> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Create instance

> Create a new compute instance



## OpenAPI

````yaml /api-reference/specs/compute.yaml post /v1/instances
openapi: 3.0.3
info:
  title: Basaltic Compute API
  version: 1.0.0
  description: |
    Virtual machine instances, and the images, flavors, SSH keypairs and
    instance pools they are built from. Covers the whole instance lifecycle:
    start, stop, reboot, resize and reinstall.
  contact:
    name: Basaltic Support
    email: ping@basaltic.sh
  license:
    name: Proprietary
    url: https://basaltic.sh/terms
servers:
  - url: https://compute.{region}.basaltic.sh
    description: Regional API endpoint
    variables:
      region:
        default: sa-saopaulo-1
        description: Region code
security:
  - SignatureAuth: []
paths:
  /v1/instances:
    post:
      tags:
        - Compute
      summary: Create instance
      description: Create a new compute instance
      operationId: createInstance
      parameters:
        - $ref: '#/components/parameters/IdempotencyKey'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InstanceCreateRequest'
      responses:
        '202':
          description: Instance creation initiated
          content:
            application/json:
              schema:
                type: object
                properties:
                  instance:
                    $ref: '#/components/schemas/Instance'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '422':
          $ref: '#/components/responses/UnprocessableEntity'
        '500':
          $ref: '#/components/responses/InternalServerError'
      security:
        - SignatureAuth: []
components:
  parameters:
    IdempotencyKey:
      name: Idempotency-Key
      in: header
      description: >-
        Optional client-generated key that makes a create replay-safe. Retrying
        a request with the same key returns the original outcome verbatim
        instead of creating a duplicate resource. Reusing a key with a different
        request body is rejected (422); a request whose key is still being
        processed returns 409. Records are honored for 24 hours. Use a UUID or
        similarly unique token.
      required: false
      schema:
        type: string
        maxLength: 255
      example: 550e8400-e29b-41d4-a716-446655440000
  schemas:
    InstanceCreateRequest:
      type: object
      required:
        - name
        - flavor_id
      properties:
        name:
          type: string
          minLength: 1
          maxLength: 255
          example: web-01
        description:
          type: string
          maxLength: 1000
          example: Primary web server
        flavor_id:
          type: string
          format: uuid
          description: Flavor ID
          example: 550e8400-e29b-41d4-a716-446655440000
        image_id:
          type: string
          description: |
            Image to clone the boot disk from (required if not booting from
            volume). Three forms are accepted: an image id; `name:version`,
            which pins one build and is how you opt out of the tag moving
            under you; or a bare `name`, which follows the tag to whichever
            build is current when the instance is created.
          example: debian-13
        key_names:
          type: array
          items:
            type: string
          description: SSH keypair names to authorize on the instance
          example:
            - my-keypair
            - backup-key
        boot_volume_size_gb:
          type: integer
          minimum: 1
          maximum: 16384
          description: >-
            Boot disk size cloned from the image; omitted = the image's
            min_disk_gb. Must be within the volume size range (1..16384) and at
            least the image's min_disk_gb.
          example: 20
        boot_volume_type:
          type: string
          enum:
            - ssd
            - nvme
          description: Boot disk tier; omitted = the region default.
        data_volumes:
          type: array
          description: Blank data volumes created and bound with the instance.
          items:
            $ref: '#/components/schemas/PoolTemplateVolume'
        security_groups:
          type: array
          items:
            type: string
          description: Security group names or IDs
          example:
            - default
            - web
        networks:
          type: array
          items:
            $ref: '#/components/schemas/NetworkConfig'
          description: Networks to attach
        assign_public_ip:
          type: boolean
          default: false
          deprecated: true
          description: >-
            The older, instance-wide spelling of `networks[0].assign_public_ip`,
            and it means the primary NIC — the only interface it could ever have
            addressed. Still honoured. Setting both is asking for the same
            address twice, not for two.
        volumes:
          type: array
          items:
            $ref: '#/components/schemas/BlockDeviceMapping'
          description: Volume attachments for boot from volume
        metadata:
          $ref: '#/components/schemas/Metadata'
        tags:
          $ref: '#/components/schemas/Tags'
        user_data:
          type: string
          format: byte
          description: Base64-encoded user data (cloud-init)
          example: I2Nsb3VkLWNvbmZpZwpwYWNrYWdlczoKICAtIG5naW54Cg==
        iam_role_id:
          type: string
          format: uuid
          example: f47ac10b-58cc-4372-a567-0e02b2c3d479
          description: |
            Attach this IAM role to the instance. The role's trust
            policy must permit `crn:compute:*:*:instance/*` (or the
            specific instance CRN). The instance's IMDS endpoint
            (169.254.169.254) mints short-lived STS credentials for
            this role from inside the VM.
