Skip to main content
POST
Create security group rule
Requires the IAM action network:CreateSecurityGroupRule. See NETWORK permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Headers

Idempotency-Key
string

Optional client-generated key that makes a create replay-safe. Retrying a request with the same key returns the original outcome verbatim instead of creating a duplicate resource. Reusing a key with a different request body is rejected (422); a request whose key is still being processed returns 409. Records are honored for 24 hours. Use a UUID or similarly unique token.

Maximum string length: 255

Path Parameters

security_group_id
string<uuid>
required

Security Group ID

Body

application/json
direction
enum<string>
required
Available options:
ingress,
egress
protocol
enum<string>
required
Available options:
tcp,
udp,
icmp,
all
description
string
Example:

"Allow inbound HTTPS"

ethertype
enum<string>
default:ipv4
Available options:
ipv4,
ipv6
port_min
integer | null
Required range: 0 <= x <= 65535
Example:

443

port_max
integer | null
Required range: 0 <= x <= 65535
Example:

443

remote_cidr
string | null
Example:

"0.0.0.0/0"

source_security_group
string

Security-group UUID, CRN or exact account-scoped name. Mutually exclusive with remote_cidr.

Example:

"d1b6f3a8-4c2e-4a9d-8f7b-1e5c3a2d9b4f"

Response

Rule created

rule
object