Documentation

esc
    API reference · Networking / VPC networks

    VPC networks

    Private networks, their subnets, and the firewall rules on each subnet.

    View as MarkdownOpen in ClaudeOpen in ChatGPT

    A VPC is a private network of your own. Create one, add subnets inside its CIDR, then create instances with a subnet_id. Each subnet has numbered firewall rules, evaluated lowest number first; the first match decides. To reach a VPC instance from the internet, give it a public IP.

    The network object

    A VPC: a private network of your own.

    Fields

    • idstringrequired

      e.g. net_....

    • namestringrequired

      Its name, unique among your VPC networks.

    • cidrstringrequired

      e.g. 10.0.0.0/16.

    • regionstring or null

      e.g. af-abj.

    • zonestring or null

      e.g. af-abj-2.

    • instance_countinteger or null

      Instances in this VPC; null when it could not be counted.

    • desired_statestringrequired

      What you asked for: present, or deleted once you deleted it.

      One of present, deleted.

    • observed_statestringrequired

      What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    • created_atstring or null

      When it was created (RFC 3339, UTC).

    • updated_atstring or null

      When it last changed (RFC 3339, UTC).

    The subnet object

    Fields

    • idstringrequired

      e.g. snet_....

    • network_idstringrequired
    • namestringrequired

      Its name.

    • cidrstringrequired

      Inside the VPC's CIDR.

    • regionstring or null

      e.g. af-abj.

    • zonestring or null

      e.g. af-abj-2.

    • instance_countinteger or null

      Instances in this subnet; null when they could not be counted.

    • desired_statestringrequired

      What you asked for: present, or deleted once you deleted it.

      One of present, deleted.

    • observed_statestringrequired

      What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    • created_atstring or null

      When it was created (RFC 3339, UTC).

    • updated_atstring or null

      When it last changed (RFC 3339, UTC).

    The firewall rule object

    Fields

    • idstringrequired

      e.g. aclr_....

    • subnet_idstringrequired

      The subnet the rule applies to, as a whole.

    • numberintegerrequired

      Evaluation order, 100-9999; lowest first.

      From 100 to 9999.

    • directionstringrequired

      ingress (into the subnet) or egress (out of it).

      One of ingress, egress.

    • protocolstringrequired

      tcp, udp, icmp or all.

      One of tcp, udp, icmp, all.

    • port_startinteger or null

      First port, for tcp/udp; null otherwise.

    • port_endinteger or null

      Last port, for tcp/udp; null otherwise.

    • icmp_typeinteger or null

      ICMP type, for icmp; null for every type.

    • icmp_codeinteger or null

      ICMP code, for icmp; null for every code.

    • cidrstringrequired

      Source (ingress) or destination (egress), e.g. 0.0.0.0/0.

    • actionstringrequired

      allow or deny.

      One of allow, deny.

    • desired_statestringrequired

      What you asked for: present, or deleted once you deleted it.

      One of present, deleted.

    • observed_statestringrequired

      What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    • created_atstring or null

      When it was created (RFC 3339, UTC).

    • updated_atstring or null

      When it last changed (RFC 3339, UTC).

    List VPC networks

    Your VPC networks, newest first. Filter by name with q, or by state.

    GET/public/v1/networks
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Query parameters

    • limitinteger

      Items per page, 1 to 100. Defaults to 50.

      From 1 to 100. Defaults to 50.

    • cursorstring

      The previous page's next_cursor, to get the next page. Leave out for the first page; keep the other parameters the same.

    • qstring

      Only items whose name contains this text (case-insensitive), at most 255 characters.

      At most 255 characters.

    • desired_statestring

      Only items with this desired_state: present or deleted.

      One of present, deleted.

    • observed_statestring

      Only items with this observed_state.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    Response 200

    A page of networks.
    • dataarray of Networkrequired
      Show 10 child fields
      • idstringrequired

        e.g. net_....

      • namestringrequired

        Its name, unique among your VPC networks.

      • cidrstringrequired

        e.g. 10.0.0.0/16.

      • regionstring or null

        e.g. af-abj.

      • zonestring or null

        e.g. af-abj-2.

      • instance_countinteger or null

        Instances in this VPC; null when it could not be counted.

      • desired_statestringrequired

        What you asked for: present, or deleted once you deleted it.