    Instance:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: 550e8400-e29b-41d4-a716-446655440000
        crn:
          type: string
          readOnly: true
          description: Cloud Resource Name
          example: >-
            crn:compute:sa-saopaulo-1:my-account:instance/550e8400-e29b-41d4-a716-446655440000
        region_id:
          type: string
          readOnly: true
          example: sa-saopaulo-1
        name:
          type: string
          example: web-server-01
        description:
          type: string
          example: Primary web server
        primary_ip:
          type: string
          description: The primary NIC's IPv4 address, resolved at read time.
          example: 10.0.1.42
        primary_ipv6:
          type: string
          description: The primary NIC's public IPv6 address, when dual-stack.
          example: 2804:1234:5678::42
        public_ip:
          type: string
          description: >
            The floating IP attached to the PRIMARY NIC, when any.


            It reports that one interface, so it is empty for an instance whose

            public address sits on a secondary NIC — which is exactly what

            `networks[].assign_public_ip` makes possible. An empty `public_ip`
            is

            therefore not evidence that an instance has no public address, and

            polling this field will never surface one.


            `GET /v1/instances/{instance_id}/nics` is the read that covers every

            interface: each NIC carries its own `public_ip` and
            `floating_ip_id`.
          example: 212.66.52.130
        vm_state:
          $ref: '#/components/schemas/VMState'
        power_state:
          $ref: '#/components/schemas/PowerState'
        task_state:
          type: string
          nullable: true
          description: In-flight transition, if any; null when settled.
          example: null
        flavor:
          allOf:
            - $ref: '#/components/schemas/Flavor'
          description: >-
            Resolved flavor (compute size) the instance runs on. Omitted if the
            referenced flavor row has been retired.
        image:
          allOf:
            - $ref: '#/components/schemas/Image'
          description: >-
            Resolved source image the instance booted from. Omitted for a
            volume-only boot or if the referenced image row is gone.
        keypairs:
          type: array
          description: >-
            SSH keypairs baked into the instance at launch. These are embedded —
            unlike attached volumes, NICs, and security groups, which each have
            their own list endpoint and so are not duplicated here.
          items:
            $ref: '#/components/schemas/Keypair'
        user_data:
          type: string
          description: Base64-encoded cloud-init user-data supplied at launch.
        iam_role_id:
          type: string
          format: uuid
          description: IAM role the instance can assume via IMDS, if attached.
        metadata:
          $ref: '#/components/schemas/Metadata'
        tags:
          $ref: '#/components/schemas/Tags'
        fault:
          $ref: '#/components/schemas/InstanceFault'
        created_at:
          type: string
          format: date-time
          readOnly: true
          example: '2024-01-15T10:30:00Z'
        updated_at:
          type: string
          format: date-time
          readOnly: true
          example: '2024-01-15T10:30:00Z'
        launched_at:
          type: string
          format: date-time
          readOnly: true
          nullable: true
          example: '2026-01-15T09:31:12Z'
        terminated_at:
          type: string
          format: date-time
          readOnly: true
          nullable: true
          example: null
    PoolTemplateVolume:
      type: object
      description: >-
        One blank per-replica data volume, created with each replica and deleted
        with it. A mount_path makes the in-guest agent format (fstype, default
        ext4, only if blank) and mount it.
      required:
        - size_gb
      properties:
        size_gb:
          type: integer
          example: 100
        volume_type:
          type: string
          enum:
            - ssd
            - nvme
        mount_path:
          type: string
          example: /data
        fstype:
          type: string
          example: ext4
        delete_on_termination:
          type: boolean
          default: true
          description: >-
            Whether the volume is destroyed with the instance (default) or
            released back to available on teardown. Honoured on a pool template
            too: a replica scaled in, replaced or torn down with the pool
            releases the volume instead of destroying it when this is false.
    NetworkConfig:
      type: object
      required:
        - subnet_id
      properties:
        subnet_id:
          type: string
          format: uuid
          description: Subnet to attach the NIC to (required).
          example: 9b2e4f1a-3c5d-4e6f-8a90-1b2c3d4e5f60
        ip_address:
          type: string
          description: |
            Optional fixed IP. Must be in the subnet's CIDR and not
            currently allocated to another interface. An address is
            picked automatically when omitted.
          example: 10.0.1.42
        mac:
          type: string
          description: |
            Optional MAC address. Must be locally-administered (`X2:`,
            `X6:`, `XA:`, `XE:` in the first octet). Generated when
            omitted.
          example: 02:1a:2b:3c:4d:5e
        security_group_ids:
          type: array
          items:
            type: string
            format: uuid
            example: c1d2e3f4-a5b6-4c7d-8e9f-0a1b2c3d4e5f
          description: |
            Security groups to attach to this NIC at provision time.
