diff --git a/PROJECT b/PROJECT
index 8d6e2c12..23bc7103 100644
--- a/PROJECT
+++ b/PROJECT
@@ -16,6 +16,14 @@ resources:
   kind: Domain
   path: github.com/k-orc/openstack-resource-controller/api/v1alpha1
   version: v1alpha1
+- api:
+    crdVersion: v1
+    namespaced: true
+  domain: k-orc.cloud
+  group: openstack
+  kind: Endpoint
+  path: github.com/k-orc/openstack-resource-controller/api/v1alpha1
+  version: v1alpha1
 - api:
     crdVersion: v1
     namespaced: true
diff --git a/README.md b/README.md
index 26c73737..dd158f75 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,7 @@ kubectl delete -f $ORC_RELEASE
 | **controller**              | **1.x** | **2.x** | **main** |
 |:---------------------------:|:-------:|:-------:|:--------:|
 | domain                      |         |    ✔    |     ✔    |
+| endpoint                    |         |    ◐    |     ◐    |
 | flavor                      |         |    ✔    |     ✔    |
 | floating ip                 |         |    ◐    |     ◐    |
 | group                       |         |    ✔    |     ✔    |
@@ -87,7 +88,6 @@ kubectl delete -f $ORC_RELEASE
 | volume type                 |         |    ◐    |     ◐    |
 
 
-
 ✔: mostly implemented
 
 ◐: partially implemented
diff --git a/api/v1alpha1/endpoint_types.go b/api/v1alpha1/endpoint_types.go
new file mode 100644
index 00000000..01e512e3
--- /dev/null
+++ b/api/v1alpha1/endpoint_types.go
@@ -0,0 +1,90 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+// EndpointResourceSpec contains the desired state of the resource.
+type EndpointResourceSpec struct {
+	// name will be the name of the created resource. If not specified, the
+	// name of the ORC object will be used.
+	// +optional
+	Name *OpenStackName `json:"name,omitempty"`
+
+	// enabled indicates whether the endpoint is enabled or not.
+	// +kubebuilder:default:=true
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// interface indicates the visibility of the endpoint.
+	// +kubebuilder:validation:Enum:=admin;internal;public
+	// +required
+	Interface string `json:"interface,omitempty"`
+
+	// url is the endpoint URL.
+	// +kubebuilder:validation:MaxLength=1024
+	// +required
+	URL string `json:"url"`
+
+	// serviceRef is a reference to the ORC Service which this resource is associated with.
+	// +required
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="serviceRef is immutable"
+	ServiceRef KubernetesNameRef `json:"serviceRef,omitempty"`
+}
+
+// EndpointFilter defines an existing resource by its properties
+// +kubebuilder:validation:MinProperties:=1
+type EndpointFilter struct {
+	// interface of the existing endpoint.
+	// +kubebuilder:validation:Enum:=admin;internal;public
+	// +optional
+	Interface string `json:"interface,omitempty"`
+
+	// serviceRef is a reference to the ORC Service which this resource is associated with.
+	// +optional
+	ServiceRef *KubernetesNameRef `json:"serviceRef,omitempty"`
+
+	// url is the URL of the existing endpoint.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	URL string `json:"url,omitempty"`
+}
+
+// EndpointResourceStatus represents the observed state of the resource.
+type EndpointResourceStatus struct {
+	// name is a Human-readable name for the resource. Might not be unique.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	Name string `json:"name,omitempty"`
+
+	// enabled indicates whether the endpoint is enabled or not.
+	// +optional
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// interface indicates the visibility of the endpoint.
+	// +kubebuilder:validation:Enum:=admin;internal;public
+	// +optional
+	Interface string `json:"interface,omitempty"`
+
+	// url is the endpoint URL.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	URL string `json:"url,omitempty"`
+
+	// serviceID is the ID of the Service to which the resource is associated.
+	// +kubebuilder:validation:MaxLength=1024
+	// +optional
+	ServiceID string `json:"serviceID,omitempty"`
+}
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 67bfeab8..0d8d337e 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -347,6 +347,218 @@ func (in *DomainStatus) DeepCopy() *DomainStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Endpoint) DeepCopyInto(out *Endpoint) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Endpoint.
+func (in *Endpoint) DeepCopy() *Endpoint {
+	if in == nil {
+		return nil
+	}
+	out := new(Endpoint)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Endpoint) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointFilter) DeepCopyInto(out *EndpointFilter) {
+	*out = *in
+	if in.ServiceRef != nil {
+		in, out := &in.ServiceRef, &out.ServiceRef
+		*out = new(KubernetesNameRef)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointFilter.
+func (in *EndpointFilter) DeepCopy() *EndpointFilter {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointFilter)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointImport) DeepCopyInto(out *EndpointImport) {
+	*out = *in
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.Filter != nil {
+		in, out := &in.Filter, &out.Filter
+		*out = new(EndpointFilter)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointImport.
+func (in *EndpointImport) DeepCopy() *EndpointImport {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointImport)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointList) DeepCopyInto(out *EndpointList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Endpoint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointList.
+func (in *EndpointList) DeepCopy() *EndpointList {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EndpointList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointResourceSpec) DeepCopyInto(out *EndpointResourceSpec) {
+	*out = *in
+	if in.Name != nil {
+		in, out := &in.Name, &out.Name
+		*out = new(OpenStackName)
+		**out = **in
+	}
+	if in.Enabled != nil {
+		in, out := &in.Enabled, &out.Enabled
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointResourceSpec.
+func (in *EndpointResourceSpec) DeepCopy() *EndpointResourceSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointResourceSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointResourceStatus) DeepCopyInto(out *EndpointResourceStatus) {
+	*out = *in
+	if in.Enabled != nil {
+		in, out := &in.Enabled, &out.Enabled
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointResourceStatus.
+func (in *EndpointResourceStatus) DeepCopy() *EndpointResourceStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointResourceStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointSpec) DeepCopyInto(out *EndpointSpec) {
+	*out = *in
+	if in.Import != nil {
+		in, out := &in.Import, &out.Import
+		*out = new(EndpointImport)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Resource != nil {
+		in, out := &in.Resource, &out.Resource
+		*out = new(EndpointResourceSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ManagedOptions != nil {
+		in, out := &in.ManagedOptions, &out.ManagedOptions
+		*out = new(ManagedOptions)
+		**out = **in
+	}
+	out.CloudCredentialsRef = in.CloudCredentialsRef
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointSpec.
+func (in *EndpointSpec) DeepCopy() *EndpointSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EndpointStatus) DeepCopyInto(out *EndpointStatus) {
+	*out = *in
+	if in.Conditions != nil {
+		in, out := &in.Conditions, &out.Conditions
+		*out = make([]v1.Condition, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ID != nil {
+		in, out := &in.ID, &out.ID
+		*out = new(string)
+		**out = **in
+	}
+	if in.Resource != nil {
+		in, out := &in.Resource, &out.Resource
+		*out = new(EndpointResourceStatus)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointStatus.
+func (in *EndpointStatus) DeepCopy() *EndpointStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(EndpointStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ExternalGateway) DeepCopyInto(out *ExternalGateway) {
 	*out = *in
diff --git a/api/v1alpha1/zz_generated.endpoint-resource.go b/api/v1alpha1/zz_generated.endpoint-resource.go
new file mode 100644
index 00000000..33bebc76
--- /dev/null
+++ b/api/v1alpha1/zz_generated.endpoint-resource.go
@@ -0,0 +1,177 @@
+// Code generated by resource-generator. DO NOT EDIT.
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// EndpointImport specifies an existing resource which will be imported instead of
+// creating a new one
+// +kubebuilder:validation:MinProperties:=1
+// +kubebuilder:validation:MaxProperties:=1
+type EndpointImport struct {
+	// id contains the unique identifier of an existing OpenStack resource. Note
+	// that when specifying an import by ID, the resource MUST already exist.
+	// The ORC object will enter an error state if the resource does not exist.
+	// +optional
+	// +kubebuilder:validation:Format:=uuid
+	ID *string `json:"id,omitempty"`
+
+	// filter contains a resource query which is expected to return a single
+	// result. The controller will continue to retry if filter returns no
+	// results. If filter returns multiple results the controller will set an
+	// error state and will not continue to retry.
+	// +optional
+	Filter *EndpointFilter `json:"filter,omitempty"`
+}
+
+// EndpointSpec defines the desired state of an ORC object.
+// +kubebuilder:validation:XValidation:rule="self.managementPolicy == 'managed' ? has(self.resource) : true",message="resource must be specified when policy is managed"
+// +kubebuilder:validation:XValidation:rule="self.managementPolicy == 'managed' ? !has(self.__import__) : true",message="import may not be specified when policy is managed"
+// +kubebuilder:validation:XValidation:rule="self.managementPolicy == 'unmanaged' ? !has(self.resource) : true",message="resource may not be specified when policy is unmanaged"
+// +kubebuilder:validation:XValidation:rule="self.managementPolicy == 'unmanaged' ? has(self.__import__) : true",message="import must be specified when policy is unmanaged"
+// +kubebuilder:validation:XValidation:rule="has(self.managedOptions) ? self.managementPolicy == 'managed' : true",message="managedOptions may only be provided when policy is managed"
+type EndpointSpec struct {
+	// import refers to an existing OpenStack resource which will be imported instead of
+	// creating a new one.
+	// +optional
+	Import *EndpointImport `json:"import,omitempty"`
+
+	// resource specifies the desired state of the resource.
+	//
+	// resource may not be specified if the management policy is `unmanaged`.
+	//
+	// resource must be specified if the management policy is `managed`.
+	// +optional
+	Resource *EndpointResourceSpec `json:"resource,omitempty"`
+
+	// managementPolicy defines how ORC will treat the object. Valid values are
+	// `managed`: ORC will create, update, and delete the resource; `unmanaged`:
+	// ORC will import an existing resource, and will not apply updates to it or
+	// delete it.
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="managementPolicy is immutable"
+	// +kubebuilder:default:=managed
+	// +optional
+	ManagementPolicy ManagementPolicy `json:"managementPolicy,omitempty"`
+
+	// managedOptions specifies options which may be applied to managed objects.
+	// +optional
+	ManagedOptions *ManagedOptions `json:"managedOptions,omitempty"`
+
+	// cloudCredentialsRef points to a secret containing OpenStack credentials
+	// +required
+	CloudCredentialsRef CloudCredentialsReference `json:"cloudCredentialsRef"`
+}
+
+// EndpointStatus defines the observed state of an ORC resource.
+type EndpointStatus struct {
+	// conditions represents the observed status of the object.
+	// Known .status.conditions.type are: "Available", "Progressing"
+	//
+	// Available represents the availability of the OpenStack resource. If it is
+	// true then the resource is ready for use.
+	//
+	// Progressing indicates whether the controller is still attempting to
+	// reconcile the current state of the OpenStack resource to the desired
+	// state. Progressing will be False either because the desired state has
+	// been achieved, or because some terminal error prevents it from ever being
+	// achieved and the controller is no longer attempting to reconcile. If
+	// Progressing is True, an observer waiting on the resource should continue
+	// to wait.
+	//
+	// +kubebuilder:validation:MaxItems:=32
+	// +patchMergeKey=type
+	// +patchStrategy=merge
+	// +listType=map
+	// +listMapKey=type
+	// +optional
+	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+
+	// id is the unique identifier of the OpenStack resource.
+	// +optional
+	ID *string `json:"id,omitempty"`
+
+	// resource contains the observed state of the OpenStack resource.
+	// +optional
+	Resource *EndpointResourceStatus `json:"resource,omitempty"`
+}
+
+var _ ObjectWithConditions = &Endpoint{}
+
+func (i *Endpoint) GetConditions() []metav1.Condition {
+	return i.Status.Conditions
+}
+
+// +genclient
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:categories=openstack
+// +kubebuilder:subresource:status
+// +kubebuilder:printcolumn:name="ID",type="string",JSONPath=".status.id",description="Resource ID"
+// +kubebuilder:printcolumn:name="Available",type="string",JSONPath=".status.conditions[?(@.type=='Available')].status",description="Availability status of resource"
+// +kubebuilder:printcolumn:name="Message",type="string",JSONPath=".status.conditions[?(@.type=='Progressing')].message",description="Message describing current progress status"
+
+// Endpoint is the Schema for an ORC resource.
+type Endpoint struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata contains the object metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// spec specifies the desired state of the resource.
+	// +optional
+	Spec EndpointSpec `json:"spec,omitempty"`
+
+	// status defines the observed state of the resource.
+	// +optional
+	Status EndpointStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+
+// EndpointList contains a list of Endpoint.
+type EndpointList struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata contains the list metadata
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty"`
+
+	// items contains a list of Endpoint.
+	// +required
+	Items []Endpoint `json:"items"`
+}
+
+func (l *EndpointList) GetItems() []Endpoint {
+	return l.Items
+}
+
+func init() {
+	SchemeBuilder.Register(&Endpoint{}, &EndpointList{})
+}
+
+func (i *Endpoint) GetCloudCredentialsRef() (*string, *CloudCredentialsReference) {
+	if i == nil {
+		return nil, nil
+	}
+
+	return &i.Namespace, &i.Spec.CloudCredentialsRef
+}
+
+var _ CloudCredentialsRefProvider = &Endpoint{}
diff --git a/cmd/manager/main.go b/cmd/manager/main.go
index 293aa2ba..50346c14 100644
--- a/cmd/manager/main.go
+++ b/cmd/manager/main.go
@@ -28,6 +28,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 
 	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/domain"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/endpoint"
 	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/flavor"
 	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/floatingip"
 	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/interfaces"
@@ -107,6 +108,7 @@ func main() {
 	scopeFactory := scope.NewFactory(orcOpts.ScopeCacheMaxSize, caCerts)
 
 	controllers := []interfaces.Controller{
+		endpoint.New(scopeFactory),
 		image.New(scopeFactory),
 		network.New(scopeFactory),
 		subnet.New(scopeFactory),
diff --git a/cmd/models-schema/zz_generated.openapi.go b/cmd/models-schema/zz_generated.openapi.go
index 5b739dfe..9799c6d2 100644
--- a/cmd/models-schema/zz_generated.openapi.go
+++ b/cmd/models-schema/zz_generated.openapi.go
@@ -44,6 +44,14 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.DomainResourceStatus":           schema_openstack_resource_controller_v2_api_v1alpha1_DomainResourceStatus(ref),
 		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.DomainSpec":                     schema_openstack_resource_controller_v2_api_v1alpha1_DomainSpec(ref),
 		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.DomainStatus":                   schema_openstack_resource_controller_v2_api_v1alpha1_DomainStatus(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.Endpoint":                       schema_openstack_resource_controller_v2_api_v1alpha1_Endpoint(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointFilter":                 schema_openstack_resource_controller_v2_api_v1alpha1_EndpointFilter(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointImport":                 schema_openstack_resource_controller_v2_api_v1alpha1_EndpointImport(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointList":                   schema_openstack_resource_controller_v2_api_v1alpha1_EndpointList(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointResourceSpec":           schema_openstack_resource_controller_v2_api_v1alpha1_EndpointResourceSpec(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointResourceStatus":         schema_openstack_resource_controller_v2_api_v1alpha1_EndpointResourceStatus(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointSpec":                   schema_openstack_resource_controller_v2_api_v1alpha1_EndpointSpec(ref),
+		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointStatus":                 schema_openstack_resource_controller_v2_api_v1alpha1_EndpointStatus(ref),
 		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.ExternalGateway":                schema_openstack_resource_controller_v2_api_v1alpha1_ExternalGateway(ref),
 		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.ExternalGatewayStatus":          schema_openstack_resource_controller_v2_api_v1alpha1_ExternalGatewayStatus(ref),
 		"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.FilterByKeystoneTags":           schema_openstack_resource_controller_v2_api_v1alpha1_FilterByKeystoneTags(ref),
@@ -998,6 +1006,367 @@ func schema_openstack_resource_controller_v2_api_v1alpha1_DomainStatus(ref commo
 	}
 }
 