        One of present, deleted.

      • observed_statestringrequired

        What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

        One of pending, provisioning, active, deleting, deleted, failed, unknown.

      • created_atstring or null

        When it was created (RFC 3339, UTC).

      • updated_atstring or null

        When it last changed (RFC 3339, UTC).

    • next_cursorstring or nullrequired

      Pass as cursor for the next page; null on the last page.

    Errors

    • 400INVALID_PAGE: limit is not a whole number from 1 to 100. Send a value in that range, or leave it out for 50. INVALID_CURSOR: cursor does not belong to this list with these filters. Start again without a cursor. INVALID_FILTER: q is longer than 255 characters, or desired_state or observed_state is not one of its listed values. Fix the parameter named in detail.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    Query
    curl "https://api.pantechdynamics.com/public/v1/networks" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "data": [
    {
      "id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "name": "prod",
      "cidr": "10.0.0.0/16",
      "region": "af-abj",
      "zone": "af-abj-1",
      "instance_count": 2,
      "desired_state": "present",
      "observed_state": "active",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": "eyJhdCI6IjIwMjYtMTAtMDNUMDk6MzA6MDBaIiwiaWQiOiJ2bV8wNmdrIn0"
}

    Create a VPC network

    Creates a VPC: a private network of your own, with a CIDR such as 10.0.0.0/16. Then add subnets to it, and instances or databases to the subnets. A VPC is billed monthly: see Price a VPC network.

    Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason. The network's id is the operation's resource_id.

    Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

    POST/public/v1/networks
    Write keyNeeds Idempotency-KeyReturns202Accepted

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    • Idempotency-Keystringrequired

      A new value, such as a UUID, for each change. Resend with the same value to retry safely.

      At most 255 characters.

    Body

    application/json
    • namestringrequired

      1 to 255 characters, unique among your VPC networks.

      At most 255 characters.

    • cidrstringrequired

      The VPC's private IPv4 range, e.g. 10.0.0.0/16. Subnets are carved from it.

    • regionstring

      A region from GET /public/v1/regions that offers VPC networks. Defaults to the platform's region.

    Response 202

    Accepted. Follow operation_id until it finishes.
    • operation_idstringrequired

      The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.

    • resource_idstringrequired

      The resource being created or changed, e.g. the new snapshot's id for a snapshot create.

    • statusstringrequired

      The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

    Errors

    • 400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 409NETWORK_NAME_TAKEN: you already have a VPC with this name. Choose a different name. ACCOUNT_SUSPENDED: an invoice is overdue, or the organization was suspended for non-payment. Pay the outstanding invoice in the console, then retry. PROVIDER_ACCOUNT_NOT_READY: your organization's cloud account is still being set up, which takes a few minutes after sign-up. Retry shortly. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
    • 413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
    • 422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: name REQUIRED or NAME_TOO_LONG: send a name of 1 to 255 characters. cidr REQUIRED: send an IPv4 CIDR such as 10.0.0.0/16. region REGION_NOT_AVAILABLE: this region cannot take VPC networks now. Pick one from GET /public/v1/regions. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling. VALIDATION_FAILED with no errors entry: cidr is not a valid IPv4 CIDR.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

    Every code is explained in Errors.

    Authorization
    Body
    Idempotency
    curl -X POST "https://api.pantechdynamics.com/public/v1/networks" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "prod",
    "cidr": "10.0.0.0/16"
  }'
    Response 202
    {
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

    Price a VPC network

    What one more VPC network costs per month, in your organization's currency. priced is false, with an unpriced_reason, when no price applies.

    GET/public/v1/networks/quote
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Response 200

    The price.
    • currencystringrequired

      NGN or USD.

    • monthly_minorintegerrequired

      Price for a full month in minor units of currency.

    • nominal_month_hoursintegerrequired

      Hours in the month the price assumes: 730.

    Errors

    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404NOT_FOUND: cost quotes are not available on this platform yet.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    curl "https://api.pantechdynamics.com/public/v1/networks/quote" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "currency": "NGN",
  "monthly_minor": 1700000,
  "nominal_month_hours": 730
}

    Get a VPC network

    One VPC network, with the number of instances in it.

    GET/public/v1/networks/{network_id}
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Path parameters

    • network_idstringrequired

      The resource's id.

