Documentation 2026-07-06 22:58 UTC to 2026-07-08 22:02 UTC

5<div className="docs-models-toc">5<div className="docs-models-toc">

6 | User agent | Description & details |6 | User agent | Description & details |

7 | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |7 | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |

8 | OAI-SearchBot | OAI-SearchBot is for search. OAI-SearchBot is used to surface websites in search results in ChatGPT's search features. Sites that are opted out of OAI-SearchBot will not be shown in ChatGPT search answers, though can still appear as navigational links. To help ensure your site appears in search results, we recommend allowing OAI-SearchBot in your site’s robots.txt file and allowing requests from our published IP ranges below. <br/><br/>Full user-agent string: `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot` <br/><br/>Published IP addresses: https://openai.com/searchbot.json8 | OAI-SearchBot | OAI-SearchBot is for search. OAI-SearchBot is used to surface websites in search results in ChatGPT's search features. Sites that are opted out of OAI-SearchBot will not be shown in ChatGPT search answers, though can still appear as navigational links. To help ensure your site appears in search results, we recommend allowing OAI-SearchBot in your site’s robots.txt file and allowing requests from our published IP ranges below. <br/><br/>Example user-agent string (the version number may change): `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot` <br/><br/>When fetching robots.txt files, we may use a user-agent string with an additional `robots.txt` marker. The marker helps site owners more easily distinguish requests for the robots.txt file from requests for other resources, especially when their logs do not include paths: `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.com/searchbot` <br/><br/>Published IP addresses: https://openai.com/searchbot.json

9 | OAI-AdsBot | OAI-AdsBot is used to validate the safety of web pages submitted as ads on ChatGPT. When you submit an ad, OpenAI may visit the landing page to ensure it complies with our policies. We may also use content from the landing page to determine when it's most relevant to show the ad to users. OAI-AdsBot only visits pages submitted as ads, and the data collected by OAI-AdsBot is not used to train generative AI foundation models. <br/><br/>Full user-agent string: `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot` <br/><br/>Published IP addresses: https://openai.com/adsbot.json9 | OAI-AdsBot | OAI-AdsBot is used to validate the safety of web pages submitted as ads on ChatGPT. When you submit an ad, OpenAI may visit the landing page to ensure it complies with our policies. We may also use content from the landing page to determine when it's most relevant to show the ad to users. OAI-AdsBot only visits pages submitted as ads, and the data collected by OAI-AdsBot is not used to train generative AI foundation models. <br/><br/>Full user-agent string: `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot` <br/><br/>Published IP addresses: https://openai.com/adsbot.json

10 | GPTBot | GPTBot is used to make our generative AI foundation models more useful and safe. It is used to crawl content that may be used in training our generative AI foundation models. Disallowing GPTBot indicates a site’s content should not be used in training generative AI foundation models. <br/><br/>Full user-agent string: `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.3; +https://openai.com/gptbot` <br/><br/>Published IP addresses: https://openai.com/gptbot.json10 | GPTBot | GPTBot is used to make our generative AI foundation models more useful and safe. It is used to crawl content that may be used in training our generative AI foundation models. Disallowing GPTBot indicates a site’s content should not be used in training generative AI foundation models. <br/><br/>Example user-agent string (the version number may change): `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot` <br/><br/>When fetching robots.txt files, we may add a `robots.txt` marker to the user-agent string to help site owners distinguish those requests from requests for other resources, especially when logs do not include paths. <br/><br/>Published IP addresses: https://openai.com/gptbot.json

11 | ChatGPT-User | OpenAI also uses ChatGPT-User for certain user actions in ChatGPT and [Custom GPTs](https://openai.com/index/introducing-gpts/). When users ask ChatGPT or a CustomGPT a question, it may visit a web page with a ChatGPT-User agent. ChatGPT users may also interact with external applications via [GPT Actions](https://developers.openai.com/api/docs/actions/introduction). ChatGPT-User is not used for crawling the web in an automatic fashion. Because these actions are initiated by a user, robots.txt rules may not apply. ChatGPT-User is not used to determine whether content may appear in Search. Please use OAI-SearchBot in robots.txt for managing Search opt outs and automatic crawl. <br/><br/>Full user-agent string: `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot` <br/><br/>Published IP addresses: https://openai.com/chatgpt-user.json11 | ChatGPT-User | OpenAI also uses ChatGPT-User for certain user actions in ChatGPT and [Custom GPTs](https://openai.com/index/introducing-gpts/). When users ask ChatGPT or a CustomGPT a question, it may visit a web page with a ChatGPT-User agent. ChatGPT users may also interact with external applications via [GPT Actions](https://developers.openai.com/api/docs/actions/introduction). ChatGPT-User is not used for crawling the web in an automatic fashion. Because these actions are initiated by a user, robots.txt rules may not apply. ChatGPT-User is not used to determine whether content may appear in Search. Please use OAI-SearchBot in robots.txt for managing Search opt outs and automatic crawl. <br/><br/>Full user-agent string: `Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot` <br/><br/>Published IP addresses: https://openai.com/chatgpt-user.json