+func schema_openstack_resource_controller_v2_api_v1alpha1_Endpoint(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "Endpoint is the Schema for an ORC resource.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "metadata contains the object metadata",
+							Default:     map[string]interface{}{},
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"),
+						},
+					},
+					"spec": {
+						SchemaProps: spec.SchemaProps{
+							Description: "spec specifies the desired state of the resource.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointSpec"),
+						},
+					},
+					"status": {
+						SchemaProps: spec.SchemaProps{
+							Description: "status defines the observed state of the resource.",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointStatus"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointSpec", "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta"},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointFilter(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointFilter defines an existing resource by its properties",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"interface": {
+						SchemaProps: spec.SchemaProps{
+							Description: "interface of the existing endpoint.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"serviceRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "serviceRef is a reference to the ORC Service which this resource is associated with.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"url": {
+						SchemaProps: spec.SchemaProps{
+							Description: "url is the URL of the existing endpoint.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointImport(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointImport specifies an existing resource which will be imported instead of creating a new one",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"id": {
+						SchemaProps: spec.SchemaProps{
+							Description: "id contains the unique identifier of an existing OpenStack resource. Note that when specifying an import by ID, the resource MUST already exist. The ORC object will enter an error state if the resource does not exist.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"filter": {
+						SchemaProps: spec.SchemaProps{
+							Description: "filter contains a resource query which is expected to return a single result. The controller will continue to retry if filter returns no results. If filter returns multiple results the controller will set an error state and will not continue to retry.",
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointFilter"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointFilter"},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointList(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointList contains a list of Endpoint.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"kind": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"apiVersion": {
+						SchemaProps: spec.SchemaProps{
+							Description: "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"metadata": {
+						SchemaProps: spec.SchemaProps{
+							Description: "metadata contains the list metadata",
+							Default:     map[string]interface{}{},
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"),
+						},
+					},
+					"items": {
+						SchemaProps: spec.SchemaProps{
+							Description: "items contains a list of Endpoint.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.Endpoint"),
+									},
+								},
+							},
+						},
+					},
+				},
+				Required: []string{"items"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.Endpoint", "k8s.io/apimachinery/pkg/apis/meta/v1.ListMeta"},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointResourceSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointResourceSpec contains the desired state of the resource.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "name will be the name of the created resource. If not specified, the name of the ORC object will be used.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"enabled": {
+						SchemaProps: spec.SchemaProps{
+							Description: "enabled indicates whether the endpoint is enabled or not.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"interface": {
+						SchemaProps: spec.SchemaProps{
+							Description: "interface indicates the visibility of the endpoint.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"url": {
+						SchemaProps: spec.SchemaProps{
+							Description: "url is the endpoint URL.",
+							Default:     "",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"serviceRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "serviceRef is a reference to the ORC Service which this resource is associated with.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+				Required: []string{"interface", "url", "serviceRef"},
+			},
+		},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointResourceStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointResourceStatus represents the observed state of the resource.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"name": {
+						SchemaProps: spec.SchemaProps{
+							Description: "name is a Human-readable name for the resource. Might not be unique.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"enabled": {
+						SchemaProps: spec.SchemaProps{
+							Description: "enabled indicates whether the endpoint is enabled or not.",
+							Type:        []string{"boolean"},
+							Format:      "",
+						},
+					},
+					"interface": {
+						SchemaProps: spec.SchemaProps{
+							Description: "interface indicates the visibility of the endpoint.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"url": {
+						SchemaProps: spec.SchemaProps{
+							Description: "url is the endpoint URL.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"serviceID": {
+						SchemaProps: spec.SchemaProps{
+							Description: "serviceID is the ID of the Service to which the resource is associated.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointSpec(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointSpec defines the desired state of an ORC object.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"import": {
+						SchemaProps: spec.SchemaProps{
+							Description: "import refers to an existing OpenStack resource which will be imported instead of creating a new one.",
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointImport"),
+						},
+					},
+					"resource": {
+						SchemaProps: spec.SchemaProps{
+							Description: "resource specifies the desired state of the resource.\n\nresource may not be specified if the management policy is `unmanaged`.\n\nresource must be specified if the management policy is `managed`.",
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointResourceSpec"),
+						},
+					},
+					"managementPolicy": {
+						SchemaProps: spec.SchemaProps{
+							Description: "managementPolicy defines how ORC will treat the object. Valid values are `managed`: ORC will create, update, and delete the resource; `unmanaged`: ORC will import an existing resource, and will not apply updates to it or delete it.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"managedOptions": {
+						SchemaProps: spec.SchemaProps{
+							Description: "managedOptions specifies options which may be applied to managed objects.",
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.ManagedOptions"),
+						},
+					},
+					"cloudCredentialsRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "cloudCredentialsRef points to a secret containing OpenStack credentials",
+							Default:     map[string]interface{}{},
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.CloudCredentialsReference"),
+						},
+					},
+				},
+				Required: []string{"cloudCredentialsRef"},
+			},
+		},
+		Dependencies: []string{
+			"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.CloudCredentialsReference", "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointImport", "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointResourceSpec", "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.ManagedOptions"},
+	}
+}
+
+func schema_openstack_resource_controller_v2_api_v1alpha1_EndpointStatus(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Description: "EndpointStatus defines the observed state of an ORC resource.",
+				Type:        []string{"object"},
+				Properties: map[string]spec.Schema{
+					"conditions": {
+						VendorExtensible: spec.VendorExtensible{
+							Extensions: spec.Extensions{
+								"x-kubernetes-list-map-keys": []interface{}{
+									"type",
+								},
+								"x-kubernetes-list-type":       "map",
+								"x-kubernetes-patch-merge-key": "type",
+								"x-kubernetes-patch-strategy":  "merge",
+							},
+						},
+						SchemaProps: spec.SchemaProps{
+							Description: "conditions represents the observed status of the object. Known .status.conditions.type are: \"Available\", \"Progressing\"\n\nAvailable represents the availability of the OpenStack resource. If it is true then the resource is ready for use.\n\nProgressing indicates whether the controller is still attempting to reconcile the current state of the OpenStack resource to the desired state. Progressing will be False either because the desired state has been achieved, or because some terminal error prevents it from ever being achieved and the controller is no longer attempting to reconcile. If Progressing is True, an observer waiting on the resource should continue to wait.",
+							Type:        []string{"array"},
+							Items: &spec.SchemaOrArray{
+								Schema: &spec.Schema{
+									SchemaProps: spec.SchemaProps{
+										Default: map[string]interface{}{},
+										Ref:     ref("k8s.io/apimachinery/pkg/apis/meta/v1.Condition"),
+									},
+								},
+							},
+						},
+					},
+					"id": {
+						SchemaProps: spec.SchemaProps{
+							Description: "id is the unique identifier of the OpenStack resource.",
+							Type:        []string{"string"},
+							Format:      "",
+						},
+					},
+					"resource": {
+						SchemaProps: spec.SchemaProps{
+							Description: "resource contains the observed state of the OpenStack resource.",
+							Ref:         ref("github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointResourceStatus"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1.EndpointResourceStatus", "k8s.io/apimachinery/pkg/apis/meta/v1.Condition"},
+	}
+}
+
 func schema_openstack_resource_controller_v2_api_v1alpha1_ExternalGateway(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
diff --git a/cmd/resource-generator/main.go b/cmd/resource-generator/main.go
index 6848b155..7b401f0c 100644
--- a/cmd/resource-generator/main.go
+++ b/cmd/resource-generator/main.go
@@ -162,6 +162,9 @@ var resources []templateFields = []templateFields{
 	{
 		Name: "Group",
 	},
+	{
+		Name: "Endpoint",
+	},
 }
 
