diff --git a/bluemix/configuration/core_config/bx_config.go b/bluemix/configuration/core_config/bx_config.go
index 0707d95a..d43228c9 100644
--- a/bluemix/configuration/core_config/bx_config.go
+++ b/bluemix/configuration/core_config/bx_config.go
@@ -24,12 +24,15 @@ func (r raw) Unmarshal(bytes []byte) error {
 
 type BXConfigData struct {
 	APIEndpoint                 string
+	IsPrivate                   bool
 	ConsoleEndpoint             string
+	ConsolePrivateEndpoint      string
 	CloudType                   string
 	CloudName                   string
 	Region                      string
 	RegionID                    string
 	IAMEndpoint                 string
+	IAMPrivateEndpoint          string
 	IAMToken                    string
 	IAMRefreshToken             string
 	Account                     models.Account
@@ -43,7 +46,7 @@ type BXConfigData struct {
 	Trace                       string
 	ColorEnabled                string
 	HTTPTimeout                 int
-	CLIInfoEndpoint             string
+	CLIInfoEndpoint             string // overwrite the cli info endpoint
 	CheckCLIVersionDisabled     bool
 	UsageStatsDisabled          bool // deprecated: use UsageStatsEnabled
 	UsageStatsEnabled           bool
@@ -154,6 +157,13 @@ func (c *bxConfig) APIEndpoint() (endpoint string) {
 	return
 }
 
+func (c *bxConfig) IsPrivateEndpointEnabled() (isPrivate bool) {
+	c.read(func() {
+		isPrivate = c.data.IsPrivate
+	})
+	return
+}
+
 func (c *bxConfig) HasAPIEndpoint() bool {
 	return c.APIEndpoint() != ""
 }
@@ -165,9 +175,10 @@ func (c *bxConfig) IsSSLDisabled() (disabled bool) {
 	return
 }
 
-func (c *bxConfig) ConsoleEndpoint() (endpoint string) {
+func (c *bxConfig) ConsoleEndpoints() (endpoints models.Endpoints) {
 	c.read(func() {
-		endpoint = c.data.ConsoleEndpoint
+		endpoints.PublicEndpoint = c.data.ConsoleEndpoint
+		endpoints.PrivateEndpoint = c.data.ConsolePrivateEndpoint
 	})
 	return
 }
@@ -201,9 +212,10 @@ func (c *bxConfig) CloudType() (ctype string) {
 	return
 }
 
-func (c *bxConfig) IAMEndpoint() (endpoint string) {
+func (c *bxConfig) IAMEndpoints() (endpoints models.Endpoints) {
 	c.read(func() {
-		endpoint = c.data.IAMEndpoint
+		endpoints.PublicEndpoint = c.data.IAMEndpoint
+		endpoints.PrivateEndpoint = c.data.IAMPrivateEndpoint
 	})
 	return
 }
@@ -419,9 +431,16 @@ func (c *bxConfig) SetAPIEndpoint(endpoint string) {
 	})
 }
 
-func (c *bxConfig) SetConsoleEndpoint(endpoint string) {
+func (c *bxConfig) SetPrivateEndpointEnabled(isPrivate bool) {
+	c.write(func() {
+		c.data.IsPrivate = isPrivate
+	})
+}
+
+func (c *bxConfig) SetConsoleEndpoints(endpoint models.Endpoints) {
 	c.write(func() {
-		c.data.ConsoleEndpoint = endpoint
+		c.data.ConsoleEndpoint = endpoint.PublicEndpoint
+		c.data.ConsolePrivateEndpoint = endpoint.PrivateEndpoint
 	})
 }
 
@@ -432,9 +451,10 @@ func (c *bxConfig) SetRegion(region models.Region) {
 	})
 }
 
-func (c *bxConfig) SetIAMEndpoint(endpoint string) {
+func (c *bxConfig) SetIAMEndpoints(endpoints models.Endpoints) {
 	c.write(func() {
-		c.data.IAMEndpoint = endpoint
+		c.data.IAMEndpoint = endpoints.PublicEndpoint
+		c.data.IAMPrivateEndpoint = endpoints.PrivateEndpoint
 	})
 }
 
@@ -600,10 +620,14 @@ func (c *bxConfig) ClearSession() {
 func (c *bxConfig) UnsetAPI() {
 	c.write(func() {
 		c.data.APIEndpoint = ""
+		c.data.SSLDisabled = false
+		c.data.IsPrivate = false
 		c.data.Region = ""
 		c.data.RegionID = ""
 		c.data.ConsoleEndpoint = ""
+		c.data.ConsolePrivateEndpoint = ""
 		c.data.IAMEndpoint = ""
+		c.data.IAMPrivateEndpoint = ""
 		c.data.CloudName = ""
 		c.data.CloudType = ""
 	})
diff --git a/bluemix/configuration/core_config/cf_config.go b/bluemix/configuration/core_config/cf_config.go
index db1c6a3a..f759d527 100644
--- a/bluemix/configuration/core_config/cf_config.go
+++ b/bluemix/configuration/core_config/cf_config.go
@@ -167,6 +167,13 @@ func (c *cfConfig) APIEndpoint() (endpoint string) {
 	return
 }
 
