Import and run your model
The import-to-inference workflow for a customer model, end to end. A customer model is imported from a model hub, never uploaded, and it runs as weight files on HIPS's own engines: no code from its repository runs anywhere.
The import runs from the Console in the first version, so this page describes the Console's steps in words and shows no command. A request sample for importing appears only once a public import route is decided and validated Not decided yet.
A model you import from a model hub: weight files only, run by HIPS's own engines, vLLM for a language model in data centers and ONNX Runtime for every other model type. Nothing is uploaded: POST /v1/uploads carries task inputs only (Uploads).
| Id | What it is |
|---|---|
mdl_ | The customer model: its name, its task and its versions |
imp_ | One import of a repository at a revision. It ends ready, refused or failed |
ver_ | A version, made by an import that ends ready: signed, immutable, with its source and license record. A refused or failed import makes none |
dep_ | A deployment: a version made runnable, the id your requests name |
- Id
mdl_- What it is
- The customer model: its name, its task and its versions
- Id
imp_- What it is
- One import of a repository at a revision. It ends
ready,refusedorfailed
- Id
ver_- What it is
- A version, made by an import that ends
ready: signed, immutable, with its source and license record. A refused or failed import makes none
- Id
dep_- What it is
- A deployment: a version made runnable, the id your requests name
In the Console an import takes seven steps, on My models and deployments:
- 01
Hub: the hubs whose adapters have shipped, Hugging Face first.
- 02
Repository and revision: the repository in the hub's own form and a branch, a tag or a commit.
- 03
Access: a public repository with no token, or one of the workspace's stored hub tokens.
- 04
Model: a new customer model's name and task, and for a model that is not a language model its task definition; or a new version of an existing one.
- 05
Where it may run: read-only, the pools the task can use and the region its copy is stored in.
- 06
License: the attestation, ticked before Import is enabled.
- 07
Review: everything above, then Import, which opens the import's own page.
Hugging Face model repositories, public, gated or private. Another hub is named on this page only once its adapter ships Not decided yet. A Hugging Face Space is an application and a dataset is data: neither is a model source.
You name the repository in the hub's own form, owner/name on Hugging Face, and a revision: a branch, a tag or a commit. A pasted address of the repository's page is reduced to the name and, where it carries one, the revision.
A public repository needs no token. A private or gated repository needs your access token for the hub: for Hugging Face, a fine-grained, read-only token scoped to the repository is asked for. For a gated repository, its terms are accepted on the hub by the token's own account, never by HIPS.
Note
HIPS stores read-only tokens only. A token the hub reports as able to write is refused and not kept. A read-only token that reaches beyond the repositories you name, or one whose permissions the hub does not report, is stored only after a warning and a second confirmation in the Console, and is only ever used to read.
- Kept encrypted under a cloud key; only its last four characters are ever shown.
- Used only in the import job, and never sent to a data-center worker, its RunPod pod or a device.
- Reused when you import a newer revision.
- Deleted when you delete it. Deleting it at HIPS does not revoke it at the hub.
Tokens are managed in the Console's Workspace settings, under Model-hub access tokens.