 // These resources won't be generated
diff --git a/config/crd/bases/openstack.k-orc.cloud_endpoints.yaml b/config/crd/bases/openstack.k-orc.cloud_endpoints.yaml
new file mode 100644
index 00000000..c2dbddb3
--- /dev/null
+++ b/config/crd/bases/openstack.k-orc.cloud_endpoints.yaml
@@ -0,0 +1,329 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: endpoints.openstack.k-orc.cloud
+spec:
+  group: openstack.k-orc.cloud
+  names:
+    categories:
+    - openstack
+    kind: Endpoint
+    listKind: EndpointList
+    plural: endpoints
+    singular: endpoint
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Resource ID
+      jsonPath: .status.id
+      name: ID
+      type: string
+    - description: Availability status of resource
+      jsonPath: .status.conditions[?(@.type=='Available')].status
+      name: Available
+      type: string
+    - description: Message describing current progress status
+      jsonPath: .status.conditions[?(@.type=='Progressing')].message
+      name: Message
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: Endpoint is the Schema for an ORC resource.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: spec specifies the desired state of the resource.
+            properties:
+              cloudCredentialsRef:
+                description: cloudCredentialsRef points to a secret containing OpenStack
+                  credentials
+                properties:
+                  cloudName:
+                    description: cloudName specifies the name of the entry in the
+                      clouds.yaml file to use.
+                    maxLength: 256
+                    minLength: 1
+                    type: string
+                  secretName:
+                    description: |-
+                      secretName is the name of a secret in the same namespace as the resource being provisioned.
+                      The secret must contain a key named `clouds.yaml` which contains an OpenStack clouds.yaml file.
+                      The secret may optionally contain a key named `cacert` containing a PEM-encoded CA certificate.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                required:
+                - cloudName
+                - secretName
+                type: object
+              import:
+                description: |-
+                  import refers to an existing OpenStack resource which will be imported instead of
+                  creating a new one.
+                maxProperties: 1
+                minProperties: 1
+                properties:
+                  filter:
+                    description: |-
+                      filter contains a resource query which is expected to return a single
+                      result. The controller will continue to retry if filter returns no
+                      results. If filter returns multiple results the controller will set an
+                      error state and will not continue to retry.
+                    minProperties: 1
+                    properties:
+                      interface:
+                        description: interface of the existing endpoint.
+                        enum:
+                        - admin
+                        - internal
+                        - public
+                        type: string
+                      serviceRef:
+                        description: serviceRef is a reference to the ORC Service
+                          which this resource is associated with.
+                        maxLength: 253
+                        minLength: 1
+                        type: string
+                      url:
+                        description: url is the URL of the existing endpoint.
+                        maxLength: 1024
+                        type: string
+                    type: object
+                  id:
+                    description: |-
+                      id contains the unique identifier of an existing OpenStack resource. Note
+                      that when specifying an import by ID, the resource MUST already exist.
+                      The ORC object will enter an error state if the resource does not exist.
+                    format: uuid
+                    type: string
+                type: object
+              managedOptions:
+                description: managedOptions specifies options which may be applied
+                  to managed objects.
+                properties:
+                  onDelete:
+                    default: delete
+                    description: |-
+                      onDelete specifies the behaviour of the controller when the ORC
+                      object is deleted. Options are `delete` - delete the OpenStack resource;
+                      `detach` - do not delete the OpenStack resource. If not specified, the
+                      default is `delete`.
+                    enum:
+                    - delete
+                    - detach
+                    type: string
+                type: object
+              managementPolicy:
+                default: managed
+                description: |-
+                  managementPolicy defines how ORC will treat the object. Valid values are
+                  `managed`: ORC will create, update, and delete the resource; `unmanaged`:
+                  ORC will import an existing resource, and will not apply updates to it or
+                  delete it.
+                enum:
+                - managed
+                - unmanaged
+                type: string
+                x-kubernetes-validations:
+                - message: managementPolicy is immutable
+                  rule: self == oldSelf
+              resource:
+                description: |-
+                  resource specifies the desired state of the resource.
+
+                  resource may not be specified if the management policy is `unmanaged`.
+
+                  resource must be specified if the management policy is `managed`.
+                properties:
+                  enabled:
+                    default: true
+                    description: enabled indicates whether the endpoint is enabled
+                      or not.
+                    type: boolean
+                  interface:
+                    description: interface indicates the visibility of the endpoint.
+                    enum:
+                    - admin
+                    - internal
+                    - public
+                    type: string
+                  name:
+                    description: |-
+                      name will be the name of the created resource. If not specified, the
+                      name of the ORC object will be used.
+                    maxLength: 255
+                    minLength: 1
+                    pattern: ^[^,]+$
+                    type: string
+                  serviceRef:
+                    description: serviceRef is a reference to the ORC Service which
+                      this resource is associated with.
+                    maxLength: 253
+                    minLength: 1
+                    type: string
+                    x-kubernetes-validations:
+                    - message: serviceRef is immutable
+                      rule: self == oldSelf
+                  url:
+                    description: url is the endpoint URL.
+                    maxLength: 1024
+                    type: string
+                required:
+                - interface
+                - serviceRef
+                - url
+                type: object
+            required:
+            - cloudCredentialsRef
+            type: object
+            x-kubernetes-validations:
+            - message: resource must be specified when policy is managed
+              rule: 'self.managementPolicy == ''managed'' ? has(self.resource) : true'
+            - message: import may not be specified when policy is managed
+              rule: 'self.managementPolicy == ''managed'' ? !has(self.__import__)
+                : true'
+            - message: resource may not be specified when policy is unmanaged
+              rule: 'self.managementPolicy == ''unmanaged'' ? !has(self.resource)
+                : true'
+            - message: import must be specified when policy is unmanaged
+              rule: 'self.managementPolicy == ''unmanaged'' ? has(self.__import__)
+                : true'
+            - message: managedOptions may only be provided when policy is managed
+              rule: 'has(self.managedOptions) ? self.managementPolicy == ''managed''
+                : true'
+          status:
+            description: status defines the observed state of the resource.
+            properties:
+              conditions:
+                description: |-
+                  conditions represents the observed status of the object.
+                  Known .status.conditions.type are: "Available", "Progressing"
+
+                  Available represents the availability of the OpenStack resource. If it is
+                  true then the resource is ready for use.
+
+                  Progressing indicates whether the controller is still attempting to
+                  reconcile the current state of the OpenStack resource to the desired
+                  state. Progressing will be False either because the desired state has
+                  been achieved, or because some terminal error prevents it from ever being
+                  achieved and the controller is no longer attempting to reconcile. If
+                  Progressing is True, an observer waiting on the resource should continue
+                  to wait.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                maxItems: 32
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+              id:
+                description: id is the unique identifier of the OpenStack resource.
+                type: string
+              resource:
+                description: resource contains the observed state of the OpenStack
+                  resource.
+                properties:
+                  enabled:
+                    description: enabled indicates whether the endpoint is enabled
+                      or not.
+                    type: boolean
+                  interface:
+                    description: interface indicates the visibility of the endpoint.
+                    enum:
+                    - admin
+                    - internal
+                    - public
+                    type: string
+                  name:
+                    description: name is a Human-readable name for the resource. Might
+                      not be unique.
+                    maxLength: 1024
+                    type: string
+                  serviceID:
+                    description: serviceID is the ID of the Service to which the resource
+                      is associated.
+                    maxLength: 1024
+                    type: string
+                  url:
+                    description: url is the endpoint URL.
+                    maxLength: 1024
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
diff --git a/config/crd/kustomization.yaml b/config/crd/kustomization.yaml
index 33b8c85e..47c09cce 100644
--- a/config/crd/kustomization.yaml
+++ b/config/crd/kustomization.yaml
@@ -4,6 +4,7 @@
 # It should be run by config/default
 resources:
 - bases/openstack.k-orc.cloud_domains.yaml
+- bases/openstack.k-orc.cloud_endpoints.yaml
 - bases/openstack.k-orc.cloud_flavors.yaml
 - bases/openstack.k-orc.cloud_floatingips.yaml
 - bases/openstack.k-orc.cloud_groups.yaml
diff --git a/config/manifests/bases/orc.clusterserviceversion.yaml b/config/manifests/bases/orc.clusterserviceversion.yaml
index 0c5f1c0e..0b7164e7 100644
--- a/config/manifests/bases/orc.clusterserviceversion.yaml
+++ b/config/manifests/bases/orc.clusterserviceversion.yaml
@@ -24,6 +24,11 @@ spec:
       kind: Domain
       name: domains.openstack.k-orc.cloud
       version: v1alpha1
+    - description: Endpoint is the Schema for an ORC resource.
+      displayName: Endpoint
+      kind: Endpoint
+      name: endpoints.openstack.k-orc.cloud
+      version: v1alpha1
     - description: Flavor is the Schema for an ORC resource.
       displayName: Flavor
       kind: Flavor
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
index 5a0a7443..a2b54d6b 100644
--- a/config/rbac/role.yaml
+++ b/config/rbac/role.yaml
@@ -18,6 +18,7 @@ rules:
   - openstack.k-orc.cloud
   resources:
   - domains
+  - endpoints
   - flavors
   - floatingips
   - groups
@@ -48,6 +49,7 @@ rules:
   - openstack.k-orc.cloud
   resources:
   - domains/status
+  - endpoints/status
   - flavors/status
   - floatingips/status
   - groups/status
diff --git a/config/samples/kustomization.yaml b/config/samples/kustomization.yaml
index dac467c6..476b934c 100644
--- a/config/samples/kustomization.yaml
+++ b/config/samples/kustomization.yaml
@@ -2,6 +2,7 @@
 ## Append samples of your project ##
 resources:
 - openstack_v1alpha1_domain.yaml
+- openstack_v1alpha1_endpoint.yaml
 - openstack_v1alpha1_flavor.yaml
 - openstack_v1alpha1_floatingip.yaml
 - openstack_v1alpha1_group.yaml
diff --git a/config/samples/openstack_v1alpha1_endpoint.yaml b/config/samples/openstack_v1alpha1_endpoint.yaml
new file mode 100644
index 00000000..78378929
--- /dev/null
+++ b/config/samples/openstack_v1alpha1_endpoint.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-sample
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    interface: internal
+    url: "https://example.com"
+    serviceRef: service-sample
+
diff --git a/internal/controllers/endpoint/actuator.go b/internal/controllers/endpoint/actuator.go
new file mode 100644
index 00000000..1dae9710
--- /dev/null
+++ b/internal/controllers/endpoint/actuator.go
@@ -0,0 +1,310 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	"context"
+	"fmt"
+	"iter"
+
+	"github.com/gophercloud/gophercloud/v2"
+	"github.com/gophercloud/gophercloud/v2/openstack/identity/v3/endpoints"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/utils/ptr"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	orcv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/interfaces"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/progress"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/logging"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/osclients"
+	orcerrors "github.com/k-orc/openstack-resource-controller/v2/internal/util/errors"
+)
+
+// OpenStack resource types
+type (
+	osResourceT = endpoints.Endpoint
+
+	createResourceActuator = interfaces.CreateResourceActuator[orcObjectPT, orcObjectT, filterT, osResourceT]
+	deleteResourceActuator = interfaces.DeleteResourceActuator[orcObjectPT, orcObjectT, osResourceT]
+	resourceReconciler     = interfaces.ResourceReconciler[orcObjectPT, osResourceT]
+	helperFactory          = interfaces.ResourceHelperFactory[orcObjectPT, orcObjectT, resourceSpecT, filterT, osResourceT]
+)
+
+type endpointActuator struct {
+	osClient  osclients.EndpointClient
+	k8sClient client.Client
+}
+
+var _ createResourceActuator = endpointActuator{}
+var _ deleteResourceActuator = endpointActuator{}
+
+func (endpointActuator) GetResourceID(osResource *osResourceT) string {
+	return osResource.ID
+}
+
+func (actuator endpointActuator) GetOSResourceByID(ctx context.Context, id string) (*osResourceT, progress.ReconcileStatus) {
+	resource, err := actuator.osClient.GetEndpoint(ctx, id)
+	if err != nil {
+		return nil, progress.WrapError(err)
+	}
+	return resource, nil
+}
+
+func (actuator endpointActuator) ListOSResourcesForAdoption(ctx context.Context, orcObject orcObjectPT) (iter.Seq2[*osResourceT, error], bool) {
+	resourceSpec := orcObject.Spec.Resource
+	if resourceSpec == nil {
+		return nil, false
+	}
+
+	service, _ := serviceDependency.GetDependency(
+		ctx, actuator.k8sClient, orcObject, func(dep *orcv1alpha1.Service) bool {
+			return orcv1alpha1.IsAvailable(dep) && dep.Status.ID != nil
+		},
+	)
+
+	if service == nil {
+		return nil, false
+	}
+
+	var filters []osclients.ResourceFilter[osResourceT]
+	filters = append(filters, func(e *endpoints.Endpoint) bool {
+		return e.URL == resourceSpec.URL
+	})
+
+	listOpts := endpoints.ListOpts{
+		Availability: gophercloud.Availability(resourceSpec.Interface),
+		ServiceID:    ptr.Deref(service.Status.ID, ""),
+	}
+
+	return actuator.listOsResources(ctx, listOpts, filters), true
+}
+
+func (actuator endpointActuator) ListOSResourcesForImport(ctx context.Context, obj orcObjectPT, filter filterT) (iter.Seq2[*osResourceT, error], progress.ReconcileStatus) {
+	var reconcileStatus progress.ReconcileStatus
+
+	service := &orcv1alpha1.Service{}
+	if filter.ServiceRef != nil {
+		serviceKey := client.ObjectKey{Name: string(*filter.ServiceRef), Namespace: obj.Namespace}
+		if err := actuator.k8sClient.Get(ctx, serviceKey, service); err != nil {
+			if apierrors.IsNotFound(err) {
+				reconcileStatus = reconcileStatus.WithReconcileStatus(
+					progress.WaitingOnObject("Service", serviceKey.Name, progress.WaitingOnCreation))
+			} else {
+				reconcileStatus = reconcileStatus.WithReconcileStatus(
+					progress.WrapError(fmt.Errorf("fetching service %s: %w", serviceKey.Name, err)))
+			}
+		} else {
+			if !orcv1alpha1.IsAvailable(service) || service.Status.ID == nil {
+				reconcileStatus = reconcileStatus.WithReconcileStatus(
+					progress.WaitingOnObject("Service", serviceKey.Name, progress.WaitingOnReady))
+			}
+		}
+	}
+
+	if needsReschedule, _ := reconcileStatus.NeedsReschedule(); needsReschedule {
+		return nil, reconcileStatus
+	}
+
+	var resourceFilters []osclients.ResourceFilter[osResourceT]
+	if filter.URL != "" {
+		resourceFilters = append(resourceFilters, func(e *endpoints.Endpoint) bool {
+			return e.URL == filter.URL
+		})
+	}
+
+	listOpts := endpoints.ListOpts{
+		ServiceID:    ptr.Deref(service.Status.ID, ""),
+		Availability: gophercloud.Availability(filter.Interface),
+	}
+
+	return actuator.listOsResources(ctx, listOpts, resourceFilters), nil
+}
+
+func (actuator endpointActuator) listOsResources(ctx context.Context, listOpts endpoints.ListOpts, filter []osclients.ResourceFilter[osResourceT]) iter.Seq2[*osResourceT, error] {
+	endpoints := actuator.osClient.ListEndpoints(ctx, listOpts)
+	return osclients.Filter(endpoints, filter...)
+}
+
+func (actuator endpointActuator) CreateResource(ctx context.Context, obj orcObjectPT) (*osResourceT, progress.ReconcileStatus) {
+	resource := obj.Spec.Resource
+
+	if resource == nil {
+		// Should have been caught by API validation
+		return nil, progress.WrapError(
+			orcerrors.Terminal(orcv1alpha1.ConditionReasonInvalidConfiguration, "Creation requested, but spec.resource is not set"))
+	}
+	var reconcileStatus progress.ReconcileStatus
+
+	var serviceID string
+	service, serviceDepRS := serviceDependency.GetDependency(
+		ctx, actuator.k8sClient, obj, func(dep *orcv1alpha1.Service) bool {
+			return orcv1alpha1.IsAvailable(dep) && dep.Status.ID != nil
+		},
+	)
+
+	reconcileStatus = reconcileStatus.WithReconcileStatus(serviceDepRS)
+	if service != nil {
+		serviceID = ptr.Deref(service.Status.ID, "")
+	}
+	if needsReschedule, _ := reconcileStatus.NeedsReschedule(); needsReschedule {
+		return nil, reconcileStatus
+	}
+	createOpts := endpoints.CreateOpts{
+		Name:         getResourceName(obj),
+		ServiceID:    serviceID,
+		Availability: gophercloud.Availability(resource.Interface),
+		URL:          resource.URL,
+	}
+
+	osResource, err := actuator.osClient.CreateEndpoint(ctx, createOpts)
+	if err != nil {
+		// We should require the spec to be updated before retrying a create which returned a conflict
+		if !orcerrors.IsRetryable(err) {
+			err = orcerrors.Terminal(orcv1alpha1.ConditionReasonInvalidConfiguration, "invalid configuration creating resource: "+err.Error(), err)
+		}
+		return nil, progress.WrapError(err)
+	}
+
+	return osResource, nil
+}
+
+func (actuator endpointActuator) DeleteResource(ctx context.Context, _ orcObjectPT, resource *osResourceT) progress.ReconcileStatus {
+	return progress.WrapError(actuator.osClient.DeleteEndpoint(ctx, resource.ID))
+}
+
+func (actuator endpointActuator) updateResource(ctx context.Context, obj orcObjectPT, osResource *osResourceT) progress.ReconcileStatus {
+	log := ctrl.LoggerFrom(ctx)
+	resource := obj.Spec.Resource
+	if resource == nil {
+		// Should have been caught by API validation
+		return progress.WrapError(
+			orcerrors.Terminal(orcv1alpha1.ConditionReasonInvalidConfiguration, "Update requested, but spec.resource is not set"))
+	}
+
+	updateOpts := endpoints.UpdateOpts{}
+
+	handleNameUpdate(&updateOpts, obj, osResource)
+	handleURLUpdate(&updateOpts, resource, osResource)
+	handleInterfaceUpdate(&updateOpts, resource, osResource)
+
+	needsUpdate, err := needsUpdate(updateOpts)
+	if err != nil {
+		return progress.WrapError(
+			orcerrors.Terminal(orcv1alpha1.ConditionReasonInvalidConfiguration, "invalid configuration updating resource: "+err.Error(), err))
+	}
+	if !needsUpdate {
+		log.V(logging.Debug).Info("No changes")
+		return nil
+	}
+
+	_, err = actuator.osClient.UpdateEndpoint(ctx, osResource.ID, updateOpts)
+
+	// We should require the spec to be updated before retrying an update which returned a conflict
+	if orcerrors.IsConflict(err) {
+		err = orcerrors.Terminal(orcv1alpha1.ConditionReasonInvalidConfiguration, "invalid configuration updating resource: "+err.Error(), err)
+	}
+
+	if err != nil {
+		return progress.WrapError(err)
+	}
+
+	return progress.NeedsRefresh()
+}
+
+func needsUpdate(updateOpts endpoints.UpdateOpts) (bool, error) {
+	updateOptsMap, err := updateOpts.ToEndpointUpdateMap()
+	if err != nil {
+		return false, err
+	}
+
+	updateMap, ok := updateOptsMap["endpoint"].(map[string]any)
+	if !ok {
+		updateMap = make(map[string]any)
+	}
+
+	return len(updateMap) > 0, nil
+}
+
+func handleNameUpdate(updateOpts *endpoints.UpdateOpts, obj orcObjectPT, osResource *osResourceT) {
+	name := getResourceName(obj)
+	if osResource.Name != name {
+		updateOpts.Name = name
+	}
+}
+
+func handleURLUpdate(updateOpts *endpoints.UpdateOpts, resource *resourceSpecT, osResource *osResourceT) {
+	url := resource.URL
+	if osResource.URL != url {
+		updateOpts.URL = url
+	}
+}
+
+func handleInterfaceUpdate(updateOpts *endpoints.UpdateOpts, resource *resourceSpecT, osResource *osResourceT) {
+	endpointInterface := gophercloud.Availability(resource.Interface)
+	if osResource.Availability != endpointInterface {
+		updateOpts.Availability = endpointInterface
+	}
+}
+
+func (actuator endpointActuator) GetResourceReconcilers(ctx context.Context, orcObject orcObjectPT, osResource *osResourceT, controller interfaces.ResourceController) ([]resourceReconciler, progress.ReconcileStatus) {
+	return []resourceReconciler{
+		actuator.updateResource,
+	}, nil
+}
+
+type endpointHelperFactory struct{}
+
+var _ helperFactory = endpointHelperFactory{}
+
+func newActuator(ctx context.Context, orcObject *orcv1alpha1.Endpoint, controller interfaces.ResourceController) (endpointActuator, progress.ReconcileStatus) {
+	log := ctrl.LoggerFrom(ctx)
+
+	// Ensure credential secrets exist and have our finalizer
+	_, reconcileStatus := credentialsDependency.GetDependencies(ctx, controller.GetK8sClient(), orcObject, func(*corev1.Secret) bool { return true })
+	if needsReschedule, _ := reconcileStatus.NeedsReschedule(); needsReschedule {
+		return endpointActuator{}, reconcileStatus
+	}
+
+	clientScope, err := controller.GetScopeFactory().NewClientScopeFromObject(ctx, controller.GetK8sClient(), log, orcObject)
+	if err != nil {
+		return endpointActuator{}, progress.WrapError(err)
+	}
+	osClient, err := clientScope.NewEndpointClient()
+	if err != nil {
+		return endpointActuator{}, progress.WrapError(err)
+	}
+
+	return endpointActuator{
+		osClient:  osClient,
+		k8sClient: controller.GetK8sClient(),
+	}, nil
+}
+
+func (endpointHelperFactory) NewAPIObjectAdapter(obj orcObjectPT) adapterI {
+	return endpointAdapter{obj}
+}
+
+func (endpointHelperFactory) NewCreateActuator(ctx context.Context, orcObject orcObjectPT, controller interfaces.ResourceController) (createResourceActuator, progress.ReconcileStatus) {
+	return newActuator(ctx, orcObject, controller)
+}
+
+func (endpointHelperFactory) NewDeleteActuator(ctx context.Context, orcObject orcObjectPT, controller interfaces.ResourceController) (deleteResourceActuator, progress.ReconcileStatus) {
+	return newActuator(ctx, orcObject, controller)
+}
diff --git a/internal/controllers/endpoint/actuator_test.go b/internal/controllers/endpoint/actuator_test.go
new file mode 100644
index 00000000..d322f0ca
--- /dev/null
+++ b/internal/controllers/endpoint/actuator_test.go
@@ -0,0 +1,112 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	"testing"
+
+	"github.com/gophercloud/gophercloud/v2"
+	"github.com/gophercloud/gophercloud/v2/openstack/identity/v3/endpoints"
+	orcv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	"k8s.io/utils/ptr"
+)
+
+func TestNeedsUpdate(t *testing.T) {
+	testCases := []struct {
+		name         string
+		updateOpts   endpoints.UpdateOpts
+		expectChange bool
+	}{
+		{
+			name:         "Empty base opts",
+			updateOpts:   endpoints.UpdateOpts{},
+			expectChange: false,
+		},
+		{
+			name:         "Updated opts",
+			updateOpts:   endpoints.UpdateOpts{URL: "http://updated.com"},
+			expectChange: true,
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			got, _ := needsUpdate(tt.updateOpts)
+			if got != tt.expectChange {
+				t.Errorf("Expected change: %v, got: %v", tt.expectChange, got)
+			}
+		})
+	}
+}
+
+func TestHandleInterfaceUpdate(t *testing.T) {
+	testCases := []struct {
+		name          string
+		newValue      *string
+		existingValue string
+		expectChange  bool
+	}{
+		{name: "Identical", newValue: ptr.To("internal"), existingValue: "internal", expectChange: false},
+		{name: "Different", newValue: ptr.To("public"), existingValue: "internal", expectChange: true},
+		{name: "No value provided, existing is kept", newValue: nil, existingValue: "internal", expectChange: false},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			resourceSpec := &orcv1alpha1.EndpointResourceSpec{Interface: ptr.Deref(tt.newValue, "")}
+			osResource := &osResourceT{Availability: gophercloud.Availability(tt.existingValue)}
+
+			updateOpts := endpoints.UpdateOpts{}
+			handleInterfaceUpdate(&updateOpts, resourceSpec, osResource)
+
+			got, _ := needsUpdate(updateOpts)
+			if got != tt.expectChange {
+				t.Errorf("Expected change: %v, got: %v", tt.expectChange, got)
+			}
+		})
+
+	}
+}
+
+func TestHandleURLUpdate(t *testing.T) {
+	testCases := []struct {
+		name          string
+		newValue      *string
+		existingValue string
+		expectChange  bool
+	}{
+		{name: "Identical", newValue: ptr.To("http://same.com"), existingValue: "http://same.com", expectChange: false},
+		{name: "Different", newValue: ptr.To("http://different.com"), existingValue: "http://same.com", expectChange: true},
+		{name: "No value provided, existing is kept", newValue: nil, existingValue: "http://same.com", expectChange: false},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			resourceSpec := &orcv1alpha1.EndpointResourceSpec{URL: ptr.Deref(tt.newValue, "")}
+			osResource := &osResourceT{URL: tt.existingValue}
+
+			updateOpts := endpoints.UpdateOpts{}
+			handleURLUpdate(&updateOpts, resourceSpec, osResource)
+
+			got, _ := needsUpdate(updateOpts)
+			if got != tt.expectChange {
+				t.Errorf("Expected change: %v, got: %v", tt.expectChange, got)
+			}
+		})
+
+	}
+}
diff --git a/internal/controllers/endpoint/controller.go b/internal/controllers/endpoint/controller.go
new file mode 100644
index 00000000..5f4a3a34
--- /dev/null
+++ b/internal/controllers/endpoint/controller.go
@@ -0,0 +1,114 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	"context"
+	"errors"
+
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/builder"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+
+	orcv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/interfaces"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/reconciler"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/scope"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/util/credentials"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/util/dependency"
+	"github.com/k-orc/openstack-resource-controller/v2/pkg/predicates"
+)
+
+const controllerName = "endpoint"
+
+// +kubebuilder:rbac:groups=openstack.k-orc.cloud,resources=endpoints,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=openstack.k-orc.cloud,resources=endpoints/status,verbs=get;update;patch
+
+type endpointReconcilerConstructor struct {
+	scopeFactory scope.Factory
+}
+
+func New(scopeFactory scope.Factory) interfaces.Controller {
+	return endpointReconcilerConstructor{scopeFactory: scopeFactory}
+}
+
+func (endpointReconcilerConstructor) GetName() string {
+	return controllerName
+}
+
+var serviceDependency = dependency.NewDeletionGuardDependency[*orcv1alpha1.EndpointList, *orcv1alpha1.Service](
+	"spec.resource.serviceRef",
+	func(endpoint *orcv1alpha1.Endpoint) []string {
+		resource := endpoint.Spec.Resource
+		if resource == nil {
+			return nil
+		}
+		return []string{string(resource.ServiceRef)}
+	},
+	finalizer, externalObjectFieldOwner,
+)
+
+var serviceImportDependency = dependency.NewDependency[*orcv1alpha1.EndpointList, *orcv1alpha1.Service](
+	"spec.import.filter.serviceRef",
+	func(endpoint *orcv1alpha1.Endpoint) []string {
+		resource := endpoint.Spec.Import
+		if resource == nil || resource.Filter == nil || resource.Filter.ServiceRef == nil {
+			return nil
+		}
+		return []string{string(*resource.Filter.ServiceRef)}
+	},
+)
+
+// SetupWithManager sets up the controller with the Manager.
+func (c endpointReconcilerConstructor) SetupWithManager(ctx context.Context, mgr ctrl.Manager, options controller.Options) error {
+	log := ctrl.LoggerFrom(ctx)
+	k8sClient := mgr.GetClient()
+
+	serviceWatchEventHandler, err := serviceDependency.WatchEventHandler(log, k8sClient)
+	if err != nil {
+		return err
+	}
+
+	serviceImportWatchEventHandler, err := serviceImportDependency.WatchEventHandler(log, k8sClient)
+	if err != nil {
+		return err
+	}
+
+	builder := ctrl.NewControllerManagedBy(mgr).
+		WithOptions(options).
+		Watches(&orcv1alpha1.Service{}, serviceWatchEventHandler,
+			builder.WithPredicates(predicates.NewBecameAvailable(log, &orcv1alpha1.Service{})),
+		).
+		// A second watch is necessary because we need a different handler that omits deletion guards
+		Watches(&orcv1alpha1.Service{}, serviceImportWatchEventHandler,
+			builder.WithPredicates(predicates.NewBecameAvailable(log, &orcv1alpha1.Service{})),
+		).
+		For(&orcv1alpha1.Endpoint{})
+
+	if err := errors.Join(
+		serviceDependency.AddToManager(ctx, mgr),
+		serviceImportDependency.AddToManager(ctx, mgr),
+		credentialsDependency.AddToManager(ctx, mgr),
+		credentials.AddCredentialsWatch(log, mgr.GetClient(), builder, credentialsDependency),
+	); err != nil {
+		return err
+	}
+
+	r := reconciler.NewController(controllerName, mgr.GetClient(), c.scopeFactory, endpointHelperFactory{}, endpointStatusWriter{})
+	return builder.Complete(&r)
+}
diff --git a/internal/controllers/endpoint/status.go b/internal/controllers/endpoint/status.go
new file mode 100644
index 00000000..22003bb8
--- /dev/null
+++ b/internal/controllers/endpoint/status.go
@@ -0,0 +1,60 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	"github.com/go-logr/logr"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	orcv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/interfaces"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/progress"
+	orcapplyconfigv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/applyconfiguration/api/v1alpha1"
+)
+
+type endpointStatusWriter struct{}
+
+type objectApplyT = orcapplyconfigv1alpha1.EndpointApplyConfiguration
+type statusApplyT = orcapplyconfigv1alpha1.EndpointStatusApplyConfiguration
+
+var _ interfaces.ResourceStatusWriter[*orcv1alpha1.Endpoint, *osResourceT, *objectApplyT, *statusApplyT] = endpointStatusWriter{}
+
+func (endpointStatusWriter) GetApplyConfig(name, namespace string) *objectApplyT {
+	return orcapplyconfigv1alpha1.Endpoint(name, namespace)
+}
+
+func (endpointStatusWriter) ResourceAvailableStatus(orcObject *orcv1alpha1.Endpoint, osResource *osResourceT) (metav1.ConditionStatus, progress.ReconcileStatus) {
+	if osResource == nil {
+		if orcObject.Status.ID == nil {
+			return metav1.ConditionFalse, nil
+		} else {
+			return metav1.ConditionUnknown, nil
+		}
+	}
+	return metav1.ConditionTrue, nil
+}
+
+func (endpointStatusWriter) ApplyResourceStatus(log logr.Logger, osResource *osResourceT, statusApply *statusApplyT) {
+	resourceStatus := orcapplyconfigv1alpha1.EndpointResourceStatus().
+		WithServiceID(osResource.ServiceID).
+		WithEnabled(osResource.Enabled).
+		WithInterface(string(osResource.Availability)).
+		WithURL(osResource.URL).
+		WithName(osResource.Name)
+
+	statusApply.WithResource(resourceStatus)
+}
diff --git a/internal/controllers/endpoint/tests/endpoint-create-full/00-assert.yaml b/internal/controllers/endpoint/tests/endpoint-create-full/00-assert.yaml
new file mode 100644
index 00000000..3507b634
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-full/00-assert.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-create-full
+status:
+  resource:
+    name: endpoint-create-full-override
+    interface: internal
+    url: https://example.com
+    #enabled: false
+  conditions:
+  - type: Available
+    status: "True"
+    reason: Success
+  - type: Progressing
+    status: "False"
+    reason: Success
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-create-full
+      ref: endpoint
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Service
+      name: endpoint-create-full
