Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Create a reusable IKE (Phase 1) policy
Creates one IKE (Phase 1) policy in the active scope as a standalone resource. The policy exists on its
own: it is NOT tied to any connection at creation time and may later be selected by any number of site
connections. The field set and every enumerated value are taken verbatim from the deployed
neutron-VPNaaS ikepolicies attribute map, so nothing is invented and nothing is hidden.
Validation: name must be non-empty and unique within the scope (duplicate -> 409 CONFLICT);
authAlgorithm, encryptionAlgorithm, pfs, ikeVersion and phase1NegotiationMode must each be one of the
enumerated values neutron accepts; lifetimeUnits must be seconds and lifetimeValue at least 60
(neutron's own type:range [60, null]); any violation -> 422 VALIDATION_FAILED naming the field.
Async & state: Asynchronous; returns 202 with the policy in provisioningState PENDING_CREATE. The
worker creates the neutron policy and settles the record to READY, or to ERROR with statusReason on a
provider rejection. A resource.updated SSE frame (kind: network.vpn_ike_policy) is emitted on settle.
Errors: 401 unauthenticated; 403 when the caller is not owner/admin/contributor on the scope;
409 when the name is already taken in the scope; 422 on field-level validation failure; 500 on
backend failure.
Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the original
202 without creating a second policy.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
Idempotency-Key*stringRequired: this operation creates a new resource asynchronously, so a retry without the key would create a second one. Same key+body within 24h replays the original result; the same key with a different body is 409 CONFLICT. Keys are unique per tenant (the same key in two tenants is two different requests). An API token or service-account (bearer) caller MUST send it -- a request without it is refused with 400 IDEMPOTENCY_KEY_REQUIRED (ErrIdempotencyKeyRequired); reuse the same key on every retry of one logical request. A console session gets one from the edge.
uuidapplication/json- body
Payload for creating a standalone, reusable IKE (Phase 1) policy. Every field maps one-for-one onto a neutron ikepolicies attribute; the defaults are the ones a site-to-site tunnel actually wants, not neutron's weaker historical defaults (sha1 / aes-128 / v1).
name*stringPolicy display name; must be unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description?stringFree-text description.
length <= 255""authAlgorithm?stringPhase 1 authentication (integrity) algorithm.
"sha256""sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm?stringPhase 1 encryption algorithm.
"aes-256""3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"pfs?stringDiffie-Hellman group used for the Phase 1 key exchange.
"group14""group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"ikeVersion?stringIKE protocol version.
"v2""v1""v2"phase1NegotiationMode?stringPhase 1 negotiation mode.
"main""main""aggressive"lifetimeUnits?"seconds"Units of the security-association lifetime.
"seconds""seconds"lifetimeValue?integerSecurity-association lifetime, in the units above.
60 <= value3600Creation accepted; returns the new IKE policy in provisioningState PENDING_CREATE.
application/json- response
An IKE (Phase 1) policy - a standalone, reusable resource mirroring the neutron-VPNaaS ikepolicies resource one-for-one. Many IPsec site connections may reference the same policy; it is never cloned per connection. While any connection references it, neutron refuses both an update and a delete (IKEPolicyInUse), which is what usedByCount warns about before the user tries.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the IKE policy.
name*stringPolicy display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset (neutron's own default).
authAlgorithm*stringPhase 1 authentication (integrity) algorithm.
"sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm*stringPhase 1 encryption algorithm.
"3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"pfs*stringDiffie-Hellman group used for the Phase 1 key exchange.
"group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"ikeVersion*stringIKE protocol version.
"v1""v2"phase1NegotiationMode*stringPhase 1 negotiation mode.
"main""aggressive"lifetimeUnits*"seconds"Units of the security-association lifetime; neutron accepts only seconds.
"seconds"lifetimeValue*integerSecurity-association lifetime, in the units above. neutron's own floor is 60.
60 <= valueprovisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"statusReason?|The provider's own message from the last failed write; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
providerId?|neutron's UUID for this policy; null until the worker has created it.
usedByCount*integerHow many IPsec site connections currently reference this policy. Non-zero means an update or a delete will be refused with 409 DEPENDENCY_BLOCKED.
curl -X POST "https://example.com/scopes/string/network/vpn/ike-policies" \ -H "Idempotency-Key: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{ "name": "string" }'{ "origin": "portal", "id": "string", "name": "string", "description": "string", "authAlgorithm": "sha1", "encryptionAlgorithm": "3des", "pfs": "group2", "ikeVersion": "v1", "phase1NegotiationMode": "main", "lifetimeUnits": "seconds", "lifetimeValue": 60, "provisioningState": "PENDING_CREATE", "statusReason": "string", "statusReasonCode": "string", "providerId": "string", "usedByCount": 0}