Skip to content
StratumStratum Docs

Create a security group.

POST
/v1/projects/{projectId}/network/security-groups
Code sample: Shell / cURL
curl --request POST \
  --url https://stratum.example.com/v1/projects/example/network/security-groups \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "name": "example", "displayName": "example", "description": "example", "region": "example", "defaultEgressAllow": true, "tags": { "additionalProperty": "example" } }'

Returns 202 Accepted with the SG in state creating. The async lifecycle worker transitions to available (success) or error (driver failure). Per the SG starts with no rules; use PUT /security-groups/{gid}/rules to set the rule set atomically.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
/^p-[a-z0-9-]+$/

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
name
required
string
/^[a-z][a-z0-9-]{1,38}[a-z0-9]$/
displayName
string
>= 1 characters <= 100 characters
description
string
region

Defaults to the install’s default region when omitted.

string
/^[a-z][a-z0-9]+(-[a-z0-9]+)*$/
defaultEgressAllow
boolean
default: true
tags

AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no leading/trailing whitespace) mapped to freeform UTF-8 values (0-256 bytes). Max 50 tags per resource. Reserved prefixes (stratum.dev/, stratum.platform_health., stratum:, aws:) return 400 RESERVED_NAMESPACE on customer input. PATCH replaces the whole map..

object
<= 50 properties
key
additional properties
string
<= 256 characters

Responses

Section titled “Responses”

202

Section titled “202”

Accepted.

Media typeapplication/json
object
ownedBy

Set on a platform-owned row; absent on a tenant’s own.

object
kind
required
string
Allowed values: auto-scaling-group platform
id
required

The owner: the Auto Scaling group id, or for platform the component (front-door, pack:platform-health, default-network, operator-recipe).

string
id
required
string
/^sg-[a-z0-9-]+$/
projectId
required
string
/^p-[a-z0-9-]+$/
name
required
string
/^[a-z][a-z0-9-]{1,38}[a-z0-9]$/
displayName
required
string
>= 1 characters <= 100 characters
description
string
region
required
string
/^[a-z][a-z0-9]+(-[a-z0-9]+)*$/
defaultEgressAllow
required

Matches AWS’s default-allow-egress. Set false to opt into explicit egress rules.

boolean
ingressRules
Array<object>
object
id
string
/^sgr-[a-z0-9-]+$/
direction
required
string
Allowed values: ingress egress
protocol
required
string
Allowed values: tcp udp icmp all
fromPort

Required for tcp/udp; ignored for icmp/all.

integer
<= 65535
toPort

Required for tcp/udp; ignored for icmp/all.

integer
<= 65535
source
required
object
type
required
string
Allowed values: cidr security-group
value
required

For cidr, an IPv4 CIDR like 10.0.0.0/16 or 0.0.0.0/0. For security-group, an sg-* ID; must point at an SG in the same project (cross-project refs land at post-2.x).

string
description
string
egressRules
Array<object>
object
id
string
/^sgr-[a-z0-9-]+$/
direction
required
string
Allowed values: ingress egress
protocol
required
string
Allowed values: tcp udp icmp all
fromPort

Required for tcp/udp; ignored for icmp/all.

integer
<= 65535
toPort

Required for tcp/udp; ignored for icmp/all.

integer
<= 65535
source
required
object
type
required
string
Allowed values: cidr security-group
value
required

For cidr, an IPv4 CIDR like 10.0.0.0/16 or 0.0.0.0/0. For security-group, an sg-* ID; must point at an SG in the same project (cross-project refs land at post-2.x).

string
description
string
state
required
string
Allowed values: creating available deleting deleted error
tags

AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no leading/trailing whitespace) mapped to freeform UTF-8 values (0-256 bytes). Max 50 tags per resource. Reserved prefixes (stratum.dev/, stratum.platform_health., stratum:, aws:) return 400 RESERVED_NAMESPACE on customer input. PATCH replaces the whole map..

object
<= 50 properties
key
additional properties
string
<= 256 characters
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
deletedAt
string format: date-time
nullable
createdBy
required
string

Example 

{
  "ownedBy": {
    "kind": "auto-scaling-group"
  },
  "ingressRules": [
    {
      "direction": "ingress",
      "protocol": "tcp",
      "source": {
        "type": "cidr"
      }
    }
  ],
  "egressRules": [
    {
      "direction": "ingress",
      "protocol": "tcp",
      "source": {
        "type": "cidr"
      }
    }
  ],
  "state": "creating"
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

409

Section titled “409”

Conflicting state.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

429

Section titled “429”

Per-project quota exceeded.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}