    Response 200

    The network.
    • idstringrequired

      e.g. net_....

    • namestringrequired

      Its name, unique among your VPC networks.

    • cidrstringrequired

      e.g. 10.0.0.0/16.

    • regionstring or null

      e.g. af-abj.

    • zonestring or null

      e.g. af-abj-2.

    • instance_countinteger or null

      Instances in this VPC; null when it could not be counted.

    • desired_statestringrequired

      What you asked for: present, or deleted once you deleted it.

      One of present, deleted.

    • observed_statestringrequired

      What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    • created_atstring or null

      When it was created (RFC 3339, UTC).

    • updated_atstring or null

      When it last changed (RFC 3339, UTC).

    Errors

    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no VPC network with this id in your organization, or the id is not a VPC network id (net_…). Check the id.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    Path
    curl "https://api.pantechdynamics.com/public/v1/networks/net_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "name": "prod",
  "cidr": "10.0.0.0/16",
  "region": "af-abj",
  "zone": "af-abj-1",
  "instance_count": 2,
  "desired_state": "present",
  "observed_state": "active",
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

    Delete a VPC network

    Deletes a VPC network. It must hold no instances (in any of its subnets) and no public IPs.

    Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason.

    Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

    Scope: write. Destructive: an AI app's key also needs delete.

    DELETE/public/v1/networks/{network_id}
    Write keyNeeds Idempotency-KeyReturns202Accepted

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    • Idempotency-Keystringrequired

      A new value, such as a UUID, for each change. Resend with the same value to retry safely.

      At most 255 characters.

    Path parameters

    • network_idstringrequired

      The resource's id.

    Response 202

    Accepted. Follow operation_id until it finishes.
    • operation_idstringrequired

      The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.

    • resource_idstringrequired

      The resource being created or changed, e.g. the new snapshot's id for a snapshot create.

    • statusstringrequired

      The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

    Errors

    • 400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no VPC network with this id in your organization, or the id is not a VPC network id (net_…). Check the id.
    • 409NETWORK_HAS_INSTANCES: a subnet of this network still has instances. Delete or move them first. NETWORK_HAS_PUBLIC_IPS: the network still holds public IPs. Release them first. INVALID_RESOURCE_STATE: the network cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
    • 422VALIDATION_FAILED with no errors entry: the platform refused a value, for example a malformed CIDR or a name longer than 255 characters. Check the request against this page.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

    Every code is explained in Errors.

    Authorization
    Path
    Idempotency
    curl -X DELETE "https://api.pantechdynamics.com/public/v1/networks/net_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
    Response 202
    {
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

    List subnets

    The VPC's subnets.

    GET/public/v1/networks/{network_id}/subnets
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Path parameters

    • network_idstringrequired

      The resource's id.

    Query parameters

    • limitinteger

      Items per page, 1 to 100. Defaults to 50.

      From 1 to 100. Defaults to 50.

    • cursorstring

      The previous page's next_cursor, to get the next page. Leave out for the first page; keep the other parameters the same.

    • qstring

      Only items whose name contains this text (case-insensitive), at most 255 characters.

      At most 255 characters.

    • desired_statestring

      Only items with this desired_state: present or deleted.

      One of present, deleted.

    • observed_statestring

      Only items with this observed_state.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    Response 200

    A page of subnets.
    • dataarray of Subnetrequired
      Show 11 child fields
      • idstringrequired

        e.g. snet_....

      • network_idstringrequired
      • namestringrequired

        Its name.

      • cidrstringrequired

        Inside the VPC's CIDR.

      • regionstring or null

        e.g. af-abj.

      • zonestring or null

        e.g. af-abj-2.

      • instance_countinteger or null

        Instances in this subnet; null when they could not be counted.

      • desired_statestringrequired

        What you asked for: present, or deleted once you deleted it.

        One of present, deleted.

      • observed_statestringrequired

        What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

        One of pending, provisioning, active, deleting, deleted, failed, unknown.

      • created_atstring or null

        When it was created (RFC 3339, UTC).

      • updated_atstring or null

        When it last changed (RFC 3339, UTC).

    • next_cursorstring or nullrequired

      Pass as cursor for the next page; null on the last page.

