diff --git a/endpoints.md b/endpoints.md
index 2adbf1c..3eb6447 100755
--- a/endpoints.md
+++ b/endpoints.md
@@ -6,6 +6,9 @@
 * api.calculator.billing-data-plane.api.nebius.cloud:443
   * [nebius.billing.v1.CalculatorService](nebius/billing/v1/calculator_service.proto)
   * [nebius.billing.v1alpha1.CalculatorService](nebius/billing/v1alpha1/calculator_service.proto)
+* applicationtunnel.mkt.api.nebius.cloud:443
+  * [nebius.common.v1.OperationService](nebius/common/v1/operation_service.proto)
+  * [nebius.tunnel.v1.TunnelService](nebius/tunnel/v1/tunnel_service.proto)
 * apps.msp.api.nebius.cloud:443
   * [nebius.ai.v1.EndpointService](nebius/ai/v1/endpoint_service.proto)
   * [nebius.ai.v1.JobService](nebius/ai/v1/job_service.proto)
diff --git a/nebius/tunnel/v1/tunnel.proto b/nebius/tunnel/v1/tunnel.proto
new file mode 100644
index 0000000..cc9ea19
--- /dev/null
+++ b/nebius/tunnel/v1/tunnel.proto
@@ -0,0 +1,63 @@
+syntax = "proto3";
+
+package nebius.tunnel.v1;
+
+import "buf/validate/validate.proto";
+import "nebius/annotations.proto";
+import "nebius/common/v1/metadata.proto";
+
+option go_package = "github.com/nebius/gosdk/proto/nebius/tunnel/v1";
+option java_multiple_files = true;
+option java_outer_classname = "TunnelProto";
+option java_package = "ai.nebius.pub.tunnel.v1";
+
+// Tunnel represents a secure tunnel connection for applications.
+// It enables connectivity between applications and external services within a parent.
+message Tunnel {
+  option (resource_behavior) = UNNAMED;
+
+  // Resource metadata containing identification and hierarchy information.
+  common.v1.ResourceMetadata metadata = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      parent_resource: ["project"]
+    }
+  ];
+
+  // Specification of the tunnel configuration.
+  TunnelSpec spec = 2 [(buf.validate.field).required = true];
+
+  // Current status of the tunnel.
+  TunnelStatus status = 3 [(field_behavior) = OUTPUT_ONLY];
+}
+
+// TunnelSpec defines the configuration for the tunnel.
+message TunnelSpec {
+  // Human-readable display name for the tunnel.
+  string title = 1 [(buf.validate.field) = {
+    string: {max_len: 256}
+  }];
+
+  // Arbitrary description of the tunnel provided by the user.
+  string description = 2 [(buf.validate.field) = {
+    string: {max_len: 1024}
+  }];
+}
+
+// TunnelStatus represents the current state of the tunnel.
+message TunnelStatus {
+  // State represents the lifecycle state of the tunnel.
+  enum State {
+    // Default unspecified state.
+    UNSPECIFIED = 0;
+
+    // The tunnel has been created and is active.
+    CREATED = 1;
+
+    // The tunnel has been deleted.
+    DELETED = 2;
+  }
+
+  // Current lifecycle state of the tunnel.
+  State state = 1;
+}
diff --git a/nebius/tunnel/v1/tunnel_service.proto b/nebius/tunnel/v1/tunnel_service.proto
new file mode 100644
index 0000000..e690c92
--- /dev/null
+++ b/nebius/tunnel/v1/tunnel_service.proto
@@ -0,0 +1,95 @@
+syntax = "proto3";
+
+package nebius.tunnel.v1;
+
+import "buf/validate/validate.proto";
+import "nebius/annotations.proto";
+import "nebius/common/v1/metadata.proto";
+import "nebius/common/v1/operation.proto";
+import "nebius/tunnel/v1/tunnel.proto";
+
+option go_package = "github.com/nebius/gosdk/proto/nebius/tunnel/v1";
+option java_multiple_files = true;
+option java_outer_classname = "TunnelServiceProto";
+option java_package = "ai.nebius.pub.tunnel.v1";
+
+// TunnelService provides methods for managing tunnels.
+// It supports CRUD operations for creating secure tunnel connections for applications.
+service TunnelService {
+  option (api_service_name) = "applicationtunnel.mkt";
+
+  // Retrieves a tunnel by its identifier.
+  rpc Get(GetTunnelRequest) returns (Tunnel);
+
+  // Lists all tunnels within a parent.
+  rpc List(ListTunnelRequest) returns (ListTunnelsResponse);
+
+  // Creates a new tunnel.
+  rpc Create(CreateTunnelRequest) returns (common.v1.Operation);
+
+  // Updates an existing tunnel.
+  rpc Update(UpdateTunnelRequest) returns (common.v1.Operation);
+
+  // Deletes a tunnel by its identifier.
+  rpc Delete(DeleteTunnelRequest) returns (common.v1.Operation);
+}
+
+// Request to get a tunnel by its identifier.
+message GetTunnelRequest {
+  // Unique identifier of the tunnel.
+  string id = 1 [(buf.validate.field).required = true];
+}
+
+// Request to list tunnels within a project.
+message ListTunnelRequest {
+  // Identifier of the parent project.
+  string parent_id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["project"]
+    }
+  ];
+
+  // Maximum number of items to return per page.
+  int64 page_size = 2;
+
+  // Token for retrieving the next page of results.
+  string page_token = 3;
+
+  // Filter expression for narrowing results.
+  string filter = 4;
+}
+
+// Response containing a list of tunnels.
+message ListTunnelsResponse {
+  // List of tunnels matching the request.
+  repeated Tunnel items = 1;
+
+  // Token to retrieve the next page of results, empty if no more results.
+  string next_page_token = 2;
+}
+
+// Request to create a new tunnel.
+message CreateTunnelRequest {
+  // Metadata for the new tunnel.
+  common.v1.ResourceMetadata metadata = 1;
+
+  // Specification for the new tunnel.
+  TunnelSpec spec = 2;
+}
+
+// Request to update an existing tunnel.
+message UpdateTunnelRequest {
+  // Metadata identifying the tunnel to update. The `id` field is required;
+  // `resource_version`, when non-zero, enables optimistic concurrency control.
+  common.v1.ResourceMetadata metadata = 1 [(buf.validate.field).required = true];
+
+  // New specification for the tunnel.
+  TunnelSpec spec = 2 [(buf.validate.field).required = true];
+}
+
+// Request to delete a tunnel.
+message DeleteTunnelRequest {
+  // Unique identifier of the tunnel to delete.
+  string id = 1 [(buf.validate.field).required = true];
+}