--- name: secrets-manager-endpoints title: Regions and endpoints description: Review region and connectivity options for interacting with IBM Cloud® Secrets Manager. last-updated: 2026-09-01 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/secrets-manager?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. {:codeblock: .codeblock} {:screen: .screen} {:download: .download} {:external: target="_blank" .external} {:faq: data-hd-content-type='faq'} {:gif: data-image-type='gif'} {:important: .important} {:note: .note} {:pre: .pre} {:tip: .tip} {:preview: .preview} {:deprecated: .deprecated} {:beta: .beta} {:term: .term} {:shortdesc: .shortdesc} {:script: data-hd-video='script'} {:support: data-reuse='support'} {:table: .aria-labeledby="caption"} {:troubleshoot: data-hd-content-type='troubleshoot'} {:help: data-hd-content-type='help'} {:tsCauses: .tsCauses} {:tsResolve: .tsResolve} {:tsSymptoms: .tsSymptoms} {:video: .video} {:step: data-tutorial-type='step'} {:tutorial: data-hd-content-type='tutorial'} {:api: .ph data-hd-interface='api'} {:cli: .ph data-hd-interface='cli'} {:ui: .ph data-hd-interface='ui'} {:terraform: .ph data-hd-interface="terraform"} {:curl: .ph data-hd-programlang='curl'} {:java: .ph data-hd-programlang='java'} {:ruby: .ph data-hd-programlang='ruby'} {:c#: .ph data-hd-programlang='c#'} {:objectc: .ph data-hd-programlang='Objective C'} {:python: .ph data-hd-programlang='python'} {:javascript: .ph data-hd-programlang='javascript'} {:php: .ph data-hd-programlang='PHP'} {:swift: .ph data-hd-programlang='swift'} {:curl: .ph data-hd-programlang='curl'} {:dotnet-standard: .ph data-hd-programlang='dotnet-standard'} {:go: .ph data-hd-programlang='go'} {:unity: .ph data-hd-programlang='unity'} {:release-note: data-hd-content-type='release-note'} # Regions and endpoints {: #endpoints} Review region and connectivity options for interacting with IBM Cloud® Secrets Manager. {: shortdesc} ## Supported regions {: #supported-regions} You can create Secrets Manager resources in one of the supported IBM Cloud regions, which represents the geographic area where your Secrets Manager requests are handled and processed. ### Trial and Standard plans {: #supported-regions-trial-standard} The [Trial and Standard]{: tag-blue} plans are available in the following regions. | Dallas (`us-south`) | Washington (`us-east`) | Toronto (`ca-tor`) | Montreal (`ca-mon`) | Sao Paulo (`br-sao`) | |---------------------|-------------------------|-------------------|----------------------|----------------------| | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | {: caption="Regions where Trial and Standard plans are available in Americas locations" caption-side="bottom"} {: #regions-table-1} {: tab-title="Americas"} {: tab-group="regions-standard"} {: class="simple-tab-table"} {: row-headers} | Tokyo (`jp-tok`) | Sydney (`au-syd`) | Osaka (`jp-osa`) | Chennai - Airtel (`in-che`) | Mumbai - Airtel (`in-mum`) | |---------------------|------------------|------------------|--------------------|-------------------| | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | {: caption="Regions where Trial and Standard plans are available in Asia Pacific locations" caption-side="bottom"} {: #regions-table-2} {: tab-title="Asia Pacific"} {: tab-group="regions-standard"} {: class="simple-tab-table"} {: row-headers} | Frankfurt (`eu-de`) | London (`eu-gb`) | Madrid (`eu-es`) | |---------------------------------------------------------------|---------------------|------------------| | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | {: caption="Regions where Trial and Standard plans are available in Europe locations" caption-side="bottom"} {: #regions-table-3} {: tab-title="Europe"} {: tab-group="regions-standard"} {: class="simple-tab-table"} {: row-headers} ### Vault Dedicated plan {: #supported-regions-vault-dedicated} The [Vault Dedicated]{: tag-green} is available in the following regions. | Dallas (`us-south`) | Frankfurt (`eu-de`) | Paris (`eu-fr2`) | |---------------------|---------------------|------------------| | [Yes]{: tag-green} | [Yes]{: tag-green} | [Yes]{: tag-green} | {: caption="Regions where Vault Dedicated plan is available" caption-side="bottom"} The Vault Dedicated plan is currently available as a public beta. Beta features are provided for evaluation and testing purposes