    Errors

    • 400INVALID_PAGE: limit is not a whole number from 1 to 100. Send a value in that range, or leave it out for 50. INVALID_CURSOR: cursor does not belong to this list with these filters. Start again without a cursor. INVALID_FILTER: q is longer than 255 characters, or desired_state or observed_state is not one of its listed values. Fix the parameter named in detail.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no VPC network with this id in your organization, or the id is not a VPC network id (net_…). Check the id.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    Path
    Query
    curl "https://api.pantechdynamics.com/public/v1/networks/net_06gk3x9tq7m2v8r4y1c5d0zp8w/subnets" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "data": [
    {
      "id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "name": "app",
      "cidr": "10.0.1.0/24",
      "region": "af-abj",
      "zone": "af-abj-1",
      "instance_count": 2,
      "desired_state": "present",
      "observed_state": "active",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": "eyJhdCI6IjIwMjYtMTAtMDNUMDk6MzA6MDBaIiwiaWQiOiJ2bV8wNmdrIn0"
}

    Create a subnet

    Creates a subnet inside the VPC's CIDR, such as 10.0.1.0/24. Instances and databases are placed in subnets; each subnet has its own firewall rules.

    Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason. The subnet's id is the operation's resource_id.

    Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

    POST/public/v1/networks/{network_id}/subnets
    Write keyNeeds Idempotency-KeyReturns202Accepted

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    • Idempotency-Keystringrequired

      A new value, such as a UUID, for each change. Resend with the same value to retry safely.

      At most 255 characters.

    Path parameters

    • network_idstringrequired

      The resource's id.

    Body

    application/json
    • namestringrequired

      1 to 255 characters.

      At most 255 characters.

    • cidrstringrequired

      An IPv4 range inside the VPC's CIDR that does not overlap its other subnets, e.g. 10.0.1.0/24.

    Response 202

    Accepted. Follow operation_id until it finishes.
    • operation_idstringrequired

      The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.

    • resource_idstringrequired

      The resource being created or changed, e.g. the new snapshot's id for a snapshot create.

    • statusstringrequired

      The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

    Errors

    • 400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no VPC network with this id in your organization, or the id is not a VPC network id (net_…). Check the id.
    • 409INVALID_RESOURCE_STATE: the network cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
    • 413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
    • 422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: name REQUIRED or NAME_TOO_LONG: send a name of 1 to 255 characters. cidr REQUIRED: send an IPv4 CIDR inside the VPC's CIDR. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling. VALIDATION_FAILED with no errors entry: cidr is not a valid IPv4 CIDR.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

    Every code is explained in Errors.

    Authorization
    Path
    Body
    Idempotency
    curl -X POST "https://api.pantechdynamics.com/public/v1/networks/net_06gk3x9tq7m2v8r4y1c5d0zp8w/subnets" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "app",
    "cidr": "10.0.1.0/24"
  }'
    Response 202
    {
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

    Get a subnet

    One subnet, with the number of instances in it.

    GET/public/v1/subnets/{subnet_id}
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Path parameters

    • subnet_idstringrequired

      The resource's id.

    Response 200

    The subnet.
    • idstringrequired

      e.g. snet_....

    • network_idstringrequired
    • namestringrequired

      Its name.

    • cidrstringrequired

      Inside the VPC's CIDR.

    • regionstring or null

      e.g. af-abj.

    • zonestring or null

      e.g. af-abj-2.

    • instance_countinteger or null

      Instances in this subnet; null when they could not be counted.

    • desired_statestringrequired

      What you asked for: present, or deleted once you deleted it.

      One of present, deleted.

    • observed_statestringrequired

      What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    • created_atstring or null

      When it was created (RFC 3339, UTC).

    • updated_atstring or null

      When it last changed (RFC 3339, UTC).

    Errors

    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no subnet with this id in your organization, or the id is not a subnet id (snet_…). Check the id.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    Path
    curl "https://api.pantechdynamics.com/public/v1/subnets/snet_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "name": "app",
  "cidr": "10.0.1.0/24",
  "region": "af-abj",
  "zone": "af-abj-1",
  "instance_count": 2,
  "desired_state": "present",
  "observed_state": "active",
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

    Delete a subnet

    Deletes a subnet. It must hold no instances or databases.

    Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason.

    Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

    Scope: write. Destructive: an AI app's key also needs delete.