12 12 

13</div>13</div>

1# Private Link

2 

3OpenAI Private Link lets Azure workloads reach regional OpenAI API endpoints through Azure Private Link instead of connecting directly to public API endpoints. Create a private endpoint for each OpenAI-provided regional Private Link Service, map its regional host name in private DNS, and send normal authenticated API requests to that host name.

4 

5Use Private Link when your organization has strict requirements to keep traffic on Azure private networking. If you don't have private-network requirements, OpenAI's public endpoints are simpler to set up and operate. Private Link isn't compatible with IP allowlist controls or mutual TLS (mTLS); contact OpenAI if you need help choosing the right enterprise network controls.

6 

7Private Link is currently not self-service. Work with your OpenAI contact or

8 [contact sales](https://openai.com/contact-sales/) to request access and

9 receive the regional Private Link Service aliases or resource identifiers you

10 need.

11 

12## Understand how Private Link works

13 

14Some customers have been using the legacy Private Link solution (v1), which connects each Private Endpoint to a specific OpenAI API cluster. The current regional solution differs in these ways:

15 

16| | Legacy Private Link (v1) | Regional Private Link |

17| --------------------- | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |

18| Host name | Cluster-specific, such as `privatelink.enterprise.unified-1.api.openai.com` | Regional, such as `southcentralus.privatelink.api.openai.com` |

19| OpenAI routing | Pinned to one OpenAI API cluster | Regional private-edge gateway that can route to more than one backing OpenAI API cluster |

20| Customer health check | Older v1 health check paths | `GET /v2/privatelink_healthcheck` |

21 

22A request follows this path:

23 

241. Your application resolves a regional Private Link host name through your private DNS.

252. The host name resolves to an Azure Private Endpoint in your virtual network.

263. The Private Endpoint connects to the regional OpenAI Private Link Service.

274. The Private Link Service sends the request to OpenAI's regional private-edge gateway.

285. The gateway routes the request to an enterprise-enabled backing OpenAI API cluster for that regional rail.

29 

30Within a regional rail, Private Link can route around an unavailable backing cluster and OpenAI can add backing clusters without requiring you to reconfigure your Private Endpoints. It doesn't automatically move traffic from the regional host name you selected to a different regional Private Endpoint. Don't assume that Private Link inherits OpenAI's public endpoint routing behavior; configure how your application fails over between regions.

31 

32## Choose regional endpoints

33 

34OpenAI provides the exact Private Link Service alias or resource identifier during onboarding. The current production regional host names are:

35 

36| Region label | Customer host name |

37| ------------------ | ------------------------------------------- |

38| South Central US | `southcentralus.privatelink.api.openai.com` |

39| West US | `westus.privatelink.api.openai.com` |

40| East US 2 | `eastus2.privatelink.api.openai.com` |

41| Spain Central / EU | `spaincentral.privatelink.api.openai.com` |

42 

43The Spain Central / EU host name can route to backing clusters in other EU regions, such as North Europe.

44 

45## Set up Private Link

46 

47### 1. Provide onboarding information

48 

49Send OpenAI:

50 

51- The Azure subscription IDs that need access to the OpenAI Private Link Services.

52- Your OpenAI organization ID.

53- The regions you need.

54- Operational contacts for maintenance and regional traffic-switching notices.

55 

56OpenAI grants the subscriptions visibility and approval for the appropriate regional Private Link Services, then provides the Private Link Service aliases or resource identifiers.

57 

58### 2. Create private endpoints

59 

60Create one Private Endpoint for each selected region. Azure requires a Private Endpoint to share the region of the customer virtual network. Set `--location` to that region, which might differ from the OpenAI Private Link Service region.

