Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Update a VPN service
Updates the mutable fields of one VPN service. neutron marks only name, description and admin_state_up as
allow_put on vpnservices; router_id and subnet_id are POST-only, so they are not accepted here and are
not presented as editable. Omitted fields are unchanged. Unlike the policies, a service in use may still
be renamed or administratively disabled - neutron allows it, so this API allows it.
Validation: vpnServiceId must exist in the scope (404); a duplicate name -> 409 CONFLICT; any other
field in the body -> 422 VALIDATION_FAILED naming it.
Async & state: Asynchronous; 202 with provisioningState PENDING_UPDATE. Setting adminStateUp false
brings every tunnel on the service down.
Errors: 401; 403; 404; 409 duplicate name; 412 stale If-Match; 422; 500.
Idempotency/Concurrency: Idempotency-Key is optional (recommended); If-Match optional.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
vpnServiceId*stringIdentifier of the VPN service within the scope.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidIf-Match?stringETag for optimistic concurrency on mutations/deletes; mismatch results in 412.
application/json- body
Partial update of a VPN service. neutron marks only name, description and admin_state_up as allow_put on vpnservices; router and subnet are POST-only and are therefore not accepted. Omitted properties are unchanged.
name?stringNew display name; must stay unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description?stringNew free-text description.
length <= 255adminStateUp?booleanNew administrative state; false brings every tunnel on the service down.
Update accepted; returns the service in provisioningState PENDING_UPDATE.
application/json- response
A VPN service - the anchor that terminates tunnels on one router, mirroring neutron-VPNaaS vpnservices. One service may carry many site connections. It deliberately has NO subnet: neutron's validator makes a subnet-bearing service and endpoint groups mutually exclusive, and this API models endpoint groups as first-class resources, so the local subnet is always carried by the connection's local endpoint group.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the VPN service.
name*stringService display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset.
routerId*stringIdentifier of the router this service terminates tunnels on; the router must have an external gateway.
routerName*stringDisplay name of that router, resolved from the networking read model.
externalV4Ip?|The router's external gateway IPv4 address, read from neutron's external_v4_ip - the tunnel's local endpoint, and the address the remote peer must be configured with. Null until neutron has reported it.
adminStateUp*booleanAdministrative state of the service; false brings every tunnel on it down.
status?|nullneutron's own status for the service, verbatim. Null until the provider has reported one. A freshly created service stays PENDING_CREATE until the first site connection attaches - that is neutron's behaviour, not a stalled record.
statusReason?|The provider's own message from the last failed write; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
provisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"providerId?|neutron's UUID for this service; null until the worker has created it.
usedByCount*integerHow many IPsec site connections terminate on this service. Non-zero means a delete will be refused with 409 DEPENDENCY_BLOCKED.
curl -X PATCH "https://example.com/scopes/string/network/vpn/services/string" \ -H "Content-Type: application/json" \ -d '{}'{ "origin": "portal", "id": "string", "name": "string", "description": "string", "routerId": "string", "routerName": "string", "externalV4Ip": "string", "adminStateUp": true, "status": "ACTIVE", "statusReason": "string", "statusReasonCode": "string", "provisioningState": "PENDING_CREATE", "providerId": "string", "usedByCount": 0}