and have limitations compared to generally available features. {: beta} #### Vault Dedicated public beta limitations {: #vault-dedicated-regions-beta-limitations} During the public beta period, the Vault Dedicated plan has the following temporary restrictions: - **Instance limit**: Only 1 Vault Dedicated instance per account during beta. - **No upgrade path**: Cannot upgrade from beta to GA. All beta instances will be deleted before general availability. - **Regional availability**: Available in Dallas and Frankfurt. - **Free during beta**: No charges apply during the beta period. - **Beta to GA migration**: Data migration from beta instances to GA instances is not supported. These limitations will be removed or modified when the Vault Dedicated plan reaches general availability. {: important} ## Service endpoints {: #service-endpoints} You can use the Secrets Manager APIs to manage your secrets programmatically. Secrets Manager offers two connectivity options for interacting with its service APIs. Private endpoints : By default, a Secrets Manager instance will have only a private endpoint. Private endpoints provide secure connectivity to Secrets Manager over the IBM Cloud private network without requiring traffic to traverse the public internet. For the [Trial and Standard]{: tag-blue} plans, you can connect using Virtual Private Endpoint (VPE) gateways or through Cloud Service Endpoints (CSE). For the [Vault Dedicated]{: tag-green} plan, **only VPE gateways are supported** — CSE is not available. For more information, see [Securing your connection to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection&format=markdown). Public endpoints : Use public endpoints to connect to Secrets Manager in your account over the IBM Cloud public network. Your data is encrypted in transit by using the Transport Security Layer (TLS) 1.2 protocol. When a Secrets Manager instance is configured with public endpoints, it also has a private endpoint in addition by default. ### Service endpoints for Trial and Standard plans {: #service-endpoints-table} If you need to manage your Secrets Manager resources, see the following table to determine the API endpoints to use when you connect to the Secrets Manager API. To learn how to configure your Secrets Manager instance to use private endpoints, see [Securing your connection to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection&format=markdown). {: note} | Region | Endpoint URL | | ------------- | ---------------------------- | | **Americas** | | | Dallas | `https://{instance_ID}.us-south.secrets-manager.appdomain.cloud` | | Washington DC | `https://{instance_ID}.us-east.secrets-manager.appdomain.cloud` | | Toronto | `https://{instance_ID}.ca-tor.secrets-manager.appdomain.cloud` | | Montreal | `https://{instance_ID}.ca-mon.secrets-manager.appdomain.cloud` | | Sao Paulo | `https://{instance_ID}.br-sao.secrets-manager.appdomain.cloud` | | **Europe** | | | London | `https://{instance_ID}.eu-gb.secrets-manager.appdomain.cloud` | | Frankfurt | `https://{instance_ID}.eu-de.secrets-manager.appdomain.cloud` | | Madrid | `https://{instance_ID}.eu-es.secrets-manager.appdomain.cloud` | | **Asia Pacific** | | | Tokyo | `https://{instance_ID}.jp-tok.secrets-manager.appdomain.cloud` | | Osaka | `https://{instance_ID}.jp-osa.secrets-manager.appdomain.cloud` | | Sydney | `https://{instance_ID}.au-syd.secrets-manager.appdomain.cloud` | | Mumbai - Airtel | `https://{instance_ID}.in-mum.secrets-manager.appdomain.cloud` | | Chennai - Airtel | `https://{instance_ID}.in-che.secrets-manager.appdomain.cloud` | {: caption="Public endpoints for interacting with Secrets Manager" caption-side="bottom"} {: #public-endpoints} {: tab-title="Public endpoints"} {: tab-group="service-endpoint-urls"} {: class="simple-tab-table"} | Region | Endpoint URL | | ------------- | ---------------------------- | | **Americas** | | | Dallas | `https://{instance_ID}.private.us-south.secrets-manager.appdomain.cloud` | | Washington DC | `https://{instance_ID}.private.us-east.secrets-manager.appdomain.cloud` | | Toronto | `https://{instance_ID}.private.ca-tor.secrets-manager.appdomain.cloud` | | Montreal | `https://{instance_ID}.private.ca-mon.secrets-manager.appdomain.cloud` | | Sao Paulo | `https://{instance_ID}.private.br-sao.secrets-manager.appdomain.cloud` | | **Europe** | | | London | `https://{instance_ID}.private.eu-gb.secrets-manager.appdomain.cloud` | | Frankfurt | `https://{instance_ID}.private.eu-de.secrets-manager.appdomain.cloud` | | Madrid | `https://{instance_ID}.private.eu-es.secrets-manager.appdomain.cloud` | | **Asia Pacific** | | | Tokyo | `https://{instance_ID}.private.jp-tok.secrets-manager.appdomain.cloud` | | Osaka | `https://{instance_ID}.private.jp-osa.secrets-manager.appdomain.cloud` | | Sydney | `https://{instance_ID}.private.au-syd.secrets-manager.appdomain.cloud` | | Mumbai - Airtel | `https://{instance_ID}.private.in-mum.secrets-manager.appdomain.cloud` | | Chennai - Airtel | `https://{instance_ID}.private.in-che.secrets-manager.appdomain.cloud` | {: caption="Private endpoints for interacting with Secrets Manager" caption-side="bottom"} {: #private-endpoints} {: tab-title="Private endpoints"} {: tab-group="service-endpoint-urls"} {: class="simple-tab-table"} Ready to try the APIs? To interact with a Swagger UI from your browser, add `api/v2/swagger-ui` to your service endpoint URL. For example, `https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/swagger-ui`. {: tip} ### Service endpoints for the Vault Dedicated plan {: #vault-dedicated-service-endpoints} The [Vault Dedicated]{: tag-green} plan exposes two private endpoint URLs per instance: one for the Vault API and one for the Vault UI. Both are accessible only through a VPE gateway — Cloud Service Endpoints (CSE) are not supported for this plan. | Endpoint | URL format | | -------- | ---------- | | **Vault API** (private) | `https://private.{instance_ID}.{region}.secrets-manager.appdomain.cloud` | | **Vault UI** (private) | `https://private.{instance_ID}.{region}.secrets-manager.appdomain.cloud/ui` | {: caption="Private endpoint URLs for the Vault Dedicated plan" caption-side="bottom"} Replace `{instance_ID}` with your instance UUID and `{region}` with the region abbreviation, for example `us-south` or `eu-de`. If your instance is configured with **private-only** endpoints, the following access requirements apply: - **API access**: Requires a VPE gateway that targets your Vault Dedicated instance. For setup instructions, see [Using service endpoints to privately connect to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection&format=markdown). - **Vault UI access**: Requires a Client-to-Site VPN that routes traffic through the VPE. A browser cannot reach the private Vault UI URL directly from outside the IBM Cloud private network. For setup instructions, see [Using Client-to-Site VPN to privately connect to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vpn-connection&format=markdown). If your instance is configured with **public-and-private** endpoints, the Vault API and Vault UI are reachable over the public internet without a VPE or VPN. The private endpoint URLs are also available, but using them still requires a VPE gateway (and a Client-to-Site VPN for Vault UI access), exactly as described above for private-only instances. {: note} You can retrieve the exact endpoint URLs for your instance from the **Endpoints** page of the Secrets Manager UI, or by calling the [instance details API](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-vault-dedicated-apis&format=markdown#get-instance-details-api). ### Viewing your endpoint URLs {: #view-endpoint-urls} You can find your service endpoint URLs in the **Endpoints** page of the Secrets Manager UI. The private control plane endpoint is accessible through a VPE gateway. For more information, see [Using service endpoints to privately connect to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection&format=markdown). If you need to retrieve your service endpoint URLs programmatically, you can also call the following API to retrieve the values that are specific to your Secrets Manager instance. ```sh curl -X GET -H "Accept: application/json" \ -H "Authorization: Bearer {IAM_token}" "https://{region}.secrets-manager.cloud.ibm.com/api/v1/instances/{url_encoded_instance_CRN}/endpoints" ``` {: pre} Replace the variables in the example request according to the following table. | Parameter | Description | | --- | --- | | `{region}` | The region abbreviation that represents the geographic area where your Secrets Manager resides. For example, `us-south` or `eu-de`. | | `{url_encoded_instance_CRN}` | The Cloud