61 

62The following command uses an OpenAI-provided Private Link Service resource identifier:

63 

64```bash

65az network private-endpoint create \

66 --name openai-privatelink-southcentralus \

67 --resource-group <customer-resource-group> \

68 --location <customer-vnet-region> \

69 --vnet-name <customer-vnet> \

70 --subnet <customer-private-endpoint-subnet> \

71 --private-connection-resource-id <openai-provided-pls-resource-id> \

72 --connection-name openai-privatelink-southcentralus

73```

74 

75If OpenAI provides an alias, use the alias and add `--manual-request true`:

76 

77```bash

78az network private-endpoint create \

79 --name openai-privatelink-southcentralus \

80 --resource-group <customer-resource-group> \

81 --location <customer-vnet-region> \

82 --vnet-name <customer-vnet> \

83 --subnet <customer-private-endpoint-subnet> \

84 --private-connection-resource-id <openai-provided-pls-alias> \

85 --connection-name openai-privatelink-southcentralus \

86 --manual-request true

87```

88 

89Azure requires `--manual-request true` for [alias connections](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview#connect-by-using-an-alias); subscriptions on the access list can still receive automatic approval.

90 

91Use a similar Azure portal or Terraform workflow if your organization manages Private Endpoints through infrastructure as code.

92 

93### 3. Test connectivity before changing DNS

94 

95After OpenAI approves the Private Endpoint and Azure provisions it, capture its private IP address. Use `curl --resolve` to test the regional host name without changing DNS globally:

96 

97```bash

98curl -v \

99 --resolve southcentralus.privatelink.api.openai.com:443:<PRIVATE_ENDPOINT_IP> \

100 https://southcentralus.privatelink.api.openai.com/v2/privatelink_healthcheck

101```

102 

103A healthy response returns HTTP `200` with a message like:

104 

105```json

106{ "message": "Service is up" }

107```

108 

109Use the exact health check path: `/v2/privatelink_healthcheck`. Keep automated health check traffic low: use at most 1 QPS per regional endpoint unless OpenAI approves a different rate.

110 

111### 4. Configure private DNS

112 

113Create private DNS records so each regional OpenAI Private Link host name resolves to its corresponding Private Endpoint IP address inside your network:

114 

115| Host name | Private Endpoint IP address |

116| ------------------------------------------- | -------------------------------------- |

117| `southcentralus.privatelink.api.openai.com` | `<southcentralus-private-endpoint-ip>` |

118| `westus.privatelink.api.openai.com` | `<westus-private-endpoint-ip>` |

119| `eastus2.privatelink.api.openai.com` | `<eastus2-private-endpoint-ip>` |

120| `spaincentral.privatelink.api.openai.com` | `<spaincentral-private-endpoint-ip>` |

121 

122Check DNS and connectivity from the same network path your application uses:

123 

124```bash

125nslookup southcentralus.privatelink.api.openai.com

126curl -v https://southcentralus.privatelink.api.openai.com/v2/privatelink_healthcheck

127```

128 

129### 5. Fail over between regions

130 

131Private Link provides a regional front door, but your traffic still targets the regional host name you select. Configure your client, service mesh, DNS layer, or load-balancing layer to fail over between regions.

132 

133Recommended behavior:

134 

135- Probe each configured region with `GET /v2/privatelink_healthcheck`.

136- Treat HTTP `200` as available.

137- Treat `5xx` responses, connection errors, TLS errors, or repeated timeouts as unavailable.

138- Fail over only after a small number of consecutive errors to avoid flapping.

139- Continue probing an unavailable region in the background and fail back according to your operational policy.

140 

141The regional health check reflects the health of the OpenAI API clusters behind the private-edge rail. A region with no known backing clusters, missing health configuration, or insufficient healthy backing clusters returns an error.

142 

143If your routing decision depends on a specific API or model, pair this health check with a low-rate synthetic request to that API and model from the same network path.

144 

145### 6. Update application base URLs

146 

147Use the regional Private Link host name as the OpenAI API base URL:

148 

149```python

150from openai import OpenAI

151 

152client = OpenAI(

153 base_url="https://southcentralus.privatelink.api.openai.com/v1",

154)

155```

156 

157The SDK reads `OPENAI_API_KEY` from your environment.

