Create an auto scaling group.
curl --request POST \ --url https://stratum.example.com/v1/projects/example/asg/groups \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "name": "example", "description": "example", "subnetIds": [ "example" ], "launchTemplateId": "example", "launchTemplateVersion": "$LATEST", "minSize": 1, "maxSize": 1, "desiredSize": 1, "healthCheckType": "instance", "healthCheckGracePeriodSeconds": 300, "targetGroupIds": [ "example" ], "loadBalancer": { "create": true, "scheme": "internet-facing", "port": 80, "protocol": "HTTP", "healthCheck": { "enabled": true, "protocol": "http", "path": "example", "interval_ms": 1, "timeout_ms": 1, "healthy_threshold": 1, "unhealthy_threshold": 1, "expect_status": "example" }, "listener": { "port": 1, "protocol": "HTTP", "certificateId": "example" } }, "defaultCooldownSeconds": 300, "terminationPolicies": [ "example" ], "tags": { "additionalProperty": "example" } }'Records the desired state; the asg reconciler
(ScopeLeader, every 30 s) launches instances from the resolved launch
template version toward desiredSize, tracks them to InService as
Compute reports running + healthy, and replaces the unhealthy after the
grace period. Subnets must be on one VPC (the AZ set is derived); the
template/version must resolve; maxSize is bounded by
asg.max_instances_per_asg. Counted against asg.auto_scaling_groups.count.
Cedar-gated on asg:CreateAutoScalingGroup.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
One or more subnets of ONE VPC; the AZ set is derived from them.
Bounded by the project’s asg.max_instances_per_asg quota.
Defaults to minSize.
Target groups (targetType ip or auto-scaling-group) on the same VPC; required with healthCheckType=load_balancer unless the group owns its front door (loadBalancer). Exclusive with loadBalancer.
Ask the group to OWN its front door (as amended,): the asg service creates a target group (targetType: ip, the group’s port and protocol, the health check), a load balancer on the group’s subnets with the requested scheme, and a listener default-forwarding to the target group — as desired state, converged by the reconciler, bound to the group, and torn down after the drain when the group goes. The owned rows are ordinary load-balancer / target-group / listener rows in the project; a resource-policy forbid keeps their update and deletion to the service. Exclusive with targetGroupIds (one owner per binding); sets healthCheckType: load_balancer unless given. The caller needs lb:CreateTargetGroup, lb:CreateLoadBalancer and lb:CreateListener in the project; the lb.* quotas apply.
object
On PATCH, false tears the owned set down (the group keeps running, its health falls back to instance when nothing else is bound). Omit or true with a spec to create or change it.
The port the members serve on (the target group’s).
The target group’s protocol.
Prober config, passed through to the axlbd data plane. Property names are the data-plane JSONB contract (snake_case). The prober only runs when enabled; disabled or empty means every target is treated healthy and no probing happens.
object
HTTP health-check path, e.g. /healthz
Accepted status codes, e.g. “200”, “200,302”, “200-299”
The listener on the load balancer; defaults to the target port over HTTP. An HTTPS listener names its certificateId and defaults to port 443. A change of port, protocol or certificate replaces the listener.
object
The listener’s port; the target port for HTTP, 443 for HTTPS when omitted.
The SSL certificate (cert-…) the HTTPS listener terminates with: a certificate of the SAME project, bound as the listener’s default certificate. Required when protocol is HTTPS, refused (400) otherwise; a certificate that is not in the project is a 400. Changing it replaces the listener, like a port change.
object
Responses
Section titled “Responses”Created.
object
asg-…
arn:stratum:asg:<region>:<projectId>:auto-scaling-group/<id>
The VPC every subnet is on; immutable.
Derived from the subnets (amended 2026-09-15), never stored.
$LATEST, $DEFAULT or an ltv-… id; resolved at every launch.
Holds back policy-driven scaling after a scaling action; customer set-desired, replace-unhealthy and delete are immediate.
api, policy:<id> or scheduled:<id> — what last moved desiredSize.
Why the controller’s most recent launch was refused (capacity, quota, a bad launch template); absent once a launch goes through. The group’s audit trail (asg.group.instance_launch_failed) has the history.
deleting while the reconciler drains the instances; the group disappears once drained.
object
The group’s owned front door: the spec as asked, what the reconciler has made of it, and the ids of the owned rows. status moves creating → active; updating while a spec change is applied (a scheme change replaces the load balancer, a listener change replaces the listener, a health-check change is applied in place); deleting while the set is torn down; error with reason when the last pass failed — it is retried every tick. Each id is recorded the moment its row exists, so a restart resumes rather than creating twice.
object
Prober config, passed through to the axlbd data plane. Property names are the data-plane JSONB contract (snake_case). The prober only runs when enabled; disabled or empty means every target is treated healthy and no probing happens.
object
HTTP health-check path, e.g. /healthz
Accepted status codes, e.g. “200”, “200,302”, “200-299”
object
The HTTPS listener’s certificate; absent for HTTP.
The load balancer’s DNS name, once it exists.
The load balancer’s VPC-internal address, once it exists.
Example
{ "healthCheckType": "instance", "terminationPolicies": [ "Default" ], "suspendedProcesses": [ "Launch" ], "state": "active", "loadBalancer": { "scheme": "internet-facing", "healthCheck": { "protocol": "http" }, "status": "creating" }}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Conflicting state.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Request rate limit exceeded. The API-boundary throttle caps request throughput per principal and per project; code is RATE_LIMITED (distinct from the quota engine’s QUOTA_EXCEEDED). The Retry-After header carries the seconds to wait. Applies to any authenticated endpoint — it is enforced by middleware, not per-path.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Headers
Section titled “Headers”Seconds to wait before retrying.
Upstream temporarily unavailable (driver / scheduler / dependency).
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}