Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Get one IKE (Phase 1) policy
Returns one IKE policy with its full neutron field set, this record's provisioning state and the list of site connections currently using it (usedBy) so the console can explain, before the user tries, why an update or delete would be refused. Validation: scopeId must be an accessible scope and vpnIkePolicyId must reference an existing, non-deleted policy in it (unknown or not visible to the caller -> 404 NOT_FOUND). Async & state: Synchronous read; no state change. Errors: 401 unauthenticated; 403 without read permission; 404 when the policy is unknown; 500 on backend read failure. Idempotency/Concurrency: Safe; carries a weak ETag over the record's (version, updated_at) pair for read-then-If-Match on the mutating operations.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
vpnIkePolicyId*stringIdentifier of the IKE (Phase 1) policy within the scope.
The IKE policy.
application/json- response
One IKE policy plus the site connections that reference it.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the IKE policy.
name*stringPolicy display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset (neutron's own default).
authAlgorithm*stringPhase 1 authentication (integrity) algorithm.
"sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm*stringPhase 1 encryption algorithm.
"3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"pfs*stringDiffie-Hellman group used for the Phase 1 key exchange.
"group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"ikeVersion*stringIKE protocol version.
"v1""v2"phase1NegotiationMode*stringPhase 1 negotiation mode.
"main""aggressive"lifetimeUnits*"seconds"Units of the security-association lifetime; neutron accepts only seconds.
"seconds"lifetimeValue*integerSecurity-association lifetime, in the units above. neutron's own floor is 60.
60 <= valueprovisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"statusReason?|The provider's own message from the last failed write; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
providerId?|neutron's UUID for this policy; null until the worker has created it.
usedByCount*integerHow many IPsec site connections currently reference this policy. Non-zero means an update or a delete will be refused with 409 DEPENDENCY_BLOCKED.
usedBy*array<>The IPsec site connections currently using this policy. While this list is non-empty the policy can be neither updated nor deleted.
curl -X GET "https://example.com/scopes/string/network/vpn/ike-policies/string"{ "origin": "portal", "id": "string", "name": "string", "description": "string", "authAlgorithm": "sha1", "encryptionAlgorithm": "3des", "pfs": "group2", "ikeVersion": "v1", "phase1NegotiationMode": "main", "lifetimeUnits": "seconds", "lifetimeValue": 60, "provisioningState": "PENDING_CREATE", "statusReason": "string", "statusReasonCode": "string", "providerId": "string", "usedByCount": 0, "usedBy": [ { "id": "string", "name": "string" } ]}