+func (c *cfConfig) AsyncTimeout() (timeout uint) {
+	c.read(func() {
+		timeout = c.data.AsyncTimeout
+	})
+	return
+}
+
 func (c *cfConfig) HasAPIEndpoint() (hasEndpoint bool) {
 	c.read(func() {
 		hasEndpoint = c.data.APIVersion != "" && c.data.Target != ""
diff --git a/bluemix/configuration/core_config/repository.go b/bluemix/configuration/core_config/repository.go
index fbee2307..98341427 100644
--- a/bluemix/configuration/core_config/repository.go
+++ b/bluemix/configuration/core_config/repository.go
@@ -13,8 +13,9 @@ import (
 type Repository interface {
 	APIEndpoint() string
 	HasAPIEndpoint() bool
-	ConsoleEndpoint() string
-	IAMEndpoint() string
+	IsPrivateEndpointEnabled() bool
+	ConsoleEndpoints() models.Endpoints
+	IAMEndpoints() models.Endpoints
 	CloudName() string
 	CloudType() string
 	CurrentRegion() models.Region
@@ -57,8 +58,9 @@ type Repository interface {
 
 	UnsetAPI()
 	SetAPIEndpoint(string)
-	SetConsoleEndpoint(string)
-	SetIAMEndpoint(string)
+	SetPrivateEndpointEnabled(bool)
+	SetConsoleEndpoints(models.Endpoints)
+	SetIAMEndpoints(models.Endpoints)
 	SetCloudType(string)
 	SetCloudName(string)
 	SetRegion(models.Region)
@@ -103,6 +105,8 @@ type ReadWriter interface {
 type CFConfig interface {
 	APIVersion() string
 	APIEndpoint() string
+	AsyncTimeout() uint
+	ColorEnabled() string
 	HasAPIEndpoint() bool
 	AuthenticationEndpoint() string
 	UAAEndpoint() string
@@ -114,9 +118,11 @@ type CFConfig interface {
 	Username() string
 	UserGUID() string
 	UserEmail() string
+	Locale() string
 	LoginAt() time.Time
 	IsLoggedIn() bool
 	SetLoginAt(loginAt time.Time)
+	Trace() string
 	UAAToken() string
 	UAARefreshToken() string
 	CurrentOrganization() models.OrganizationFields
diff --git a/bluemix/endpoints/endpoints.go b/bluemix/endpoints/endpoints.go
new file mode 100644
index 00000000..dc307ee0
--- /dev/null
+++ b/bluemix/endpoints/endpoints.go
@@ -0,0 +1,89 @@
+package endpoints
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/models"
+)
+
+type Service string
+
+const (
+	GlobalSearch       Service = "global-search"
+	GlobalTagging      Service = "global-tagging"
+	AccountManagement  Service = "account-management"
+	UserManagement     Service = "user-management"
+	Billing            Service = "billing"
+	Enterprise         Service = "enterprise"
+	ResourceController Service = "resource-controller"
+	ResourceCatalog    Service = "global-catalog"
+)
+
+func (s Service) String() string {
+	return string(s)
+}
+
+var endpointsMapping = map[Service]models.Endpoints{
+	GlobalSearch: models.Endpoints{
+		PublicEndpoint:  "https://api.global-search-tagging.<cloud_domain>",
+		PrivateEndpoint: "https://api.private.<region>.global-search-tagging.<cloud_domain>",
+	},
+	GlobalTagging: models.Endpoints{
+		PublicEndpoint:  "https://tags.global-search-tagging.<cloud_domain>",
+		PrivateEndpoint: "https://tags.private.<region>.global-search-tagging.<cloud_domain>",
+	},
+	AccountManagement: models.Endpoints{
+		PublicEndpoint:  "https://accounts.<cloud_domain>",
+		PrivateEndpoint: "https://private.<region>.accounts.<cloud_domain>",
+	},
+	UserManagement: models.Endpoints{
+		PublicEndpoint:  "https://user-management.<cloud_domain>",
+		PrivateEndpoint: "https://private.<region>.user-management.<cloud_domain>",
+	},
+	Billing: models.Endpoints{
+		PublicEndpoint:  "https://billing.<cloud_domain>",
+		PrivateEndpoint: "https://private.<region>.billing.<cloud_domain>",
+	},
+	Enterprise: models.Endpoints{
+		PublicEndpoint:  "https://enterprise.<cloud_domain>",
+		PrivateEndpoint: "https://private.<region>.enterprise.<cloud_domain>",
+	},
+	ResourceController: models.Endpoints{
+		PublicEndpoint:  "https://resource-controller.<cloud_domain>",
+		PrivateEndpoint: "https://private.<region>.resource-controller.<cloud_domain>",
+	},
+	ResourceCatalog: models.Endpoints{
+		PublicEndpoint:  "https://globalcatalog.<cloud_domain>",
+		PrivateEndpoint: "https://private.<region>.globalcatalog.<cloud_domain>",
+	},
+}
+
+func Endpoint(svc Service, cloudDomain, region string, private bool) (string, error) {
+	var endpoint string
+	if endpoints, found := endpointsMapping[svc]; found {
+		if private {
+			endpoint = endpoints.PrivateEndpoint
+		} else {
+			endpoint = endpoints.PublicEndpoint
+		}
+	}
+	if endpoint == "" {
+		return "", fmt.Errorf("the endpoint of service '%s' was unknown", svc)
+	}
+
+	// replace <cloud_domain>
+	if cloudDomain == "" {
+		return "", fmt.Errorf("the cloud domain is empty")
+	}
+	endpoint = strings.ReplaceAll(endpoint, "<cloud_domain>", cloudDomain)
+
+	// replace <region>
+	if region != "" {
+		endpoint = strings.ReplaceAll(endpoint, "<region>", region)
+	} else if strings.Index(endpoint, "<region>") >= 0 {
+		return "", fmt.Errorf("region is required to get the endpoint of service '%s'", svc)
+	}
+
+	return endpoint, nil
+}
diff --git a/bluemix/endpoints/endpoints_test.go b/bluemix/endpoints/endpoints_test.go
new file mode 100644
index 00000000..6749c057
--- /dev/null
+++ b/bluemix/endpoints/endpoints_test.go
@@ -0,0 +1,68 @@
+package endpoints_test
+
+import (
+	"fmt"
+	"testing"
+
+	. "github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/endpoints"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEndpointUnknownService(t *testing.T) {
+	_, err := Endpoint(Service("unknown"), "cloud.ibm.com", "us-south", false)
+	assert.Error(t, err, "an error is expected")
+}
+
+func TestEndpointEmptyCloudDomain(t *testing.T) {
+	_, err := Endpoint(AccountManagement, "", "", false)
+	assert.Error(t, err, "an error is expected")
+}
+
+func TestEndpointPublic(t *testing.T) {
+	cloudDomain := "cloud.ibm.com"
+	region := ""
+	private := false
+
+	endpoints := map[Service]string{
+		GlobalSearch:       fmt.Sprintf("https://api.global-search-tagging.%s", cloudDomain),
+		GlobalTagging:      fmt.Sprintf("https://tags.global-search-tagging.%s", cloudDomain),
+		AccountManagement:  fmt.Sprintf("https://accounts.%s", cloudDomain),
+		UserManagement:     fmt.Sprintf("https://user-management.%s", cloudDomain),
+		Billing:            fmt.Sprintf("https://billing.%s", cloudDomain),
+		Enterprise:         fmt.Sprintf("https://enterprise.%s", cloudDomain),
+		ResourceController: fmt.Sprintf("https://resource-controller.%s", cloudDomain),
+		ResourceCatalog:    fmt.Sprintf("https://globalcatalog.%s", cloudDomain),
+	}
+	for svc, expected := range endpoints {
+		actual, err := Endpoint(svc, cloudDomain, region, private)
+		assert.NoError(t, err, "public endpoint of service '%s'", svc)
+		assert.Equal(t, expected, actual, "public endpoint of service '%s'", svc)
+	}
+}
+
+func TestEndpointPrivate(t *testing.T) {
+	cloudDomain := "cloud.ibm.com"
+	region := "us-south"
+	private := true
+
+	endpoints := map[Service]string{
+		GlobalSearch:       fmt.Sprintf("https://api.private.%s.global-search-tagging.%s", region, cloudDomain),
+		GlobalTagging:      fmt.Sprintf("https://tags.private.%s.global-search-tagging.%s", region, cloudDomain),
+		AccountManagement:  fmt.Sprintf("https://private.%s.accounts.%s", region, cloudDomain),
+		UserManagement:     fmt.Sprintf("https://private.%s.user-management.%s", region, cloudDomain),
+		Billing:            fmt.Sprintf("https://private.%s.billing.%s", region, cloudDomain),
+		Enterprise:         fmt.Sprintf("https://private.%s.enterprise.%s", region, cloudDomain),
+		ResourceController: fmt.Sprintf("https://private.%s.resource-controller.%s", region, cloudDomain),
+		ResourceCatalog:    fmt.Sprintf("https://private.%s.globalcatalog.%s", region, cloudDomain),
+	}
+	for svc, expected := range endpoints {
+		actual, err := Endpoint(svc, cloudDomain, region, private)
+		assert.NoError(t, err, "private endpoint of service '%s'", svc)
+		assert.Equal(t, expected, actual, "private endpoint of service '%s'", svc)
+	}
+}
+
+func TestEndpointPrivateNoRegion(t *testing.T) {
+	_, err := Endpoint(AccountManagement, "cloud.ibm.com", "", true)
+	assert.Error(t, err, "an error is expected")
+}
diff --git a/bluemix/env.go b/bluemix/env.go
index 997823cf..2d3b8702 100644
--- a/bluemix/env.go
+++ b/bluemix/env.go
@@ -5,25 +5,38 @@ import (
 )
 
