nebius · nebius-devtools · Feb 5, 2026 · Feb 5, 2026
diff --git a/nebius/audit/v2/audit_event.proto b/nebius/audit/v2/audit_event.proto
@@ -28,7 +28,8 @@ message AuditEvent {
   // Version of CloudEvents spec. See https://github.com/cloudevents/spec/blob/main/cloudevents/spec.md#specversion
   string spec_version = 3 [(buf.validate.field).required = true];
 
-  // The type of event related to the originating occurrence. Formed according to template: `ai.nebius.<serviceName>.<resourceType>.<action>`
+  // The type of event related to the originating occurrence. Formed according to template:
+  // `ai.nebius.<serviceName>.<resourceType>.<action>`
   string type = 4 [(buf.validate.field).required = true];
 
   // Indicates the service that generated the event.

diff --git a/nebius/audit/v2/audit_event_export.proto b/nebius/audit/v2/audit_event_export.proto
@@ -94,6 +94,10 @@ message AuditEventExportParams {
 message AuditEventExportStatus {
   // Current state of audit logs export.
   AuditEventExportState state = 1;
+
+  // Identifier of the audit logs export operation.
+  // This value is used as the final path prefix for exported files in the destination object storage bucket.
+  string export_operation_id = 2;
 }
 
 enum AuditEventExportState {

diff --git a/nebius/audit/v2/authorization.proto b/nebius/audit/v2/authorization.proto
@@ -8,6 +8,7 @@ option java_outer_classname = "AuthorizationProto";
 option java_package = "ai.nebius.pub.audit.v2";
 
 message Authorization {
-  // Field is required. We do not use «(buf.validate.field).required = true» here as false value considered as unset (validation violation)
+  // Field is required. We do not use `(buf.validate.field).required = true` here as false value
+  // considered as unset (validation violation)
   bool authorized = 1;
 }
diff --git a/nebius/common/v1/operation.proto b/nebius/common/v1/operation.proto
@@ -33,7 +33,8 @@ message Operation {
   // The request that generated this operation.
   google.protobuf.Any request = 6;
 
-  // Request header is a container for all the values of a particular header of a request because there is no such thing as `map<string, repeated string>`
+  // Request header is a container for all the values of a particular header of a request because there is no such thing as
+  // `map<string, repeated string>`
   message RequestHeader {
     // The values of a particular header from a request
     repeated string values = 1;
@@ -76,7 +77,8 @@ message Operation {
   // the operation is running and after it has been completed.
   ProgressTracker progress_tracker = 12;
 
-  // Extra information about this operation's progress. MAY be absent while the operation is running, MUST be absent after the operation has completed.
+  // Extra information about this operation's progress. MAY be absent while the operation is running, MUST be absent after the operation has
+  // completed.
   //
   // Type of message that's stored inside [progress_data] is service-dependent.
   google.protobuf.Any progress_data = 9;

diff --git a/nebius/common/v1/resource_event.proto b/nebius/common/v1/resource_event.proto
@@ -12,7 +12,8 @@ option java_multiple_files = true;
 option java_outer_classname = "ResourceEventProto";
 option java_package = "ai.nebius.pub.common.v1";
 
-// Represents an API Resource-related event which is potentially important to the end-user. What exactly constitutes an *event* to be reported is service-dependent
+// Represents an API Resource-related event which is potentially important to the end-user. What exactly constitutes an *event* to be
+// reported is service-dependent
 message ResourceEvent {
   // Time at which the event has occurred
   google.protobuf.Timestamp occurred_at = 1 [(buf.validate.field).required = true];
@@ -23,10 +24,13 @@ message ResourceEvent {
   // Event code (unique within the API service), in UpperCamelCase, e.g. `"DiskAttached"`
   string code = 3 [(buf.validate.field).required = true];
 
-  // A human-readable message describing what has happened (and suggested actions for the user, if this is a `WARN`- or `ERROR`-level event)
+  // A human-readable message describing what has happened
+  // (and suggested actions for the user, if this is a `WARN` or `ERROR` level event)
   string message = 4 [(buf.validate.field).required = true];
 
-  // Describes a GRPC error status associated with an `ERROR`- or `WARN`-level event, if known. The `error` **must** have a standard GRPC `code` (which **must not** be `OK` (0)) and a human-readable `message`. A standard `common.v1.ServiceError` **should** also be included in `details`
+  // Describes a GRPC error status associated with an `ERROR` or `WARN` level event, if known. The `error` **must** have a standard GRPC
+  // `code` (which **must not** be `OK` (0)) and a human-readable `message`. A standard `common.v1.ServiceError` **should** also be
+  // included in `details`
   google.rpc.Status error = 10 [(field_behavior) = MEANINGFUL_EMPTY_VALUE];
 
   enum Level {
@@ -39,7 +43,8 @@ message ResourceEvent {
     // A normal event or state change. Informs what is happening with the API resource. Does not require user attention or interaction
     INFO = 2;
 
-    // Warning event. Indicates a potential or minor problem with the API resource and/or the corresponding processes. Needs user attention, but requires no immediate action (yet)
+    // Warning event. Indicates a potential or minor problem with the API resource and/or the corresponding processes. Needs user attention,
+    // but requires no immediate action (yet)
     WARN = 3;
 
     // Error event. Indicates a serious problem with the API resource and/or the corresponding processes. Requires immediate user action

diff --git a/nebius/common/v1/warning.proto b/nebius/common/v1/warning.proto
@@ -0,0 +1,83 @@
+syntax = "proto3";
+
+package nebius.common.v1;
+
+option go_package = "github.com/nebius/gosdk/proto/nebius/common/v1";
+option java_multiple_files = true;
+option java_outer_classname = "WarningProto";
+option java_package = "ai.nebius.pub.common.v1";
+
+message Warnings {
+  // List of warnings associated with the response.
+  repeated Warning warnings = 1;
+}
+
+message Warning {
+  // Target client or tool for which this warning is intended.
+  Target target = 1;
+
+  // Warning category.
+  Code code = 2;
+
+  // User-facing summary text. Can contain a liquid format template which must be executed on client side.
+  // Empty means use summary_fallback.
+  string summary = 3;
+
+  // Summary text to use when summary is empty or not applicable.
+  // Can contain a liquid format template which must be executed on client side.
+  string summary_fallback = 4;
+
+  // User-facing details text. Can contain a liquid format template which must be executed on client side.
+  // Empty means use details_fallback.
+  string details = 5;
+
+  // Details text to use when details is empty or not applicable.
+  // Can contain a liquid format template which must be executed on client side.
+  string details_fallback = 6;
+
+  // Contains a Full Service/Method name or a select mask for a field.
+  // Examples:
+  //   nebius.compute.v1.InstanceService
+  //   nebius.compute.v1.InstanceService/Get
+  //   spec.control_plane.version
+  //   spec.network_interfaces.0.subnet_id
+  //   items.0.spec.control_plane.version
+  string path = 7;
+
+  enum Target {
+    // Target is not specified.
+    TARGET_UNSPECIFIED = 0;
+
+    // Warning is intended for CLI users.
+    TARGET_CLI = 1;
+
+    // Warning is intended for Terraform provider users.
+    TARGET_TF = 2;
+
+    // Warning is intended for console users.
+    TARGET_CONSOLE = 3;
+  }
+
+  enum Code {
+    // Code is not specified.
+    CODE_UNSPECIFIED = 0;
+
+    // The request was served via failover routing.
+    CODE_REGION_ROUTING_FAILOVER = 1;
+
+    // Client tool version is deprecated.
+    CODE_DEPRECATED_TOOL_VERSION = 2;
+
+    // Endpoint is deprecated.
+    CODE_DEPRECATED_ENDPOINT = 3;
+
+    // Proto field, message or service is deprecated.
+    CODE_DEPRECATED_PROTO = 4;
+
+    // Deprecated value was used in the request.
+    CODE_DEPRECATED_SPEC_VALUE_REQUEST = 5;
+
+    // Deprecated value was observed in the response.
+    CODE_DEPRECATED_SPEC_VALUE_RESPONSE = 6;
+  }
+}
diff --git a/nebius/compute/v1/image_service.proto b/nebius/compute/v1/image_service.proto
@@ -34,6 +34,9 @@ service ImageService {
   // Creates a new image resource.
   rpc Create(CreateImageRequest) returns (common.v1.Operation);
 
+  // Deletes an existing image resource by its ID.
+  rpc Delete(DeleteImageRequest) returns (common.v1.Operation);
+
   // Lists all operations that were performed within a specific parent resource.
   rpc ListOperationsByParent(ListOperationsByParentRequest) returns (common.v1.ListOperationsResponse);
 
@@ -76,6 +79,10 @@ message CreateImageRequest {
   ImageSpec spec = 2;
 }
 
+message DeleteImageRequest {
+  string id = 1;
+}
+
 message ListImagesResponse {
   repeated Image items = 1;
 

diff --git a/nebius/compute/v1/instance.proto b/nebius/compute/v1/instance.proto
@@ -62,10 +62,12 @@ message InstanceSpec {
   // Indicates whether the instance should be stopped.
   bool stopped = 13;
 
-  // Recovery policy defines how the instance will be treated in case of a failure. Common source of failure is a host failure, but it can be any other failure.
-  // Instance undergoing a guest shutdown (poweroff, etc.) will be subject to recovery policy, meaning that it could be restarted and billed accordingly. Stop instance via API or UI to stop it to avoid recovering.
-  // If set to RECOVER, instance will be restarted, if possible. It could be restarted on the same host or on another host.
-  // If set to FAIL, instance will be stopped and not restarted.
+  // Recovery policy defines how the instance will be treated in case of a failure.
+  // Common source of failure is a host failure, but it can be any other failure.
+  // Instance undergoing a guest shutdown (poweroff, etc.) will be subject to recovery policy, meaning that it could
+  // be restarted and billed accordingly. Stop instance via API or UI to stop it to avoid recovering.
+  // - If set to RECOVER, instance will be restarted, if possible. It could be restarted on the same host or on another host.
+  // - If set to FAIL, instance will be stopped and not restarted.
   InstanceRecoveryPolicy recovery_policy = 15 [(field_behavior) = IMMUTABLE];
 
   // Include these parameters to create a Preemptible VM and omit them to create a Regular VM

diff --git a/nebius/compute/v1alpha1/instance.proto b/nebius/compute/v1alpha1/instance.proto
@@ -49,10 +49,13 @@ message InstanceSpec {
 
   bool stopped = 13;
 
-  // Recovery policy defines how the instance will be treated in case of a failure. Common source of failure is a host failure, but it can be any other failure.
-  // Instance undergoing a guest shutdown (poweroff, etc.) will be subject to recovery policy, meaning that it could be restarted and billed accordingly. Stop instance via API or UI to stop it to avoid recovering.
-  // If set to RECOVER, instance will be restarted, if possible. It could be restarted on the same host or on another host.
-  // If set to FAIL, instance will be stopped and not restarted.
+  // Recovery policy defines how the instance will be treated in case of a failure.
+  // Common source of failure is a host failure, but it can be any other failure.
+  // Instance undergoing a guest shutdown (poweroff, etc.) will be subject to recovery policy,
+  // meaning that it could be restarted and billed accordingly.
+  // Stop instance via API or UI to stop it to avoid recovering.
+  // - If set to RECOVER, instance will be restarted, if possible. It could be restarted on the same host or on another host.
+  // - If set to FAIL, instance will be stopped and not restarted.
   InstanceRecoveryPolicy recovery_policy = 15 [(field_behavior) = IMMUTABLE];
 }
 

diff --git a/nebius/dns/v1/record.proto b/nebius/dns/v1/record.proto
@@ -59,7 +59,9 @@ message RecordSpec {
 
   // Record data in text format
   //
-  // This should be the RDATA part of this Resource Record's [presentation (zonefile) format](https://datatracker.ietf.org/doc/html/rfc9499#name-resource-records). E.g., `10 xyz.tuv` for a `@ 600 IN MX 10 xyz.tuv.` resource record in a zonefile
+  // This should be the RDATA part of this Resource Record's
+  // [presentation (zonefile) format](https://datatracker.ietf.org/doc/html/rfc9499#name-resource-records).
+  // E.g., `10 xyz.tuv` for a `@ 600 IN MX 10 xyz.tuv.` resource record in a zonefile
   string data = 4 [(buf.validate.field).required = true];
 
   // Mark this record as delete-protected
@@ -104,7 +106,8 @@ message RecordSpec {
     // `SVCB` record: service binding. See [RFC 9460, section 2.3](https://www.rfc-editor.org/rfc/rfc9460.html#section-2.3)
     SVCB = 11;
 
-    // `HTTPS` record: service binding with HTTPS protocol configuration. See [RFC 9460, section 9.1](https://www.rfc-editor.org/rfc/rfc9460.html#section-9.1)
+    // `HTTPS` record: service binding with HTTPS protocol configuration.
+    // See [RFC 9460, section 9.1](https://www.rfc-editor.org/rfc/rfc9460.html#section-9.1)
     HTTPS = 12;
   }
 }
@@ -132,7 +135,8 @@ message GetRecordRequest {
   ];
 
   // Optional: expected record version (`metadata.resource_version`)
-  // - If specified, the requested version will be returned if possible (if the version has changed, you will get a `FAILED_PRECONDITION` error)
+  // - If specified, the requested version will be returned if possible
+  //   (if the version has changed, you will get a `FAILED_PRECONDITION` error)
   // - If not specified or set to `0`, the latest version will be returned
   int64 resource_version = 2 [(buf.validate.field) = {
     int64: {gte: 0}

diff --git a/nebius/dns/v1/zone.proto b/nebius/dns/v1/zone.proto
@@ -13,9 +13,12 @@ option java_package = "ai.nebius.pub.dns.v1";
 
 // API Resource: *DNS zone*, a container for DNS data
 //
-// Each DNS zone starts at a particular domain within the hierarchical DNS namespace tree, e.g., `example.com.`, and can also include its subdomains, e.g., `sales.example.com.`
-// DNS Zones contain *Resource Records* (RRs), which are individual information entries about the domain(s), e.g., a domain's IP address
-// See the [graphical explanation of DNS zones and Resource Records on Wikipedia](https://en.wikipedia.org/wiki/Domain_Name_System#/media/File:Domain_name_space.svg)
+// Each DNS zone starts at a particular domain within the hierarchical DNS namespace tree,
+// e.g., `example.com.`, and can also include its subdomains,
+// e.g., `sales.example.com.` DNS Zones contain *Resource Records* (RRs), which are individual information entries about the domain(s),
+// e.g., a domain's IP address
+// See the [graphical explanation of DNS zones and Resource Records on
+// Wikipedia](https://en.wikipedia.org/wiki/Domain_Name_System#/media/File:Domain_name_space.svg)
 //
 // A Resource Record is represented in this API by the `Record` API Resource which is managed by the `RecordService`
 message Zone {
@@ -100,7 +103,8 @@ message GetZoneRequest {
   ];
 
   // Optional: expected zone version (`metadata.resource_version`)
-  // - If specified, the requested version will be returned if possible (if the version has changed, you will get a `FAILED_PRECONDITION` error)
+  // - If specified, the requested version will be returned if possible (if the version has changed, you will get a `FAILED_PRECONDITION`
+  //   error)
   // - If not specified or set to `0`, the latest zone version will be returned
   int64 resource_version = 2 [(buf.validate.field) = {
     int64: {gte: 0}

diff --git a/nebius/iam/v1/federated_credentials.proto b/nebius/iam/v1/federated_credentials.proto
@@ -42,7 +42,7 @@ message OidcCredentialsProvider {
   //
   // Limitations for external OIDC providers:
   // - token service limits the number of handled keys by 50. If your JWKS return more than 50,
-  // the only first 50  will be used for signature verifying.
+  // the only first 50 will be used for signature verifying.
   // - response size for jwks_uri and "/.well-known/openid-configuration limited by 100KB.
   string issuer_url = 1 [(buf.validate.field).required = true];
 

diff --git a/nebius/iam/v1/tenant_user_account.proto b/nebius/iam/v1/tenant_user_account.proto
@@ -99,15 +99,18 @@ message TenantUserAccountStatus {
   enum State {
     STATE_UNSPECIFIED = 0;
 
-    // in case of ordinary tenant user account a corresponding user can log into the system and use granted tenant resources
-    // in case of invited tenant user account once the invitation is accepted a corresponding user can start using granted resources immediately
+    // - in case of ordinary tenant user account a corresponding user can log into the system and use granted tenant resources
+    // - in case of invited tenant user account once the invitation is accepted a corresponding user can start using granted resources
+    //   immediately
     ACTIVE = 1;
 
     // unused
     INACTIVE = 2;
 
-    // in case of ordinary tenant user account a corresponding user can log into the system but cannot be authorized to use tenant resources
-    // in case of invited tenant user account once the invitation is accepted a corresponding user cannot start using granted resources until is unblocked
+    // - in case of ordinary tenant user account a corresponding user can log into the system but cannot be authorized to use tenant
+    //   resources
+    // - in case of invited tenant user account once the invitation is accepted a corresponding user cannot start using granted resources
+    //   until is unblocked
     BLOCKED = 3;
   }
 
@@ -117,7 +120,8 @@ message TenantUserAccountStatus {
   // once invitation is accepted it looses this reference (and internally gets a reference to their global federated user account)
   string invitation_id = 2;
 
-  // the federation id of the linked user account. Could be empty in a case of a tenant user account belongs to an invitation which wasn't accepted.
+  // the federation id of the linked user account. Could be empty in a case of a tenant user account belongs to an invitation which wasn't
+  // accepted.
   string federation_id = 3;
 
   // user account state can help distinguish case when account is blocked globally

diff --git a/nebius/iam/v1/token_service.proto b/nebius/iam/v1/token_service.proto
@@ -23,9 +23,12 @@ message ExchangeTokenRequest {
 
   string audience = 6; // optional, name of the oauth client id on which this token will be used
 
-  string actor_token = 7 [(credentials) = true]; // optional, subject token for impersonation/delegation (who want to impersonate/delegate) in subject_token.
+  // optional, subject token for impersonation/delegation (who want to impersonate/delegate) in subject_token.
+  string actor_token = 7 [(credentials) = true];
 
-  string actor_token_type = 8; // optional, token type for the impersonation/delegation (who want to impersonate/delegate). Usually it's urn:ietf:params:oauth:token-type:access_token
+  // optional, token type for the impersonation/delegation (who want to impersonate/delegate). Usually it's
+  // urn:ietf:params:oauth:token-type:access_token
+  string actor_token_type = 8;
 
   repeated string resource = 9; // optional, list of resources approved to use by token, if applicable
 }

diff --git a/nebius/iam/v1/user_account.proto b/nebius/iam/v1/user_account.proto
@@ -25,7 +25,8 @@ message UserAccountStatus {
     // federated user can be blocked (manually or by any specific automated process), in this state user cannot log into the system
     INACTIVE = 2;
 
-    // federated user can be deleted/forgot, in this state user cannot log into the system and various internal removal interactions are in progress
+    // federated user can be deleted/forgot, in this state user cannot log into the system and various internal removal interactions are in
+    // progress
     DELETING = 3;
   }
 

diff --git a/nebius/iam/v2/access_key.proto b/nebius/iam/v2/access_key.proto
@@ -30,7 +30,8 @@ message AccessKeySpec {
 
   string description = 3;
 
-  // Specifies how the secret will be delivered upon creation. This field is immutable — it cannot be changed after the resource is created.
+  // Specifies how the secret will be delivered upon creation. This field is immutable — it cannot be changed after the resource is
+  // created.
   SecretDeliveryMode secret_delivery_mode = 4 [(field_behavior) = IMMUTABLE];
 }
 

diff --git a/nebius/logging/v1/agentmanager/version_service.proto b/nebius/logging/v1/agentmanager/version_service.proto
@@ -168,7 +168,11 @@ message OSInfo {
   string name = 1;
 
   // Detailed system information from uname command.
-  // Example: "Linux computeimage-abcdef 6.5.0-44-generic #44~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 18 14:36:16 UTC 2 x86_64 x86_64 x86_64 GNU/Linux"
+  //
+  // Example:
+  // ```
+  // Linux computeimage-abcdef 6.5.0-44-generic #44~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 18 14:36:16 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
+  // ```
   string uname = 2;
 
   // System architecture.