Preview — pending review
This reference is generated from the platform API contract and is still under review. Operations, fields, and descriptions can change before publication.
Update an IPsec site connection
Updates the mutable fields of one site connection - exactly the fields neutron marks allow_put on
ipsec_site_connections: name, description, localId, peerAddress, peerId, localEndpointGroupId,
peerEndpointGroupId, mtu, initiator, presharedKey, dpdAction, dpdInterval, dpdTimeout and adminStateUp.
vpnServiceId, ikePolicyId and ipsecPolicyId are POST-only in neutron and are not accepted here: a
connection cannot be moved onto a different service or policy after creation, so they are not presented as
editable either. Omitted fields are unchanged.
Validation: vpnSiteConnectionId must exist in the scope (404); the same per-field rules as create
apply to every supplied value, including the endpoint-group type check, the dpdTimeout > dpdInterval rule
and the MTU ceiling; sending vpnServiceId, ikePolicyId or ipsecPolicyId -> 422 VALIDATION_FAILED naming
the field and saying it is immutable; a duplicate name -> 409 CONFLICT; a connection in a PENDING_* state
-> 409 CONFLICT, since neutron refuses a concurrent update.
Async & state: Asynchronous; 202 with provisioningState PENDING_UPDATE. Changing the pre-shared key or
the endpoints renegotiates the tunnel.
Errors: 401; 403; 404; 409 duplicate name or a busy connection; 412 stale If-Match; 422; 500.
Idempotency/Concurrency: Idempotency-Key is optional (recommended); If-Match optional.
presharedKey stays write-only.
bearerTokenAuthorizationBearer <token>An API token (pc_live_…) or a service-account key (sak_live_…), created in Identity & Access Management and sent as Authorization: Bearer <token>. Requests are rate limited per credential and per tenant: every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, and a refused request gets 429 RATE_LIMITED with Retry-After.
scopeId*stringOpaque ownership+authorization scope resolving to tenant + subscription + project.
vpnSiteConnectionId*stringIdentifier of the IPsec site connection within the scope.
Idempotency-Key?stringOptional; recommended for safe retries. When sent, the same key+body within 24h replays the original result and the same key with a different body is 409 CONFLICT; keys are unique per tenant. When an API token or service-account (bearer) caller omits it, the request is applied once with no replay protection (a retry may apply it again). A console session gets one from the edge.
uuidIf-Match?stringETag for optimistic concurrency on mutations/deletes; mismatch results in 412.
application/json- body
Partial update of an IPsec site connection. Omitted properties are unchanged. vpnServiceId, ikePolicyId and ipsecPolicyId are POST-only in neutron and are not accepted - a connection cannot be moved onto a different service or policy after creation. localEndpointGroupId and peerEndpointGroupId are not accepted either: to cover a different set of subnets, create a new connection on the endpoint groups you want, then delete this one.
name?stringNew display name; must stay unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description?stringNew free-text description.
length <= 255peerAddress?stringNew remote gateway address.
1 <= lengthinitiator?stringNew negotiation initiator mode.
"bi-directional""response-only"dpdAction?stringNew dead-peer-detection action.
"hold""clear""disabled""restart""restart-by-peer"dpdInterval?integerNew dead-peer-detection probe interval in seconds.
1 <= valuedpdTimeout?integerNew dead-peer-detection timeout in seconds; must stay strictly greater than dpdInterval.
2 <= valuemtu?integerNew tunnel MTU; capped at the deployment's configured tenant network MTU.
68 <= valueadminStateUp?booleanNew administrative state.
presharedKey?stringReplacement shared secret; at least 8 characters. Write-only - changing it renegotiates the tunnel and it is never returned by any read.
password8 <= lengthUpdate accepted; returns the connection in provisioningState PENDING_UPDATE.
application/json- response
An IPsec site connection, mirroring neutron-VPNaaS ipsec_site_connections. It REFERENCES the VPN service, the IKE and IPsec policies and the two endpoint groups - it never copies or clones them, which is what lets one policy back many connections. The pre-shared key is write-only and appears in no read.
origin?stringWhere the resource was made -- portal for a create on the console, api for an object made straight against the OpenStack API (CLI, Terraform, the Kubernetes cloud provider) that discovery adopted. Informational; nothing behaves differently. Absent from a backend that predates it, which means portal.