 var (
-	EnvTrace        = newEnv("IBMCLOUD_TRACE", "BLUEMIX_TRACE")
-	EnvColor        = newEnv("IBMCLOUD_COLOR", "BLUEMIX_COLOR")
+	// EnvTrace is the environment variable `IBMCLOUD_TRACE` and `BLUEMIX_TRACE` (deprecated)
+	EnvTrace = newEnv("IBMCLOUD_TRACE", "BLUEMIX_TRACE")
+	// EnvColor is the environment variable `IBMCLOUD_COLOR` and `BLUEMIX_COLOR` (deprecated)
+	EnvColor = newEnv("IBMCLOUD_COLOR", "BLUEMIX_COLOR")
+	// EnvVersionCheck is the environment variable `IBMCLOUD_VERSION_CHECK` and `BLUEMIX_VERSION_CHECK` (deprecated)
 	EnvVersionCheck = newEnv("IBMCLOUD_VERSION_CHECK", "BLUEMIX_VERSION_CHECK")
-	EnvAnalytics    = newEnv("IBMCLOUD_ANALYTICS", "BLUEMIX_ANALYTICS")
-	EnvHTTPTimeout  = newEnv("IBMCLOUD_HTTP_TIMEOUT", "BLUEMIX_HTTP_TIMEOUT")
-	EnvAPIKey       = newEnv("IBMCLOUD_API_KEY", "BLUEMIX_API_KEY")
-	EnvConfigHome   = newEnv("IBMCLOUD_HOME", "BLUEMIX_HOME")
-	EnvConfigDir    = newEnv("IBMCLOUD_CONFIG_HOME")
-	EnvQuiet        = newEnv("IBMCLOUD_QUIET")
+	// EnvAnalytics is the environment variable `IBMCLOUD_ANALYTICS` and `BLUEMIX_ANALYTICS` (deprecated)
+	EnvAnalytics = newEnv("IBMCLOUD_ANALYTICS", "BLUEMIX_ANALYTICS")
+	// EnvHTTPTimeout is the environment variable `IBMCLOUD_HTTP_TIMEOUT` and `BLUEMIX_HTTP_TIMEOUT` (deprecated)
+	EnvHTTPTimeout = newEnv("IBMCLOUD_HTTP_TIMEOUT", "BLUEMIX_HTTP_TIMEOUT")
+	// EnvAPIKey is the environment variable `IBMCLOUD_API_KEY` and `BLUEMIX_API_KEY` (deprecated)
+	EnvAPIKey = newEnv("IBMCLOUD_API_KEY", "BLUEMIX_API_KEY")
+	// EnvConfigHome is the environment variable `IBMCLOUD_HOME` and `BLUEMIX_HOME` (deprecated)
+	EnvConfigHome = newEnv("IBMCLOUD_HOME", "BLUEMIX_HOME")
+	// EnvConfigDir is the environment variable `IBMCLOUD_CONFIG_HOME`
+	EnvConfigDir = newEnv("IBMCLOUD_CONFIG_HOME")
+	// EnvQuiet is the environment variable `IBMCLOUD_QUIET`
+	EnvQuiet = newEnv("IBMCLOUD_QUIET")
 
