API reference · Networking / Public IPs

Public IPs

Public addresses for VPC instances, with static NAT or port forwarding.

View as Markdown Open in Claude Open in ChatGPT

A public IP belongs to a VPC. With purpose static_nat every port of the address maps to one instance. With port_forwarding the address carries rules, each forwarding a port or range to an instance in the VPC. With load_balancer it carries load balancers, one per public port.

The public IP object

Fields

idstringrequired
e.g. pip_....
network_idstringrequired
network_namestring or null
The VPC's name.
purposestringrequired
static_nat maps every port to one instance; port_forwarding carries per-port rules.
One of static_nat, port_forwarding, load_balancer.
addressstring or null
The public IPv4 address; null until allocated.
instance_idstring or null
static_nat: the instance it maps to; null while it is detached (still yours, and billed once).
instance_namestring or null
The mapped instance's name; null when none.
regionstring or null
zonestring or null
desired_statestringrequired
What you asked for: present, or deleted once you deleted it.
One of present, deleted.
observed_statestringrequired
What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.
One of pending, provisioning, active, deleting, deleted, failed, unknown.
in_syncbooleanrequired
False while an attach or detach has not reached the address yet.
created_atstring or null
When it was created (RFC 3339, UTC).
updated_atstring or null
When it last changed (RFC 3339, UTC).

The port forwarding rule object

Fields

idstringrequired
e.g. pfr_....
public_ip_idstringrequired
instance_idstringrequired
instance_namestring or null
The target instance's name; null when it is gone.
protocolstringrequired
tcp or udp.
One of tcp, udp.
public_port_startintegerrequired
public_port_endintegerrequired
private_port_startintegerrequired
private_port_endintegerrequired
desired_statestringrequired
What you asked for: present, or deleted once you deleted it.
One of present, deleted.
observed_statestringrequired
What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.
One of pending, provisioning, active, deleting, deleted, failed, unknown.
created_atstring or null
When it was created (RFC 3339, UTC).
updated_atstring or null
When it last changed (RFC 3339, UTC).

List public IPs

Your VPC public IPs, or one VPC's with network_id.

GET/public/v1/public-ips

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Query parameters

network_idstring

Response 200

Public IPs.

dataarray of PublicIPrequired
Show 14 child fieldsHide child fields
- idstringrequired
  e.g. pip_....
- network_idstringrequired
- network_namestring or null
  The VPC's name.
- purposestringrequired
  static_nat maps every port to one instance; port_forwarding carries per-port rules.
  One of static_nat, port_forwarding, load_balancer.
- addressstring or null
  The public IPv4 address; null until allocated.
- instance_idstring or null
  static_nat: the instance it maps to; null while it is detached (still yours, and billed once).
- instance_namestring or null
  The mapped instance's name; null when none.
- regionstring or null
- zonestring or null
- desired_statestringrequired
  What you asked for: present, or deleted once you deleted it.
  One of present, deleted.
- observed_statestringrequired
  What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.
  One of pending, provisioning, active, deleting, deleted, failed, unknown.
- in_syncbooleanrequired
  False while an attach or detach has not reached the address yet.
- created_atstring or null
  When it was created (RFC 3339, UTC).
- updated_atstring or null
  When it last changed (RFC 3339, UTC).
next_cursorstring or nullrequired
Always null: this list is returned whole.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404NOT_FOUND: public IPs are not offered on this platform yet.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Query

network_id

curl "https://api.pantechdynamics.com/public/v1/public-ips" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "network_name": "prod",
      "purpose": "static_nat",
      "address": "102.211.122.80",
      "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "instance_name": "web-1",
      "region": "af-abj",
      "zone": "af-abj-1",
      "desired_state": "present",
      "observed_state": "active",
      "in_sync": true,
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": null
}

Allocate a public IP

Allocates a public IPv4 address for a VPC. static_nat (the default) maps every port of the address to one instance in network_id, sent as instance_id; port_forwarding, where offered, carries per-port rules instead (add them with Add a port forwarding rule). The network must be active. A public IP is billed monthly: see Price a public IP.

Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason. The address is in the public IP's address once it succeeds.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/public-ips

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Body

application/json

network_idstringrequired
The VPC network to allocate the address in. It must be active.
purposestring
static_nat maps every port to one instance (instance_id). port_forwarding carries per-port rules instead, and load_balancer carries load balancers. Defaults to static_nat.
One of static_nat, port_forwarding, load_balancer. Defaults to static_nat.
instance_idstring
For static_nat only: an instance in network_id without a public IP. Leave it out to reserve the address now and attach it later (POST /public/v1/public-ips/{public_ip_id}/attach). Leave out for port_forwarding and load_balancer.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: this API key has only the read scope. Use a key with write access. FORBIDDEN: the member who created this key may not do this in the organization, or has left it. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server. An owner can turn it on in the console under Organization › AI apps. STATIC_NAT_LIMIT_EXCEEDED: your organization has reached its limit of static NAT public IPs. Release one you no longer need, or contact support for a higher limit. PUBLIC_IP_LIMIT_EXCEEDED: your organization has reached its limit of public IPs of any purpose (20 by default). Release one you no longer need, or contact support for a higher limit.
404NOT_FOUND: public IPs are not offered on this platform yet. RESOURCE_NOT_FOUND: network_id is not one of your VPC networks.
409NETWORK_NOT_READY: public IPs can only be added to an active VPC network. Wait for the network to be active. INSTANCE_ALREADY_HAS_PUBLIC_IP: the instance already has a public IP. Release it before adding another. ACCOUNT_SUSPENDED: an invoice is overdue, or the organization was suspended for non-payment. Pay the outstanding invoice in the console, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: network_id REQUIRED: send the VPC network. purpose PURPOSE_NOT_AVAILABLE: use static_nat, port_forwarding or load_balancer. instance_id INSTANCE_NOT_IN_NETWORK: the instance is not in network_id. instance_id NOT_ALLOWED: a port_forwarding address takes no instance; each rule names its own. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/public-ips" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w"
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Price a public IP

What one more public IP costs per month, in your organization's currency.

GET/public/v1/public-ips/quote

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Response 200

The price.

currencystringrequired
NGN or USD.
monthly_minorintegerrequired
Price for a full month in minor units of currency.
nominal_month_hoursintegerrequired
Hours in the month the price assumes: 730.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404NOT_FOUND: cost quotes are not available on this platform yet.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

curl "https://api.pantechdynamics.com/public/v1/public-ips/quote" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "currency": "NGN",
  "monthly_minor": 1700000,
  "nominal_month_hours": 730
}

Get a public IP

One public IP, with the instance it maps to.

GET/public/v1/public-ips/{public_ip_id}

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

public_ip_idstringrequired
The resource's id.

Response 200

The public IP.

idstringrequired
e.g. pip_....
network_idstringrequired
network_namestring or null
The VPC's name.
purposestringrequired
static_nat maps every port to one instance; port_forwarding carries per-port rules.
One of static_nat, port_forwarding, load_balancer.
addressstring or null
The public IPv4 address; null until allocated.
instance_idstring or null
static_nat: the instance it maps to; null while it is detached (still yours, and billed once).
instance_namestring or null
The mapped instance's name; null when none.
regionstring or null
zonestring or null
desired_statestringrequired
What you asked for: present, or deleted once you deleted it.
One of present, deleted.
observed_statestringrequired
What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.
One of pending, provisioning, active, deleting, deleted, failed, unknown.
in_syncbooleanrequired
False while an attach or detach has not reached the address yet.
created_atstring or null
When it was created (RFC 3339, UTC).
updated_atstring or null
When it last changed (RFC 3339, UTC).

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no public IP with this id in your organization, or the id is not a public IP id (pip_…). Check the id. NOT_FOUND: public IPs are not offered on this platform yet.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

curl "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "network_id": "net_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "network_name": "prod",
  "purpose": "static_nat",
  "address": "102.211.122.80",
  "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "instance_name": "web-1",
  "region": "af-abj",
  "zone": "af-abj-1",
  "desired_state": "present",
  "observed_state": "active",
  "in_sync": true,
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

Release a public IP

Releases a public IP. The address is returned to the pool and may be given to someone else; billing stops when the operation succeeds. Delete its port forwarding rules first.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

Scope: write. Destructive: an AI app's key also needs delete.