| Kind | What the import takes | Engine and pool |
|---|---|---|
| Language model | safetensors in the Hugging Face repository layout, of an architecture on the engine's list, with its tokenizer files and its chat template where it has one | vLLM, in the approved pool: data centers only, at launch and after |
| Every other model type (classifier, vision, audio, video, specialist) | One ONNX graph with its external data files, within the runtime's opset range, with the task definition you give at import naming every input and output | ONNX Runtime, in the approved pool at launch |
- Kind
- Language model
- What the import takes
- safetensors in the Hugging Face repository layout, of an architecture on the engine's list, with its tokenizer files and its chat template where it has one
- Engine and pool
- vLLM, in the
approvedpool: data centers only, at launch and after
- Kind
- Every other model type (classifier, vision, audio, video, specialist)
- What the import takes
- One ONNX graph with its external data files, within the runtime's opset range, with the task definition you give at import naming every input and output
- Engine and pool
- ONNX Runtime, in the
approvedpool at launch
What the repository holds besides the model (code, notebooks, images, a pickle file beside safetensors of the same weights) is listed on the import and never downloaded. A refusal ends the import with its reason code, the check and the file at fault, never the file's content:
Refusals at import, as the Console shows them
| Reason code | What it means | What to change |
|---|---|---|
format_unsupported | The repository has no weights in a format HIPS's engines load (safetensors in the Hugging Face layout for a language model, or ONNX for another model type), or what it has does not load: an architecture off the engine's list, an opset outside the runtime's range, a tokenizer that does not load, a task definition that does not match the graph. The failing check is named. | Choose a repository or revision that publishes safetensors or ONNX weights of a supported architecture, or correct the task definition. Formats are not converted at launch Not decided yet. |
code_required | The model needs code from its repository to load: it asks for trust_remote_code, or its configuration carries an auto_map. Customer models run on HIPS's engines without any repository code. | Choose a model whose architecture the engine supports without custom code, or a revision that has none. |
pickle_weights | The weights exist only as pickle files (.bin, .pt, .pth, .ckpt, .pkl, or any file whose bytes are a pickle, whatever its name), which can run code when they are loaded. A pickle file beside safetensors of the same weights is never opened and does not refuse the import. | Publish the weights as safetensors (or ONNX) in the repository and import that revision. |
custom_operator | The ONNX graph uses an operator outside the standard domains of the ONNX Runtime release HIPS runs. | Export the model again with standard operators, within the supported opset range. |
external_data_outside | The ONNX graph's external data points to a file outside the model's own files. | Export again with the external data stored beside the graph in the repository. |
template_refused | The language model's chat template did not pass the template checks. A template is data, rendered only in the engine's sandboxed template environment on data-center workers. | Use the architecture's standard chat template, or remove what the check names. |
license_refused | The license the hub records does not allow paid hosted inference under the license rules Not decided yet. | Choose a model whose license allows it, or contact HIPS about another license. |
access_denied | The repository cannot be read: it is private or gated and no token was given, the token cannot read it (for a gated repository, its account has not accepted the terms), or there is no such repository. All three are answered alike, so an import never discloses whether a private repository exists. | Check the repository's name; accept the terms on the hub with the token's account; or choose or add a token that can read the repository. |
revision_not_found | The repository was read and holds no such branch, tag, commit or version. | Check the revision, and import again. |
too_large | The files exceed the size HIPS imports for this kind of model Not decided yet, or the model fits no hardware class of the approved pool. | Choose a smaller variant, or a quantization the engine loads. |
- Reason code
format_unsupported- What it means
- The repository has no weights in a format HIPS's engines load (safetensors in the Hugging Face layout for a language model, or ONNX for another model type), or what it has does not load: an architecture off the engine's list, an opset outside the runtime's range, a tokenizer that does not load, a task definition that does not match the graph. The failing check is named.
- What to change
- Choose a repository or revision that publishes safetensors or ONNX weights of a supported architecture, or correct the task definition. Formats are not converted at launch Not decided yet.
- Reason code
code_required- What it means
- The model needs code from its repository to load: it asks for
trust_remote_code, or its configuration carries anauto_map. Customer models run on HIPS's engines without any repository code. - What to change
- Choose a model whose architecture the engine supports without custom code, or a revision that has none.
- Reason code
pickle_weights- What it means
- The weights exist only as pickle files (
.bin,.pt,.pth,.ckpt,.pkl, or any file whose bytes are a pickle, whatever its name), which can run code when they are loaded. A pickle file beside safetensors of the same weights is never opened and does not refuse the import. - What to change
- Publish the weights as safetensors (or ONNX) in the repository and import that revision.
- Reason code
custom_operator- What it means
- The ONNX graph uses an operator outside the standard domains of the ONNX Runtime release HIPS runs.
- What to change
- Export the model again with standard operators, within the supported opset range.
- Reason code
external_data_outside- What it means
- The ONNX graph's external data points to a file outside the model's own files.