 	// for internal use
 	EnvCLIName         = newEnv("IBMCLOUD_CLI", "BLUEMIX_CLI")
 	EnvPluginNamespace = newEnv("IBMCLOUD_PLUGIN_NAMESPACE", "BLUEMIX_PLUGIN_NAMESPACE")
 )
 
+// Env is an environment variable supported by IBM Cloud CLI for specific purpose
+// An Env could be bound to multiple environment variables due to historical reasons (i.e. renaming)
+// Make sure you define the latest environment variable first
 type Env struct {
 	names []string
 }
 
+// Get will return the value of the environment variable, the first found non-empty value will be returned
 func (e Env) Get() string {
 	for _, n := range e.names {
 		if v := os.Getenv(n); v != "" {
@@ -33,6 +46,7 @@ func (e Env) Get() string {
 	return ""
 }
 
+// Set will set the value to **ALL** belonging environment variables
 func (e Env) Set(val string) error {
 	for _, n := range e.names {
 		if err := os.Setenv(n, val); err != nil {
diff --git a/bluemix/env_test.go b/bluemix/env_test.go
new file mode 100644
index 00000000..8df9bc88
--- /dev/null
+++ b/bluemix/env_test.go
@@ -0,0 +1,36 @@
+package bluemix_test
+
+import (
+	"os"
+	"testing"
+
+	. "github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGet(t *testing.T) {
+	assert.Empty(t, EnvTrace.Get())
+
+	os.Setenv("IBMCLOUD_TRACE", "true")
+	assert.Equal(t, "true", EnvTrace.Get())
+
+	os.Unsetenv("IBMCLOUD_TRACE")
+	assert.Empty(t, EnvTrace.Get())
+
+	os.Setenv("BLUEMIX_TRACE", "false")
+	assert.Equal(t, "false", EnvTrace.Get())
+
+	os.Unsetenv("BLUEMIX_TRACE")
+	assert.Empty(t, EnvTrace.Get())
+}
+
+func TestSet(t *testing.T) {
+	assert.Empty(t, os.Getenv("IBMCLOUD_COLOR"))
+	assert.Empty(t, os.Getenv("BLUEMIX_COLOR"))
+	assert.Empty(t, EnvColor.Get())
+
+	EnvColor.Set("true")
+	assert.Equal(t, "true", os.Getenv("IBMCLOUD_COLOR"))
+	assert.Equal(t, "true", os.Getenv("BLUEMIX_COLOR"))
+	assert.Equal(t, "true", EnvColor.Get())
+}
diff --git a/bluemix/models/endpoints.go b/bluemix/models/endpoints.go
new file mode 100644
index 00000000..1fe41d20
--- /dev/null
+++ b/bluemix/models/endpoints.go
@@ -0,0 +1,6 @@
+package models
+
+type Endpoints struct {
+	PublicEndpoint  string
+	PrivateEndpoint string
+}
diff --git a/bluemix/version.go b/bluemix/version.go
index 0408ad8e..b05afec8 100644
--- a/bluemix/version.go
+++ b/bluemix/version.go
@@ -12,6 +12,7 @@ type VersionType struct {
 	Build int // build number
 }
 
+// String will return the version in semver format string "Major.Minor.Build"
 func (v VersionType) String() string {
 	if v == (VersionType{}) {
 		return ""
diff --git a/bluemix/version_test.go b/bluemix/version_test.go
new file mode 100644
index 00000000..e62ed78e
--- /dev/null
+++ b/bluemix/version_test.go
@@ -0,0 +1,19 @@
+package bluemix_test
+
+import (
+	"testing"
+
+	. "github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestVersion(t *testing.T) {
+	v := VersionType{}
+	assert.Equal(t, 0, v.Major)
+	assert.Equal(t, 0, v.Minor)
+	assert.Equal(t, 0, v.Build)
+	assert.Empty(t, v.String())
+
+	v = VersionType{Major: 1, Minor: 2, Build: 3}
+	assert.Equal(t, "1.2.3", v.String())
+}
diff --git a/plugin/plugin.go b/plugin/plugin.go
index dd7bdf53..91a51cba 100644
--- a/plugin/plugin.go
+++ b/plugin/plugin.go
@@ -6,6 +6,7 @@ package plugin
 import (
 	"fmt"
 