DELETE/public/v1/public-ips/{public_ip_id}

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

public_ip_idstringrequired
The resource's id.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no public IP with this id in your organization, or the id is not a public IP id (pip_…). Check the id. NOT_FOUND: public IPs are not offered on this platform yet.
409PUBLIC_IP_HAS_PORT_FORWARDS: delete this address's port forwarding rules first. PUBLIC_IP_HAS_LOAD_BALANCERS: delete this address's load balancers first. INVALID_RESOURCE_STATE: the public IP cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
422VALIDATION_FAILED with no errors entry: the platform refused the request, for example because the resource has already been deleted. Read the resource to check its state.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account and deletes what it names.

curl -X DELETE "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Attach a public IP to an instance

Points a static NAT public IP at an instance in the same private network (VPC), keeping the address. Use it to move an address from one instance to another without releasing it: you keep the same IP and pay for it once. If the address is attached elsewhere it moves; the instance must not already have a static NAT address of its own.

Returns 202 Accepted with an operation_id (also in the Location header). Poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed. While it runs the address shows in_sync: false. Send an Idempotency-Key; a change that changes nothing returns an empty operation_id.

POST/public/v1/public-ips/{public_ip_id}/attach

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

public_ip_idstringrequired
The resource's id.

Body

application/json

instance_idstringrequired
An instance in the address's private network.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no public IP with this id in your organization, or the id is not a public IP id (pip_…). Check the id. NOT_FOUND: public IPs are not offered on this platform yet.
409PUBLIC_IP_NOT_STATIC_NAT: only a static NAT address can be attached or detached; port forwarding and load balancer addresses use their rules. INSTANCE_ALREADY_HAS_PUBLIC_IP: the instance already has a static NAT address. Detach or release that one first. INVALID_RESOURCE_STATE: the public IP cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
422VALIDATION_FAILED: instance_id REQUIRED, or INSTANCE_NOT_IN_NETWORK (the instance must be in the address's private network). With no errors entry: the platform refused the request, for example because the instance is deleted.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w/attach" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w"
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

List port forwarding rules

The address's port forwarding rules.

GET/public/v1/public-ips/{public_ip_id}/port-forwarding-rules

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

public_ip_idstringrequired
The resource's id.

Response 200

The rules.

dataarray of PortForwardingRulerequired
Show 13 child fieldsHide child fields
- idstringrequired
  e.g. pfr_....
- public_ip_idstringrequired
- instance_idstringrequired
- instance_namestring or null
  The target instance's name; null when it is gone.
- protocolstringrequired
  tcp or udp.
  One of tcp, udp.
- public_port_startintegerrequired
- public_port_endintegerrequired
- private_port_startintegerrequired
- private_port_endintegerrequired
- desired_statestringrequired
  What you asked for: present, or deleted once you deleted it.
  One of present, deleted.
- observed_statestringrequired
  What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.
  One of pending, provisioning, active, deleting, deleted, failed, unknown.
- created_atstring or null
  When it was created (RFC 3339, UTC).
- updated_atstring or null
  When it last changed (RFC 3339, UTC).
next_cursorstring or nullrequired
Always null: this list is returned whole.

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no public IP with this id in your organization, or the id is not a public IP id (pip_…). Check the id. NOT_FOUND: port forwarding is not offered on this platform yet.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

curl "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w/port-forwarding-rules" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "data": [
    {
      "id": "pfr_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "public_ip_id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "instance_name": "web-1",
      "protocol": "tcp",
      "public_port_start": 443,
      "public_port_end": 443,
      "private_port_start": 8443,
      "private_port_end": 8443,
      "desired_state": "present",
      "observed_state": "active",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": null
}

Detach a public IP from its instance

Unmaps a static NAT public IP from its instance. The address stays yours (and is billed once, as before) until you attach it to another instance or release it. The instance keeps running and can then be deleted.

