Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Rename a VPN endpoint group
Updates the only mutable fields neutron allows on an endpoint group: name and description. type and endpoints are marked allow_put false in the deployed attribute map, so they cannot be changed and are not presented as editable - to point a tunnel at a different subnet or CIDR, create a new endpoint group and a new site connection. Validation: vpnEndpointGroupId must exist in the scope (404); a duplicate name -> 409 CONFLICT; any attempt to send type or endpoints -> 422 VALIDATION_FAILED naming the field and saying it is immutable. Async & state: Asynchronous; 202 with provisioningState PENDING_UPDATE. Errors: 401; 403; 404; 409 duplicate name; 412 stale If-Match; 422; 500. Idempotency/Concurrency: Idempotency-Key is optional (recommended); If-Match optional.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
vpnEndpointGroupId*stringIdentifier of the VPN endpoint group within the scope.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidIf-Match?stringETag for optimistic concurrency on mutations/deletes; mismatch results in 412.
application/json- body
Partial update of a VPN endpoint group. neutron marks only name and description as allow_put; type and endpoints are immutable, so they are not accepted here - cover a different set of subnets by creating a new group and a new site connection.
name?stringNew display name; must stay unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description?stringNew free-text description.
length <= 255Update accepted; returns the group in provisioningState PENDING_UPDATE.
application/json- response
A VPN endpoint group - one end of a tunnel, mirroring the neutron-VPNaaS endpoint_groups resource. type subnet names tenant subnets and is used as the LOCAL end; type cidr names remote networks and is used as the PEER end. Groups are reusable across site connections. A group may hold SEVERAL endpoints: one site connection then covers all of them on a single CHILD_SA, which is the only arrangement that actually carries traffic for more than one subnet against the same peer gateway.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the endpoint group.
name*stringGroup display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset.
type*stringWhich end of the tunnel this group describes.
"subnet""cidr"endpoints*array<string>One or more endpoints - subnet ids for type subnet, CIDRs for type cidr. Immutable once created (neutron marks it allow_put false).
1 <= itemsendpointLabel?|Human-readable rendering of the endpoints - each subnet's name and CIDR for a subnet group, resolved from the networking read model, comma-separated when there is more than one. Null when no subnet can be resolved; the raw endpoints above are always present.
provisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"statusReason?|The provider's own message from the last failed write; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
providerId?|neutron's UUID for this endpoint group; null until the worker has created it.
usedByCount*integerHow many IPsec site connections use this group as their local or peer end. Non-zero means a delete will be refused with 409 DEPENDENCY_BLOCKED.
curl -X PATCH "https://example.com/scopes/string/network/vpn/endpoint-groups/string" \ -H "Content-Type: application/json" \ -d '{}'{ "origin": "portal", "id": "string", "name": "string", "description": "string", "type": "subnet", "endpoints": [ "string" ], "endpointLabel": "string", "provisioningState": "PENDING_CREATE", "statusReason": "string", "statusReasonCode": "string", "providerId": "string", "usedByCount": 0}