+	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/endpoints"
 	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/models"
 )
 
@@ -25,6 +26,9 @@ type PluginMetadata struct {
 	// If DelegateBashCompletion is true, plugin command's completion is handled by plugin.
 	// The CLI will invoke '<plugin_binary> SendCompletion <args>'
 	DelegateBashCompletion bool
+
+	// Whether the plugin supports private endpoint
+	PrivateEndpointSupported bool
 }
 
 func (p PluginMetadata) NameAndAliases() []string {
@@ -129,12 +133,27 @@ type PluginContext interface {
 	// Call HasTargetedCF() to return whether a CF environment has been targeted.
 	HasAPIEndpoint() bool
 
-	// ConsoleEndpoint returns the Bluemix Console endpoint
+	// IsPrivateEndpointEnabled returns whether use of the private endpoint has been chosen
+	IsPrivateEndpointEnabled() bool
+
+	// ConsoleEndpoint returns console's public endpoint if api endpoint is public, or returns
+	// private endpoint if api endpoint is private.
 	ConsoleEndpoint() string
 
-	// IAMTEndpoint return the endpoint of IAM token service
+	// ConsoleEndpoints returns both the public and private endpoint of console.
+	ConsoleEndpoints() models.Endpoints
+
+	// IAMEndpoint returns IAM's public endpoint if api endpoint is public, or returns private
+	// endpoint if api endpoint is private.
 	IAMEndpoint() string
 
+	// IAMEndpoints returns both the public and private endpoint of IAM.
+	IAMEndpoints() models.Endpoints
+
+	// GetEndpoint is a utility method to return private or public endpoint for a requested service.
+	// It supports public cloud only. For non public clouds, plugin needs its own way to determine endpoint.
+	GetEndpoint(endpoints.Service) (string, error)
+
 	// CloudName returns the name of the target cloud
 	CloudName() string
 
diff --git a/plugin/plugin_context.go b/plugin/plugin_context.go
index fe985ad2..3f4204af 100644
--- a/plugin/plugin_context.go
+++ b/plugin/plugin_context.go
@@ -11,6 +11,7 @@ import (
 	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/authentication/iam"
 	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/authentication/uaa"
 	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/configuration/core_config"
+	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/endpoints"
 	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/common/rest"
 )
 
@@ -58,6 +59,42 @@ func (c *pluginContext) APIEndpoint() string {
 	return c.ReadWriter.APIEndpoint()
 }
 
+func (c *pluginContext) IAMEndpoint() string {
+	if c.IsPrivateEndpointEnabled() {
+		return c.IAMEndpoints().PrivateEndpoint
+	}
+	return c.IAMEndpoints().PublicEndpoint
+}
+
+func (c *pluginContext) ConsoleEndpoint() string {
+	if c.IsPrivateEndpointEnabled() {
+		return c.ConsoleEndpoints().PrivateEndpoint
+	}
+	return c.ConsoleEndpoints().PublicEndpoint
+}
+
+func (c *pluginContext) GetEndpoint(svc endpoints.Service) (string, error) {
+	if c.CloudType() != "public" {
+		return "", fmt.Errorf("only public cloud is supported")
+	}
+
+	if !c.HasAPIEndpoint() {
+		return "", nil
+	}
+
+	var cloudDomain string
+	switch cname := c.CloudName(); cname {
+	case "bluemix":
+		cloudDomain = "cloud.ibm.com"
+	case "staging":
+		cloudDomain = "test.cloud.ibm.com"
+	default:
+		return "", fmt.Errorf("unknown cloud name '%s'", cname)
+	}
+
+	return endpoints.Endpoint(svc, cloudDomain, c.CurrentRegion().Name, c.IsPrivateEndpointEnabled())
+}
+
 func compareVersion(v1, v2 string) int {
 	s1 := strings.Split(v1, ".")
 	s2 := strings.Split(v2, ".")
diff --git a/plugin/pluginfakes/fake_plugin_context.go b/plugin/pluginfakes/fake_plugin_context.go
index 8c323681..79cb053b 100644
--- a/plugin/pluginfakes/fake_plugin_context.go
+++ b/plugin/pluginfakes/fake_plugin_context.go
@@ -2,10 +2,11 @@
 package pluginfakes
 
 import (
-	sync "sync"
+	"sync"
 