158 

159You can also call the regional endpoint directly:

160 

161```bash

162curl https://southcentralus.privatelink.api.openai.com/v1/responses \

163 -H "Authorization: Bearer $OPENAI_API_KEY" \

164 -H "Content-Type: application/json" \

165 -d '{

166 "model": "gpt-5.5",

167 "input": "Say hello from Private Link."

168 }'

169```

170 

171 

172Start in a development or staging environment, then promote traffic gradually.

173 

174## Check your configuration

175 

176Use this checklist while onboarding or migrating to Private Link:

177 

178- OpenAI has confirmed that your Azure subscription IDs can access the selected regional Private Link Services.

179- You created Private Endpoints, and OpenAI approved them for each selected region.

180- You recorded the Private Endpoint IP addresses.

181- `curl --resolve` succeeds against `/v2/privatelink_healthcheck`.

182- Private DNS resolves regional host names to Private Endpoint IP addresses from the application network.

183- The application can call a representative `/v1` API endpoint through the regional host name.

184- Health check automation is rate-limited and logs the region, status code, and error type for errors.

185- You tested how the application fails over by forcing a region unhealthy in a controlled environment.

186- Your operational documentation identifies who can change DNS, Private Endpoint configuration, and application regional routing.

187 

188## Check endpoint compatibility

189 

190The following matrix reflects the current deployment configuration for services behind the listed public API routes. It doesn't replace live customer validation: test model availability, product gates, downstream dependencies, request-size limits, streaming behavior, and WebSocket behavior in each target region. `Yes` means every backing cluster in the regional rail has the route; `No` means the backing service is absent from that rail.

191 

192| Endpoint family | South Central US | West US | East US 2 | Spain Central / EU |

193| --------------------------------------- | ---------------- | ------- | --------- | ------------------ |

194| `/v1/responses` | Yes | Yes | Yes | Yes |

195| `/v1/chat/completions` | Yes | Yes | Yes | Yes |

196| `/v1/completions` | Yes | Yes | Yes | Yes |

197| `/v1/embeddings` | Yes | Yes | Yes | Yes |

198| `/v1/audio/*` (Inference) | Yes | Yes | Yes | Yes |

199| `/v1/audio/*` (management) | Yes | No | No | Yes |

200| `/v1/models` | Yes | Yes | Yes | Yes |

201| `/v1/files`, `/v1/uploads` | Yes | Yes | Yes | Yes |

202| `/v1/batches` | Yes | Yes | Yes | Yes |

203| `/v1/images/*` | Yes | Yes | Yes | Yes |

204| `/v1/moderations` | Yes | Yes | Yes | Yes |

205| `/v1/vector_stores` | Yes | Yes | Yes | Yes |

206| `/v1/organization/audit_logs` | Yes | Yes | Yes | Yes |

207| Other `/v1/organization/*`, `/v1/usage` | Yes | No | No | Yes |

208| `/v1/realtime` | Yes | Yes | Yes | Yes |

209 

210## Frequently asked questions

211 

212### Does Private Link fail over between regions automatically?

213 

214No. The regional private-edge rail can route across its configured backing clusters, but it doesn't automatically move your traffic to a different regional Private Endpoint. Configure your application to fail over across the regional endpoints you use.

215 

216### Which health check should I use?

217 

218Use `GET /v2/privatelink_healthcheck` on the regional host name. The older v1 health check paths probe the backing-cluster health rail, so don't use them as customer-facing probes.

219 

220### Which API host name should applications use?

221 

222Use the regional host name with the normal `/v1` API path, such as `https://southcentralus.privatelink.api.openai.com/v1`.

223 

224### Can AWS or Google Cloud workloads connect through Private Link?

225 

226Not directly. Private Link connectivity is Azure-specific. Workloads in AWS or Google Cloud can connect only through customer-managed networking into Azure, such as an Azure proxy or cross-cloud private connectivity pattern, and then from Azure to OpenAI over Azure Private Link.

227 

228### Does Private Link change authentication?

229 

230No. Private Link changes only the network path. Requests still need normal OpenAI API authentication and authorization.

231 

232### Does Private Link support every OpenAI API?

233 

234No. Support depends on whether an API is available on every backing cluster for the selected regional rail. Use the compatibility matrix as a starting point, then test each API surface and model you need in every target region.