Update a Client VPN endpoint's security groups.

PATCH

/v1/projects/{projectId}/network/client-vpn-endpoints/{clientVpnEndpointId}

Code sample: Shell / cURL

curl --request PATCH \
  --url https://stratum.example.com/v1/projects/example/network/client-vpn-endpoints/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "securityGroupIds": [ "example" ] }'

• A Stratum cluster endpoint.

Reapply the endpoint’s ingress security groups to its Stratum-owned NICs without a delete-and-recreate, which would drop the interface, the floating-IP association and any dependent config.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

clientVpnEndpointId

required

string

/^cvpn-[a-z0-9-]+$/

Request Body^required

Media typeapplication/json

Change a Stratum-owned endpoint’s ingress security groups in place, instead of deleting and recreating the endpoint (which drops its interface, its floating-IP association and any dependent config).

Applies to the endpoint’s Stratum-owned NICs, which is where security groups actually bind — neither endpoint type has an SG primitive of its own.

subnetIds is deliberately NOT patchable: changing it recreates interfaces, a much larger operation than reapplying groups to the NICs that already exist. Security groups alone are the common day-2 edit.

object

securityGroupIds

The complete desired set — this REPLACES the endpoint’s groups rather than adding to them, matching how securityGroupIds behaves on a network-interface PATCH.

Omit the field to leave the groups untouched; send [] to remove them all. Those are different requests, so a client that always sends the field must send the current value to mean “no change”.

Array<string>

Example ^generated

{
  "securityGroupIds": [
    "example"
  ]
}

Responses

200

The updated endpoint.

Media typeapplication/json

A per-VPC WireGuard terminator for remote user access (AWS-Client-VPN-shaped). serverPublicKey is populated once the data-plane terminator is provisioned.

object

id

required

string

/^cvpn-[a-z0-9-]+$/

projectId

required

string

vpcId

required

string

/^vpc-[a-z0-9-]+$/

clientCidrBlock

required

The address pool handed to connecting clients (IPv4 /16../22).

string

authMode

required

string

Allowed values: oidc certificate

splitTunnel

required

True routes only VPC/authorized CIDRs; false is a full tunnel.

boolean

dnsServers

Pushed resolvers; empty means the VPC.3 resolver default.

Array<string>

connectionLogging

required

Emit per-connection events to observability.

boolean

serverPublicKey

WireGuard server public key; empty until the terminator is provisioned.

string

floatingIpId

The floating IP DNAT’d to the terminator for public ingress; empty when none is bound.

string

/^fip-[a-z0-9-]+$/

publicEndpoint

The terminator’s reachable “:51820”; empty until a floating IP is associated.

string

subnetIds

Tenant subnets the endpoint has an interface in.

Array<string>

securityGroupIds

Security groups governing who may reach the endpoint. Empty when the endpoint uses the pre- shared-transit path, where ingress is all-or-nothing on the floating IP association.

Array<string>

nicIds

The Stratum-owned NICs backing this endpoint, one per subnet. These carry the security groups and their addresses are what the floating IP forwards to. Empty means the endpoint is on the shared-transit path and its security groups, if any, govern nothing.

Array<string>

state

required

string

Allowed values: creating available deleting deleted error

tags

AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no leading/trailing whitespace) mapped to freeform UTF-8 values (0-256 bytes). Max 50 tags per resource. Reserved prefixes (stratum.dev/, stratum.platform_health., stratum:, aws:) return 400 RESERVED_NAMESPACE on customer input. PATCH replaces the whole map..

object

<= 50 properties

key

additional properties

string

<= 256 characters

createdAt

required

string format: date-time

updatedAt

required

string format: date-time

deletedAt

string format: date-time

createdBy

string

Example

{
  "authMode": "oidc",
  "state": "creating"
}

400

Bad request.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Resource not found.

Media typeapplication/problem+json

object

type

required

string format: uri

title

required

string

status

required

integer

>= 400 <= 599

detail

string

instance

string format: uri-reference

requestId

required

string

code

required

string

issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object

code

required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string

statement

required

Index of the statement at fault; -1 for the document as a whole.

integer

>= -1

detail

required

string

action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string

errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object

field

required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string

message

required

string

details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object

key

additional properties

any

Example

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}