    DELETE/public/v1/subnets/{subnet_id}
    Write keyNeeds Idempotency-KeyReturns202Accepted

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    • Idempotency-Keystringrequired

      A new value, such as a UUID, for each change. Resend with the same value to retry safely.

      At most 255 characters.

    Path parameters

    • subnet_idstringrequired

      The resource's id.

    Response 202

    Accepted. Follow operation_id until it finishes.
    • operation_idstringrequired

      The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.

    • resource_idstringrequired

      The resource being created or changed, e.g. the new snapshot's id for a snapshot create.

    • statusstringrequired

      The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

    Errors

    • 400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no subnet with this id in your organization, or the id is not a subnet id (snet_…). Check the id.
    • 409INVALID_RESOURCE_STATE: the subnet still has instances or databases, or is already being deleted. Delete them first. SUBNET_HAS_KUBERNETES_CLUSTERS: Kubernetes clusters still run in this subnet. Delete them first. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
    • 422VALIDATION_FAILED with no errors entry: the platform refused a value, for example a malformed CIDR or a name longer than 255 characters. Check the request against this page.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

    Every code is explained in Errors.

    Authorization
    Path
    Idempotency
    curl -X DELETE "https://api.pantechdynamics.com/public/v1/subnets/snet_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
    Response 202
    {
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

    List a subnet's firewall rules

    The subnet's firewall rules, in evaluation order, and the platform's fixed rules around them (system_rules), which always apply.

    GET/public/v1/subnets/{subnet_id}/firewall-rules
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Path parameters

    • subnet_idstringrequired

      The resource's id.

    Response 200

    The rules.
    • dataarray of FirewallRulerequired
      Show 15 child fields
      • idstringrequired

        e.g. aclr_....

      • subnet_idstringrequired

        The subnet the rule applies to, as a whole.

      • numberintegerrequired

        Evaluation order, 100-9999; lowest first.

        From 100 to 9999.

      • directionstringrequired

        ingress (into the subnet) or egress (out of it).

        One of ingress, egress.

      • protocolstringrequired

        tcp, udp, icmp or all.

        One of tcp, udp, icmp, all.

      • port_startinteger or null

        First port, for tcp/udp; null otherwise.

      • port_endinteger or null

        Last port, for tcp/udp; null otherwise.

      • icmp_typeinteger or null

        ICMP type, for icmp; null for every type.

      • icmp_codeinteger or null

        ICMP code, for icmp; null for every code.

      • cidrstringrequired

        Source (ingress) or destination (egress), e.g. 0.0.0.0/0.

      • actionstringrequired

        allow or deny.

        One of allow, deny.

      • desired_statestringrequired

        What you asked for: present, or deleted once you deleted it.

        One of present, deleted.

      • observed_statestringrequired

        What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

        One of pending, provisioning, active, deleting, deleted, failed, unknown.

      • created_atstring or null

        When it was created (RFC 3339, UTC).

      • updated_atstring or null

        When it last changed (RFC 3339, UTC).

    • next_cursorstring or nullrequired

      Always null.

    • system_rulesarray of FirewallRuleFieldsrequired

      The platform's own rules around yours. They always apply and cannot be changed.

      Show 9 child fields
      • numberintegerrequired

        Evaluation order, 100-9999; lowest first.

        From 100 to 9999.

      • directionstringrequired

        ingress (into the subnet) or egress (out of it).

        One of ingress, egress.

      • protocolstringrequired

        tcp, udp, icmp or all.

        One of tcp, udp, icmp, all.

      • port_startinteger or null

        First port, for tcp/udp; null otherwise.

      • port_endinteger or null

        Last port, for tcp/udp; null otherwise.

      • icmp_typeinteger or null

        ICMP type, for icmp; null for every type.

      • icmp_codeinteger or null

        ICMP code, for icmp; null for every code.

      • cidrstringrequired

        Source (ingress) or destination (egress), e.g. 0.0.0.0/0.

      • actionstringrequired

        allow or deny.

        One of allow, deny.

