endpoint-prereq} Before you begin, to access the Schematics service through the Virtual Private Endpoint Gateways, ensure that you meet the following criteria: * Make sure that you have the required [permissions](https://cloud.ibm.com/docs/schematics?topic=schematics-access&format=markdown#access-setup) to [create VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown), to create an endpoint gateway, to create or bind a reserved IP from the subnet, and [account limits for VSI creation](https://cloud.ibm.com/docs/vpc?topic=vpc-quotas&format=markdown#vpcquotas) for concurrent instances. * A VPC Generation 2 instance and a subnet zones to bind an IP address at the same time you provision the endpoint gateway. For more information, see [Getting started with VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-a-vpc-using-the-ibm-cloud-console&format=markdown). * A VSI is created. For more information, see [creating a VSI](https://cloud.ibm.com/docs/vpc?topic=vpc-creating-virtual-servers&interface=cli&format=markdown). ### Adding Virtual Private Endpoint Gateways for Schematics {: #endpoint-add} Now, you can securely connect the Virtual Private Endpoint Gateways to access Schematics services and functions such as `workspace`, `action`, `job`, `plan`, `apply`, and `destroy` for a new instance. For more information, see [Overview of private service endpoints in Schematics](https://cloud.ibm.com/docs/schematics?topic=schematics-secure-data&format=markdown#pi-location). {: shortdesc} You cannot create multiple Virtual Private Endpoint Gateways for the same Schematics instance. {: important} The steps to add the private network endpoints for Schematics: 1. Create a Schematics workspace. For more information, see [creating a workspace](https://cloud.ibm.com/docs/schematics?topic=schematics-sch-create-wks&interface=ui&format=markdown#create-wks-ui). 2. Optionally, you can deploy a resource instance into Schematics workspace. For more information, see [deploying your resource](https://cloud.ibm.com/docs/schematics?topic=schematics-manage-lifecycle&format=markdown#deploy-resources). 3. Create a Virtual Private Endpoint Gateways. For more information, see [creating an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&interface=ui&format=markdown#vpe-creating-ui). And you can assign the listed Schematics services endpoint into Virtual Private Endpoint Gateways. 4. View the created Virtual Private Endpoint Gateways associated with the Schematics services. For more information, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown).