Docs

Torch Object Storage

Converged access points (CAP)

Overview

To more efficiently manage access to TOS resources, TOS introduces the converged access point feature. This topic provides an overview of the feature, its use cases, and its constraints and limitations.

tip

This feature is currently in closed beta. Please contact your account manager for access.

Introduction

A converged access point (CAP) is a type of endpoint provided by TOS. With a converged access point, you can consolidate resource scope, access network, access domains, and access protocol configurations. The platform orchestrates virtual private cloud (VPC) endpoints, PrivateZone, and DNS records on the back end.

A converged access point allows you to combine configurations across the following dimensions:

Dimension	Description
Resource scope	The scope of the resources that are accessible through the converged access point. You can select a specific bucket, any bucket, or any ObjectSet.
Access network	The access network for converged access point. Options include public network, shared private network, and VPC.
Access domain	The access domain for the converged access point. Options include public domain names, intranet domain names, and custom endpoints.
Access protocol	The access protocol used by the converged access point. Options include the TOS protocol and the S3 protocol.

Use cases

Use case	Description	Recommended configuration
Unified access across buckets	A converged access point can serve as a private endpoint for multiple buckets. This eliminates the need to maintain separate endpoints for each bucket. The access point is on a private network, but the DNS is public.	Resource scope: Specified bucket(s)
Account-wide bucket access	You can use one converged access point to access any bucket under your account, where the bucket set changes dynamically.	Resource scope: Any bucket
Dedicated domain for ObjectSet	You can use converged access points as dedicated access points for ObjectSets. This exposes objects that share a specific prefix within a bucket as standalone logical resources accessible via their own domain.	Resource scope: Any ObjectSet
Private access from VPC	With a converged access point, you can access TOS resources within a designated VPC without going through the Internet.	IP address type: Private or shared address
Access via custom domain	With a converged access point, you can use your own domain to access TOS resources.	Access domain: Custom endpoint
Isolated access per VPC	You can attach different VPCs to the same access point. Each VPC can have its own custom domain to enable isolated private access and distinct entry points.	Access domain: Custom endpoint

Notes

Category	Description
Network	Public access points only support public domains. Private domains are not supported.
Domain name	ObjectSets can only use converged access points for dedicated access. For more information, see Configuring access domains. Custom domains must meet requirements for domain ownership verification, Internet content provider (ICP) filing, and certificate validity. Access domains for access points within a VPC cannot be the same under the same account, which can cause resolution failures. Custom domains reused by other access points cannot be deleted directly.
Access point	Once you create an access point, you cannot delete it. An access point only becomes effective once the configuration process is complete and the status changes to "Ready". Do not modify the access point while its status is "Updating", as this may cause requests to be rejected and make troubleshooting more difficult. When creating an access point for specific buckets, make sure the selected bucket set does not overlap with those of other access points. Otherwise, creation will fail. The options available for creating an access point may vary by region and site. Refer to the information displayed in the console. The access point itself does not store object data. Rather, it serves as an entry point that routes traffic to the underlying buckets or ObjectSets. Object data is stored in the corresponding TOS buckets.

FAQ

What should I do if the status of an access point stays on "Updating" for a long time?

If it does not return to normal, first check the following:

Whether a VPC endpoint was recently created.

Whether the VPC and subnet are valid.

Whether PrivateZone associations have recently been modified.

Whether the custom domain or certificate is abnormal.

Whether the current region supports the selected capabilities.

If the issue persists after troubleshooting, record the following information: account, region, access point name, time of the most recent operation, and any error messages displayed on the page. Then, contact technical support. During the troubleshooting process, avoid repeatedly resubmitting the same configuration to prevent interference with backend resource synchronization.

What should I do if I receive a message saying that the access point is not ready?

This means the access point is still synchronizing the previous configuration and cannot support further operations. Go back to the details page and wait for the status to change to Ready before trying again.

What should I do if a VPC selection conflict occurs?

If a conflict is reported, check if another access point with the same access domain is already associated with that VPC under the same account and region.

If both access points have specific buckets selected as resource scope, verify that the bucket lists do not overlap. The system rejects configurations with overlapping buckets. Adjust the associated VPC, access domain, or bucket scope for the access point, and then try again.

What should I do if the custom domain verification fails?

If the custom domain verification fails, check the following:

Whether the TXT host record is complete.

Whether the TXT record value contains extra spaces, quotation marks, or other invalid characters.

Whether the DNS record has propagated.

Whether the verification information has expired.

Whether you have obtained an ICP license for the domain.

Whether the domain is in use by another access point.

What should I do if the certificate status is abnormal?

An abnormal certificate status is usually caused by one of the following:

No certificate bound.

The certificate has expired.

The certificate does not exist or has been deleted.

Your account does not have access permissions to the certificate.

The certificate does not cover the your domain.

Make sure the certificate is valid and exists, and that your account has the necessary permissions. If you are using a custom domain, verify that the selected certificate covers your domain.

What should I do if the domain resolves correctly but access fails?

If the domain resolves correctly, but you cannot access the access point, check the following:

Whether the access point is Ready.

Whether the access protocol used by the client matches the access point configuration.

For private access, confirm that the client is within the associated VPC.

For private address access, check if the VPC endpoint covers the availability zone where the client resides.

Whether the local or client DNS cache still points to an old address.

Whether the signature region, system time, and access credentials in the client request are correct.

Last updated: 2026.08.31 18:16:35