-	models "github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/models"
-	plugin "github.com/IBM-Cloud/ibm-cloud-cli-sdk/plugin"
+	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/endpoints"
+	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/bluemix/models"
+	"github.com/IBM-Cloud/ibm-cloud-cli-sdk/plugin"
 )
 
 type FakePluginContext struct {
@@ -99,6 +100,16 @@ type FakePluginContext struct {
 	consoleEndpointReturnsOnCall map[int]struct {
 		result1 string
 	}
+	ConsoleEndpointsStub        func() models.Endpoints
+	consoleEndpointsMutex       sync.RWMutex
+	consoleEndpointsArgsForCall []struct {
+	}
+	consoleEndpointsReturns struct {
+		result1 models.Endpoints
+	}
+	consoleEndpointsReturnsOnCall map[int]struct {
+		result1 models.Endpoints
+	}
 	CurrentAccountStub        func() models.Account
 	currentAccountMutex       sync.RWMutex
 	currentAccountArgsForCall []struct {
@@ -129,6 +140,19 @@ type FakePluginContext struct {
 	currentResourceGroupReturnsOnCall map[int]struct {
 		result1 models.ResourceGroup
 	}
+	GetEndpointStub        func(endpoints.Service) (string, error)
+	getEndpointMutex       sync.RWMutex
+	getEndpointArgsForCall []struct {
+		arg1 endpoints.Service
+	}
+	getEndpointReturns struct {
+		result1 string
+		result2 error
+	}
+	getEndpointReturnsOnCall map[int]struct {
+		result1 string
+		result2 error
+	}
 	HTTPTimeoutStub        func() int
 	hTTPTimeoutMutex       sync.RWMutex
 	hTTPTimeoutArgsForCall []struct {
@@ -219,6 +243,16 @@ type FakePluginContext struct {
 	iAMEndpointReturnsOnCall map[int]struct {
 		result1 string
 	}
+	IAMEndpointsStub        func() models.Endpoints
+	iAMEndpointsMutex       sync.RWMutex
+	iAMEndpointsArgsForCall []struct {
+	}
+	iAMEndpointsReturns struct {
+		result1 models.Endpoints
+	}
+	iAMEndpointsReturnsOnCall map[int]struct {
+		result1 models.Endpoints
+	}
 	IAMRefreshTokenStub        func() string
 	iAMRefreshTokenMutex       sync.RWMutex
 	iAMRefreshTokenArgsForCall []struct {
@@ -269,6 +303,16 @@ type FakePluginContext struct {
 	isLoggedInWithServiceIDReturnsOnCall map[int]struct {
 		result1 bool
 	}
+	IsPrivateEndpointEnabledStub        func() bool
+	isPrivateEndpointEnabledMutex       sync.RWMutex
+	isPrivateEndpointEnabledArgsForCall []struct {
+	}
+	isPrivateEndpointEnabledReturns struct {
+		result1 bool
+	}
+	isPrivateEndpointEnabledReturnsOnCall map[int]struct {
+		result1 bool
+	}
 	IsSSLDisabledStub        func() bool
 	isSSLDisabledMutex       sync.RWMutex
 	isSSLDisabledArgsForCall []struct {
@@ -823,6 +867,58 @@ func (fake *FakePluginContext) ConsoleEndpointReturnsOnCall(i int, result1 strin
 	}{result1}
 }
 
+func (fake *FakePluginContext) ConsoleEndpoints() models.Endpoints {
+	fake.consoleEndpointsMutex.Lock()
+	ret, specificReturn := fake.consoleEndpointsReturnsOnCall[len(fake.consoleEndpointsArgsForCall)]
+	fake.consoleEndpointsArgsForCall = append(fake.consoleEndpointsArgsForCall, struct {
+	}{})
+	fake.recordInvocation("ConsoleEndpoints", []interface{}{})
+	fake.consoleEndpointsMutex.Unlock()
+	if fake.ConsoleEndpointsStub != nil {
+		return fake.ConsoleEndpointsStub()
+	}
+	if specificReturn {
+		return ret.result1
+	}
+	fakeReturns := fake.consoleEndpointsReturns
+	return fakeReturns.result1
+}
+
+func (fake *FakePluginContext) ConsoleEndpointsCallCount() int {
+	fake.consoleEndpointsMutex.RLock()
+	defer fake.consoleEndpointsMutex.RUnlock()
+	return len(fake.consoleEndpointsArgsForCall)
+}
+
+func (fake *FakePluginContext) ConsoleEndpointsCalls(stub func() models.Endpoints) {
+	fake.consoleEndpointsMutex.Lock()
+	defer fake.consoleEndpointsMutex.Unlock()
+	fake.ConsoleEndpointsStub = stub
+}
+
+func (fake *FakePluginContext) ConsoleEndpointsReturns(result1 models.Endpoints) {
+	fake.consoleEndpointsMutex.Lock()
+	defer fake.consoleEndpointsMutex.Unlock()
+	fake.ConsoleEndpointsStub = nil
+	fake.consoleEndpointsReturns = struct {
+		result1 models.Endpoints
+	}{result1}
+}
+
+func (fake *FakePluginContext) ConsoleEndpointsReturnsOnCall(i int, result1 models.Endpoints) {
+	fake.consoleEndpointsMutex.Lock()
+	defer fake.consoleEndpointsMutex.Unlock()
+	fake.ConsoleEndpointsStub = nil
+	if fake.consoleEndpointsReturnsOnCall == nil {
+		fake.consoleEndpointsReturnsOnCall = make(map[int]struct {
+			result1 models.Endpoints
+		})
+	}
+	fake.consoleEndpointsReturnsOnCall[i] = struct {
+		result1 models.Endpoints
+	}{result1}
+}
+
 func (fake *FakePluginContext) CurrentAccount() models.Account {
 	fake.currentAccountMutex.Lock()
 	ret, specificReturn := fake.currentAccountReturnsOnCall[len(fake.currentAccountArgsForCall)]
@@ -979,6 +1075,69 @@ func (fake *FakePluginContext) CurrentResourceGroupReturnsOnCall(i int, result1
 	}{result1}
 }
 
