Update a resolver inbound endpoint's security groups.
curl --request PATCH \ --url https://stratum.example.com/v1/projects/example/dns/resolver-inbound-endpoints/example \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "securityGroupIds": [ "example" ] }'Reapply the endpoint’s ingress security groups to its Stratum-owned NICs without a delete-and-recreate.
Rejected with 400 when the endpoint already carries allowedCidrs:
both express ingress and nothing defines which wins, the same rule
applied at create. Clear the allow list first.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”Change a Stratum-owned endpoint’s ingress security groups in place, instead of deleting and recreating the endpoint (which drops its interface, its floating-IP association and any dependent config).
Applies to the endpoint’s Stratum-owned NICs, which is where security groups actually bind — neither endpoint type has an SG primitive of its own.
subnetIds is deliberately NOT patchable: changing it recreates interfaces,
a much larger operation than reapplying groups to the NICs that already
exist. Security groups alone are the common day-2 edit.
object
The complete desired set — this REPLACES the endpoint’s groups rather
than adding to them, matching how securityGroupIds behaves on a
network-interface PATCH.
Omit the field to leave the groups untouched; send [] to remove them
all. Those are different requests, so a client that always sends the
field must send the current value to mean “no change”.
Example generated
{ "securityGroupIds": [ "example" ]}Responses
Section titled “Responses”The updated endpoint.
object
The floating IP address on-prem resolvers point at (port 53 udp+tcp).
Client networks permitted to query through this endpoint. Empty means only the VPC’s own clients can resolve through it. See CreateResolverInboundEndpointRequest.allowedCidrs.
Tenant subnets the endpoint has an interface in.
Security groups applied to the endpoint’s interfaces. Empty when the endpoint uses the pre- shared-recursor path.
The Stratum-owned NICs backing this endpoint, one per subnet. These carry the security groups and their addresses are what the floating IP forwards to.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Example
{ "state": "available"}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Resource not found.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}