Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Re-read an IPsec site connection from the provider
Returns the connection's current read-model snapshot. Refresh does not mutate configuration: the read model is kept live by the worker's reconciliation, and the API service - like every other networking API plane here - never reaches the cloud itself. Validation: vpnSiteConnectionId must reference an existing, non-deleted connection in the scope (404). Async & state: Synchronous 200 returning the current VpnSiteConnection. Errors: 401; 403; 404; 500. Idempotency/Concurrency: Idempotency-Key is optional (recommended); replaying the same key returns the same snapshot.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
vpnSiteConnectionId*stringIdentifier of the IPsec site connection within the scope.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidThe connection's current snapshot.
application/json- response
An IPsec site connection, mirroring neutron-VPNaaS ipsec_site_connections. It REFERENCES the VPN service, the IKE and IPsec policies and the two endpoint groups - it never copies or clones them, which is what lets one policy back many connections. The pre-shared key is write-only and appears in no read.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the site connection.
name*stringConnection display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset.
vpnServiceId*stringThe VPN service this connection terminates on. Immutable after creation (neutron marks it allow_put false).
ikePolicyId*stringThe IKE (Phase 1) policy this connection negotiates with. Immutable after creation.
ipsecPolicyId*stringThe IPsec (Phase 2) policy this connection negotiates with. Immutable after creation.
localEndpointGroupId*stringThe endpoint group (type subnet) naming the local end of the tunnel.
peerEndpointGroupId*stringThe endpoint group (type cidr) naming the remote end of the tunnel.
localId?|Local IKE identity as neutron holds it. READ-ONLY and always neutron's default here - it cannot be set or changed through this API, because neutron-vpnaas writes the pre-shared key into ipsec.secrets keyed on the local/peer ADDRESS pair and never on these identities, so a custom identity authenticates against no key at all ("no shared key found").
peerAddress*stringPublic address of the remote VPN gateway - an IPv4 address or a resolvable FQDN.
peerId*stringRemote IKE identity as neutron holds it. READ-ONLY and always equal to peerAddress here, for the same reason as localId.
initiator*stringNegotiation initiator mode.
"bi-directional""response-only"dpdAction*stringWhat to do when dead peer detection fires.
"hold""clear""disabled""restart""restart-by-peer"dpdInterval*integerDead-peer-detection probe interval in seconds.
1 <= valuedpdTimeout*integerDead-peer-detection timeout in seconds; neutron requires it to be strictly greater than dpdInterval.
2 <= valuemtu*integerMaximum transmission unit for the tunnel. Capped at the deployment's configured tenant network MTU - a tunnel MTU above what the underlay carries makes large packets vanish silently instead of failing loudly. The usable payload INSIDE the tunnel is lower again by the IPsec overhead: measured on this deployment with mtu 1400, the largest inner IP packet that crossed was 1374 bytes (ping -M do -s 1346), so the 1372-byte payload a plain 1400-MTU tenant network allows does not fit. Oversized packets fail with a DF / EMSGSIZE error rather than disappearing.
68 <= valueadminStateUp*booleanAdministrative state; false tears the tunnel down without deleting anything.
status?|nullneutron's own status for the connection, verbatim. Null until the provider has reported one. ACTIVE means the security associations are established - it is not by itself evidence that traffic passes.
statusReason?|The provider's own message from the last failed write or negotiation; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
provisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"providerId?|neutron's UUID for this site connection; null until the worker has created it.
curl -X POST "https://example.com/scopes/string/network/vpn/site-connections/string/actions/refresh"{ "origin": "portal", "id": "string", "name": "string", "description": "string", "vpnServiceId": "string", "ikePolicyId": "string", "ipsecPolicyId": "string", "localEndpointGroupId": "string", "peerEndpointGroupId": "string", "localId": "string", "peerAddress": "string", "peerId": "string", "initiator": "bi-directional", "dpdAction": "hold", "dpdInterval": 1, "dpdTimeout": 2, "mtu": 68, "adminStateUp": true, "status": "ACTIVE", "statusReason": "string", "statusReasonCode": "string", "provisioningState": "PENDING_CREATE", "providerId": "string"}