    Errors

    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no subnet with this id in your organization, or the id is not a subnet id (snet_…). Check the id. NOT_FOUND: firewall rules are not offered on this platform yet.
    • 409FIREWALL_RULES_NOT_SUPPORTED: firewall rules apply to VPC subnets only. Standard instances use security groups.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    Path
    curl "https://api.pantechdynamics.com/public/v1/subnets/snet_06gk3x9tq7m2v8r4y1c5d0zp8w/firewall-rules" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "data": [
    {
      "id": "aclr_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "subnet_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "number": 100,
      "direction": "ingress",
      "protocol": "tcp",
      "port_start": 443,
      "port_end": 443,
      "icmp_type": 1,
      "icmp_code": 1,
      "cidr": "0.0.0.0/0",
      "action": "allow",
      "desired_state": "present",
      "observed_state": "active",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": null,
  "system_rules": [
    {
      "number": 100,
      "direction": "ingress",
      "protocol": "tcp",
      "port_start": 443,
      "port_end": 443,
      "icmp_type": 1,
      "icmp_code": 1,
      "cidr": "0.0.0.0/0",
      "action": "allow"
    }
  ]
}

    Add a firewall rule

    Adds a rule to the subnet's firewall. Rules are evaluated by number, lowest first, and the first match decides; traffic no rule allows is dropped. A rule applies to the whole subnet. Defaults: direction ingress, action allow, port_end equal to port_start.

    Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason. The rule's id is the operation's resource_id.

    Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

    POST/public/v1/subnets/{subnet_id}/firewall-rules
    Write keyNeeds Idempotency-KeyReturns202Accepted

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    • Idempotency-Keystringrequired

      A new value, such as a UUID, for each change. Resend with the same value to retry safely.

      At most 255 characters.

    Path parameters

    • subnet_idstringrequired

      The resource's id.

    Body

    application/json
    • numberintegerrequired

      Evaluation order, 100 to 9999, unique on the subnet; lower numbers are evaluated first and the first match decides.

      From 100 to 9999.

    • directionstring

      ingress (traffic into the subnet) or egress (traffic out of it). Defaults to ingress.

      One of ingress, egress. Defaults to ingress.

    • protocolstringrequired

      tcp, udp, icmp or all.

      One of tcp, udp, icmp, all.

    • port_startinteger

      First port, 1 to 65535. For tcp and udp only; leave out for icmp and all.

    • port_endinteger

      Last port, 1 to 65535, at least port_start. Defaults to port_start (one port).

    • icmp_typeinteger

      ICMP type, for icmp only, e.g. 8 for echo request. Leave out for every type.

    • icmp_codeinteger

      ICMP code, for icmp only. Leave out for every code.

    • cidrstringrequired

      One IPv4 CIDR: the source for ingress, the destination for egress. 0.0.0.0/0 means anywhere.

    • actionstring

      allow or deny. Defaults to allow.

      One of allow, deny. Defaults to allow.

    Response 202

    Accepted. Follow operation_id until it finishes.
    • operation_idstringrequired

      The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.

    • resource_idstringrequired

      The resource being created or changed, e.g. the new snapshot's id for a snapshot create.

    • statusstringrequired

      The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

    Errors

    • 400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no subnet with this id in your organization, or the id is not a subnet id (snet_…). Check the id. NOT_FOUND: firewall rules are not offered on this platform yet.
    • 409FIREWALL_RULES_NOT_SUPPORTED: firewall rules apply to VPC subnets only. Standard instances use security groups. INVALID_RESOURCE_STATE: the subnet cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
    • 413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
    • 422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: protocol or cidr REQUIRED: send both. number INVALID_RULE_NUMBER: use 100 to 9999. number RULE_NUMBER_TAKEN: another rule on this subnet has this number. Choose another. port_start INVALID_PORTS: send ports 1 to 65535 for tcp or udp, and leave them out for icmp or all. protocol INVALID_FIREWALL_RULE: direction, protocol, action or the ICMP fields are not valid values. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

    Every code is explained in Errors.

    Authorization
    Path
    Body
    Idempotency
    curl -X POST "https://api.pantechdynamics.com/public/v1/subnets/snet_06gk3x9tq7m2v8r4y1c5d0zp8w/firewall-rules" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "number": 100,
    "protocol": "tcp",
    "cidr": "203.0.113.0/24"
  }'
    Response 202
    {
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "aclr_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

    Get a firewall rule

    One firewall rule on the subnet.

