Skip to content
StratumStratum Docs

Bind a floating IP to a Client VPN terminator (public ingress).

POST
/v1/projects/{projectId}/network/client-vpn-endpoints/{clientVpnEndpointId}/associate-floating-ip
Code sample: Shell / cURL
curl --request POST \
  --url https://stratum.example.com/v1/projects/example/network/client-vpn-endpoints/example/associate-floating-ip \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "floatingIpId": "example" }'

DNATs an allocated floating IP to the endpoint’s WireGuard terminator so remote clients have a routable Endpoint to dial (the terminator otherwise lives in a per-VPC netns reachable only over the OVN transit link). Sets publicEndpoint to <floating-ip>:51820, which the client-config download then stamps into the WireGuard .conf. The endpoint must be available, and the FIP must be allocated + unassociated.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
/^p-[a-z0-9-]+$/
clientVpnEndpointId
required
string
/^cvpn-[a-z0-9-]+$/

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
floatingIpId
required

An allocated, unassociated floating IP to DNAT to the terminator.

string
/^fip-[a-z0-9-]+$/

Example generated

{
  "floatingIpId": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

The endpoint, now with its public ingress bound.

Media typeapplication/json

A per-VPC WireGuard terminator for remote user access (AWS-Client-VPN-shaped). serverPublicKey is populated once the data-plane terminator is provisioned.

object
id
required
string
/^cvpn-[a-z0-9-]+$/
projectId
required
string
vpcId
required
string
/^vpc-[a-z0-9-]+$/
clientCidrBlock
required

The address pool handed to connecting clients (IPv4 /16../22).

string
authMode
required
string
Allowed values: oidc certificate
splitTunnel
required

True routes only VPC/authorized CIDRs; false is a full tunnel.

boolean
dnsServers

Pushed resolvers; empty means the VPC.3 resolver default.

Array<string>
connectionLogging
required

Emit per-connection events to observability.

boolean
serverPublicKey

WireGuard server public key; empty until the terminator is provisioned.

string
floatingIpId

The floating IP DNAT’d to the terminator for public ingress; empty when none is bound.

string
/^fip-[a-z0-9-]+$/
publicEndpoint

The terminator’s reachable “:51820”; empty until a floating IP is associated.

string
subnetIds

Tenant subnets the endpoint has an interface in.

Array<string>
securityGroupIds

Security groups governing who may reach the endpoint. Empty when the endpoint uses the pre- shared-transit path, where ingress is all-or-nothing on the floating IP association.

Array<string>
nicIds

The Stratum-owned NICs backing this endpoint, one per subnet. These carry the security groups and their addresses are what the floating IP forwards to. Empty means the endpoint is on the shared-transit path and its security groups, if any, govern nothing.

Array<string>
state
required
string
Allowed values: creating available deleting deleted error
tags

AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no leading/trailing whitespace) mapped to freeform UTF-8 values (0-256 bytes). Max 50 tags per resource. Reserved prefixes (stratum.dev/, stratum.platform_health., stratum:, aws:) return 400 RESERVED_NAMESPACE on customer input. PATCH replaces the whole map..

object
<= 50 properties
key
additional properties
string
<= 256 characters
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
deletedAt
string format: date-time
createdBy
string

Example 

{
  "authMode": "oidc",
  "state": "creating"
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Section titled “404”

Resource not found.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

409

Section titled “409”

Conflicting state.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}