POST/public/v1/public-ips/{public_ip_id}/detach

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

public_ip_idstringrequired
The resource's id.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no public IP with this id in your organization, or the id is not a public IP id (pip_…). Check the id. NOT_FOUND: public IPs are not offered on this platform yet.
409PUBLIC_IP_NOT_STATIC_NAT: only a static NAT address can be attached or detached; port forwarding and load balancer addresses use their rules. INVALID_RESOURCE_STATE: the public IP cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
422VALIDATION_FAILED with no errors entry: the platform refused the request, for example because the resource has already been deleted. Read the resource to check its state.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w/detach" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Add a port forwarding rule

Forwards a port or range of a port_forwarding public IP to an instance in its VPC. Defaults: public_port_end equals public_port_start, and the private range equals the public one (or starts at private_port_start with the same width).

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

POST/public/v1/public-ips/{public_ip_id}/port-forwarding-rules

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

public_ip_idstringrequired
The resource's id.

Body

application/json

instance_idstringrequired
An instance in the public IP's VPC.
protocolstringrequired
tcp or udp.
One of tcp, udp.
public_port_startintegerrequired
First public port, 1 to 65535.
public_port_endinteger
Last public port. Defaults to public_port_start (one port).
private_port_startinteger
First port on the instance. Defaults to public_port_start.
private_port_endinteger
Last port on the instance; the private range must be as wide as the public one. Defaults to match it.

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value. INVALID_REQUEST_BODY: the body is not a single valid JSON object. Send one JSON object with the fields documented for this endpoint.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no public IP with this id in your organization, or the id is not a public IP id (pip_…). Check the id. NOT_FOUND: port forwarding is not offered on this platform yet.
409PUBLIC_IP_NOT_FOR_PORT_FORWARDING: use an active public IP with purpose port_forwarding. PORTS_IN_USE: another rule on this address already forwards some of these ports for this protocol. Choose other ports, or delete that rule. INVALID_RESOURCE_STATE: the public IP cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
413REQUEST_TOO_LARGE: the body is larger than 64 KiB. Send a smaller request.
422VALIDATION_FAILED: a field is invalid. Each entry of errors names the field and its code: instance_id or protocol REQUIRED: send both. instance_id INSTANCE_NOT_IN_NETWORK: the instance is not in the address's VPC. public_port_start INVALID_PORTS: use tcp or udp, ports 1 to 65535, and public and private ranges of the same width. UNKNOWN_FIELD: the body has a field this endpoint does not take (named in field). Remove it or fix its spelling.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

Body

JSONEdit the example to suit.

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account.

curl -X POST "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w/port-forwarding-rules" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w",
    "protocol": "tcp",
    "public_port_start": 443
  }'

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "pfr_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

Get a port forwarding rule

One port forwarding rule on the address.

GET/public/v1/public-ips/{public_ip_id}/port-forwarding-rules/{rule_id}

Read keyReturns200OK

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….

Path parameters

public_ip_idstringrequired
The resource's id.
rule_idstringrequired
The rule's id (aclr_... for a firewall rule, pfr_... for a port forwarding rule).

Response 200

The rule.

idstringrequired
e.g. pfr_....
public_ip_idstringrequired
instance_idstringrequired
instance_namestring or null
The target instance's name; null when it is gone.
protocolstringrequired
tcp or udp.
One of tcp, udp.
public_port_startintegerrequired
public_port_endintegerrequired
private_port_startintegerrequired
private_port_endintegerrequired
desired_statestringrequired
What you asked for: present, or deleted once you deleted it.
One of present, deleted.
observed_statestringrequired
What the platform last observed: pending and provisioning while it is being created, active once ready, deleting/deleted on the way out, failed if it could not be made, unknown when it could not be checked.
One of pending, provisioning, active, deleting, deleted, failed, unknown.
created_atstring or null
When it was created (RFC 3339, UTC).
updated_atstring or null
When it last changed (RFC 3339, UTC).