    GET/public/v1/subnets/{subnet_id}/firewall-rules/{rule_id}
    Read keyReturns200OK

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    Path parameters

    • subnet_idstringrequired

      The resource's id.

    • rule_idstringrequired

      The rule's id (aclr_... for a firewall rule, pfr_... for a port forwarding rule).

    Response 200

    The rule.
    • idstringrequired

      e.g. aclr_....

    • subnet_idstringrequired

      The subnet the rule applies to, as a whole.

    • numberintegerrequired

      Evaluation order, 100-9999; lowest first.

      From 100 to 9999.

    • directionstringrequired

      ingress (into the subnet) or egress (out of it).

      One of ingress, egress.

    • protocolstringrequired

      tcp, udp, icmp or all.

      One of tcp, udp, icmp, all.

    • port_startinteger or null

      First port, for tcp/udp; null otherwise.

    • port_endinteger or null

      Last port, for tcp/udp; null otherwise.

    • icmp_typeinteger or null

      ICMP type, for icmp; null for every type.

    • icmp_codeinteger or null

      ICMP code, for icmp; null for every code.

    • cidrstringrequired

      Source (ingress) or destination (egress), e.g. 0.0.0.0/0.

    • actionstringrequired

      allow or deny.

      One of allow, deny.

    • desired_statestringrequired

      What you asked for: present, or deleted once you deleted it.

      One of present, deleted.

    • observed_statestringrequired

      What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.

      One of pending, provisioning, active, deleting, deleted, failed, unknown.

    • created_atstring or null

      When it was created (RFC 3339, UTC).

    • updated_atstring or null

      When it last changed (RFC 3339, UTC).

    Errors

    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no rule with this id on this subnet, or no such subnet in your organization. Check both ids. NOT_FOUND: firewall rules are not offered on this platform yet.
    • 409FIREWALL_RULES_NOT_SUPPORTED: firewall rules apply to VPC subnets only. Standard instances use security groups.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

    Every code is explained in Errors.

    Authorization
    Path
    curl "https://api.pantechdynamics.com/public/v1/subnets/snet_06gk3x9tq7m2v8r4y1c5d0zp8w/firewall-rules/aclr_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"
    Response 200
    {
  "id": "aclr_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "subnet_id": "snet_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "number": 100,
  "direction": "ingress",
  "protocol": "tcp",
  "port_start": 443,
  "port_end": 443,
  "icmp_type": 1,
  "icmp_code": 1,
  "cidr": "0.0.0.0/0",
  "action": "allow",
  "desired_state": "present",
  "observed_state": "active",
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

    Delete a firewall rule

    Deletes one subnet firewall rule. Traffic it allowed is dropped once the operation succeeds, unless another rule allows it.

    Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason.

    Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

    Scope: write. Destructive: an AI app's key also needs delete.

    DELETE/public/v1/firewall-rules/{rule_id}
    Write keyNeeds Idempotency-KeyReturns202Accepted

    Headers

    • Authorizationstringrequired

      Bearer and your API key: Bearer PAN_….

    • Idempotency-Keystringrequired

      A new value, such as a UUID, for each change. Resend with the same value to retry safely.

      At most 255 characters.

    Path parameters

    • rule_idstringrequired

      The rule's id (aclr_... for a firewall rule, pfr_... for a port forwarding rule).

    Response 202

    Accepted. Follow operation_id until it finishes.
    • operation_idstringrequired

      The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.

    • resource_idstringrequired

      The resource being created or changed, e.g. the new snapshot's id for a snapshot create.

    • statusstringrequired

      The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

    Errors

    • 400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
    • 401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
    • 403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
    • 404RESOURCE_NOT_FOUND: no firewall rule with this id in your organization, or the id is not a firewall rule id (aclr_…). Check the id. NOT_FOUND: firewall rules are not offered on this platform yet.
    • 409INVALID_RESOURCE_STATE: the firewall rule cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
    • 422VALIDATION_FAILED with no errors entry: the platform refused the request, for example because the resource has already been deleted. Read the resource to check its state.
    • 429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
    • 503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

    Every code is explained in Errors.

    Authorization
    Path
    Idempotency
    curl -X DELETE "https://api.pantechdynamics.com/public/v1/firewall-rules/aclr_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
    Response 202
    {
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "aclr_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

    Was this page helpful?

    Updated