+      ref: service
+assertAll:
+    - celExpr: "endpoint.status.id != ''"
+    - celExpr: "endpoint.status.resource.serviceID == service.status.id"
diff --git a/internal/controllers/endpoint/tests/endpoint-create-full/00-create-resource.yaml b/internal/controllers/endpoint/tests/endpoint-create-full/00-create-resource.yaml
new file mode 100644
index 00000000..d65438be
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-full/00-create-resource.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-create-full
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-test
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-create-full
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    name: endpoint-create-full-override
+    serviceRef: endpoint-create-full
+    interface: internal
+    url: https://example.com
+    # TODO(winiciusallan): make this field available after
+    # the next gophercloud minor.
+    #enabled: false
diff --git a/internal/controllers/endpoint/tests/endpoint-create-full/00-secret.yaml b/internal/controllers/endpoint/tests/endpoint-create-full/00-secret.yaml
new file mode 100644
index 00000000..045711ee
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-full/00-secret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl create secret generic openstack-clouds --from-file=clouds.yaml=${E2E_KUTTL_OSCLOUDS} ${E2E_KUTTL_CACERT_OPT}
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-create-full/README.md b/internal/controllers/endpoint/tests/endpoint-create-full/README.md
new file mode 100644
index 00000000..d625e7b6
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-full/README.md
@@ -0,0 +1,11 @@
+# Create a Endpoint with all the options
+
+## Step 00
+
+Create a Endpoint using all available fields, and verify that the observed state corresponds to the spec.
+
+Also validate that the OpenStack resource uses the name from the spec when it is specified.
+
+## Reference
+
+https://k-orc.cloud/development/writing-tests/#create-full
diff --git a/internal/controllers/endpoint/tests/endpoint-create-minimal/00-assert.yaml b/internal/controllers/endpoint/tests/endpoint-create-minimal/00-assert.yaml
new file mode 100644
index 00000000..28806601
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-minimal/00-assert.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-create-minimal
+status:
+  resource:
+    name: endpoint-create-minimal
+    url: http://example.com
+    interface: internal
+    enabled: true
+  conditions:
+  - type: Available
+    status: "True"
+    reason: Success
+  - type: Progressing
+    status: "False"
+    reason: Success
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-create-minimal
+      ref: endpoint
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Service
+      name: endpoint-create-minimal
+      ref: service
+assertAll:
+    - celExpr: "endpoint.status.id != ''"
+    - celExpr: "endpoint.status.resource.serviceID == service.status.id"
diff --git a/internal/controllers/endpoint/tests/endpoint-create-minimal/00-create-resource.yaml b/internal/controllers/endpoint/tests/endpoint-create-minimal/00-create-resource.yaml
new file mode 100644
index 00000000..48b59dc1
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-minimal/00-create-resource.yaml
@@ -0,0 +1,26 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-create-minimal
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-test
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-create-minimal
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-create-minimal
+    interface: internal
+    url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-create-minimal/00-secret.yaml b/internal/controllers/endpoint/tests/endpoint-create-minimal/00-secret.yaml
new file mode 100644
index 00000000..045711ee
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-minimal/00-secret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl create secret generic openstack-clouds --from-file=clouds.yaml=${E2E_KUTTL_OSCLOUDS} ${E2E_KUTTL_CACERT_OPT}
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-create-minimal/01-assert.yaml b/internal/controllers/endpoint/tests/endpoint-create-minimal/01-assert.yaml
new file mode 100644
index 00000000..e724dcba
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-minimal/01-assert.yaml
@@ -0,0 +1,11 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: v1
+      kind: Secret
+      name: openstack-clouds
+      ref: secret
+assertAll:
+    - celExpr: "secret.metadata.deletionTimestamp != 0"
+    - celExpr: "'openstack.k-orc.cloud/endpoint' in secret.metadata.finalizers"
diff --git a/internal/controllers/endpoint/tests/endpoint-create-minimal/01-delete-secret.yaml b/internal/controllers/endpoint/tests/endpoint-create-minimal/01-delete-secret.yaml
new file mode 100644
index 00000000..1620791b
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-minimal/01-delete-secret.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  # We expect the deletion to hang due to the finalizer, so use --wait=false
+  - command: kubectl delete secret openstack-clouds --wait=false
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-create-minimal/README.md b/internal/controllers/endpoint/tests/endpoint-create-minimal/README.md
new file mode 100644
index 00000000..b9644e32
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-create-minimal/README.md
@@ -0,0 +1,15 @@
+# Create a Endpoint with the minimum options
+
+## Step 00
+
+Create a minimal Endpoint, that sets only the required fields, and verify that the observed state corresponds to the spec.
+
+Also validate that the OpenStack resource uses the name of the ORC object when it is not specified.
+
+## Step 01
+
+Try deleting the secret and ensure that it is not deleted thanks to the finalizer.
+
+## Reference
+
+https://k-orc.cloud/development/writing-tests/#create-minimal
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/00-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/00-assert.yaml
new file mode 100644
index 00000000..17743d6e
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/00-assert.yaml
@@ -0,0 +1,17 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency
+status:
+  conditions:
+    - type: Available
+      message: |-
+        Waiting for Service/endpoint-import-dependency to be ready
+      status: "False"
+      reason: Progressing
+    - type: Progressing
+      message: |-
+        Waiting for Service/endpoint-import-dependency to be ready
+      status: "True"
+      reason: Progressing
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/00-import-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/00-import-resource.yaml
new file mode 100644
index 00000000..76cddcd6
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/00-import-resource.yaml
@@ -0,0 +1,28 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-import-dependency
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: unmanaged
+  import:
+    filter:
+      name: endpoint-import-dependency-external
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: unmanaged
+  import:
+    filter:
+      serviceRef: endpoint-import-dependency
+      interface: internal
+      url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/00-secret.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/00-secret.yaml
new file mode 100644
index 00000000..045711ee
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/00-secret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl create secret generic openstack-clouds --from-file=clouds.yaml=${E2E_KUTTL_OSCLOUDS} ${E2E_KUTTL_CACERT_OPT}
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/01-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/01-assert.yaml
new file mode 100644
index 00000000..438dd019
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/01-assert.yaml
@@ -0,0 +1,32 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency-not-this-one
+status:
+  conditions:
+    - type: Available
+      message: OpenStack resource is available
+      status: "True"
+      reason: Success
+    - type: Progressing
+      message: OpenStack resource is up to date
+      status: "False"
+      reason: Success
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency
+status:
+  conditions:
+    - type: Available
+      message: |-
+        Waiting for Service/endpoint-import-dependency to be ready
+      status: "False"
+      reason: Progressing
+    - type: Progressing
+      message: |-
+        Waiting for Service/endpoint-import-dependency to be ready
+      status: "True"
+      reason: Progressing
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/01-create-trap-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/01-create-trap-resource.yaml
new file mode 100644
index 00000000..a7c71ece
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/01-create-trap-resource.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-import-dependency-not-this-one
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-import-dependency-not-this-one
+---
+# This `endpoint-import-dependency-not-this-one` should not be picked by the import filter
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency-not-this-one
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-import-dependency-not-this-one
+    interface: internal
+    url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/02-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/02-assert.yaml
new file mode 100644
index 00000000..76b42d4b
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/02-assert.yaml
@@ -0,0 +1,34 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-import-dependency
+      ref: endpoint1
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-import-dependency-not-this-one
+      ref: endpoint2
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Service
+      name: endpoint-import-dependency
+      ref: service
+assertAll:
+    - celExpr: "endpoint1.status.id != endpoint2.status.id"
+    - celExpr: "endpoint1.status.resource.serviceID == service.status.id"
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency
+status:
+  conditions:
+    - type: Available
+      message: OpenStack resource is available
+      status: "True"
+      reason: Success
+    - type: Progressing
+      message: OpenStack resource is up to date
+      status: "False"
+      reason: Success
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/02-create-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/02-create-resource.yaml
new file mode 100644
index 00000000..65786fa0
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/02-create-resource.yaml
@@ -0,0 +1,26 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-import-dependency-external
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-import-dependency-external
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-dependency-external
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-import-dependency-external
+    interface: internal
+    url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/03-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/03-assert.yaml
new file mode 100644
index 00000000..dad9764b
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/03-assert.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+commands:
+- script: "! kubectl get service endpoint-import-dependency --namespace $NAMESPACE"
+  skipLogOutput: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/03-delete-import-dependencies.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/03-delete-import-dependencies.yaml
new file mode 100644
index 00000000..a102aa7e
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/03-delete-import-dependencies.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  # We should be able to delete the import dependencies
+  - command: kubectl delete services.openstack.k-orc.cloud endpoint-import-dependency
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/04-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/04-assert.yaml
new file mode 100644
index 00000000..4155ea16
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/04-assert.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+commands:
+- script: "! kubectl get endpoint endpoint-import-dependency --namespace $NAMESPACE"
+  skipLogOutput: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/04-delete-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import-dependency/04-delete-resource.yaml
new file mode 100644
index 00000000..56a973e5
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/04-delete-resource.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+delete:
+  - apiVersion: openstack.k-orc.cloud/v1alpha1
+    kind: Endpoint
+    name: endpoint-import-dependency
diff --git a/internal/controllers/endpoint/tests/endpoint-import-dependency/README.md b/internal/controllers/endpoint/tests/endpoint-import-dependency/README.md
new file mode 100644
index 00000000..934ab20f
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-dependency/README.md
@@ -0,0 +1,29 @@
+# Check dependency handling for imported Endpoint
+
+## Step 00
+
+Import a Endpoint that references other imported resources. The referenced imported resources have no matching resources yet.
+Verify the Endpoint is waiting for the dependency to be ready.
+
+## Step 01
+
+Create a Endpoint matching the import filter, except for referenced resources, and verify that it's not being imported.
+
+## Step 02
+
+Create the referenced resources and a Endpoint matching the import filters.
+
+Verify that the observed status on the imported Endpoint corresponds to the spec of the created Endpoint.
+
+## Step 03
+
+Delete the referenced resources and check that ORC does not prevent deletion. The OpenStack resources still exist because they
+were imported resources and we only deleted the ORC representation of it.
+
+## Step 04
+
+Delete the Endpoint and validate that all resources are gone.
+
+## Reference
+
+https://k-orc.cloud/development/writing-tests/#import-dependency
diff --git a/internal/controllers/endpoint/tests/endpoint-import-error/00-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-error/00-assert.yaml
new file mode 100644
index 00000000..06992d40
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-error/00-assert.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-error-external-1
+status:
+  conditions:
+    - type: Available
+      message: OpenStack resource is available
+      status: "True"
+      reason: Success
+    - type: Progressing
+      message: OpenStack resource is up to date
+      status: "False"
+      reason: Success
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-error-external-2
+status:
+  conditions:
+    - type: Available
+      message: OpenStack resource is available
+      status: "True"
+      reason: Success
+    - type: Progressing
+      message: OpenStack resource is up to date
+      status: "False"
+      reason: Success
diff --git a/internal/controllers/endpoint/tests/endpoint-import-error/00-create-resources.yaml b/internal/controllers/endpoint/tests/endpoint-import-error/00-create-resources.yaml
new file mode 100644
index 00000000..43afeab6
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-error/00-create-resources.yaml
@@ -0,0 +1,40 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-import-error
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-import-error
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-error-external-1
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-import-error
+    interface: internal
+    url: http://example1.com
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-error-external-2
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-import-error
+    interface: internal
+    url: http://example2.com
diff --git a/internal/controllers/endpoint/tests/endpoint-import-error/00-secret.yaml b/internal/controllers/endpoint/tests/endpoint-import-error/00-secret.yaml
new file mode 100644
index 00000000..045711ee
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-error/00-secret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl create secret generic openstack-clouds --from-file=clouds.yaml=${E2E_KUTTL_OSCLOUDS} ${E2E_KUTTL_CACERT_OPT}
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import-error/01-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import-error/01-assert.yaml
new file mode 100644
index 00000000..e9751d90
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-error/01-assert.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-error
+status:
+  conditions:
+    - type: Available
+      message: found more than one matching OpenStack resource during import
+      status: "False"
+      reason: InvalidConfiguration
+    - type: Progressing
+      message: found more than one matching OpenStack resource during import
+      status: "False"
+      reason: InvalidConfiguration
diff --git a/internal/controllers/endpoint/tests/endpoint-import-error/01-import-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import-error/01-import-resource.yaml
new file mode 100644
index 00000000..0b106e2c
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-error/01-import-resource.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-error
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: unmanaged
+  import:
+    filter:
+      serviceRef: endpoint-import-error
+      interface: internal
diff --git a/internal/controllers/endpoint/tests/endpoint-import-error/README.md b/internal/controllers/endpoint/tests/endpoint-import-error/README.md
new file mode 100644
index 00000000..7a8e80bc
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import-error/README.md
@@ -0,0 +1,13 @@
+# Import Endpoint with more than one matching resources
+
+## Step 00
+
+Create two Endpoints with identical specs.
+
+## Step 01
+
+Ensure that an imported Endpoint with a filter matching the resources returns an error.
+
+## Reference
+
+https://k-orc.cloud/development/writing-tests/#import-error
diff --git a/internal/controllers/endpoint/tests/endpoint-import/00-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import/00-assert.yaml
new file mode 100644
index 00000000..cc87b9a8
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/00-assert.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import
+status:
+  conditions:
+    - type: Available
+      message: Waiting for OpenStack resource to be created externally
+      status: "False"
+      reason: Progressing
+    - type: Progressing
+      message: Waiting for OpenStack resource to be created externally
+      status: "True"
+      reason: Progressing
diff --git a/internal/controllers/endpoint/tests/endpoint-import/00-import-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import/00-import-resource.yaml
new file mode 100644
index 00000000..df38e931
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/00-import-resource.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-import
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-import
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: unmanaged
+  import:
+    filter:
+      serviceRef: endpoint-import
+      interface: internal
+      url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-import/00-secret.yaml b/internal/controllers/endpoint/tests/endpoint-import/00-secret.yaml
new file mode 100644
index 00000000..045711ee
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/00-secret.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl create secret generic openstack-clouds --from-file=clouds.yaml=${E2E_KUTTL_OSCLOUDS} ${E2E_KUTTL_CACERT_OPT}
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import/01-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import/01-assert.yaml
new file mode 100644
index 00000000..9d6a646c
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/01-assert.yaml
@@ -0,0 +1,34 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-external-not-this-one
+status:
+  conditions:
+    - type: Available
+      message: OpenStack resource is available
+      status: "True"
+      reason: Success
+    - type: Progressing
+      message: OpenStack resource is up to date
+      status: "False"
+      reason: Success
+  resource:
+    name: endpoint-import-external-not-this-one
+    interface: internal
+    url: http://example.com
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import
+status:
+  conditions:
+    - type: Available
+      message: Waiting for OpenStack resource to be created externally
+      status: "False"
+      reason: Progressing
+    - type: Progressing
+      message: Waiting for OpenStack resource to be created externally
+      status: "True"
+      reason: Progressing
diff --git a/internal/controllers/endpoint/tests/endpoint-import/01-create-trap-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import/01-create-trap-resource.yaml
new file mode 100644
index 00000000..2e41c1cf
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/01-create-trap-resource.yaml
@@ -0,0 +1,30 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-import-external-not-this-one
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-import-external-not-this-one
+---
+# This `endpoint-import-external-not-this-one` resource serves two purposes:
+# - ensure that we can successfully create another resource which name is a substring of it (i.e. it's not being adopted)
+# - ensure that importing a resource which name is a substring of it will not pick this one.
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-external-not-this-one
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-import-external-not-this-one
+    interface: internal
+    url: http://example.com
+
diff --git a/internal/controllers/endpoint/tests/endpoint-import/02-assert.yaml b/internal/controllers/endpoint/tests/endpoint-import/02-assert.yaml
new file mode 100644
index 00000000..a66d66a4
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/02-assert.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-import-external
+      ref: endpoint1
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-import-external-not-this-one
+      ref: endpoint2
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Service
+      name: endpoint-import
+      ref: service
+assertAll:
+    - celExpr: "endpoint1.status.id != endpoint2.status.id"
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import
+status:
+  conditions:
+    - type: Available
+      message: OpenStack resource is available
+      status: "True"
+      reason: Success
+    - type: Progressing
+      message: OpenStack resource is up to date
+      status: "False"
+      reason: Success
+  resource:
+    name: endpoint-import-external
+    interface: internal
+    url: http://example.com
+    #enabled: true
diff --git a/internal/controllers/endpoint/tests/endpoint-import/02-create-resource.yaml b/internal/controllers/endpoint/tests/endpoint-import/02-create-resource.yaml
new file mode 100644
index 00000000..5b67ce9d
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/02-create-resource.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-import-external
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-import
+    interface: internal
+    url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-import/README.md b/internal/controllers/endpoint/tests/endpoint-import/README.md
new file mode 100644
index 00000000..5fbb68b9
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-import/README.md
@@ -0,0 +1,18 @@
+# Import Endpoint
+
+## Step 00
+
+Import a endpoint, matching all of the available filter's fields, and verify it is waiting for the external resource to be created.
+
+## Step 01
+
+Create a endpoint which name is a superstring of the one specified in the import filter, and otherwise matching the filter, and verify that it's not being imported.
+
+## Step 02
+
+Create a endpoint matching the filter and verify that the observed status on the imported endpoint corresponds to the spec of the created endpoint.
+Also verify that the created endpoint didn't adopt the one which name is a superstring of it.
+
+## Reference
+
+https://k-orc.cloud/development/writing-tests/#import
diff --git a/internal/controllers/endpoint/tests/endpoint-update/00-assert.yaml b/internal/controllers/endpoint/tests/endpoint-update/00-assert.yaml
new file mode 100644
index 00000000..76532138
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/00-assert.yaml
@@ -0,0 +1,32 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-update
+status:
+  resource:
+    name: endpoint-update
+    interface: internal
+    url: http://example.com
+    enabled: true
+  conditions:
+  - type: Available
+    status: "True"
+    reason: Success
+  - type: Progressing
+    status: "False"
+    reason: Success
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-update
+      ref: endpoint
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Service
+      name: endpoint-update
+      ref: service
+assertAll:
+    - celExpr: "endpoint.status.resource.serviceID == service.status.id"
diff --git a/internal/controllers/endpoint/tests/endpoint-update/00-minimal-resource.yaml b/internal/controllers/endpoint/tests/endpoint-update/00-minimal-resource.yaml
new file mode 100644
index 00000000..cfa64972
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/00-minimal-resource.yaml
@@ -0,0 +1,26 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Service
+metadata:
+  name: endpoint-update
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    type: endpoint-test-update
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-update
+spec:
+  cloudCredentialsRef:
+    cloudName: openstack-admin
+    secretName: openstack-clouds
+  managementPolicy: managed
+  resource:
+    serviceRef: endpoint-update
+    interface: internal
+    url: http://example.com
diff --git a/internal/controllers/endpoint/tests/endpoint-update/00-prerequisites.yaml b/internal/controllers/endpoint/tests/endpoint-update/00-prerequisites.yaml
new file mode 100644
index 00000000..045711ee
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/00-prerequisites.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl create secret generic openstack-clouds --from-file=clouds.yaml=${E2E_KUTTL_OSCLOUDS} ${E2E_KUTTL_CACERT_OPT}
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-update/01-assert.yaml b/internal/controllers/endpoint/tests/endpoint-update/01-assert.yaml
new file mode 100644
index 00000000..94ced388
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/01-assert.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-update
+status:
+  resource:
+    name: endpoint-update-updated
+    interface: public
+    url: http://example.com/updated
+    #enabled: true
+  conditions:
+  - type: Available
+    status: "True"
+    reason: Success
+  - type: Progressing
+    status: "False"
+    reason: Success
diff --git a/internal/controllers/endpoint/tests/endpoint-update/01-updated-resource.yaml b/internal/controllers/endpoint/tests/endpoint-update/01-updated-resource.yaml
new file mode 100644
index 00000000..bd1374ea
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/01-updated-resource.yaml
@@ -0,0 +1,13 @@
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-update
+spec:
+  resource:
+    name: endpoint-update-updated
+    interface: public
+    url: http://example.com/updated
+    # TODO(winiciusallan): change it later.
+    #enabled: true
+
diff --git a/internal/controllers/endpoint/tests/endpoint-update/02-assert.yaml b/internal/controllers/endpoint/tests/endpoint-update/02-assert.yaml
new file mode 100644
index 00000000..64ee33bd
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/02-assert.yaml
@@ -0,0 +1,32 @@
+---
+apiVersion: kuttl.dev/v1beta1
+kind: TestAssert
+resourceRefs:
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Endpoint
+      name: endpoint-update
+      ref: endpoint
+    - apiVersion: openstack.k-orc.cloud/v1alpha1
+      kind: Service
+      name: endpoint-update
+      ref: service
+assertAll:
+    - celExpr: "endpoint.status.resource.serviceID == service.status.id"
+---
+apiVersion: openstack.k-orc.cloud/v1alpha1
+kind: Endpoint
+metadata:
+  name: endpoint-update
+status:
+  resource:
+    name: endpoint-update
+    interface: internal
+    url: http://example.com
+    #enabled: true
+  conditions:
+  - type: Available
+    status: "True"
+    reason: Success
+  - type: Progressing
+    status: "False"
+    reason: Success
diff --git a/internal/controllers/endpoint/tests/endpoint-update/02-reverted-resource.yaml b/internal/controllers/endpoint/tests/endpoint-update/02-reverted-resource.yaml
new file mode 100644
index 00000000..2c6c253f
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/02-reverted-resource.yaml
@@ -0,0 +1,7 @@
+# NOTE: kuttl only does patch updates, which means we can't delete a field.
+# We have to use a kubectl apply command instead.
+apiVersion: kuttl.dev/v1beta1
+kind: TestStep
+commands:
+  - command: kubectl replace -f 00-minimal-resource.yaml
+    namespaced: true
diff --git a/internal/controllers/endpoint/tests/endpoint-update/README.md b/internal/controllers/endpoint/tests/endpoint-update/README.md
new file mode 100644
index 00000000..3cf396e8
--- /dev/null
+++ b/internal/controllers/endpoint/tests/endpoint-update/README.md
@@ -0,0 +1,17 @@
+# Update Endpoint
+
+## Step 00
+
+Create a Endpoint using only mandatory fields.
+
+## Step 01
+
+Update all mutable fields.
+
+## Step 02
+
+Revert the resource to its original value and verify the resulting object is similar to when if was first created.
+
+## Reference
+
+https://k-orc.cloud/development/writing-tests/#update
diff --git a/internal/controllers/endpoint/zz_generated.adapter.go b/internal/controllers/endpoint/zz_generated.adapter.go
new file mode 100644
index 00000000..934d9b7d
--- /dev/null
+++ b/internal/controllers/endpoint/zz_generated.adapter.go
@@ -0,0 +1,88 @@
+// Code generated by resource-generator. DO NOT EDIT.
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	orcv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	"github.com/k-orc/openstack-resource-controller/v2/internal/controllers/generic/interfaces"
+)
+
+// Fundamental types
+type (
+	orcObjectT     = orcv1alpha1.Endpoint
+	orcObjectListT = orcv1alpha1.EndpointList
+	resourceSpecT  = orcv1alpha1.EndpointResourceSpec
+	filterT        = orcv1alpha1.EndpointFilter
+)
+
+// Derived types
+type (
+	orcObjectPT = *orcObjectT
+	adapterI    = interfaces.APIObjectAdapter[orcObjectPT, resourceSpecT, filterT]
+	adapterT    = endpointAdapter
+)
+
+type endpointAdapter struct {
+	*orcv1alpha1.Endpoint
+}
+
+var _ adapterI = &adapterT{}
+
+func (f adapterT) GetObject() orcObjectPT {
+	return f.Endpoint
+}
+
+func (f adapterT) GetManagementPolicy() orcv1alpha1.ManagementPolicy {
+	return f.Spec.ManagementPolicy
+}
+
+func (f adapterT) GetManagedOptions() *orcv1alpha1.ManagedOptions {
+	return f.Spec.ManagedOptions
+}
+
+func (f adapterT) GetStatusID() *string {
+	return f.Status.ID
+}
+
+func (f adapterT) GetResourceSpec() *resourceSpecT {
+	return f.Spec.Resource
+}
+
+func (f adapterT) GetImportID() *string {
+	if f.Spec.Import == nil {
+		return nil
+	}
+	return f.Spec.Import.ID
+}
+
+func (f adapterT) GetImportFilter() *filterT {
+	if f.Spec.Import == nil {
+		return nil
+	}
+	return f.Spec.Import.Filter
+}
+
+// getResourceName returns the name of the OpenStack resource we should use.
+// This method is not implemented as part of APIObjectAdapter as it is intended
+// to be used by resource actuators, which don't use the adapter.
+func getResourceName(orcObject orcObjectPT) string {
+	if orcObject.Spec.Resource.Name != nil {
+		return string(*orcObject.Spec.Resource.Name)
+	}
+	return orcObject.Name
+}
diff --git a/internal/controllers/endpoint/zz_generated.controller.go b/internal/controllers/endpoint/zz_generated.controller.go
new file mode 100644
index 00000000..1dd55a10
--- /dev/null
+++ b/internal/controllers/endpoint/zz_generated.controller.go
@@ -0,0 +1,45 @@
+// Code generated by resource-generator. DO NOT EDIT.
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package endpoint
+
+import (
+	corev1 "k8s.io/api/core/v1"
+
+	"github.com/k-orc/openstack-resource-controller/v2/internal/util/dependency"
+	orcstrings "github.com/k-orc/openstack-resource-controller/v2/internal/util/strings"
+)
+
+var (
+	// NOTE: controllerName must be defined in any controller using this template
+
+	// finalizer is the string this controller adds to an object's Finalizers
+	finalizer = orcstrings.GetFinalizerName(controllerName)
+
+	// externalObjectFieldOwner is the field owner we use when using
+	// server-side-apply on objects we don't control
+	externalObjectFieldOwner = orcstrings.GetSSAFieldOwner(controllerName)
+
+	credentialsDependency = dependency.NewDeletionGuardDependency[*orcObjectListT, *corev1.Secret](
+		"spec.cloudCredentialsRef.secretName",
+		func(obj orcObjectPT) []string {
+			return []string{obj.Spec.CloudCredentialsRef.SecretName}
+		},
+		finalizer, externalObjectFieldOwner,
+		dependency.OverrideDependencyName("credentials"),
+	)
+)
diff --git a/internal/controllers/service/actuator_test.go b/internal/controllers/service/actuator_test.go
index 980cd269..0980a53c 100644
--- a/internal/controllers/service/actuator_test.go
+++ b/internal/controllers/service/actuator_test.go
@@ -146,7 +146,7 @@ func TestHandleDescriptionUpdate(t *testing.T) {
 	}{
 		{name: "Identical", newValue: ptr.To("same-description"), existingValue: "same-description", expectChange: false},
 		{name: "Different", newValue: ptr.To("new-description"), existingValue: "same-description", expectChange: true},
-		{name: "No value provided, existing is set", newValue: nil, existingValue: "description", expectChange: true},
+		{name: "No value provided, existing is keept", newValue: nil, existingValue: "description", expectChange: true},
 	}
 
