Skip to main content
POST
Create a load balancer
Requires the IAM action loadbalancer:CreateLoadBalancer. See LOADBALANCER permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Body

application/json

Relationships accept a UUID, CRN or exact immutable name, classified by syntax. VPC, subnets and security groups must belong to the caller account in this region. Subnet names are scoped by vpc. Flavor is a regional catalog reference. Floating IP references accept UUID or CRN only. All references resolve before writes. Addresses are fixed at creation; updates cannot replace them.

name
string
required

1..127 chars of [A-Za-z0-9._-] Resource names must not start with the literal crn: prefix or be UUIDs (canonical, compact, braced, or urn:uuid: forms, in either case).

Example:

"web-lb"

type
enum<string>
required
Available options:
application,
network
Example:

"application"

vpc
string
required

VPC the LB will live in. Every selected subnet must belong to this VPC.

Example:

"c3d4e5f6-a7b8-4901-c2d3-e4f5a6b7c8d9"

subnets
string[]
required

One or more subnet selectors in the same VPC, account and region. Each instance has one interface; new instances are placed in the least-populated eligible subnet. The first subnet supplies automatic private floating IP allocations. Placement is fixed at creation.

Minimum array length: 1
Example:
flavor
string
required

Compute flavor for each LB instance.

Example:

"e5f6a7b8-c9d0-4123-e4f5-a6b7c8d9e0f1"

security_groups
string[]
required

Security groups attached to every replica NIC (AWS ALB shape). A VPC NIC with no security group denies all data traffic, so the listener port(s) must be opened by a security group listed here. Re-applied to replacement replicas. The LB's own control-plane path (agent config + heartbeat via the metadata endpoint) is always-allowed and needs none.

Example:
desired_count
integer

Steady target within min_count and max_count.

Required range: 1 <= x <= 10
Example:

2

min_count
integer

Lower capacity bound.

Required range: 1 <= x <= 10
Example:

1

max_count
integer

Upper capacity bound including rollout surge.

Required range: 1 <= x <= 10
Example:

5

autoscaling
object

Target tracking shared by instance pools and load balancers. Updates replace the policy. Set enabled=false to retain settings and use manual sizing. Each metric recommends a desired count; the largest recommendation wins. Missing, stale or incomplete observations prevent scale-in but do not block scale-out recommended by another valid metric. Decisions obey the resource's min_count/max_count, warmup, cooldown, stabilization, step limits and quotas. State survives controller restarts. Active policies own desired_count; manual changes are accepted and automatic evaluation resumes after cooldown. Custom telemetry requires telemetry:ReadMetrics in the same account.

replica_count
integer
default:1
deprecated

Deprecated input alias of desired_count; send only one. Desired defaults to 1. Omitted bounds default to desired.

Required range: 1 <= x <= 10
Example:

2

floating_ips
string[]

Existing free floating IPs from this account and region, at most one per family and visibility (private/public, IPv4/IPv6). Private addresses must belong to any selected subnet. Missing private families are allocated automatically from the first selected subnet for each family enabled there. Public addresses are optional and require a matching-family default route to an internet gateway in every selected subnet; NAT and egress-only gateways do not qualify. Public IPv6 requires every selected subnet to support IPv6. Pool-owned or attached addresses are unavailable. On deletion, supplied addresses are detached and retained; automatic private allocations are released.

Maximum array length: 4
Example:
tags
object
Example:

Response

Created

load_balancer
object
required