Create a Client VPN endpoint.
curl --request POST \ --url https://stratum.example.com/v1/projects/example/network/client-vpn-endpoints \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "vpcId": "example", "clientCidrBlock": "example", "authMode": "oidc", "splitTunnel": true, "dnsServers": [ "example" ], "connectionLogging": true, "subnetIds": [ "example" ], "securityGroupIds": [ "example" ], "tags": { "additionalProperty": "example" } }'The per-VPC WireGuard terminator (remote access to a
VPC). WireGuard is an implementation detail behind an AWS-Client-VPN
shaped model. The endpoint is created in creating; the data-plane
terminator is provisioned asynchronously and the endpoint moves to
available once it is up. clientCidrBlock (the pool handed to
connecting clients, /16../22) must not overlap the VPC CIDR or any
of its subnets. Bridge-driver installs return NOT_SUPPORTED_BY_DRIVER.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”object
The address pool handed to connecting clients (IPv4 /16../22); must not overlap the VPC or its subnets.
Defaults to oidc when omitted.
Defaults to true (split tunnel) when omitted.
Tenant subnets the endpoint places an interface in.
Each one gets a Stratum-owned NIC with an address in that subnet, and that NIC is what the floating IP forwards to. Subnets must belong to vpcId: the terminator and its DNAT are per-VPC, so a port on another VPC’s switch could never receive the endpoint’s traffic.
Omit to keep the pre- behaviour, where the floating IP forwards straight to the terminator’s shared transit address. That path cannot carry security groups — see securityGroupIds.
Security groups governing who may reach the endpoint’s UDP/51820. Requires subnetIds: a security group binds to a PORT, so the endpoint needs one of its own before this can mean anything.
Without them ingress is all-or-nothing — associating a floating IP opens the terminator to the whole internet, and removing it closes the endpoint entirely. Note the groups govern who may reach the endpoint; what a connected client may then reach is a separate control, the endpoint’s authorization rules.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Responses
Section titled “Responses”Accepted.
A per-VPC WireGuard terminator for remote user access
(AWS-Client-VPN-shaped). serverPublicKey is populated once the
data-plane terminator is provisioned.
object
The address pool handed to connecting clients (IPv4 /16../22).
True routes only VPC/authorized CIDRs; false is a full tunnel.
Pushed resolvers; empty means the VPC.3 resolver default.
Emit per-connection events to observability.
WireGuard server public key; empty until the terminator is provisioned.
The floating IP DNAT’d to the terminator for public ingress; empty when none is bound.
The terminator’s reachable “
Tenant subnets the endpoint has an interface in.
Security groups governing who may reach the endpoint. Empty when the endpoint uses the pre- shared-transit path, where ingress is all-or-nothing on the floating IP association.
The Stratum-owned NICs backing this endpoint, one per subnet. These carry the security groups and their addresses are what the floating IP forwards to. Empty means the endpoint is on the shared-transit path and its security groups, if any, govern nothing.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Example
{ "authMode": "oidc", "state": "creating"}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Conflicting state.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}