Skip to main content
POST
Create instance
Requires the IAM action compute:CreateInstance. See COMPUTE permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Body

application/json
name
string
required

Resource names must not start with the literal crn: prefix or be UUIDs (canonical, compact, braced, or urn:uuid: forms, in either case).

Required string length: 1 - 255
Example:

"web-01"

flavor
string
required

Regional flavor reference (UUID, CRN or exact name)

Example:

"550e8400-e29b-41d4-a716-446655440000"

networks
object[]
required

Interfaces to attach, at least one. index 0 is the primary NIC.

Required because an instance with no interface boots with no network at all, and nothing inside it can add one afterwards.

Minimum array length: 1
description
string
Maximum string length: 1000
Example:

"Primary web server"

architecture
string
default:amd64

Architecture for image names and name:version tags (default amd64); a CRN pins its own architecture and version.

image
string

Image to clone the boot disk from. Required unless volumes contains an existing boot volume; cannot be combined with an existing boot volume. Four forms are accepted: a complete image/name/architecture/arch/version/version CRN; an image id; name:version, which pins one build and is how you opt out of the tag moving under you; or a bare name, which follows the tag to whichever build is current when the instance is created. Names prefer a usable caller-owned build over a tagged platform catalog build for the requested architecture (default amd64). A CRN pins owner, name, architecture and version. Resolution never retries another reference kind; responses and stored templates retain the resolved image UUID.

Example:

"debian-13"

volumes
object[]

New or existing disks bound with the instance, the boot disk included — mark it with boot: true. At most one entry may.

Omit the boot entry to take the image's minimum size and the region's default tier.

Create a new disk, optionally with provisioned performance, or attach an existing available volume in this account and region using volume. Existing volumes keep their contents, performance, and snapshot schedules; they are retained after failed launch or instance deletion. Requires compute:AttachVolume for existing disks. A volume may only occur once. An existing boot disk must be bootable and replaces the top-level image.

metadata
object
Example:
tags
object
Example:
user_data
string<byte>

Base64-encoded user data (cloud-init)

Example:

"I2Nsb3VkLWNvbmZpZwpwYWNrYWdlczoKICAtIG5naW54Cg=="

iam_role
string

Attach an IAM role from the same account by UUID, CRN or exact name. The role's trust policy must permit crn:compute:*:*:instance/* (or the specific instance CRN). The instance's IMDS endpoint (169.254.169.254) mints short-lived STS credentials for this role from inside the VM.

Example:

"f47ac10b-58cc-4372-a567-0e02b2c3d479"

Response

Instance creation initiated

instance
object
required