> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # Create NAT gateway > Allocates an EIP from the regional public pool and configures source NAT for the VPC's private subnets through the internet gateway's uplink. The target VPC must already have an Internet Gateway attached. ## OpenAPI ````yaml /api-reference/specs/network.yaml post /v1/nat-gateways openapi: 3.0.3 info: title: Basaltic Network API version: 1.0.0 description: | The VPC surface — networks and subnets, interfaces, route tables, security groups, internet, NAT and egress-only gateways, and floating IPs. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://network.{region}.basaltic.sh description: Regional API endpoint variables: region: default: sa-saopaulo-1 description: Region code security: - SignatureAuth: [] paths: /v1/nat-gateways: post: tags: - Networking summary: Create NAT gateway description: | Allocates an EIP from the regional public pool and configures source NAT for the VPC's private subnets through the internet gateway's uplink. The target VPC must already have an Internet Gateway attached. operationId: createNATGateway parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/NATGatewayCreateRequest' responses: '201': description: NAT gateway created content: application/json: schema: $ref: '#/components/schemas/NATGatewayResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': $ref: '#/components/responses/Conflict' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' security: - SignatureAuth: [] components: parameters: IdempotencyKey: name: Idempotency-Key in: header description: >- Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token. required: false schema: type: string maxLength: 255 example: 550e8400-e29b-41d4-a716-446655440000 schemas: NATGatewayCreateRequest: type: object required: - name - subnet_id properties: name: type: string example: main description: type: string example: NAT gateway for private subnet egress subnet_id: type: string format: uuid description: | Subnet the NAT GW lives in. The parent VPC must already have an Internet Gateway attached — the NAT GW reuses that uplink. example: 7a1c9d3e-2f5b-4c8a-9e6d-3b2a1c4f5e8d tags: type: object additionalProperties: type: string NATGatewayResponse: type: object properties: nat_gateway: $ref: '#/components/schemas/NATGateway' NATGateway: type: object required: - id - crn - name - subnet_id - vpc_id - external_ip - tags - created_at - updated_at properties: id: type: string format: uuid readOnly: true crn: type: string readOnly: true example: crn:network:sa-saopaulo-1:my-account:nat-gateway/main name: type: string example: main description: type: string example: NAT gateway for private subnet egress subnet_id: type: string format: uuid description: Subnet the NAT GW lives in. Subnet delete is blocked while occupied. example: 7a1c9d3e-2f5b-4c8a-9e6d-3b2a1c4f5e8d vpc_id: type: string format: uuid description: VPC of the parent subnet (denormalised for convenience). example: 5f8d3a2e-1c4b-4e7a-9f6d-2b1a8c3e5d7f external_ip: type: string description: >- Public IP allocated from the regional pool. Stable for the NAT GW's lifetime. example: 203.0.113.10 tags: type: object additionalProperties: type: string created_at: type: string format: date-time readOnly: true updated_at: type: string format: date-time readOnly: true Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 responses: BadRequest: description: Invalid request parameters content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INVALID_INPUT message: Invalid request parameters request_id: 550e8400-e29b-41d4-a716-446655440000 Unauthorized: description: Authentication required or token invalid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Authentication required request_id: 550e8400-e29b-41d4-a716-446655440000 Forbidden: description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ACCESS_DENIED message: You don't have permission to perform this action request_id: 550e8400-e29b-41d4-a716-446655440000 Conflict: description: Resource conflict (e.g., already exists, invalid state) content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: CONFLICT message: Resource with this name already exists request_id: 550e8400-e29b-41d4-a716-446655440000 UnprocessableEntity: description: | The request is well-formed but cannot be processed as sent. On the operations that accept `Idempotency-Key` this is the key-reuse case: the key was first seen with a different request payload, so replaying the stored outcome would answer a question the caller did not ask. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: IDEMPOTENCY_KEY_REUSED message: >- This Idempotency-Key was already used with a different request payload request_id: 550e8400-e29b-41d4-a716-446655440000 InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INTERNAL_ERROR message: An internal error occurred request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````