Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Update an IKE (Phase 1) policy
Updates the mutable fields of one IKE policy. Exactly the fields neutron marks allow_put on
ikepolicies are accepted - name, description, authAlgorithm, encryptionAlgorithm, phase1NegotiationMode,
lifetimeUnits, lifetimeValue, ikeVersion, pfs - and nothing else. Omitted fields are left unchanged.
A policy that is in use cannot be updated. neutron-VPNaaS raises IKEPolicyInUse from
update_ikepolicy whenever any IPsec site connection references the policy, so this endpoint refuses the
same case up front with 409 CONFLICT, code DEPENDENCY_BLOCKED, and details.usedBy listing the referencing
connections by id and name. Change the algorithms by creating a new policy and a new connection, or by
deleting the connections first.
Validation: vpnIkePolicyId must reference an existing policy in the scope (404); every supplied
value must be one of the enumerated values neutron accepts and lifetimeValue at least 60
(-> 422 VALIDATION_FAILED naming the field); a duplicate name -> 409 CONFLICT.
Async & state: Asynchronous; returns 202 with the record in provisioningState PENDING_UPDATE. The
worker applies the change to neutron and settles the record to READY, or ERROR with statusReason.
Errors: 401 unauthenticated; 403 without manage permission; 404 unknown policy;
409 when the policy is in use or the new name is taken; 412 when If-Match is stale;
422 on field-level validation failure; 500 on backend failure.
Idempotency/Concurrency: Idempotency-Key is optional (recommended); If-Match is optional
and honoured against the
weak ETag returned by the view.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
vpnIkePolicyId*stringIdentifier of the IKE (Phase 1) policy within the scope.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidIf-Match?stringETag for optimistic concurrency on mutations/deletes; mismatch results in 412.
application/json- body
Partial update of an IKE policy. Every property here is a field neutron marks allow_put on ikepolicies; omitted properties are left unchanged. Refused with 409 DEPENDENCY_BLOCKED while any site connection references the policy, exactly as neutron's own update_ikepolicy does.
name?stringNew display name; must stay unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description?stringNew free-text description.
length <= 255authAlgorithm?stringNew Phase 1 authentication algorithm.
"sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm?stringNew Phase 1 encryption algorithm.
"3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"pfs?stringNew Diffie-Hellman group.
"group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"ikeVersion?stringNew IKE protocol version.
"v1""v2"phase1NegotiationMode?stringNew Phase 1 negotiation mode.
"main""aggressive"lifetimeUnits?"seconds"New lifetime units.
"seconds"lifetimeValue?integerNew security-association lifetime.
60 <= valueUpdate accepted; returns the policy in provisioningState PENDING_UPDATE.
application/json- response
An IKE (Phase 1) policy - a standalone, reusable resource mirroring the neutron-VPNaaS ikepolicies resource one-for-one. Many IPsec site connections may reference the same policy; it is never cloned per connection. While any connection references it, neutron refuses both an update and a delete (IKEPolicyInUse), which is what usedByCount warns about before the user tries.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the IKE policy.
name*stringPolicy display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset (neutron's own default).
authAlgorithm*stringPhase 1 authentication (integrity) algorithm.
"sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm*stringPhase 1 encryption algorithm.
"3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"pfs*stringDiffie-Hellman group used for the Phase 1 key exchange.
"group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"ikeVersion*stringIKE protocol version.
"v1""v2"phase1NegotiationMode*stringPhase 1 negotiation mode.
"main""aggressive"lifetimeUnits*"seconds"Units of the security-association lifetime; neutron accepts only seconds.
"seconds"lifetimeValue*integerSecurity-association lifetime, in the units above. neutron's own floor is 60.
60 <= valueprovisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"statusReason?|The provider's own message from the last failed write; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
providerId?|neutron's UUID for this policy; null until the worker has created it.
usedByCount*integerHow many IPsec site connections currently reference this policy. Non-zero means an update or a delete will be refused with 409 DEPENDENCY_BLOCKED.
curl -X PATCH "https://example.com/scopes/string/network/vpn/ike-policies/string" \ -H "Content-Type: application/json" \ -d '{}'{ "origin": "portal", "id": "string", "name": "string", "description": "string", "authAlgorithm": "sha1", "encryptionAlgorithm": "3des", "pfs": "group2", "ikeVersion": "v1", "phase1NegotiationMode": "main", "lifetimeUnits": "seconds", "lifetimeValue": 60, "provisioningState": "PENDING_CREATE", "statusReason": "string", "statusReasonCode": "string", "providerId": "string", "usedByCount": 0}