 	for _, tt := range testCases {
diff --git a/internal/osclients/endpoint.go b/internal/osclients/endpoint.go
new file mode 100644
index 00000000..e9955539
--- /dev/null
+++ b/internal/osclients/endpoint.go
@@ -0,0 +1,104 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package osclients
+
+import (
+	"context"
+	"fmt"
+	"iter"
+
+	"github.com/gophercloud/gophercloud/v2"
+	"github.com/gophercloud/gophercloud/v2/openstack"
+	"github.com/gophercloud/gophercloud/v2/openstack/identity/v3/endpoints"
+	"github.com/gophercloud/utils/v2/openstack/clientconfig"
+)
+
+type EndpointClient interface {
+	ListEndpoints(ctx context.Context, listOpts endpoints.ListOptsBuilder) iter.Seq2[*endpoints.Endpoint, error]
+	CreateEndpoint(ctx context.Context, opts endpoints.CreateOptsBuilder) (*endpoints.Endpoint, error)
+	DeleteEndpoint(ctx context.Context, resourceID string) error
+	GetEndpoint(ctx context.Context, resourceID string) (*endpoints.Endpoint, error)
+	UpdateEndpoint(ctx context.Context, id string, opts endpoints.UpdateOptsBuilder) (*endpoints.Endpoint, error)
+}
+
+type endpointClient struct{ client *gophercloud.ServiceClient }
+
+// NewEndpointClient returns a new OpenStack client.
+func NewEndpointClient(providerClient *gophercloud.ProviderClient, providerClientOpts *clientconfig.ClientOpts) (EndpointClient, error) {
+	client, err := openstack.NewIdentityV3(providerClient, gophercloud.EndpointOpts{
+		Region:       providerClientOpts.RegionName,
+		Availability: clientconfig.GetEndpointType(providerClientOpts.EndpointType),
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to create endpoint service client: %v", err)
+	}
+
+	return &endpointClient{client}, nil
+}
+
+func (c endpointClient) ListEndpoints(ctx context.Context, listOpts endpoints.ListOptsBuilder) iter.Seq2[*endpoints.Endpoint, error] {
+	pager := endpoints.List(c.client, listOpts)
+	return func(yield func(*endpoints.Endpoint, error) bool) {
+		_ = pager.EachPage(ctx, yieldPage(endpoints.ExtractEndpoints, yield))
+	}
+}
+
+func (c endpointClient) CreateEndpoint(ctx context.Context, opts endpoints.CreateOptsBuilder) (*endpoints.Endpoint, error) {
+	return endpoints.Create(ctx, c.client, opts).Extract()
+}
+
+func (c endpointClient) DeleteEndpoint(ctx context.Context, resourceID string) error {
+	return endpoints.Delete(ctx, c.client, resourceID).ExtractErr()
+}
+
+func (c endpointClient) GetEndpoint(ctx context.Context, resourceID string) (*endpoints.Endpoint, error) {
+	return endpoints.Get(ctx, c.client, resourceID).Extract()
+}
+
+func (c endpointClient) UpdateEndpoint(ctx context.Context, id string, opts endpoints.UpdateOptsBuilder) (*endpoints.Endpoint, error) {
+	return endpoints.Update(ctx, c.client, id, opts).Extract()
+}
+
+type endpointErrorClient struct{ error }
+
+// NewEndpointErrorClient returns a EndpointClient in which every method returns the given error.
+func NewEndpointErrorClient(e error) EndpointClient {
+	return endpointErrorClient{e}
+}
+
+func (e endpointErrorClient) ListEndpoints(_ context.Context, _ endpoints.ListOptsBuilder) iter.Seq2[*endpoints.Endpoint, error] {
+	return func(yield func(*endpoints.Endpoint, error) bool) {
+		yield(nil, e.error)
+	}
+}
+
+func (e endpointErrorClient) CreateEndpoint(_ context.Context, _ endpoints.CreateOptsBuilder) (*endpoints.Endpoint, error) {
+	return nil, e.error
+}
+
+func (e endpointErrorClient) DeleteEndpoint(_ context.Context, _ string) error {
+	return e.error
+}
+
+func (e endpointErrorClient) GetEndpoint(_ context.Context, _ string) (*endpoints.Endpoint, error) {
+	return nil, e.error
+}
+
+func (e endpointErrorClient) UpdateEndpoint(_ context.Context, _ string, _ endpoints.UpdateOptsBuilder) (*endpoints.Endpoint, error) {
+	return nil, e.error
+}
diff --git a/internal/osclients/mock/doc.go b/internal/osclients/mock/doc.go
index 47292b65..84971e17 100644
--- a/internal/osclients/mock/doc.go
+++ b/internal/osclients/mock/doc.go
@@ -38,6 +38,9 @@ import (
 //go:generate mockgen -package mock -destination=domain.go -source=../domain.go github.com/k-orc/openstack-resource-controller/internal/osclients/mock DomainClient
 //go:generate /usr/bin/env bash -c "cat ../../../hack/boilerplate.go.txt domain.go > _domain.go && mv _domain.go domain.go"
 