- What to change
- Export again with the external data stored beside the graph in the repository.
- Reason code
template_refused- What it means
- The language model's chat template did not pass the template checks. A template is data, rendered only in the engine's sandboxed template environment on data-center workers.
- What to change
- Use the architecture's standard chat template, or remove what the check names.
- Reason code
license_refused- What it means
- The license the hub records does not allow paid hosted inference under the license rules Not decided yet.
- What to change
- Choose a model whose license allows it, or contact HIPS about another license.
- Reason code
access_denied- What it means
- The repository cannot be read: it is private or gated and no token was given, the token cannot read it (for a gated repository, its account has not accepted the terms), or there is no such repository. All three are answered alike, so an import never discloses whether a private repository exists.
- What to change
- Check the repository's name; accept the terms on the hub with the token's account; or choose or add a token that can read the repository.
- Reason code
revision_not_found- What it means
- The repository was read and holds no such branch, tag, commit or version.
- What to change
- Check the revision, and import again.
- Reason code
too_large- What it means
- The files exceed the size HIPS imports for this kind of model Not decided yet, or the model fits no hardware class of the
approvedpool. - What to change
- Choose a smaller variant, or a quantization the engine loads.
An import can also fail for a reason that is not the model's. Nothing is kept and no version is made; starting again is a new import:
Failures that are not the model's
| Failure | What happened | What to do |
|---|---|---|
hub_unavailable | The hub did not answer. | Retry. |
timed_out | The import ran past its time limit Not decided yet. | Retry; a smaller variant if it happens again. |
credential_deleted | The hub token the import used was deleted before the import had fetched with it. | Import again, choosing or adding a token. |
canceled | A member canceled the import. | Import again. |
internal | A failure on HIPS's side, with the request id for support. | Retry, or contact HIPS. |
- Failure
hub_unavailable- What happened
- The hub did not answer.
- What to do
- Retry.
- Failure
timed_out- What happened
- The import ran past its time limit Not decided yet.
- What to do
- Retry; a smaller variant if it happens again.
- Failure
credential_deleted- What happened
- The hub token the import used was deleted before the import had fetched with it.
- What to do
- Import again, choosing or adding a token.
- Failure
canceled- What happened
- A member canceled the import.
- What to do
- Import again.
- Failure
internal- What happened
- A failure on HIPS's side, with the request id for support.
- What to do
- Retry, or contact HIPS.
The revision you enter, a branch, a tag, a commit or a hub version, is pinned at import to the exact commit or version id. Later changes on the hub never reach the version.
| Import state | What happens |
|---|---|
queued | Accepted, waiting for an import job |
fetching | The revision is pinned, the hub's license is read, and only the files an engine reads are fetched. The only step that holds the hub token |
checking | Each file is parsed with the pinned engine release, with no token and no network; what passes is re-saved: safetensors rewritten, ONNX re-serialized |
copying | The re-saved files are copied once into encrypted HIPS storage in the workspace's storage region, where its deployments run. The import takes no region |
signing | The copy is signed with a HIPS key and the version is created. Workers and devices load only that signed copy, never the hub |
ready, refused or failed | A new version; or the reason code; or the failure. Only ready makes a version |
- Import state
queued- What happens
- Accepted, waiting for an import job
- Import state
fetching- What happens
- The revision is pinned, the hub's license is read, and only the files an engine reads are fetched. The only step that holds the hub token
- Import state
checking- What happens
- Each file is parsed with the pinned engine release, with no token and no network; what passes is re-saved: safetensors rewritten, ONNX re-serialized
- Import state
copying- What happens
- The re-saved files are copied once into encrypted HIPS storage in the workspace's storage region, where its deployments run. The import takes no region
- Import state
signing- What happens
- The copy is signed with a HIPS key and the version is created. Workers and devices load only that signed copy, never the hub
- Import state
ready,refusedorfailed- What happens
- A new version; or the reason code; or the failure. Only
readymakes a version
A version records its hub, repository, pinned revision, license, attestation time, the signed manifest's digest and the signing time. Importing a newer revision makes a new version and reuses the stored token. Versions are immutable. Deleting a version or a model removes HIPS's copies and never touches the hub. Stored models and a stopped deployment's weights cost $0.10 per GB-month while they are kept.