Resource Name (CRN) that uniquely identifies your Secrets Manager service instance. The value must be URL encoded. | | `{IAM_token}` | Your IBM Cloud IAM access token. | {: caption="Required parameters for retrieving service endpoints with the API" caption-side="bottom"} A successful request returns the endpoint URLs that are associated with the region and service instance CRN that you specify. The following JSON snippet shows an example response. ```json { "plan": "standard", "public_endpoints": { "service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc81234.us-south.secrets-manager.appdomain.cloud/api", "vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc81234.us-south.secrets-manager.appdomain.cloud" }, "private_endpoints": { "service_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc1234.private.us-south.secrets-manager.appdomain.cloud/api", "vault_api": "https://927fb8ae-1ddd-4483-a21f-7d3c0fc81234.private.us-south.secrets-manager.appdomain.cloud" }, "encryption": { "provider_managed_encryption": "key_protect", "encryption_key_crn": "crn:v1:staging:public:kms:us-south:a/791f5fb10986423e97aa8512f181234:31639268-42e8-4420-9872-590a6ee21234:key:b4af8f76-e6ea-4dc5-89cc-5f1b9bb1234" } } ``` {: screen} ### Control plane endpoints {: #control-plane-endpoints} Use the following control plane endpoints to call control plane APIs. | Region | Endpoint URL | | ------------- | ---------------------------- | | **Americas** | | | Dallas | `https://us-south.secrets-manager.cloud.ibm.com` | | Washington DC | `https://us-east.secrets-manager.cloud.ibm.com` | | Toronto | `https://ca-tor.secrets-manager.cloud.ibm.com` | | Montreal | `https://ca-mon.secrets-manager.cloud.ibm.com` | | Sao Paulo | `https://br-sao.secrets-manager.cloud.ibm.com` | | **Europe** | | | London | `https://eu-gb.secrets-manager.cloud.ibm.com` | | Frankfurt | `https://eu-de.secrets-manager.cloud.ibm.com` | | Madrid | `https://eu-es.secrets-manager.cloud.ibm.com` | | **Asia Pacific** | | | Tokyo | `https://jp-tok.secrets-manager.cloud.ibm.com` | | Osaka | `https://jp-osa.secrets-manager.cloud.ibm.com` | | Sydney | `https://au-syd.secrets-manager.cloud.ibm.com` | | Mumbai - Airtel | `https://in-mum.secrets-manager.cloud.ibm.com` | | Chennai - Airtel | `https://in-che.secrets-manager.cloud.ibm.com` | {: caption="Public control plane endpoints for Secrets Manager" caption-side="bottom"} {: #public-control-plane-endpoints} {: tab-title="Public endpoints"} {: tab-group="control-plane-endpoint-urls"} {: class="simple-tab-table"} | Region | Endpoint URL | | ------------- | ---------------------------- | | **Americas** | | | Dallas | `https://private.us-south.secrets-manager.cloud.ibm.com` | | Washington DC | `https://private.us-east.secrets-manager.cloud.ibm.com` | | Toronto | `https://private.ca-tor.secrets-manager.cloud.ibm.com` | | Montreal | `https://private.ca-mon.secrets-manager.cloud.ibm.com` | | Sao Paulo | `https://private.br-sao.secrets-manager.cloud.ibm.com` | | **Europe** | | | London | `https://private.eu-gb.secrets-manager.cloud.ibm.com` | | Frankfurt | `https://private.eu-de.secrets-manager.cloud.ibm.com` | | Madrid | `https://private.eu-es.secrets-manager.cloud.ibm.com` | | **Asia Pacific** | | | Tokyo | `https://private.jp-tok.secrets-manager.cloud.ibm.com` | | Osaka | `https://private.jp-osa.secrets-manager.cloud.ibm.com` | | Sydney | `https://private.au-syd.secrets-manager.cloud.ibm.com` | | Mumbai - Airtel | `https://private.in-mum.secrets-manager.cloud.ibm.com` | | Chennai - Airtel | `https://private.in-che.secrets-manager.cloud.ibm.com` | {: caption="Private control plane endpoints for Secrets Manager" caption-side="bottom"} {: #private-control-plane-endpoints} {: tab-title="Private endpoints"} {: tab-group="control-plane-endpoint-urls"} {: class="simple-tab-table"} The private control plane endpoint is accessible through a VPE gateway. For more information, see [Using service endpoints to privately connect to Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-service-connection&format=markdown). To try this API, you can interact with the following Swagger UI from your browser: `https://{region}.secrets-manager.cloud.ibm.com/swagger-ui`. {: tip} If your instance is configured with the **Private only** option, this API returns only the `private_endpoints` object in the response. {: note}