            Each must be owned by the same account. Empty list = no
            per-NIC ACLs (the platform's default-allow stays in
            force).
        assign_public_ip:
          type: boolean
          default: false
          description: |
            Allocate a floating IP and attach it to THIS interface once it
            exists. Per NIC, so a secondary interface can carry the public
            address while the primary stays private, and an instance with
            several public interfaces gets one address each.

            Each address is a separate floating-IP allocation: it counts
            against the account's floating_ips quota and is billed like any
            other. It is released when the instance is torn down — an
            address you allocated yourself and attached to the same NIC is
            not, and survives the instance.

            The interface's subnet must already route 0.0.0.0/0 to an
            internet gateway. Without that the address would be silently
            unreachable, so the launch fails instead.
    BlockDeviceMapping:
      type: object
      properties:
        uuid:
          type: string
          format: uuid
          description: Volume or snapshot ID
          example: 7c9e6679-7425-40de-944b-e07fc1f90ae7
        source_type:
          type: string
          enum:
            - volume
            - snapshot
            - image
            - blank
          example: volume
        destination_type:
          type: string
          enum:
            - volume
            - local
          default: volume
          example: volume
        boot_index:
          type: integer
          description: Boot order (0 for boot device, -1 for non-boot)
          example: 0
        volume_size:
          type: integer
          description: Volume size in GB
          example: 40
        volume_type:
          type: string
          description: Volume type name or ID
          example: ssd
        delete_on_termination:
          type: boolean
          default: false
          example: true
        device_name:
          type: string
          description: Device name (e.g., /dev/vda)
          example: /dev/vda
    Metadata:
      type: object
      additionalProperties:
        type: string
      example:
        environment: production
        team: backend
    Tags:
      type: object
      additionalProperties:
        type: string
      example:
        environment: production
        team: backend
    VMState:
      type: string
      description: Lifecycle state the control plane tracks for the instance.
      enum:
        - pending
        - building
        - running
        - stopping
        - stopped
        - rebooting
        - deleting
        - deleted
        - error
      example: running
    PowerState:
      type: string
      description: Power state observed on the hypervisor.
      enum:
        - nostate
        - running
        - paused
        - shutdown
        - crashed
        - suspended
      example: running
    Flavor:
      type: object
      description: >-
        A compute size (vCPU + RAM). A flavor carries no disk size — the boot
        disk is a customer volume sized at launch, floored by the image's
        min_disk_gb.
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: 550e8400-e29b-41d4-a716-446655440000
        crn:
          type: string
          readOnly: true
          description: Cloud Resource Name
          example: >-
            crn:compute:sa-saopaulo-1::flavor/550e8400-e29b-41d4-a716-446655440000
        region_id:
          type: string
          readOnly: true
          example: sa-saopaulo-1
        name:
          type: string
          example: m1.medium
        description:
          type: string
          example: Medium instance with 2 vCPUs and 4GB RAM
        vcpus:
          type: integer
          description: Number of virtual CPUs
          example: 2
        ram_mb:
          type: integer
          description: RAM in MB
          example: 4096
        class:
          type: string
          description: >-
            Host-pool routing. "shared" oversubscribes CPU for higher density;
            "dedicated" pins each vCPU 1:1 to a physical core.
          enum:
            - shared
            - dedicated
          example: shared
        family:
          type: string
          description: >-
            Which product can book the flavor. "general" flavors are for regular
            instances and instance pools; "loadbalancer" and "database" flavors
            are reserved for the managed products (their nodes are platform-
            operated and priced accordingly) and cannot be used for regular
            instances.
          enum:
            - general
            - loadbalancer
            - database
          example: general
        status:
          type: string
          enum:
            - active
            - disabled
          example: active
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
    Image:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: 550e8400-e29b-41d4-a716-446655440000
        crn:
          type: string
          readOnly: true
          description: Cloud Resource Name
          example: >-
            crn:compute:sa-saopaulo-1:my-account:image/550e8400-e29b-41d4-a716-446655440000
        region_id:
          type: string
          readOnly: true
          example: sa-saopaulo-1
        name:
          type: string
          example: debian-13
        description:
          type: string
          example: Debian 13 (Trixie) cloud image
        visibility:
          type: string
          description: >-
            "private" (owned by the caller's account) or "public" (a global,
            platform-owned image visible to every account).
          enum:
            - private
            - public
          example: public
        os:
          type: string
          description: OS family
          example: debian
        os_version:
          type: string
          example: '13'
        architecture:
          type: string
          example: amd64
        format:
          type: string
          description: On-disk format of the stored image bits.
          example: raw
        size_bytes:
          type: integer
          format: int64
          description: Virtual size of the stored image, in bytes.
