Network API

Creates an isolated regional network without user subnets or external routes.

Returns 202 with the network ID and realization operation. A created network has no user subnet until one is explicitly added. It has no external default route merely because it exists.

Returns configuration, subnet IDs, dependency counts, applied revision, health, and its ETag. Requires networks:read.

Lists networks using the selected region and label filters.

The list supports region_id and label filters.

Updates mutable network configuration.

Requires networks:write and If-Match. Name, DNS settings, and labels are writable. Omitted fields remain unchanged; supplied arrays replace their whole value. Region changes and inline mutation of child resources are rejected.

Creates a peering request awaiting the remote project's approval.

Accepts remote_network_id and export_subnet_ids. It returns 201 with a pending connection, the proposed export set, and the remote project approval requirement.

Accepts the proposed peering and requests route realization.

Requires the current peering ETag in If-Match and the accepting side's export_subnet_ids. The caller must have peer administration permission on that side. Successful acceptance returns 202 and a route-realization operation.

Overlapping exported ranges return 422 overlapping_prefix. A rejected or pending request installs no forwarding path. A permitted peer route remains subject to both projects' firewall policies.

Withdraws that connection and returns 202. Either authorized side can request withdrawal. The operation reports applied state separately on both sides; existing sessions can break.

Deletes a network after its dependencies are removed.

Deleting a network requires its current ETag and no remaining interfaces, subnets, services, gateways, or connections. Dependencies return 409 network_in_use with blocking IDs. Accepted network removal returns 202.

See network peering for non-transitive routing, Subnet API for ranges, and Interface API for guest attachments.

Creates VPC policy membership for permitted regional networks.

Accepts a name and permitted regional network_ids. It records policy membership without creating inter-segment forwarding. Connection policies are explicit child resources and require the VPC ETag for changes.

Requests a private connection with an approved routing definition.

Accepts the regional network, circuit or gateway reference, approved prefix set, and supported static or BGP routing definition. Accepted provisioning returns 202; physical handoff and route activation have separate observed states.

These resources require networks:write plus regional connectivity permission. Overlapping exported ranges and unsupported transit return 422 without a new forwarding path. See VPC segments and private connectivity.