+func (fake *FakePluginContext) GetEndpoint(arg1 endpoints.Service) (string, error) {
+	fake.getEndpointMutex.Lock()
+	ret, specificReturn := fake.getEndpointReturnsOnCall[len(fake.getEndpointArgsForCall)]
+	fake.getEndpointArgsForCall = append(fake.getEndpointArgsForCall, struct {
+		arg1 endpoints.Service
+	}{arg1})
+	fake.recordInvocation("GetEndpoint", []interface{}{arg1})
+	fake.getEndpointMutex.Unlock()
+	if fake.GetEndpointStub != nil {
+		return fake.GetEndpointStub(arg1)
+	}
+	if specificReturn {
+		return ret.result1, ret.result2
+	}
+	fakeReturns := fake.getEndpointReturns
+	return fakeReturns.result1, fakeReturns.result2
+}
+
+func (fake *FakePluginContext) GetEndpointCallCount() int {
+	fake.getEndpointMutex.RLock()
+	defer fake.getEndpointMutex.RUnlock()
+	return len(fake.getEndpointArgsForCall)
+}
+
+func (fake *FakePluginContext) GetEndpointCalls(stub func(endpoints.Service) (string, error)) {
+	fake.getEndpointMutex.Lock()
+	defer fake.getEndpointMutex.Unlock()
+	fake.GetEndpointStub = stub
+}
+
+func (fake *FakePluginContext) GetEndpointArgsForCall(i int) endpoints.Service {
+	fake.getEndpointMutex.RLock()
+	defer fake.getEndpointMutex.RUnlock()
+	argsForCall := fake.getEndpointArgsForCall[i]
+	return argsForCall.arg1
+}
+
+func (fake *FakePluginContext) GetEndpointReturns(result1 string, result2 error) {
+	fake.getEndpointMutex.Lock()
+	defer fake.getEndpointMutex.Unlock()
+	fake.GetEndpointStub = nil
+	fake.getEndpointReturns = struct {
+		result1 string
+		result2 error
+	}{result1, result2}
+}
+
+func (fake *FakePluginContext) GetEndpointReturnsOnCall(i int, result1 string, result2 error) {
+	fake.getEndpointMutex.Lock()
+	defer fake.getEndpointMutex.Unlock()
+	fake.GetEndpointStub = nil
+	if fake.getEndpointReturnsOnCall == nil {
+		fake.getEndpointReturnsOnCall = make(map[int]struct {
+			result1 string
+			result2 error
+		})
+	}
+	fake.getEndpointReturnsOnCall[i] = struct {
+		result1 string
+		result2 error
+	}{result1, result2}
+}
+
 func (fake *FakePluginContext) HTTPTimeout() int {
 	fake.hTTPTimeoutMutex.Lock()
 	ret, specificReturn := fake.hTTPTimeoutReturnsOnCall[len(fake.hTTPTimeoutArgsForCall)]
@@ -1447,6 +1606,58 @@ func (fake *FakePluginContext) IAMEndpointReturnsOnCall(i int, result1 string) {
 	}{result1}
 }
 
+func (fake *FakePluginContext) IAMEndpoints() models.Endpoints {
+	fake.iAMEndpointsMutex.Lock()
+	ret, specificReturn := fake.iAMEndpointsReturnsOnCall[len(fake.iAMEndpointsArgsForCall)]
+	fake.iAMEndpointsArgsForCall = append(fake.iAMEndpointsArgsForCall, struct {
+	}{})
+	fake.recordInvocation("IAMEndpoints", []interface{}{})
+	fake.iAMEndpointsMutex.Unlock()
+	if fake.IAMEndpointsStub != nil {
+		return fake.IAMEndpointsStub()
+	}
+	if specificReturn {
+		return ret.result1
+	}
+	fakeReturns := fake.iAMEndpointsReturns
+	return fakeReturns.result1
+}
+
+func (fake *FakePluginContext) IAMEndpointsCallCount() int {
+	fake.iAMEndpointsMutex.RLock()
+	defer fake.iAMEndpointsMutex.RUnlock()
+	return len(fake.iAMEndpointsArgsForCall)
+}
+
+func (fake *FakePluginContext) IAMEndpointsCalls(stub func() models.Endpoints) {
+	fake.iAMEndpointsMutex.Lock()
+	defer fake.iAMEndpointsMutex.Unlock()
+	fake.IAMEndpointsStub = stub
+}
+
+func (fake *FakePluginContext) IAMEndpointsReturns(result1 models.Endpoints) {
+	fake.iAMEndpointsMutex.Lock()
+	defer fake.iAMEndpointsMutex.Unlock()
+	fake.IAMEndpointsStub = nil
+	fake.iAMEndpointsReturns = struct {
+		result1 models.Endpoints
+	}{result1}
+}
+
+func (fake *FakePluginContext) IAMEndpointsReturnsOnCall(i int, result1 models.Endpoints) {
+	fake.iAMEndpointsMutex.Lock()
+	defer fake.iAMEndpointsMutex.Unlock()
+	fake.IAMEndpointsStub = nil
+	if fake.iAMEndpointsReturnsOnCall == nil {
+		fake.iAMEndpointsReturnsOnCall = make(map[int]struct {
+			result1 models.Endpoints
+		})
+	}
+	fake.iAMEndpointsReturnsOnCall[i] = struct {
+		result1 models.Endpoints
+	}{result1}
+}
+
 func (fake *FakePluginContext) IAMRefreshToken() string {
 	fake.iAMRefreshTokenMutex.Lock()
 	ret, specificReturn := fake.iAMRefreshTokenReturnsOnCall[len(fake.iAMRefreshTokenArgsForCall)]
@@ -1707,6 +1918,58 @@ func (fake *FakePluginContext) IsLoggedInWithServiceIDReturnsOnCall(i int, resul
 	}{result1}
 }
 