+//go:generate mockgen -package mock -destination=endpoint.go -source=../endpoint.go github.com/k-orc/openstack-resource-controller/internal/osclients/mock EndpointClient
+//go:generate /usr/bin/env bash -c "cat ../../../hack/boilerplate.go.txt endpoint.go > _endpoint.go && mv _endpoint.go endpoint.go"
+
 //go:generate mockgen -package mock -destination=group.go -source=../group.go github.com/k-orc/openstack-resource-controller/internal/osclients/mock GroupClient
 //go:generate /usr/bin/env bash -c "cat ../../../hack/boilerplate.go.txt group.go > _group.go && mv _group.go group.go"
 
diff --git a/internal/osclients/mock/endpoint.go b/internal/osclients/mock/endpoint.go
new file mode 100644
index 00000000..dafc9227
--- /dev/null
+++ b/internal/osclients/mock/endpoint.go
@@ -0,0 +1,131 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ../endpoint.go
+//
+// Generated by this command:
+//
+//	mockgen -package mock -destination=endpoint.go -source=../endpoint.go github.com/k-orc/openstack-resource-controller/internal/osclients/mock EndpointClient
+//
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	context "context"
+	iter "iter"
+	reflect "reflect"
+
+	endpoints "github.com/gophercloud/gophercloud/v2/openstack/identity/v3/endpoints"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockEndpointClient is a mock of EndpointClient interface.
+type MockEndpointClient struct {
+	ctrl     *gomock.Controller
+	recorder *MockEndpointClientMockRecorder
+	isgomock struct{}
+}
+
+// MockEndpointClientMockRecorder is the mock recorder for MockEndpointClient.
+type MockEndpointClientMockRecorder struct {
+	mock *MockEndpointClient
+}
+
+// NewMockEndpointClient creates a new mock instance.
+func NewMockEndpointClient(ctrl *gomock.Controller) *MockEndpointClient {
+	mock := &MockEndpointClient{ctrl: ctrl}
+	mock.recorder = &MockEndpointClientMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockEndpointClient) EXPECT() *MockEndpointClientMockRecorder {
+	return m.recorder
+}
+
+// CreateEndpoint mocks base method.
+func (m *MockEndpointClient) CreateEndpoint(ctx context.Context, opts endpoints.CreateOptsBuilder) (*endpoints.Endpoint, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateEndpoint", ctx, opts)
+	ret0, _ := ret[0].(*endpoints.Endpoint)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CreateEndpoint indicates an expected call of CreateEndpoint.
+func (mr *MockEndpointClientMockRecorder) CreateEndpoint(ctx, opts any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateEndpoint", reflect.TypeOf((*MockEndpointClient)(nil).CreateEndpoint), ctx, opts)
+}
+
+// DeleteEndpoint mocks base method.
+func (m *MockEndpointClient) DeleteEndpoint(ctx context.Context, resourceID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteEndpoint", ctx, resourceID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteEndpoint indicates an expected call of DeleteEndpoint.
+func (mr *MockEndpointClientMockRecorder) DeleteEndpoint(ctx, resourceID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteEndpoint", reflect.TypeOf((*MockEndpointClient)(nil).DeleteEndpoint), ctx, resourceID)
+}
+
+// GetEndpoint mocks base method.
+func (m *MockEndpointClient) GetEndpoint(ctx context.Context, resourceID string) (*endpoints.Endpoint, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetEndpoint", ctx, resourceID)
+	ret0, _ := ret[0].(*endpoints.Endpoint)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetEndpoint indicates an expected call of GetEndpoint.
+func (mr *MockEndpointClientMockRecorder) GetEndpoint(ctx, resourceID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetEndpoint", reflect.TypeOf((*MockEndpointClient)(nil).GetEndpoint), ctx, resourceID)
+}
+
+// ListEndpoints mocks base method.
+func (m *MockEndpointClient) ListEndpoints(ctx context.Context, listOpts endpoints.ListOptsBuilder) iter.Seq2[*endpoints.Endpoint, error] {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListEndpoints", ctx, listOpts)
+	ret0, _ := ret[0].(iter.Seq2[*endpoints.Endpoint, error])
+	return ret0
+}
+
+// ListEndpoints indicates an expected call of ListEndpoints.
+func (mr *MockEndpointClientMockRecorder) ListEndpoints(ctx, listOpts any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListEndpoints", reflect.TypeOf((*MockEndpointClient)(nil).ListEndpoints), ctx, listOpts)
+}
+
+// UpdateEndpoint mocks base method.
+func (m *MockEndpointClient) UpdateEndpoint(ctx context.Context, id string, opts endpoints.UpdateOptsBuilder) (*endpoints.Endpoint, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateEndpoint", ctx, id, opts)
+	ret0, _ := ret[0].(*endpoints.Endpoint)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateEndpoint indicates an expected call of UpdateEndpoint.
+func (mr *MockEndpointClientMockRecorder) UpdateEndpoint(ctx, id, opts any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateEndpoint", reflect.TypeOf((*MockEndpointClient)(nil).UpdateEndpoint), ctx, id, opts)
+}
diff --git a/internal/scope/mock.go b/internal/scope/mock.go
index ef959fae..9cc49cd0 100644
--- a/internal/scope/mock.go
+++ b/internal/scope/mock.go
@@ -36,6 +36,7 @@ import (
 type MockScopeFactory struct {
 	ComputeClient    *mock.MockComputeClient
 	DomainClient     *mock.MockDomainClient
+	EndpointClient   *mock.MockEndpointClient
 	GroupClient      *mock.MockGroupClient
 	IdentityClient   *mock.MockIdentityClient
 	ImageClient      *mock.MockImageClient
@@ -52,6 +53,7 @@ type MockScopeFactory struct {
 func NewMockScopeFactory(mockCtrl *gomock.Controller) *MockScopeFactory {
 	computeClient := mock.NewMockComputeClient(mockCtrl)
 	domainClient := mock.NewMockDomainClient(mockCtrl)
+	endpointClient := mock.NewMockEndpointClient(mockCtrl)
 	groupClient := mock.NewMockGroupClient(mockCtrl)
 	identityClient := mock.NewMockIdentityClient(mockCtrl)
 	imageClient := mock.NewMockImageClient(mockCtrl)
@@ -65,6 +67,7 @@ func NewMockScopeFactory(mockCtrl *gomock.Controller) *MockScopeFactory {
 	return &MockScopeFactory{
 		ComputeClient:    computeClient,
 		DomainClient:     domainClient,
+		EndpointClient:   endpointClient,
 		GroupClient:      groupClient,
 		IdentityClient:   identityClient,
 		ImageClient:      imageClient,
@@ -132,6 +135,10 @@ func (f *MockScopeFactory) NewRoleClient() (osclients.RoleClient, error) {
 	return f.RoleClient, nil
 }
 
+func (f *MockScopeFactory) NewEndpointClient() (osclients.EndpointClient, error) {
+	return f.EndpointClient, nil
+}
+
 func (f *MockScopeFactory) ExtractToken() (*tokens.Token, error) {
 	return &tokens.Token{ExpiresAt: time.Now().Add(24 * time.Hour)}, nil
 }
diff --git a/internal/scope/provider.go b/internal/scope/provider.go
index 65670ba6..d9853e38 100644
--- a/internal/scope/provider.go
+++ b/internal/scope/provider.go
@@ -169,6 +169,10 @@ func (s *providerScope) NewServiceClient() (clients.ServiceClient, error) {
 	return clients.NewServiceClient(s.providerClient, s.providerClientOpts)
 }
 
