Access Model Studio APIs over a private network

​

How it works

• Public network access: Call Model Studio APIs over a public domain name, such as dashscope.aliyuncs.com for the China site or dashscope-intl.aliyuncs.com for regions outside the Chinese mainland, or over a public domain name that is specific to your workspace. Traffic is routed over the public internet.
• PrivateLink private connection: Create an interface endpoint in a VPC and then call Model Studio APIs over the endpoint service domain name. Traffic stays within the Alibaba Cloud network and does not traverse the public internet.

• Public cloud: Singapore and China (Beijing).

  Private network access is not currently supported in the US (Virginia) region.

​

Access Model Studio APIs with an endpoint

​

Step 1: Create an interface endpoint

​

Step 2: Get theendpoint service domain name

​

Step 3: Verify the connection

# Replace the original domain name with the endpoint service domain name from the previous step.
curl -X POST http://ep-***.dashscope.ap-southeast-1.privatelink.aliyuncs.com/compatible-mode/v1/chat/completions \
-H "Authorization: Bearer $DASHSCOPE_API_KEY" \
-H "Content-Type: application/json" \
-d '{
    "model": "qwen-flash",
    "messages": [
        {
            "role": "system",
            "content": "You are a helpful assistant."
        },
        {
            "role": "user",
            "content": "Who are you?"
        }
    ]
}'

​

Cross-regionprivate access

• For access between regions that are either both in mainland China or both outside mainland China (for example, a VPC in Japan (Tokyo) accessing Model Studio in Singapore): use Method 1: Enable a cross-region endpoint.
• For cross-border access between the Chinese mainland and other regions (for example, a VPC in Singapore accessing Model Studio in China (Beijing)): use Method 2: Connect VPCs across regions by using CEN.

​

Method 1: Cross-region endpoint (recommended)

• Region: Select the region of your source VPC.
• Type: Select Alibaba Cloud Service.
• Service Region: Select the Enable inter-region endpoint check box and select Singapore or China (Beijing).
• Endpoint Service: Select com.aliyuncs.dashscope from the list of services.
• Cross-region configuration: Cross-region traffic is billed through Cloud Data Transfer (CDT). Default bandwidth: 1,000 Mbit/s within the Chinese mainland, 100 Mbit/s outside the Chinese mainland.

Method 1 does not support connections between the Chinese mainland and other regions. For cross-border access, use Method 2.

​

Method 2: Cross-region VPC connection with CEN (for cross-border scenarios)

1. Complete the configurations in Access Model Studio APIs by using an endpoint.
2. Use Cloud Enterprise Network (CEN) to configure a cross-region VPC connection. Note the following:
   • Select VPCs with non-overlapping CIDR blocks to avoid network conflicts.
   • To establish a cross-region VPC connection between the Chinese mainland and other regions by using CEN, your account must complete enterprise identity verification.
3. In the endpoint security group, add an inbound rule to allow traffic from the source VPC on ports 80 and 443.

1. Add a private authoritative domain name that matches the custom domain name, such as vpc-ap-southeast-1.dashscope.aliyuncs.com. Set its effective scope to the source VPC.
2. Add a DNS record: set Record Type to CNAME, set Host Record to @, and set Record Value to the default domain name of the target endpoint, such as ep-***.dashscope.ap-southeast-1.privatelink.aliyuncs.com. Note: When you configure PrivateZone, do not use underscores (_) in the host record or full domain name. Otherwise, API calls may fail. Domain names should contain only letters, numbers, and hyphens (-), for example, test-for-dns.dashscope.aliyuncs.com, not test_for_dns.dashscope.aliyuncs.com.

​

Billing

• Billing of PrivateLink
• Billing of CEN (for cross-border scenarios only)
• Billing of PrivateZone

​

FAQ

1. Why can't my ECS instance access Model Studio APIs over a private network? Check the following items:
   1. Confirm that the resources are in the same VPC. If the ECS instance and the endpoint are in different VPCs, configure VPC connections first.
   2. Verify that the endpoint security group allows inbound traffic from the ECS instance CIDR block on port 80 (HTTP) or 443 (HTTPS).
   3. Check that you are using the correct endpoint service domain name. The default domain name supports only HTTP.
2. Can an endpoint be accessed from the public internet? No. PrivateLink establishes private connections only within the Alibaba Cloud internal network. Endpoints cannot be accessed from the public internet, and you cannot associate an EIP with an endpoint ENI.
3. Why do I get an error when I call a model when using a custom domain name withPrivateZone? This usually occurs when the host record or domain name configured in PrivateZone contains invalid characters, such as underscores (_). Domain names must contain only letters, digits, and hyphens (-). Configure the DNS record by following these steps:
   1. Authoritative Domain: In PrivateZone, add a DNS record for the dashscope.aliyuncs.com authoritative domain.
   2. Host Record: Set Record Type to CNAME and enter your custom domain prefix, such as test-for-dns-right. Note: The host record cannot contain underscores (_).

      Correct example	Incorrect example
      On the Edit Record page, set Record Type to CNAME. For Host Record, use a hyphen (-) to separate words, for example, test-for-dns-right. The suffix is .dashscope.aliyuncs.com. For Record Value, enter the corresponding endpoint address.	On the Edit Record page, the Host Record field is test_for_dns_wrong. This uses an underscore (_) as a separator, which is invalid. DNS host records do not support underscores. You must use valid characters, such as hyphens (-).

   3. Record Value: Enter the default domain name of the Model Studio endpoint. Example: ep-***.dashscope.ap-southeast-1.privatelink.aliyuncs.com.
   After the configuration is complete, you can call the model at https://test-for-dns-right.dashscope.aliyuncs.com/api/v1. The endpoint for the OpenAI-compatible mode is https://test-for-dns-right.dashscope.aliyuncs.com/compatible-mode/v1/chat/completions.

   Using a domain name that contains an underscore, such as https://test_for_dns_wrong.dashscope.aliyuncs.com/api/v1, will cause the API call to fail.

4. What do I do if API calls to Model Studio time out or take a long time to respond? Check the following causes:
   • Network issues: DNS resolution fails or the TCP connection to the endpoint times out. Verify that the source VPC and the endpoint are in the same VPC or are connected through Cloud Enterprise Network (CEN). Check that the endpoint security group allows inbound traffic on port 80 (HTTP) and port 443 (HTTPS). If you use a custom service domain name, verify that the PrivateZone authoritative domain resolves to the endpoint default domain name.
   • Rate limiting: The request rate or token consumption exceeds the RPM or TPM quota of the model, and the API returns HTTP 429 with a throttling error code such as Throttling.RateQuota. Check the current quota on the model rate limiting page in the console and submit a quota increase request if needed.
   • Peak traffic: During peak hours, requests may be queued on the server side, which increases response latency or causes timeouts. Increase the client-side timeout value or retry during off-peak hours.
   • Parameter settings: Reasoning models such as QwQ and QVQ support only streaming calls. A non-streaming call returns an error or does not respond. Set stream=true in your request or use the streaming API of the corresponding SDK.