          example: 10737418240
        min_disk_gb:
          type: integer
          description: >-
            Minimum boot-volume size, in GB, an instance must request to boot
            this image. Defaults to ceil(size_bytes / 1 GiB) at upload.
          example: 10
        min_ram_mb:
          type: integer
          description: Minimum RAM in MB
          example: 1024
        status:
          type: string
          description: Catalog lifecycle state.
          enum:
            - pending
            - importing
            - active
            - error
            - hidden
          example: active
        tags:
          $ref: '#/components/schemas/Tags'
        attributes:
          type: object
          additionalProperties:
            type: string
          description: Free-form key/value image attributes.
        created_at:
          type: string
          format: date-time
          readOnly: true
        updated_at:
          type: string
          format: date-time
          readOnly: true
    Keypair:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
          example: 550e8400-e29b-41d4-a716-446655440000
        crn:
          type: string
          readOnly: true
          description: Cloud Resource Name
          example: crn:compute:sa-saopaulo-1:my-account:keypair/my-keypair
        region_id:
          type: string
          readOnly: true
          example: sa-saopaulo-1
        name:
          type: string
          example: my-keypair
        public_key:
          type: string
          description: SSH public key
          example: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB...
        fingerprint:
          type: string
          readOnly: true
          example: 2e:f8:7e:a7:d9:85:c6:c9:44:89:6a:4c:56:7e:98:42
        tags:
          $ref: '#/components/schemas/Tags'
        created_at:
          type: string
          format: date-time
          readOnly: true
    InstanceFault:
      type: object
      properties:
        code:
          type: string
          description: Short machine-readable failure code.
          example: BOOT_VOLUME_FAILED
        message:
          type: string
          example: failed to create boot volume
        details:
          type: string
          example: 'rbd: image already exists'
        at:
          type: string
          format: date-time
          example: '2026-01-15T09:30:00Z'
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - request_id
          properties:
            code:
              type: string
              description: Error code identifying the type of error
              example: INVALID_INPUT
            message:
              type: string
              description: Human-readable error message
              example: Invalid request parameters
            request_id:
              type: string
              format: uuid
              description: Request ID for debugging
              example: 550e8400-e29b-41d4-a716-446655440000
  responses:
    BadRequest:
      description: Invalid request parameters
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: INVALID_INPUT
              message: Invalid request parameters
              request_id: 550e8400-e29b-41d4-a716-446655440000
    Unauthorized:
      description: Authentication required or token invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: UNAUTHORIZED
              message: Authentication required
              request_id: 550e8400-e29b-41d4-a716-446655440000
    Forbidden:
      description: Insufficient permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: ACCESS_DENIED
              message: You don't have permission to perform this action
              request_id: 550e8400-e29b-41d4-a716-446655440000
    Conflict:
      description: Resource conflict (e.g., already exists, invalid state)
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: CONFLICT
              message: Resource with this name already exists
              request_id: 550e8400-e29b-41d4-a716-446655440000
    UnprocessableEntity:
      description: |
        The request is well-formed but cannot be processed as sent. On the
        operations that accept `Idempotency-Key` this is the key-reuse case: the
        key was first seen with a different request payload, so replaying the
        stored outcome would answer a question the caller did not ask.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: IDEMPOTENCY_KEY_REUSED
              message: >-
                This Idempotency-Key was already used with a different request
                payload
              request_id: 550e8400-e29b-41d4-a716-446655440000
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
          example:
            error:
              code: INTERNAL_ERROR
              message: An internal error occurred
              request_id: 550e8400-e29b-41d4-a716-446655440000
  securitySchemes:
    SignatureAuth:
      type: apiKey
      in: header
      name: Authorization
      description: >
        Request signing with an access key issued to a service account. An

        HMAC-SHA256 over a canonical form of the request, close to AWS SigV4.

        The `basaltic` CLI signs for you.


        Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce`

        (random per request); add `X-Content-Sha256` to bind a body, and

        `X-Amz-Security-Token` when using temporary credentials.


        ```

        Authorization: BASALTIC-HMAC-SHA256
        Credential=<access_key_id>/<date>/<region>/basaltic/basaltic_request,
        SignedHeaders=host;x-date;x-nonce, Signature=<hex>

        ```


        `<region>` is the region code you are calling, or `global` for the
        global

        services. A signature is valid for 5 minutes from `X-Date`, and mutating

        requests are replay-guarded on the nonce.


        **Full signing procedure, including a working implementation:**

        https://docs.basaltic.sh/authentication


        ## Rate limits

        There is no global request budget. A limit applies only where an

        operation documents a `429`, and that operation says what it counts.

        Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`,

        `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather

        than hard-coding a number. Retrying before `Retry-After` is refused and

        extends the window. Everything else is bounded by quota, not by request

        rate.

````