+func (s *providerScope) NewEndpointClient() (clients.EndpointClient, error) {
+	return clients.NewEndpointClient(s.providerClient, s.providerClientOpts)
+}
+
 func (s *providerScope) NewKeyPairClient() (clients.KeyPairClient, error) {
 	return clients.NewKeyPairClient(s.providerClient, s.providerClientOpts)
 }
diff --git a/internal/scope/scope.go b/internal/scope/scope.go
index 7da50dc8..8baa7f40 100644
--- a/internal/scope/scope.go
+++ b/internal/scope/scope.go
@@ -50,6 +50,7 @@ type Factory interface {
 type Scope interface {
 	NewComputeClient() (osclients.ComputeClient, error)
 	NewDomainClient() (osclients.DomainClient, error)
+	NewEndpointClient() (osclients.EndpointClient, error)
 	NewGroupClient() (osclients.GroupClient, error)
 	NewIdentityClient() (osclients.IdentityClient, error)
 	NewImageClient() (osclients.ImageClient, error)
diff --git a/kuttl-test.yaml b/kuttl-test.yaml
index d499782e..9f74099f 100644
--- a/kuttl-test.yaml
+++ b/kuttl-test.yaml
@@ -3,6 +3,7 @@ apiVersion: kuttl.dev/v1beta1
 kind: TestSuite
 testDirs:
 - ./internal/controllers/domain/tests/
+- ./internal/controllers/endpoint/tests/
 - ./internal/controllers/flavor/tests/
 - ./internal/controllers/floatingip/tests/
 - ./internal/controllers/group/tests/
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpoint.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpoint.go
new file mode 100644
index 00000000..a099f728
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpoint.go
@@ -0,0 +1,281 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	internal "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/applyconfiguration/internal"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	managedfields "k8s.io/apimachinery/pkg/util/managedfields"
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// EndpointApplyConfiguration represents a declarative configuration of the Endpoint type for use
+// with apply.
+type EndpointApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *EndpointSpecApplyConfiguration   `json:"spec,omitempty"`
+	Status                           *EndpointStatusApplyConfiguration `json:"status,omitempty"`
+}
+
+// Endpoint constructs a declarative configuration of the Endpoint type for use with
+// apply.
+func Endpoint(name, namespace string) *EndpointApplyConfiguration {
+	b := &EndpointApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("Endpoint")
+	b.WithAPIVersion("openstack.k-orc.cloud/v1alpha1")
+	return b
+}
+
+// ExtractEndpoint extracts the applied configuration owned by fieldManager from
+// endpoint. If no managedFields are found in endpoint for fieldManager, a
+// EndpointApplyConfiguration is returned with only the Name, Namespace (if applicable),
+// APIVersion and Kind populated. It is possible that no managed fields were found for because other
+// field managers have taken ownership of all the fields previously owned by fieldManager, or because
+// the fieldManager never owned fields any fields.
+// endpoint must be a unmodified Endpoint API object that was retrieved from the Kubernetes API.
+// ExtractEndpoint provides a way to perform a extract/modify-in-place/apply workflow.
+// Note that an extracted apply configuration will contain fewer fields than what the fieldManager previously
+// applied if another fieldManager has updated or force applied any of the previously applied fields.
+// Experimental!
+func ExtractEndpoint(endpoint *apiv1alpha1.Endpoint, fieldManager string) (*EndpointApplyConfiguration, error) {
+	return extractEndpoint(endpoint, fieldManager, "")
+}
+
+// ExtractEndpointStatus is the same as ExtractEndpoint except
+// that it extracts the status subresource applied configuration.
+// Experimental!
+func ExtractEndpointStatus(endpoint *apiv1alpha1.Endpoint, fieldManager string) (*EndpointApplyConfiguration, error) {
+	return extractEndpoint(endpoint, fieldManager, "status")
+}
+
+func extractEndpoint(endpoint *apiv1alpha1.Endpoint, fieldManager string, subresource string) (*EndpointApplyConfiguration, error) {
+	b := &EndpointApplyConfiguration{}
+	err := managedfields.ExtractInto(endpoint, internal.Parser().Type("com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.Endpoint"), fieldManager, b, subresource)
+	if err != nil {
+		return nil, err
+	}
+	b.WithName(endpoint.Name)
+	b.WithNamespace(endpoint.Namespace)
+
+	b.WithKind("Endpoint")
+	b.WithAPIVersion("openstack.k-orc.cloud/v1alpha1")
+	return b, nil
+}
+func (b EndpointApplyConfiguration) IsApplyConfiguration() {}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithKind(value string) *EndpointApplyConfiguration {
+	b.TypeMetaApplyConfiguration.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithAPIVersion(value string) *EndpointApplyConfiguration {
+	b.TypeMetaApplyConfiguration.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithName(value string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithGenerateName(value string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithNamespace(value string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithUID(value types.UID) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithResourceVersion(value string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithGeneration(value int64) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithCreationTimestamp(value metav1.Time) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ObjectMetaApplyConfiguration.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *EndpointApplyConfiguration) WithLabels(entries map[string]string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Labels == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *EndpointApplyConfiguration) WithAnnotations(entries map[string]string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.ObjectMetaApplyConfiguration.Annotations == nil && len(entries) > 0 {
+		b.ObjectMetaApplyConfiguration.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.ObjectMetaApplyConfiguration.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *EndpointApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.ObjectMetaApplyConfiguration.OwnerReferences = append(b.ObjectMetaApplyConfiguration.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *EndpointApplyConfiguration) WithFinalizers(values ...string) *EndpointApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.ObjectMetaApplyConfiguration.Finalizers = append(b.ObjectMetaApplyConfiguration.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *EndpointApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithSpec(value *EndpointSpecApplyConfiguration) *EndpointApplyConfiguration {
+	b.Spec = value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *EndpointApplyConfiguration) WithStatus(value *EndpointStatusApplyConfiguration) *EndpointApplyConfiguration {
+	b.Status = value
+	return b
+}
+
+// GetKind retrieves the value of the Kind field in the declarative configuration.
+func (b *EndpointApplyConfiguration) GetKind() *string {
+	return b.TypeMetaApplyConfiguration.Kind
+}
+
+// GetAPIVersion retrieves the value of the APIVersion field in the declarative configuration.
+func (b *EndpointApplyConfiguration) GetAPIVersion() *string {
+	return b.TypeMetaApplyConfiguration.APIVersion
+}
+
+// GetName retrieves the value of the Name field in the declarative configuration.
+func (b *EndpointApplyConfiguration) GetName() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Name
+}
+
+// GetNamespace retrieves the value of the Namespace field in the declarative configuration.
+func (b *EndpointApplyConfiguration) GetNamespace() *string {
+	b.ensureObjectMetaApplyConfigurationExists()
+	return b.ObjectMetaApplyConfiguration.Namespace
+}
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpointfilter.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpointfilter.go
new file mode 100644
index 00000000..3cf7c600
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpointfilter.go
@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+)
+
+// EndpointFilterApplyConfiguration represents a declarative configuration of the EndpointFilter type for use
+// with apply.
+type EndpointFilterApplyConfiguration struct {
+	Interface  *string                        `json:"interface,omitempty"`
+	ServiceRef *apiv1alpha1.KubernetesNameRef `json:"serviceRef,omitempty"`
+	URL        *string                        `json:"url,omitempty"`
+}
+
+// EndpointFilterApplyConfiguration constructs a declarative configuration of the EndpointFilter type for use with
+// apply.
+func EndpointFilter() *EndpointFilterApplyConfiguration {
+	return &EndpointFilterApplyConfiguration{}
+}
+
+// WithInterface sets the Interface field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Interface field is set to the value of the last call.
+func (b *EndpointFilterApplyConfiguration) WithInterface(value string) *EndpointFilterApplyConfiguration {
+	b.Interface = &value
+	return b
+}
+
+// WithServiceRef sets the ServiceRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServiceRef field is set to the value of the last call.
+func (b *EndpointFilterApplyConfiguration) WithServiceRef(value apiv1alpha1.KubernetesNameRef) *EndpointFilterApplyConfiguration {
+	b.ServiceRef = &value
+	return b
+}
+
+// WithURL sets the URL field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the URL field is set to the value of the last call.
+func (b *EndpointFilterApplyConfiguration) WithURL(value string) *EndpointFilterApplyConfiguration {
+	b.URL = &value
+	return b
+}
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpointimport.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpointimport.go
new file mode 100644
index 00000000..e20a99cd
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpointimport.go
@@ -0,0 +1,48 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// EndpointImportApplyConfiguration represents a declarative configuration of the EndpointImport type for use
+// with apply.
+type EndpointImportApplyConfiguration struct {
+	ID     *string                           `json:"id,omitempty"`
+	Filter *EndpointFilterApplyConfiguration `json:"filter,omitempty"`
+}
+
+// EndpointImportApplyConfiguration constructs a declarative configuration of the EndpointImport type for use with
+// apply.
+func EndpointImport() *EndpointImportApplyConfiguration {
+	return &EndpointImportApplyConfiguration{}
+}
+
+// WithID sets the ID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ID field is set to the value of the last call.
+func (b *EndpointImportApplyConfiguration) WithID(value string) *EndpointImportApplyConfiguration {
+	b.ID = &value
+	return b
+}
+
+// WithFilter sets the Filter field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Filter field is set to the value of the last call.
+func (b *EndpointImportApplyConfiguration) WithFilter(value *EndpointFilterApplyConfiguration) *EndpointImportApplyConfiguration {
+	b.Filter = value
+	return b
+}
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpointresourcespec.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpointresourcespec.go
new file mode 100644
index 00000000..b9f15790
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpointresourcespec.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+)
+
+// EndpointResourceSpecApplyConfiguration represents a declarative configuration of the EndpointResourceSpec type for use
+// with apply.
+type EndpointResourceSpecApplyConfiguration struct {
+	Name       *apiv1alpha1.OpenStackName     `json:"name,omitempty"`
+	Enabled    *bool                          `json:"enabled,omitempty"`
+	Interface  *string                        `json:"interface,omitempty"`
+	URL        *string                        `json:"url,omitempty"`
+	ServiceRef *apiv1alpha1.KubernetesNameRef `json:"serviceRef,omitempty"`
+}
+
+// EndpointResourceSpecApplyConfiguration constructs a declarative configuration of the EndpointResourceSpec type for use with
+// apply.
+func EndpointResourceSpec() *EndpointResourceSpecApplyConfiguration {
+	return &EndpointResourceSpecApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EndpointResourceSpecApplyConfiguration) WithName(value apiv1alpha1.OpenStackName) *EndpointResourceSpecApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithEnabled sets the Enabled field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Enabled field is set to the value of the last call.
+func (b *EndpointResourceSpecApplyConfiguration) WithEnabled(value bool) *EndpointResourceSpecApplyConfiguration {
+	b.Enabled = &value
+	return b
+}
+
+// WithInterface sets the Interface field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Interface field is set to the value of the last call.
+func (b *EndpointResourceSpecApplyConfiguration) WithInterface(value string) *EndpointResourceSpecApplyConfiguration {
+	b.Interface = &value
+	return b
+}
+
+// WithURL sets the URL field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the URL field is set to the value of the last call.
+func (b *EndpointResourceSpecApplyConfiguration) WithURL(value string) *EndpointResourceSpecApplyConfiguration {
+	b.URL = &value
+	return b
+}
+
+// WithServiceRef sets the ServiceRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServiceRef field is set to the value of the last call.
+func (b *EndpointResourceSpecApplyConfiguration) WithServiceRef(value apiv1alpha1.KubernetesNameRef) *EndpointResourceSpecApplyConfiguration {
+	b.ServiceRef = &value
+	return b
+}
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpointresourcestatus.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpointresourcestatus.go
new file mode 100644
index 00000000..8a0b7c87
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpointresourcestatus.go
@@ -0,0 +1,75 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+// EndpointResourceStatusApplyConfiguration represents a declarative configuration of the EndpointResourceStatus type for use
+// with apply.
+type EndpointResourceStatusApplyConfiguration struct {
+	Name      *string `json:"name,omitempty"`
+	Enabled   *bool   `json:"enabled,omitempty"`
+	Interface *string `json:"interface,omitempty"`
+	URL       *string `json:"url,omitempty"`
+	ServiceID *string `json:"serviceID,omitempty"`
+}
+
+// EndpointResourceStatusApplyConfiguration constructs a declarative configuration of the EndpointResourceStatus type for use with
+// apply.
+func EndpointResourceStatus() *EndpointResourceStatusApplyConfiguration {
+	return &EndpointResourceStatusApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *EndpointResourceStatusApplyConfiguration) WithName(value string) *EndpointResourceStatusApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithEnabled sets the Enabled field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Enabled field is set to the value of the last call.
+func (b *EndpointResourceStatusApplyConfiguration) WithEnabled(value bool) *EndpointResourceStatusApplyConfiguration {
+	b.Enabled = &value
+	return b
+}
+
+// WithInterface sets the Interface field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Interface field is set to the value of the last call.
+func (b *EndpointResourceStatusApplyConfiguration) WithInterface(value string) *EndpointResourceStatusApplyConfiguration {
+	b.Interface = &value
+	return b
+}
+
+// WithURL sets the URL field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the URL field is set to the value of the last call.
+func (b *EndpointResourceStatusApplyConfiguration) WithURL(value string) *EndpointResourceStatusApplyConfiguration {
+	b.URL = &value
+	return b
+}
+
+// WithServiceID sets the ServiceID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ServiceID field is set to the value of the last call.
+func (b *EndpointResourceStatusApplyConfiguration) WithServiceID(value string) *EndpointResourceStatusApplyConfiguration {
+	b.ServiceID = &value
+	return b
+}
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpointspec.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpointspec.go
new file mode 100644
index 00000000..fbe73d12
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpointspec.go
@@ -0,0 +1,79 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+)
+
+// EndpointSpecApplyConfiguration represents a declarative configuration of the EndpointSpec type for use
+// with apply.
+type EndpointSpecApplyConfiguration struct {
+	Import              *EndpointImportApplyConfiguration            `json:"import,omitempty"`
+	Resource            *EndpointResourceSpecApplyConfiguration      `json:"resource,omitempty"`
+	ManagementPolicy    *apiv1alpha1.ManagementPolicy                `json:"managementPolicy,omitempty"`
+	ManagedOptions      *ManagedOptionsApplyConfiguration            `json:"managedOptions,omitempty"`
+	CloudCredentialsRef *CloudCredentialsReferenceApplyConfiguration `json:"cloudCredentialsRef,omitempty"`
+}
+
+// EndpointSpecApplyConfiguration constructs a declarative configuration of the EndpointSpec type for use with
+// apply.
+func EndpointSpec() *EndpointSpecApplyConfiguration {
+	return &EndpointSpecApplyConfiguration{}
+}
+
+// WithImport sets the Import field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Import field is set to the value of the last call.
+func (b *EndpointSpecApplyConfiguration) WithImport(value *EndpointImportApplyConfiguration) *EndpointSpecApplyConfiguration {
+	b.Import = value
+	return b
+}
+
+// WithResource sets the Resource field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Resource field is set to the value of the last call.
+func (b *EndpointSpecApplyConfiguration) WithResource(value *EndpointResourceSpecApplyConfiguration) *EndpointSpecApplyConfiguration {
+	b.Resource = value
+	return b
+}
+
+// WithManagementPolicy sets the ManagementPolicy field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ManagementPolicy field is set to the value of the last call.
+func (b *EndpointSpecApplyConfiguration) WithManagementPolicy(value apiv1alpha1.ManagementPolicy) *EndpointSpecApplyConfiguration {
+	b.ManagementPolicy = &value
+	return b
+}
+
+// WithManagedOptions sets the ManagedOptions field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ManagedOptions field is set to the value of the last call.
+func (b *EndpointSpecApplyConfiguration) WithManagedOptions(value *ManagedOptionsApplyConfiguration) *EndpointSpecApplyConfiguration {
+	b.ManagedOptions = value
+	return b
+}
+
+// WithCloudCredentialsRef sets the CloudCredentialsRef field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CloudCredentialsRef field is set to the value of the last call.
+func (b *EndpointSpecApplyConfiguration) WithCloudCredentialsRef(value *CloudCredentialsReferenceApplyConfiguration) *EndpointSpecApplyConfiguration {
+	b.CloudCredentialsRef = value
+	return b
+}
diff --git a/pkg/clients/applyconfiguration/api/v1alpha1/endpointstatus.go b/pkg/clients/applyconfiguration/api/v1alpha1/endpointstatus.go
new file mode 100644
index 00000000..ab14837e
--- /dev/null
+++ b/pkg/clients/applyconfiguration/api/v1alpha1/endpointstatus.go
@@ -0,0 +1,66 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1 "k8s.io/client-go/applyconfigurations/meta/v1"
+)
+
+// EndpointStatusApplyConfiguration represents a declarative configuration of the EndpointStatus type for use
+// with apply.
+type EndpointStatusApplyConfiguration struct {
+	Conditions []v1.ConditionApplyConfiguration          `json:"conditions,omitempty"`
+	ID         *string                                   `json:"id,omitempty"`
+	Resource   *EndpointResourceStatusApplyConfiguration `json:"resource,omitempty"`
+}
+
+// EndpointStatusApplyConfiguration constructs a declarative configuration of the EndpointStatus type for use with
+// apply.
+func EndpointStatus() *EndpointStatusApplyConfiguration {
+	return &EndpointStatusApplyConfiguration{}
+}
+
+// WithConditions adds the given value to the Conditions field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Conditions field.
+func (b *EndpointStatusApplyConfiguration) WithConditions(values ...*v1.ConditionApplyConfiguration) *EndpointStatusApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithConditions")
+		}
+		b.Conditions = append(b.Conditions, *values[i])
+	}
+	return b
+}
+
+// WithID sets the ID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ID field is set to the value of the last call.
+func (b *EndpointStatusApplyConfiguration) WithID(value string) *EndpointStatusApplyConfiguration {
+	b.ID = &value
+	return b
+}
+
+// WithResource sets the Resource field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Resource field is set to the value of the last call.
+func (b *EndpointStatusApplyConfiguration) WithResource(value *EndpointResourceStatusApplyConfiguration) *EndpointStatusApplyConfiguration {
+	b.Resource = value
+	return b
+}
diff --git a/pkg/clients/applyconfiguration/internal/internal.go b/pkg/clients/applyconfiguration/internal/internal.go
index 92ad4e79..4cd38889 100644
--- a/pkg/clients/applyconfiguration/internal/internal.go
+++ b/pkg/clients/applyconfiguration/internal/internal.go
@@ -192,6 +192,121 @@ var schemaYAML = typed.YAMLObject(`types:
     - name: resource
       type:
         namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.DomainResourceStatus
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.Endpoint
+  map:
+    fields:
+    - name: apiVersion
+      type:
+        scalar: string
+    - name: kind
+      type:
+        scalar: string
+    - name: metadata
+      type:
+        namedType: io.k8s.apimachinery.pkg.apis.meta.v1.ObjectMeta
+      default: {}
+    - name: spec
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointSpec
+      default: {}
+    - name: status
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointStatus
+      default: {}
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointFilter
+  map:
+    fields:
+    - name: interface
+      type:
+        scalar: string
+    - name: serviceRef
+      type:
+        scalar: string
+    - name: url
+      type:
+        scalar: string
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointImport
+  map:
+    fields:
+    - name: filter
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointFilter
+    - name: id
+      type:
+        scalar: string
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointResourceSpec
+  map:
+    fields:
+    - name: enabled
+      type:
+        scalar: boolean
+    - name: interface
+      type:
+        scalar: string
+    - name: name
+      type:
+        scalar: string
+    - name: serviceRef
+      type:
+        scalar: string
+    - name: url
+      type:
+        scalar: string
+      default: ""
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointResourceStatus
+  map:
+    fields:
+    - name: enabled
+      type:
+        scalar: boolean
+    - name: interface
+      type:
+        scalar: string
+    - name: name
+      type:
+        scalar: string
+    - name: serviceID
+      type:
+        scalar: string
+    - name: url
+      type:
+        scalar: string
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointSpec
+  map:
+    fields:
+    - name: cloudCredentialsRef
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.CloudCredentialsReference
+      default: {}
+    - name: import
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointImport
+    - name: managedOptions
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.ManagedOptions
+    - name: managementPolicy
+      type:
+        scalar: string
+    - name: resource
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointResourceSpec
+- name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointStatus
+  map:
+    fields:
+    - name: conditions
+      type:
+        list:
+          elementType:
+            namedType: io.k8s.apimachinery.pkg.apis.meta.v1.Condition
+          elementRelationship: associative
+          keys:
+          - type
+    - name: id
+      type:
+        scalar: string
+    - name: resource
+      type:
+        namedType: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.EndpointResourceStatus
 - name: com.github.k-orc.openstack-resource-controller.v2.api.v1alpha1.ExternalGateway
   map:
     fields:
diff --git a/pkg/clients/applyconfiguration/utils.go b/pkg/clients/applyconfiguration/utils.go
index e3166fef..ed751fc9 100644
--- a/pkg/clients/applyconfiguration/utils.go
+++ b/pkg/clients/applyconfiguration/utils.go
@@ -58,6 +58,20 @@ func ForKind(kind schema.GroupVersionKind) interface{} {
 		return &apiv1alpha1.DomainSpecApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("DomainStatus"):
 		return &apiv1alpha1.DomainStatusApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("Endpoint"):
+		return &apiv1alpha1.EndpointApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("EndpointFilter"):
+		return &apiv1alpha1.EndpointFilterApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("EndpointImport"):
+		return &apiv1alpha1.EndpointImportApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("EndpointResourceSpec"):
+		return &apiv1alpha1.EndpointResourceSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("EndpointResourceStatus"):
+		return &apiv1alpha1.EndpointResourceStatusApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("EndpointSpec"):
+		return &apiv1alpha1.EndpointSpecApplyConfiguration{}
+	case v1alpha1.SchemeGroupVersion.WithKind("EndpointStatus"):
+		return &apiv1alpha1.EndpointStatusApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("ExternalGateway"):
 		return &apiv1alpha1.ExternalGatewayApplyConfiguration{}
 	case v1alpha1.SchemeGroupVersion.WithKind("ExternalGatewayStatus"):
diff --git a/pkg/clients/clientset/clientset/typed/api/v1alpha1/api_client.go b/pkg/clients/clientset/clientset/typed/api/v1alpha1/api_client.go
index 4d2f93b0..09c39d52 100644
--- a/pkg/clients/clientset/clientset/typed/api/v1alpha1/api_client.go
+++ b/pkg/clients/clientset/clientset/typed/api/v1alpha1/api_client.go
@@ -29,6 +29,7 @@ import (
 type OpenstackV1alpha1Interface interface {
 	RESTClient() rest.Interface
 	DomainsGetter
+	EndpointsGetter
 	FlavorsGetter
 	FloatingIPsGetter
 	GroupsGetter
@@ -58,6 +59,10 @@ func (c *OpenstackV1alpha1Client) Domains(namespace string) DomainInterface {
 	return newDomains(c, namespace)
 }
 
+func (c *OpenstackV1alpha1Client) Endpoints(namespace string) EndpointInterface {
+	return newEndpoints(c, namespace)
+}
+
 func (c *OpenstackV1alpha1Client) Flavors(namespace string) FlavorInterface {
 	return newFlavors(c, namespace)
 }
diff --git a/pkg/clients/clientset/clientset/typed/api/v1alpha1/endpoint.go b/pkg/clients/clientset/clientset/typed/api/v1alpha1/endpoint.go
new file mode 100644
index 00000000..8c0f3c58
--- /dev/null
+++ b/pkg/clients/clientset/clientset/typed/api/v1alpha1/endpoint.go
@@ -0,0 +1,74 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	applyconfigurationapiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/applyconfiguration/api/v1alpha1"
+	scheme "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/clientset/clientset/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	gentype "k8s.io/client-go/gentype"
+)
+
+// EndpointsGetter has a method to return a EndpointInterface.
+// A group's client should implement this interface.
+type EndpointsGetter interface {
+	Endpoints(namespace string) EndpointInterface
+}
+
+// EndpointInterface has methods to work with Endpoint resources.
+type EndpointInterface interface {
+	Create(ctx context.Context, endpoint *apiv1alpha1.Endpoint, opts v1.CreateOptions) (*apiv1alpha1.Endpoint, error)
+	Update(ctx context.Context, endpoint *apiv1alpha1.Endpoint, opts v1.UpdateOptions) (*apiv1alpha1.Endpoint, error)
+	// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+	UpdateStatus(ctx context.Context, endpoint *apiv1alpha1.Endpoint, opts v1.UpdateOptions) (*apiv1alpha1.Endpoint, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*apiv1alpha1.Endpoint, error)
+	List(ctx context.Context, opts v1.ListOptions) (*apiv1alpha1.EndpointList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *apiv1alpha1.Endpoint, err error)
+	Apply(ctx context.Context, endpoint *applyconfigurationapiv1alpha1.EndpointApplyConfiguration, opts v1.ApplyOptions) (result *apiv1alpha1.Endpoint, err error)
+	// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+	ApplyStatus(ctx context.Context, endpoint *applyconfigurationapiv1alpha1.EndpointApplyConfiguration, opts v1.ApplyOptions) (result *apiv1alpha1.Endpoint, err error)
+	EndpointExpansion
+}
+
+// endpoints implements EndpointInterface
+type endpoints struct {
+	*gentype.ClientWithListAndApply[*apiv1alpha1.Endpoint, *apiv1alpha1.EndpointList, *applyconfigurationapiv1alpha1.EndpointApplyConfiguration]
+}
+
+// newEndpoints returns a Endpoints
+func newEndpoints(c *OpenstackV1alpha1Client, namespace string) *endpoints {
+	return &endpoints{
+		gentype.NewClientWithListAndApply[*apiv1alpha1.Endpoint, *apiv1alpha1.EndpointList, *applyconfigurationapiv1alpha1.EndpointApplyConfiguration](
+			"endpoints",
+			c.RESTClient(),
+			scheme.ParameterCodec,
+			namespace,
+			func() *apiv1alpha1.Endpoint { return &apiv1alpha1.Endpoint{} },
+			func() *apiv1alpha1.EndpointList { return &apiv1alpha1.EndpointList{} },
+		),
+	}
+}
diff --git a/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_api_client.go b/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_api_client.go
index 44feeb45..dfe83cde 100644
--- a/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_api_client.go
+++ b/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_api_client.go
@@ -32,6 +32,10 @@ func (c *FakeOpenstackV1alpha1) Domains(namespace string) v1alpha1.DomainInterfa
 	return newFakeDomains(c, namespace)
 }
 