Errors

401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no rule with this id on this address, or no such address in your organization. Check both ids. NOT_FOUND: port forwarding is not offered on this platform yet.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

public_ip_idrequiredThe resource's id.

rule_idrequiredThe rule's id (`aclr_...` for a firewall rule, `pfr_...` for a port forwarding rule).

curl "https://api.pantechdynamics.com/public/v1/public-ips/pip_06gk3x9tq7m2v8r4y1c5d0zp8w/port-forwarding-rules/pfr_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

Response 200

{
  "id": "pfr_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "public_ip_id": "pip_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "instance_id": "vm_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "instance_name": "web-1",
  "protocol": "tcp",
  "public_port_start": 443,
  "public_port_end": 443,
  "private_port_start": 8443,
  "private_port_end": 8443,
  "desired_state": "present",
  "observed_state": "active",
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

Delete a port forwarding rule

Deletes one port forwarding rule. Traffic to those ports stops once the operation succeeds.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

Scope: write. Destructive: an AI app's key also needs delete.

DELETE/public/v1/port-forwarding-rules/{rule_id}

Write keyNeeds Idempotency-KeyReturns202Accepted

Headers

Authorizationstringrequired
Bearer and your API key: Bearer PAN_….
Idempotency-Keystringrequired
A new value, such as a UUID, for each change. Resend with the same value to retry safely.
At most 255 characters.

Path parameters

rule_idstringrequired
The rule's id (aclr_... for a firewall rule, pfr_... for a port forwarding rule).

Response 202

Accepted. Follow operation_id until it finishes.

operation_idstringrequired
The operation carrying out the change. Poll GET /public/v1/operations/{operation_id} (also the Location header) until status is succeeded or failed.
resource_idstringrequired
The resource being created or changed, e.g. the new snapshot's id for a snapshot create.
statusstringrequired
The operation's status when the request was accepted, usually submitting. Follow operation_id for the outcome.

Errors

400IDEMPOTENCY_KEY_REQUIRED: the Idempotency-Key header is missing. Send a new unique value, such as a UUID, with every write. INVALID_IDEMPOTENCY_KEY: the Idempotency-Key header is longer than 255 characters. Use a shorter value.
401UNAUTHENTICATED: the request has no API key, or the key is mistyped, revoked or expired, or its creator has left the organization. Send Authorization: Bearer PAN_… with a valid key; create one in the console under Organization › API keys.
403INSUFFICIENT_SCOPE: the API key lacks the scope this endpoint needs (read for GET, write for changes; an AI app's key also needs delete for a destructive call). Use a key with that scope, or reconnect the AI app with "Manage and delete" access. FORBIDDEN: the member who created the key may not do this in the organization. Use a key created by an owner or admin. AI_APPS_DISABLED: the organization has turned AI app access off, and this request was made with an AI app's key or sent by Pantech's MCP server (Pantech-Client: mcp/…). An owner can turn it on in the console under Organization › AI apps.
404RESOURCE_NOT_FOUND: no port forwarding rule with this id in your organization, or the id is not a port forwarding rule id (pfr_…). Check the id. NOT_FOUND: port forwarding is not offered on this platform yet.
409INVALID_RESOURCE_STATE: the port forwarding rule cannot do this in its current state, for example while it is being created or deleted. Wait for its current operation to finish, then retry. CONCURRENT_UPDATE: the resource changed while this request was being processed. Retry the request; if it repeats, read the resource first.
422VALIDATION_FAILED with no errors entry: the platform refused the request, for example because the resource has already been deleted. Read the resource to check its state.
429RATE_LIMITED: this API key, verified user or organization used its request budget for the current window, or this address exceeded an IP/failed-auth limit. Wait Retry-After seconds, then retry. For authenticated quota denials, RateLimit-Scope identifies the denying quota and RateLimit-Reset reports its remaining window in seconds.
503SERVICE_UNAVAILABLE: request quota storage is unavailable. Wait a few seconds, then retry. PROVISIONING_UNAVAILABLE: the provisioning service is temporarily unavailable. Wait a few seconds, then retry with the same Idempotency-Key.

Every code is explained in Errors.

Authorization

API keyrequiredKept in this tab only, sent only to the API.

Path

rule_idrequiredThe rule's id (`aclr_...` for a firewall rule, `pfr_...` for a port forwarding rule).

Idempotency

Idempotency-KeyrequiredResend with the same key to retry safely.

This is a real request. It changes your account and deletes what it names.

curl -X DELETE "https://api.pantechdynamics.com/public/v1/port-forwarding-rules/pfr_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

Response 202

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "pfr_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}