"portal""api""system""imported"id*stringPlatform identifier of the site connection.
name*stringConnection display name, unique within the scope.
^[^\p{C}\p{Z}\x{10000}-\x{10FFFF}](?:[^\p{C}\p{Zl}\p{Zp}\x{10000}-\x{10FFFF}]*[^\p{C}\p{Z}\x{10000}-\x{10FFFF}])?$1 <= length <= 255description*stringFree-text description; empty string when unset.
vpnServiceId*stringThe VPN service this connection terminates on. Immutable after creation (neutron marks it allow_put false).
ikePolicyId*stringThe IKE (Phase 1) policy this connection negotiates with. Immutable after creation.
ipsecPolicyId*stringThe IPsec (Phase 2) policy this connection negotiates with. Immutable after creation.
localEndpointGroupId*stringThe endpoint group (type subnet) naming the local end of the tunnel.
peerEndpointGroupId*stringThe endpoint group (type cidr) naming the remote end of the tunnel.
localId?|Local IKE identity as neutron holds it. READ-ONLY and always neutron's default here - it cannot be set or changed through this API, because neutron-vpnaas writes the pre-shared key into ipsec.secrets keyed on the local/peer ADDRESS pair and never on these identities, so a custom identity authenticates against no key at all ("no shared key found").
peerAddress*stringPublic address of the remote VPN gateway - an IPv4 address or a resolvable FQDN.
peerId*stringRemote IKE identity as neutron holds it. READ-ONLY and always equal to peerAddress here, for the same reason as localId.
initiator*stringNegotiation initiator mode.
"bi-directional""response-only"dpdAction*stringWhat to do when dead peer detection fires.
"hold""clear""disabled""restart""restart-by-peer"dpdInterval*integerDead-peer-detection probe interval in seconds.
1 <= valuedpdTimeout*integerDead-peer-detection timeout in seconds; neutron requires it to be strictly greater than dpdInterval.
2 <= valuemtu*integerMaximum transmission unit for the tunnel. Capped at the deployment's configured tenant network MTU - a tunnel MTU above what the underlay carries makes large packets vanish silently instead of failing loudly. The usable payload INSIDE the tunnel is lower again by the IPsec overhead: measured on this deployment with mtu 1400, the largest inner IP packet that crossed was 1374 bytes (ping -M do -s 1346), so the 1372-byte payload a plain 1400-MTU tenant network allows does not fit. Oversized packets fail with a DF / EMSGSIZE error rather than disappearing.
68 <= valueadminStateUp*booleanAdministrative state; false tears the tunnel down without deleting anything.
status?|nullneutron's own status for the connection, verbatim. Null until the provider has reported one. ACTIVE means the security associations are established - it is not by itself evidence that traffic passes.
statusReason?|The provider's own message from the last failed write or negotiation; null when the last write succeeded.
statusReasonCode?|Machine-readable companion to statusReason: a small, OPEN vocabulary of codes the console can branch on without parsing the human text, deliberately a plain string rather than a closed enum so a code the client does not recognize yet degrades to the generic failure message. Today the only value is cancelled: the resource is in its failure state because its create operation was CANCELLED; a provider object the create had already built may be left in place, and the resource's DELETE removes it. Reported only while the resource is in that failure state; null otherwise.
provisioningState*stringLifecycle state of this platform record.
"PENDING_CREATE""PENDING_UPDATE""PENDING_DELETE""READY""ERROR"providerId?|neutron's UUID for this site connection; null until the worker has created it.
curl -X PATCH "https://example.com/scopes/string/network/vpn/site-connections/string" \ -H "Content-Type: application/json" \ -d '{}'{ "origin": "portal", "id": "string", "name": "string", "description": "string", "vpnServiceId": "string", "ikePolicyId": "string", "ipsecPolicyId": "string", "localEndpointGroupId": "string", "peerEndpointGroupId": "string", "localId": "string", "peerAddress": "string", "peerId": "string", "initiator": "bi-directional", "dpdAction": "hold", "dpdInterval": 1, "dpdTimeout": 2, "mtu": 68, "adminStateUp": true, "status": "ACTIVE", "statusReason": "string", "statusReasonCode": "string", "provisioningState": "PENDING_CREATE", "providerId": "string"}