+func (c *FakeOpenstackV1alpha1) Endpoints(namespace string) v1alpha1.EndpointInterface {
+	return newFakeEndpoints(c, namespace)
+}
+
 func (c *FakeOpenstackV1alpha1) Flavors(namespace string) v1alpha1.FlavorInterface {
 	return newFakeFlavors(c, namespace)
 }
diff --git a/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_endpoint.go b/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_endpoint.go
new file mode 100644
index 00000000..bc2842cd
--- /dev/null
+++ b/pkg/clients/clientset/clientset/typed/api/v1alpha1/fake/fake_endpoint.go
@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/applyconfiguration/api/v1alpha1"
+	typedapiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/clientset/clientset/typed/api/v1alpha1"
+	gentype "k8s.io/client-go/gentype"
+)
+
+// fakeEndpoints implements EndpointInterface
+type fakeEndpoints struct {
+	*gentype.FakeClientWithListAndApply[*v1alpha1.Endpoint, *v1alpha1.EndpointList, *apiv1alpha1.EndpointApplyConfiguration]
+	Fake *FakeOpenstackV1alpha1
+}
+
+func newFakeEndpoints(fake *FakeOpenstackV1alpha1, namespace string) typedapiv1alpha1.EndpointInterface {
+	return &fakeEndpoints{
+		gentype.NewFakeClientWithListAndApply[*v1alpha1.Endpoint, *v1alpha1.EndpointList, *apiv1alpha1.EndpointApplyConfiguration](
+			fake.Fake,
+			namespace,
+			v1alpha1.SchemeGroupVersion.WithResource("endpoints"),
+			v1alpha1.SchemeGroupVersion.WithKind("Endpoint"),
+			func() *v1alpha1.Endpoint { return &v1alpha1.Endpoint{} },
+			func() *v1alpha1.EndpointList { return &v1alpha1.EndpointList{} },
+			func(dst, src *v1alpha1.EndpointList) { dst.ListMeta = src.ListMeta },
+			func(list *v1alpha1.EndpointList) []*v1alpha1.Endpoint { return gentype.ToPointerSlice(list.Items) },
+			func(list *v1alpha1.EndpointList, items []*v1alpha1.Endpoint) {
+				list.Items = gentype.FromPointerSlice(items)
+			},
+		),
+		fake,
+	}
+}
diff --git a/pkg/clients/clientset/clientset/typed/api/v1alpha1/generated_expansion.go b/pkg/clients/clientset/clientset/typed/api/v1alpha1/generated_expansion.go
index 56550a99..a2aff2ef 100644
--- a/pkg/clients/clientset/clientset/typed/api/v1alpha1/generated_expansion.go
+++ b/pkg/clients/clientset/clientset/typed/api/v1alpha1/generated_expansion.go
@@ -20,6 +20,8 @@ package v1alpha1
 
 type DomainExpansion interface{}
 
+type EndpointExpansion interface{}
+
 type FlavorExpansion interface{}
 
 type FloatingIPExpansion interface{}
diff --git a/pkg/clients/informers/externalversions/api/v1alpha1/endpoint.go b/pkg/clients/informers/externalversions/api/v1alpha1/endpoint.go
new file mode 100644
index 00000000..496b0540
--- /dev/null
+++ b/pkg/clients/informers/externalversions/api/v1alpha1/endpoint.go
@@ -0,0 +1,102 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	context "context"
+	time "time"
+
+	v2apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	clientset "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/clientset/clientset"
+	internalinterfaces "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/informers/externalversions/internalinterfaces"
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/pkg/clients/listers/api/v1alpha1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// EndpointInformer provides access to a shared informer and lister for
+// Endpoints.
+type EndpointInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() apiv1alpha1.EndpointLister
+}
+
+type endpointInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+	namespace        string
+}
+
+// NewEndpointInformer constructs a new informer for Endpoint type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewEndpointInformer(client clientset.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredEndpointInformer(client, namespace, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredEndpointInformer constructs a new informer for Endpoint type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredEndpointInformer(client clientset.Interface, namespace string, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.OpenstackV1alpha1().Endpoints(namespace).List(context.Background(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.OpenstackV1alpha1().Endpoints(namespace).Watch(context.Background(), options)
+			},
+			ListWithContextFunc: func(ctx context.Context, options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.OpenstackV1alpha1().Endpoints(namespace).List(ctx, options)
+			},
+			WatchFuncWithContext: func(ctx context.Context, options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.OpenstackV1alpha1().Endpoints(namespace).Watch(ctx, options)
+			},
+		},
+		&v2apiv1alpha1.Endpoint{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *endpointInformer) defaultInformer(client clientset.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredEndpointInformer(client, f.namespace, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *endpointInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&v2apiv1alpha1.Endpoint{}, f.defaultInformer)
+}
+
+func (f *endpointInformer) Lister() apiv1alpha1.EndpointLister {
+	return apiv1alpha1.NewEndpointLister(f.Informer().GetIndexer())
+}
diff --git a/pkg/clients/informers/externalversions/api/v1alpha1/interface.go b/pkg/clients/informers/externalversions/api/v1alpha1/interface.go
index 1b449781..801c38e8 100644
--- a/pkg/clients/informers/externalversions/api/v1alpha1/interface.go
+++ b/pkg/clients/informers/externalversions/api/v1alpha1/interface.go
@@ -26,6 +26,8 @@ import (
 type Interface interface {
 	// Domains returns a DomainInformer.
 	Domains() DomainInformer
+	// Endpoints returns a EndpointInformer.
+	Endpoints() EndpointInformer
 	// Flavors returns a FlavorInformer.
 	Flavors() FlavorInformer
 	// FloatingIPs returns a FloatingIPInformer.
@@ -80,6 +82,11 @@ func (v *version) Domains() DomainInformer {
 	return &domainInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
 }
 
+// Endpoints returns a EndpointInformer.
+func (v *version) Endpoints() EndpointInformer {
+	return &endpointInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
+}
+
 // Flavors returns a FlavorInformer.
 func (v *version) Flavors() FlavorInformer {
 	return &flavorInformer{factory: v.factory, namespace: v.namespace, tweakListOptions: v.tweakListOptions}
diff --git a/pkg/clients/informers/externalversions/generic.go b/pkg/clients/informers/externalversions/generic.go
index 30911d11..1ad4042c 100644
--- a/pkg/clients/informers/externalversions/generic.go
+++ b/pkg/clients/informers/externalversions/generic.go
@@ -55,6 +55,8 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	// Group=openstack.k-orc.cloud, Version=v1alpha1
 	case v1alpha1.SchemeGroupVersion.WithResource("domains"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Openstack().V1alpha1().Domains().Informer()}, nil
+	case v1alpha1.SchemeGroupVersion.WithResource("endpoints"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Openstack().V1alpha1().Endpoints().Informer()}, nil
 	case v1alpha1.SchemeGroupVersion.WithResource("flavors"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Openstack().V1alpha1().Flavors().Informer()}, nil
 	case v1alpha1.SchemeGroupVersion.WithResource("floatingips"):
diff --git a/pkg/clients/listers/api/v1alpha1/endpoint.go b/pkg/clients/listers/api/v1alpha1/endpoint.go
new file mode 100644
index 00000000..427f0914
--- /dev/null
+++ b/pkg/clients/listers/api/v1alpha1/endpoint.go
@@ -0,0 +1,70 @@
+/*
+Copyright 2025 The ORC Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	apiv1alpha1 "github.com/k-orc/openstack-resource-controller/v2/api/v1alpha1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	listers "k8s.io/client-go/listers"
+	cache "k8s.io/client-go/tools/cache"
+)
+
+// EndpointLister helps list Endpoints.
+// All objects returned here must be treated as read-only.
+type EndpointLister interface {
+	// List lists all Endpoints in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiv1alpha1.Endpoint, err error)
+	// Endpoints returns an object that can list and get Endpoints.
+	Endpoints(namespace string) EndpointNamespaceLister
+	EndpointListerExpansion
+}
+
+// endpointLister implements the EndpointLister interface.
+type endpointLister struct {
+	listers.ResourceIndexer[*apiv1alpha1.Endpoint]
+}
+
+// NewEndpointLister returns a new EndpointLister.
+func NewEndpointLister(indexer cache.Indexer) EndpointLister {
+	return &endpointLister{listers.New[*apiv1alpha1.Endpoint](indexer, apiv1alpha1.Resource("endpoint"))}
+}
+
+// Endpoints returns an object that can list and get Endpoints.
+func (s *endpointLister) Endpoints(namespace string) EndpointNamespaceLister {
+	return endpointNamespaceLister{listers.NewNamespaced[*apiv1alpha1.Endpoint](s.ResourceIndexer, namespace)}
+}
+
+// EndpointNamespaceLister helps list and get Endpoints.
+// All objects returned here must be treated as read-only.
+type EndpointNamespaceLister interface {
+	// List lists all Endpoints in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*apiv1alpha1.Endpoint, err error)
+	// Get retrieves the Endpoint from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*apiv1alpha1.Endpoint, error)
+	EndpointNamespaceListerExpansion
+}
+
+// endpointNamespaceLister implements the EndpointNamespaceLister
+// interface.
+type endpointNamespaceLister struct {
+	listers.ResourceIndexer[*apiv1alpha1.Endpoint]
+}
diff --git a/pkg/clients/listers/api/v1alpha1/expansion_generated.go b/pkg/clients/listers/api/v1alpha1/expansion_generated.go
index ba288873..357c7d56 100644
--- a/pkg/clients/listers/api/v1alpha1/expansion_generated.go
+++ b/pkg/clients/listers/api/v1alpha1/expansion_generated.go
@@ -26,6 +26,14 @@ type DomainListerExpansion interface{}
 // DomainNamespaceLister.
 type DomainNamespaceListerExpansion interface{}
 
+// EndpointListerExpansion allows custom methods to be added to
+// EndpointLister.
+type EndpointListerExpansion interface{}
+
+// EndpointNamespaceListerExpansion allows custom methods to be added to
+// EndpointNamespaceLister.
+type EndpointNamespaceListerExpansion interface{}
+
 // FlavorListerExpansion allows custom methods to be added to
 // FlavorLister.
 type FlavorListerExpansion interface{}
diff --git a/website/docs/crd-reference.md b/website/docs/crd-reference.md
index 36f357a3..131d2a64 100644
--- a/website/docs/crd-reference.md
+++ b/website/docs/crd-reference.md
@@ -11,6 +11,7 @@ Package v1alpha1 contains API Schema definitions for the openstack v1alpha1 API
 
 ### Resource Types
 - [Domain](#domain)
+- [Endpoint](#endpoint)
 - [Flavor](#flavor)
 - [FloatingIP](#floatingip)
 - [Group](#group)
@@ -164,6 +165,7 @@ CloudCredentialsReference is a reference to a secret containing OpenStack creden
 
 _Appears in:_
 - [DomainSpec](#domainspec)
+- [EndpointSpec](#endpointspec)
 - [FlavorSpec](#flavorspec)
 - [FloatingIPSpec](#floatingipspec)
 - [GroupSpec](#groupspec)
@@ -335,6 +337,142 @@ _Appears in:_
 | `resource` _[DomainResourceStatus](#domainresourcestatus)_ | resource contains the observed state of the OpenStack resource. |  |  |
 
 
+#### Endpoint
+
+
+
+Endpoint is the Schema for an ORC resource.
+
+
+
+
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `apiVersion` _string_ | `openstack.k-orc.cloud/v1alpha1` | | |
+| `kind` _string_ | `Endpoint` | | |
+| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |  |  |
+| `spec` _[EndpointSpec](#endpointspec)_ | spec specifies the desired state of the resource. |  |  |
+| `status` _[EndpointStatus](#endpointstatus)_ | status defines the observed state of the resource. |  |  |
+
+
+#### EndpointFilter
+
+
+
+EndpointFilter defines an existing resource by its properties
+
+_Validation:_
+- MinProperties: 1
+
+_Appears in:_
+- [EndpointImport](#endpointimport)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `interface` _string_ | interface of the existing endpoint. |  | Enum: [admin internal public] <br /> |
+| `serviceRef` _[KubernetesNameRef](#kubernetesnameref)_ | serviceRef is a reference to the ORC Service which this resource is associated with. |  | MaxLength: 253 <br />MinLength: 1 <br /> |
+| `url` _string_ | url is the URL of the existing endpoint. |  | MaxLength: 1024 <br /> |
+
+
+#### EndpointImport
+
+
+
+EndpointImport specifies an existing resource which will be imported instead of
+creating a new one
+
+_Validation:_
+- MaxProperties: 1
+- MinProperties: 1
+
+_Appears in:_
+- [EndpointSpec](#endpointspec)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `id` _string_ | id contains the unique identifier of an existing OpenStack resource. Note<br />that when specifying an import by ID, the resource MUST already exist.<br />The ORC object will enter an error state if the resource does not exist. |  | Format: uuid <br /> |
+| `filter` _[EndpointFilter](#endpointfilter)_ | filter contains a resource query which is expected to return a single<br />result. The controller will continue to retry if filter returns no<br />results. If filter returns multiple results the controller will set an<br />error state and will not continue to retry. |  | MinProperties: 1 <br /> |
+
+
+#### EndpointResourceSpec
+
+
+
+EndpointResourceSpec contains the desired state of the resource.
+
+
+
+_Appears in:_
+- [EndpointSpec](#endpointspec)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `name` _[OpenStackName](#openstackname)_ | name will be the name of the created resource. If not specified, the<br />name of the ORC object will be used. |  | MaxLength: 255 <br />MinLength: 1 <br />Pattern: `^[^,]+$` <br /> |
+| `enabled` _boolean_ | enabled indicates whether the endpoint is enabled or not. | true |  |
+| `interface` _string_ | interface indicates the visibility of the endpoint. |  | Enum: [admin internal public] <br /> |
+| `url` _string_ | url is the endpoint URL. |  | MaxLength: 1024 <br /> |
+| `serviceRef` _[KubernetesNameRef](#kubernetesnameref)_ | serviceRef is a reference to the ORC Service which this resource is associated with. |  | MaxLength: 253 <br />MinLength: 1 <br /> |
+
+
+#### EndpointResourceStatus
+
+
+
+EndpointResourceStatus represents the observed state of the resource.
+
+
+
+_Appears in:_
+- [EndpointStatus](#endpointstatus)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `name` _string_ | name is a Human-readable name for the resource. Might not be unique. |  | MaxLength: 1024 <br /> |
+| `enabled` _boolean_ | enabled indicates whether the endpoint is enabled or not. |  |  |
+| `interface` _string_ | interface indicates the visibility of the endpoint. |  | Enum: [admin internal public] <br /> |
+| `url` _string_ | url is the endpoint URL. |  | MaxLength: 1024 <br /> |
+| `serviceID` _string_ | serviceID is the ID of the Service to which the resource is associated. |  | MaxLength: 1024 <br /> |
+
+
+#### EndpointSpec
+
+
+
+EndpointSpec defines the desired state of an ORC object.
+
+
+
+_Appears in:_
+- [Endpoint](#endpoint)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `import` _[EndpointImport](#endpointimport)_ | import refers to an existing OpenStack resource which will be imported instead of<br />creating a new one. |  | MaxProperties: 1 <br />MinProperties: 1 <br /> |
+| `resource` _[EndpointResourceSpec](#endpointresourcespec)_ | resource specifies the desired state of the resource.<br />resource may not be specified if the management policy is `unmanaged`.<br />resource must be specified if the management policy is `managed`. |  |  |
+| `managementPolicy` _[ManagementPolicy](#managementpolicy)_ | managementPolicy defines how ORC will treat the object. Valid values are<br />`managed`: ORC will create, update, and delete the resource; `unmanaged`:<br />ORC will import an existing resource, and will not apply updates to it or<br />delete it. | managed | Enum: [managed unmanaged] <br /> |
+| `managedOptions` _[ManagedOptions](#managedoptions)_ | managedOptions specifies options which may be applied to managed objects. |  |  |
+| `cloudCredentialsRef` _[CloudCredentialsReference](#cloudcredentialsreference)_ | cloudCredentialsRef points to a secret containing OpenStack credentials |  |  |
+
+
+#### EndpointStatus
+
+
+
+EndpointStatus defines the observed state of an ORC resource.
+
+
+
+_Appears in:_
+- [Endpoint](#endpoint)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.29/#condition-v1-meta) array_ | conditions represents the observed status of the object.<br />Known .status.conditions.type are: "Available", "Progressing"<br />Available represents the availability of the OpenStack resource. If it is<br />true then the resource is ready for use.<br />Progressing indicates whether the controller is still attempting to<br />reconcile the current state of the OpenStack resource to the desired<br />state. Progressing will be False either because the desired state has<br />been achieved, or because some terminal error prevents it from ever being<br />achieved and the controller is no longer attempting to reconcile. If<br />Progressing is True, an observer waiting on the resource should continue<br />to wait. |  | MaxItems: 32 <br /> |
+| `id` _string_ | id is the unique identifier of the OpenStack resource. |  |  |
+| `resource` _[EndpointResourceStatus](#endpointresourcestatus)_ | resource contains the observed state of the OpenStack resource. |  |  |
+
+
 #### Ethertype
 
 _Underlying type:_ _string_
@@ -1611,6 +1749,8 @@ _Validation:_
 
 _Appears in:_
 - [Address](#address)
+- [EndpointFilter](#endpointfilter)
+- [EndpointResourceSpec](#endpointresourcespec)
 - [ExternalGateway](#externalgateway)
 - [FloatingIPFilter](#floatingipfilter)
 - [FloatingIPResourceSpec](#floatingipresourcespec)
@@ -1677,6 +1817,7 @@ _Appears in:_
 
 _Appears in:_
 - [DomainSpec](#domainspec)
+- [EndpointSpec](#endpointspec)
 - [FlavorSpec](#flavorspec)
 - [FloatingIPSpec](#floatingipspec)
 - [GroupSpec](#groupspec)
@@ -1711,6 +1852,7 @@ _Validation:_
 
 _Appears in:_
 - [DomainSpec](#domainspec)
+- [EndpointSpec](#endpointspec)
 - [FlavorSpec](#flavorspec)
 - [FloatingIPSpec](#floatingipspec)
 - [GroupSpec](#groupspec)
@@ -2003,6 +2145,7 @@ _Validation:_
 - Pattern: `^[^,]+$`
 
 _Appears in:_
+- [EndpointResourceSpec](#endpointresourcespec)
 - [FlavorFilter](#flavorfilter)
 - [FlavorResourceSpec](#flavorresourcespec)
 - [ImageFilter](#imagefilter)