Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Create a reusable IPsec (Phase 2) policy
Creates one IPsec (Phase 2) policy in the active scope as a standalone resource that any number of site
connections may later select. The field set and enumerated values come verbatim from the deployed
neutron-VPNaaS ipsecpolicies attribute map.
Validation: name must be non-empty and unique within the scope (duplicate -> 409 CONFLICT);
transformProtocol, encapsulationMode, authAlgorithm, encryptionAlgorithm and pfs must each be one of the
enumerated values neutron accepts; lifetimeUnits must be seconds and lifetimeValue at least 60; any
violation -> 422 VALIDATION_FAILED naming the field.
Async & state: Asynchronous; returns 202 with the policy in provisioningState PENDING_CREATE, settled
to READY or ERROR by the worker with a resource.updated SSE frame (kind: network.vpn_ipsec_policy).
Errors: 401 unauthenticated; 403 without manage permission; 409 duplicate name;
422 on field-level validation failure; 500 on backend failure.
Idempotency/Concurrency: Idempotency-Key is required; a replay returns the original 202.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
Idempotency-Key*stringRequired: this operation creates a new resource asynchronously, so a retry without the key would create a second one. Same key+body within 24h replays the original result; the same key with a different body is 409 CONFLICT. Keys are unique per tenant (the same key in two tenants is two different requests). An API token or service-account (bearer) caller MUST send it -- a request without it is refused with 400 IDEMPOTENCY_KEY_REQUIRED (ErrIdempotencyKeyRequired); reuse the same key on every retry of one logical request. A console session gets one from the edge.
uuidapplication/json- body
Payload for creating a standalone, reusable IPsec (Phase 2) policy. Every field maps one-for-one onto a neutron ipsecpolicies attribute.
name*stringPolicy display name; must be unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description?stringFree-text description.
length <= 255""transformProtocol?stringIPsec transform protocol.
"esp""esp""ah""ah-esp"authAlgorithm?stringPhase 2 authentication (integrity) algorithm.
"sha256""sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm?stringPhase 2 encryption algorithm.
"aes-256""3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"encapsulationMode?stringEncapsulation mode for protected traffic.
"tunnel""tunnel""transport"pfs?stringDiffie-Hellman group used for the Phase 2 rekey.
"group14""group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"lifetimeUnits?"seconds"Units of the security-association lifetime.
"seconds""seconds"lifetimeValue?integerSecurity-association lifetime, in the units above.
60 <= value3600Creation accepted; returns the new IPsec policy in provisioningState PENDING_CREATE.
application/json- response
An IPsec (Phase 2) policy - a standalone, reusable resource mirroring the neutron-VPNaaS ipsecpolicies resource one-for-one. Many site connections may share one policy. While any connection references it, neutron refuses both update and delete (IPsecPolicyInUse).
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the IPsec policy.
name*stringPolicy display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset.
transformProtocol*stringIPsec transform protocol.
"esp""ah""ah-esp"authAlgorithm*stringPhase 2 authentication (integrity) algorithm.
"sha1""sha256""sha384""sha512""aes-xcbc""aes-cmac"encryptionAlgorithm*stringPhase 2 encryption algorithm.
"3des""aes-128""aes-192""aes-256""aes-128-ccm-8""aes-192-ccm-8""aes-256-ccm-8""aes-128-ccm-12""aes-192-ccm-12""aes-256-ccm-12""aes-128-ccm-16""aes-192-ccm-16""aes-256-ccm-16""aes-128-gcm-8""aes-192-gcm-8""aes-256-gcm-8""aes-128-gcm-12""aes-192-gcm-12""aes-256-gcm-12""aes-128-gcm-16""aes-192-gcm-16""aes-256-gcm-16"encapsulationMode*stringEncapsulation mode for protected traffic.
"tunnel""transport"pfs*stringDiffie-Hellman group used for the Phase 2 rekey.
"group2""group5""group14""group15""group16""group17""group18""group19""group20""group21""group22""group23""group24""group25""group26""group27""group28""group29""group30""group31"lifetimeUnits*"seconds"Units of the security-association lifetime; neutron accepts only seconds.
"seconds"lifetimeValue*integerSecurity-association lifetime, in the units above.
60 <= valueprovisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"statusReason?|The provider's own message from the last failed write; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
providerId?|neutron's UUID for this policy; null until the worker has created it.
usedByCount*integerHow many IPsec site connections currently reference this policy.
curl -X POST "https://example.com/scopes/string/network/vpn/ipsec-policies" \ -H "Idempotency-Key: 497f6eca-6276-4993-bfeb-53cbbbba6f08" \ -H "Content-Type: application/json" \ -d '{ "name": "string" }'{ "origin": "portal", "id": "string", "name": "string", "description": "string", "transformProtocol": "esp", "authAlgorithm": "sha1", "encryptionAlgorithm": "3des", "encapsulationMode": "tunnel", "pfs": "group2", "lifetimeUnits": "seconds", "lifetimeValue": 60, "provisioningState": "PENDING_CREATE", "statusReason": "string", "statusReasonCode": "string", "providerId": "string", "usedByCount": 0}