Skip to main content
POST
Create egress-only gateway
Requires the IAM action network:CreateEgressOnlyGateway. See NETWORK permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Body

application/json
name
string
required

Resource names must not start with the literal crn: prefix or be UUIDs (canonical, compact, braced, or urn:uuid: forms, in either case).

Example:

"main"

vpc
string
required

VPC UUID, CRN or exact name in the caller account.

Example:

"5f8d3a2e-1c4b-4e7a-9f6d-2b1a8c3e5d7f"

description
string
Example:

"Egress-only v6 for the private tier"

tags
object

Response

Egress-only gateway created

egress_only_gateway
object

Native IPv6 egress without address translation: a subnet with global IPv6 whose route table points ::/0 at one gets OUTBOUND v6 (plus the return traffic of its own flows), but the internet can never initiate an inbound connection — a platform-band drop enforces that regardless of the tenant's security groups. It owns no address and does not translate ULA sources and reuses the VPC's internet gateway for the L3 uplink, so the VPC must have an IGW attached. One per VPC.