Skip to content
StratumStratum Docs

List Client VPN endpoints in a project.

GET
/v1/projects/{projectId}/network/client-vpn-endpoints
Code sample: Shell / cURL
curl --request GET \
  --url https://stratum.example.com/v1/projects/example/network/client-vpn-endpoints \
  --header 'Authorization: Bearer <token>'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
/^p-[a-z0-9-]+$/

Query Parameters

Section titled “Query Parameters”
vpcId
string
/^vpc-[a-z0-9-]+$/

Return endpoints attached to this VPC.

Responses

Section titled “Responses”

200

Section titled “200”

Client VPN endpoints.

Media typeapplication/json
object
items
required
Array<object>

A per-VPC WireGuard terminator for remote user access (AWS-Client-VPN-shaped). serverPublicKey is populated once the data-plane terminator is provisioned.

object
id
required
string
/^cvpn-[a-z0-9-]+$/
projectId
required
string
vpcId
required
string
/^vpc-[a-z0-9-]+$/
clientCidrBlock
required

The address pool handed to connecting clients (IPv4 /16../22).

string
authMode
required
string
Allowed values: oidc certificate
splitTunnel
required

True routes only VPC/authorized CIDRs; false is a full tunnel.

boolean
dnsServers

Pushed resolvers; empty means the VPC.3 resolver default.

Array<string>
connectionLogging
required

Emit per-connection events to observability.

boolean
serverPublicKey

WireGuard server public key; empty until the terminator is provisioned.

string
floatingIpId

The floating IP DNAT’d to the terminator for public ingress; empty when none is bound.

string
/^fip-[a-z0-9-]+$/
publicEndpoint

The terminator’s reachable “:51820”; empty until a floating IP is associated.

string
subnetIds

Tenant subnets the endpoint has an interface in.

Array<string>
securityGroupIds

Security groups governing who may reach the endpoint. Empty when the endpoint uses the pre- shared-transit path, where ingress is all-or-nothing on the floating IP association.

Array<string>
nicIds

The Stratum-owned NICs backing this endpoint, one per subnet. These carry the security groups and their addresses are what the floating IP forwards to. Empty means the endpoint is on the shared-transit path and its security groups, if any, govern nothing.

Array<string>
state
required
string
Allowed values: creating available deleting deleted error
tags

AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no leading/trailing whitespace) mapped to freeform UTF-8 values (0-256 bytes). Max 50 tags per resource. Reserved prefixes (stratum.dev/, stratum.platform_health., stratum:, aws:) return 400 RESERVED_NAMESPACE on customer input. PATCH replaces the whole map..

object
<= 50 properties
key
additional properties
string
<= 256 characters
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
deletedAt
string format: date-time
createdBy
string
nextPageToken
string
isTruncated

True when the server had more rows than it returned. The response is a valid prefix of the result, not the whole of it.

Without this flag a client at the server’s row ceiling receives a full page and no nextPageToken, which means “this is the complete set” — so data it never saw would be indistinguishable from data that does not exist.

It does not imply a cursor exists. These queries do not all sort on a total order, so a resumable token cannot be minted for them yet. The remedy is to narrow the request (a filter, or a tighter scope), not to page.

boolean

Example 

{
  "items": [
    {
      "authMode": "oidc",
      "state": "creating"
    }
  ]
}