Skip to main content

Regions Overview

Use this page when you need one public reference for how Keeptrusts talks about region and locality today.

Start with the requested region​

The most important region concept is the requested region: the region your current CLI invocation, gateway workflow, or published endpoint is trying to use right now.

Other region-related values may exist at the same time:

  • Profile default region: the region stored for a named CLI profile in ~/.keeptrusts/config.yaml.
  • Process-wide override: kt --region <region> sets KEEPTRUSTS_REGION for the current CLI process.
  • Published-endpoint locality: the hostname you use for a Keeptrusts-managed public endpoint determines locality and publication routing.
  • Resource home region: some resources or provider targets only exist in one region. If your requested region does not match, the result can look empty or unavailable rather than globally aggregated.

Set a default region for a CLI profile​

The CLI stores profile defaults in ~/.keeptrusts/config.yaml.

kt configure set region eu-west --profile default
kt configure get region --profile default
kt configure list-profiles

kt regions use <region> and kt regions switch <region> still work, but they are aliases for writing the same profile-scoped default region.

Inspect the active region​

Use these commands to inspect what the CLI can see and what it will use:

kt regions list
kt regions list --json
kt regions list --enabled
kt regions list --group eu
kt regions current
kt regions status

kt regions current prints:

  • the resolved region
  • the source that won
  • the resolved API endpoint
  • whether the current scope is global or regional

Current CLI precedence​

For the current kt regions current CLI behavior, region resolution is:

  1. process-wide override from kt --region <region> or KEEPTRUSTS_REGION
  2. profiles.<profile>.default_region in ~/.keeptrusts/config.yaml
  3. the legacy root-level default_region field in the same file

The API endpoint is resolved separately from the usual CLI config chain:

  1. --api-url
  2. KEEPTRUSTS_API_URL
  3. api_url in ~/.keeptrusts/config.yaml
  4. https://api.keeptrusts.com
Declarative-config precedence

~/.keeptrusts/config.yaml controls the requested region used by API-backed CLI commands. policy-config.yaml stays authoritative for gateway runtime and provider locality, and a published hostname keeps its own locality binding. If those disagree, fix the declarative config or hostname instead of expecting the CLI profile default to rewrite runtime routing.

Region behavior

Keeptrusts does not treat "nearby" or same-family regions as interchangeable by default. When a workflow depends on a specific region or locality, the product fails closed instead of silently switching regions for you.

Console availability​

The current customer console does not provide a Settings → Regions page or a browser-session region selector. Use the CLI commands above to inspect and change a profile's requested region. For managed public endpoints, choose the hostname whose locality matches the workload; the console does not rewrite that binding.

Managed public endpoints​

For Keeptrusts-managed public endpoints, the hostname you choose changes locality and publication routing without changing the auth model.

Examples:

  • *.ai.global.keeptrusts.com
  • *.ai.eu.keeptrusts.com
  • *.ai.us.keeptrusts.com

Use Unified Access when you need the current public hostname and locality model.

When the wrong region looks like a missing resource​

Start with these checks:

  1. Run kt regions current.
  2. Confirm the resolved API endpoint is the one you intended to use.
  3. Confirm the resource or provider target actually exists in that region.
  4. If you are using a published hostname, confirm the hostname's locality matches the workload you expect.

Next steps​