+func (fake *FakePluginContext) IsPrivateEndpointEnabled() bool {
+	fake.isPrivateEndpointEnabledMutex.Lock()
+	ret, specificReturn := fake.isPrivateEndpointEnabledReturnsOnCall[len(fake.isPrivateEndpointEnabledArgsForCall)]
+	fake.isPrivateEndpointEnabledArgsForCall = append(fake.isPrivateEndpointEnabledArgsForCall, struct {
+	}{})
+	fake.recordInvocation("IsPrivateEndpointEnabled", []interface{}{})
+	fake.isPrivateEndpointEnabledMutex.Unlock()
+	if fake.IsPrivateEndpointEnabledStub != nil {
+		return fake.IsPrivateEndpointEnabledStub()
+	}
+	if specificReturn {
+		return ret.result1
+	}
+	fakeReturns := fake.isPrivateEndpointEnabledReturns
+	return fakeReturns.result1
+}
+
+func (fake *FakePluginContext) IsPrivateEndpointEnabledCallCount() int {
+	fake.isPrivateEndpointEnabledMutex.RLock()
+	defer fake.isPrivateEndpointEnabledMutex.RUnlock()
+	return len(fake.isPrivateEndpointEnabledArgsForCall)
+}
+
+func (fake *FakePluginContext) IsPrivateEndpointEnabledCalls(stub func() bool) {
+	fake.isPrivateEndpointEnabledMutex.Lock()
+	defer fake.isPrivateEndpointEnabledMutex.Unlock()
+	fake.IsPrivateEndpointEnabledStub = stub
+}
+
+func (fake *FakePluginContext) IsPrivateEndpointEnabledReturns(result1 bool) {
+	fake.isPrivateEndpointEnabledMutex.Lock()
+	defer fake.isPrivateEndpointEnabledMutex.Unlock()
+	fake.IsPrivateEndpointEnabledStub = nil
+	fake.isPrivateEndpointEnabledReturns = struct {
+		result1 bool
+	}{result1}
+}
+
+func (fake *FakePluginContext) IsPrivateEndpointEnabledReturnsOnCall(i int, result1 bool) {
+	fake.isPrivateEndpointEnabledMutex.Lock()
+	defer fake.isPrivateEndpointEnabledMutex.Unlock()
+	fake.IsPrivateEndpointEnabledStub = nil
+	if fake.isPrivateEndpointEnabledReturnsOnCall == nil {
+		fake.isPrivateEndpointEnabledReturnsOnCall = make(map[int]struct {
+			result1 bool
+		})
+	}
+	fake.isPrivateEndpointEnabledReturnsOnCall[i] = struct {
+		result1 bool
+	}{result1}
+}
+
 func (fake *FakePluginContext) IsSSLDisabled() bool {
 	fake.isSSLDisabledMutex.Lock()
 	ret, specificReturn := fake.isSSLDisabledReturnsOnCall[len(fake.isSSLDisabledArgsForCall)]
@@ -2147,12 +2410,16 @@ func (fake *FakePluginContext) Invocations() map[string][][]interface{} {
 	defer fake.commandNamespaceMutex.RUnlock()
 	fake.consoleEndpointMutex.RLock()
 	defer fake.consoleEndpointMutex.RUnlock()
+	fake.consoleEndpointsMutex.RLock()
+	defer fake.consoleEndpointsMutex.RUnlock()
 	fake.currentAccountMutex.RLock()
 	defer fake.currentAccountMutex.RUnlock()
 	fake.currentRegionMutex.RLock()
 	defer fake.currentRegionMutex.RUnlock()
 	fake.currentResourceGroupMutex.RLock()
 	defer fake.currentResourceGroupMutex.RUnlock()
+	fake.getEndpointMutex.RLock()
+	defer fake.getEndpointMutex.RUnlock()
 	fake.hTTPTimeoutMutex.RLock()
 	defer fake.hTTPTimeoutMutex.RUnlock()
 	fake.hasAPIEndpointMutex.RLock()
@@ -2171,6 +2438,8 @@ func (fake *FakePluginContext) Invocations() map[string][][]interface{} {
 	defer fake.hasTargetedResourceGroupMutex.RUnlock()
 	fake.iAMEndpointMutex.RLock()
 	defer fake.iAMEndpointMutex.RUnlock()
+	fake.iAMEndpointsMutex.RLock()
+	defer fake.iAMEndpointsMutex.RUnlock()
 	fake.iAMRefreshTokenMutex.RLock()
 	defer fake.iAMRefreshTokenMutex.RUnlock()
 	fake.iAMTokenMutex.RLock()
@@ -2181,6 +2450,8 @@ func (fake *FakePluginContext) Invocations() map[string][][]interface{} {
 	defer fake.isLoggedInMutex.RUnlock()
 	fake.isLoggedInWithServiceIDMutex.RLock()
 	defer fake.isLoggedInWithServiceIDMutex.RUnlock()
+	fake.isPrivateEndpointEnabledMutex.RLock()
+	defer fake.isPrivateEndpointEnabledMutex.RUnlock()
 	fake.isSSLDisabledMutex.RLock()
 	defer fake.isSSLDisabledMutex.RUnlock()
 	fake.localeMutex.RLock()