Security groups

A security group is a set of rules shared by every standard instance that uses it. Inbound traffic no rule allows is dropped. Each organization has a default group, used when an instance names none. VPC instances use their subnet's firewall rules instead.

#The security group object

A reusable firewall for standard instances.

#List security groups

Your security groups, newest first, with their rules. Filter by name with q, or by state.

curl "https://api.pantechdynamics.com/public/v1/security-groups" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

{
  "data": [
    {
      "id": "sg_06gk3x9tq7m2v8r4y1c5d0zp8w",
      "name": "web",
      "rules": [
        {
          "direction": "ingress",
          "protocol": "tcp",
          "port_range": "22",
          "cidr": "203.0.113.4/32"
        }
      ],
      "desired_state": "present",
      "observed_state": "active",
      "created_at": "2026-10-03T09:30:00Z",
      "updated_at": "2026-10-03T09:30:00Z"
    }
  ],
  "next_cursor": "eyJhdCI6IjIwMjYtMTAtMDNUMDk6MzA6MDBaIiwiaWQiOiJ2bV8wNmdrIn0"
}

#Create a security group

Creates a reusable firewall for standard instances in a security-group zone (af-abj-1). Each rule has a direction, a protocol (tcp, udp, icmp or all), a port_range for tcp/udp and one IPv4 cidr. Inbound traffic no rule allows is dropped. A group needs at least one rule.

The name is unique among your live security groups; a deleted group frees its name. Attach the group to an instance at create (security_group_id) or with Change an instance's security group, or to a database as a source of allowed address ranges.

Prefer narrow sources: a rule from 0.0.0.0/0 stops an instance from attaching a private database network interface.

Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason. The group's id is the operation's resource_id.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

curl -X POST "https://api.pantechdynamics.com/public/v1/security-groups" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "web",
    "rules": [
      {
        "direction": "ingress",
        "protocol": "tcp",
        "port_range": "443",
        "cidr": "0.0.0.0/0"
      },
      {
        "direction": "ingress",
        "protocol": "tcp",
        "port_range": "22",
        "cidr": "203.0.113.4/32"
      }
    ]
  }'

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "sg_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

#Get a security group

One security group and its rules.

curl "https://api.pantechdynamics.com/public/v1/security-groups/sg_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY"

{
  "id": "sg_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "name": "web",
  "rules": [
    {
      "direction": "ingress",
      "protocol": "tcp",
      "port_range": "22",
      "cidr": "203.0.113.4/32"
    }
  ],
  "desired_state": "present",
  "observed_state": "active",
  "created_at": "2026-10-03T09:30:00Z",
  "updated_at": "2026-10-03T09:30:00Z"
}

#Replace a security group's rules

Replaces the group's complete rule list, for every instance using it. Each rule has a direction, a protocol (tcp, udp, icmp or all), a port_range for tcp/udp and one IPv4 cidr. Inbound traffic no rule allows is dropped. A group needs at least one rule.

Databases the group is attached to are updated automatically; a list that would give one of them more than 1024 address ranges is refused. While an instance using the group has a private database network interface, an ingress rule whose source overlaps the private network's range (10.250.0.0/20), 0.0.0.0/0 included, is refused.

Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

curl -X PUT "https://api.pantechdynamics.com/public/v1/security-groups/sg_06gk3x9tq7m2v8r4y1c5d0zp8w/rules" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
    "rules": [
      {
        "direction": "ingress",
        "protocol": "tcp",
        "port_range": "22",
        "cidr": "203.0.113.4/32"
      },
      {
        "direction": "ingress",
        "protocol": "tcp",
        "port_range": "5432",
        "cidr": "10.0.1.0/24"
      }
    ]
  }'

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "sg_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}

#Delete a security group

Deletes a security group. It must not be used by any instance. The organization's default group cannot be deleted. A group attached to a database cannot be deleted either: detach it with PUT /public/v1/databases/{database_id}/security-groups first.

Returns 202 Accepted with an operation_id (also in the Location header). The change happens in the background: poll GET /public/v1/operations/{operation_id}, or stream /events, until status is succeeded or failed; a failed operation carries a stable failure.code and a readable failure.reason.

Send an Idempotency-Key. A retry with the same key returns the original operation instead of making the change twice.

Scope: write. Destructive: an AI app's key also needs delete.

curl -X DELETE "https://api.pantechdynamics.com/public/v1/security-groups/sg_06gk3x9tq7m2v8r4y1c5d0zp8w" \
  -H "Authorization: Bearer $PANTECH_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

{
  "operation_id": "op_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "resource_id": "sg_06gk3x9tq7m2v8r4y1c5d0zp8w",
  "status": "submitting"
}