The hub's license is recorded on the version, and before importing you attest the right to run the model commercially as a hosted service. Which licenses allow paid hosted inference, and the attestation's text, are not yet decided Not decided yet, so this page states no license rule.
- 01
Engine fit, and hardware fit beyond VRAM: the weights must fit at least one hardware class of the
approvedpool. - 02
Profiling on HIPS-operated capacity, per version, pool and hardware class: load time, memory, throughput at representative inputs, and correctness.
- 03
The tariff, assigned after profiling and never before. It belongs to the version, and every deployment of the version inherits it.
A version still profiling can serve an always-on deployment, charged by allocated time. A shared deployment may be created while its version's tariff is pending: it waits in tariff_pending, serving nothing and charged nothing, until the tariff takes effect.
At launch every customer model runs in the approved-provider pool (approved) only. A language model in safetensors stays in data centers in every phase. The personal pool opens later to customer ONNX models only, on four conditions together:
- An opt-in per deployment that says in plain words that the device owner's machine holds the weights.
- The device engine sandboxed: a separate process with no network and no file access outside its model cache.
- The provider agreement binding device owners as processors.
- Verification sampling running.
Opt-in runs on both sides: such a deployment reaches only devices whose provider has turned on that device's own switch for customer models, which is off until the provider turns it on. The pool choice shows the quote, availability and runtime-access conditions together. Cross-pool fallback is off by default, never weakens a region or data-use rule, and reaches personal only on a deployment that opted in.
A deployment (dep_) runs on shared, or, from approved only, on always_on: the separate option for a model that must stay loaded, charged by allocated time, including between requests. The request-data policy is shown before the first request can be sent.
| Model type | Field | Route |
|---|---|---|
| Language model | model: "dep_..." | POST /v1/chat/completions, through an OpenAI client |
| Every other model type | deployment: "dep_..." | POST /v1/tasks or POST /v1/jobs, through the HIPS SDK |
- Model type
- Language model
- Field
model: "dep_..."- Route
POST /v1/chat/completions, through an OpenAI client
- Model type
- Every other model type
- Field
deployment: "dep_..."- Route
POST /v1/tasksorPOST /v1/jobs, through the HIPS SDK
| Deployment state | Meaning |
|---|---|
allocating | Capacity is being assigned; requests answer 503 deployment_not_ready with Retry-After |
loading | The model is being loaded; the same answer |
tariff_pending | A shared deployment waiting for its version's tariff; the same answer, and nothing is charged |
ready | Serving |
busy | Serving at capacity |
degraded | Served; the state is visible in GET /v1/models/{id} |
stopped | Requests answer 400 deployment_stopped; start it in the Console |
- Deployment state
allocating- Meaning
- Capacity is being assigned; requests answer 503
deployment_not_readywithRetry-After
- Deployment state
loading- Meaning
- The model is being loaded; the same answer
- Deployment state
tariff_pending- Meaning
- A
shareddeployment waiting for its version's tariff; the same answer, and nothing is charged
- Deployment state
ready- Meaning
- Serving
- Deployment state
busy- Meaning
- Serving at capacity
- Deployment state
degraded- Meaning
- Served; the state is visible in
GET /v1/models/{id}
- Deployment state
stopped- Meaning
- Requests answer 400
deployment_stopped; start it in the Console
Allocation is not readiness: every transition is timestamped and explained in the Console. The Deployments page has the read side.
Policy
Customer-owned model weights will never be used to train other models on any plan.
Policy
On Free/PAYG and the lower paid plan, request inputs and generated outputs may be used for training. This includes requests processed by customer-owned models. On the higher paid plan, request-data training is off by default.
The rest is on Security and Data and Data handling.
Related sheets
- Sheet
- 05 of 13
- Updated
- 2026-10-21
- Status
- Preview