---
title: "Create VPC"
method: POST
path: "/v2/org/{org}/nico/vpc"
tags: ["VPC"]
---

# Create VPC

`POST /v2/org/{org}/nico/vpc`

Create a VPC for the org.

Org must have a Tenant entity. User must have authorization role with `TENANT_ADMIN` suffix.

When `slaacEnabled` is true, REST reads `vpcSlaac` from the latest successfully stored configuration inventory for the selected Site before persisting the VPC. Periodic Site inventory reports whether Core supports this feature, so the stored value can lag a Core rollout. False or missing `vpcSlaac` returns 412 before REST persistence or workflow dispatch. This flag reports Core support only; it does not verify DPU agent versions. When a new API server release is deployed, DPU agents roll forward, and instance network configuration may fail transiently until eligible agents converge. Core can also return 412 after dispatch for another create prerequisite. Failure to resolve the Site client or persist the VPC returns 500, rolls back the REST transaction, and does not request a remote create. An error returned while starting the workflow also returns 500 and may leave remote acceptance unknown. After the start request, an unavailable result returns 503, while a workflow wait timeout returns 500 and triggers an attempted workflow termination. Errors while starting or waiting for the workflow roll back the REST transaction, but do not guarantee that Core did not create the VPC; a later inventory reconciliation may recreate the REST record.

Safe recovery from an ambiguous create result requires supplying a stable `id` in the original request. After an ambiguous error while starting the workflow or after dispatch, callers should allow inventory reconciliation time, then retrieve that `id`. If the VPC is found, do not retry. If no record is found, reuse the same `id` for any retry; reusing the ID prevents a second Core VPC record, but the retry itself is not guaranteed to succeed and can return 409 if reconciliation completes concurrently.

## Request body

- VpcCreateRequest — Request data to create a VPC
  - `id` string, uuid — Optional user-specified UUID for the VPC
  - `name` string, required — Name of the VPC
  - `description` string, nullable — Optional description for the VPC
  - `siteId` string, uuid, required — ID of the Site where the VPC should be created
  - `networkVirtualizationType` 'ETHERNET_VIRTUALIZER' | 'FNN' | 'FLAT', nullable — Network virtualization type of the VPC. If no value is specified, then defaults to `FNN` if Site has native networking enabled, or `ETHERNET_VIRTUALIZER` if native networking is disabled. Flat VPCs hold instances on zero-DPU hosts (or hosts with their DPU in NIC mode) and are never auto-selected -- `FLAT` must be specified explicitly.
  - `slaacEnabled` boolean — When true, Core allocates a `/64` to each instance interface that includes IPv6 and retains the prefix without assigning a concrete IPv6 host address. It is supported only for FNN VPCs and fixed during creation. False or omission disables SLAAC. Before persistence, REST requires `vpcSlaac` in the latest successfully stored configuration inventory for the selected Site. Periodic Site inventory reports whether Core supports this feature, so the stored value can lag a Core rollout. False or missing `vpcSlaac` returns 412 before REST persistence or workflow dispatch. This flag does not verify DPU agent versions. When a new API server release is deployed, DPU agents roll forward, and instance network configuration may fail transiently until eligible agents converge. NICo does not yet configure router advertisements (RAs); that support is tracked by https://github.com/NVIDIA/infra-controller/issues/2398.
  - `routingProfile` string, nullable — Specify routing profile for the VPC. Only supported when `networkVirtualizationType` is set to `FNN`, or when `networkVirtualizationType` is omitted and Site has Native Networking enabled. Requires Tenant to have elevated privilege. Current accepted values are `privileged-internal`, `internal`, and `external`.
  - `routingProfileOverrides` VpcRoutingProfileOverrides — Presence-aware routing-profile properties set directly on a VPC. Each present property replaces the corresponding named-profile value; omitted properties inherit from that profile.
    - `routeTargetImports` VpcRouteTarget[], nullable — Route targets imported into the VPC. An empty array overrides the named profile with no imports.
      - `asn` integer — Autonomous system number.
      - `vni` integer — Route-target VNI.
    - `routeTargetsOnExports` VpcRouteTarget[], nullable — Route targets attached to VPC exports. An empty array overrides the named profile with no export targets.
      - `asn` integer — Autonomous system number.
      - `vni` integer — Route-target VNI.
    - `leakDefaultRouteFromUnderlay` boolean, nullable — Whether the underlay default route is leaked into the VPC.
    - `leakTenantHostRoutesToUnderlay` boolean, nullable — Whether tenant host routes are leaked into the underlay.
    - `tenantLeakCommunitiesAccepted` boolean, nullable — Whether tenant-supplied route-leak communities are honored.
    - `acceptedLeaksFromUnderlay` string[], nullable — IPv4 or IPv6 CIDR prefixes allowed to leak from the underlay. An empty array disables explicitly accepted leaks.
    - `allowedAnycastPrefixes` string[], nullable — IPv4 or IPv6 CIDR prefixes tenant hosts may announce as anycast routes. An empty array disables anycast announcements.
  - `networkSecurityGroupId` string, nullable — ID of the Network Security Group to attach to the VPC
  - `vni` integer, nullable — Explicitly requested VNI for the VPC
  - `nvLinkLogicalPartitionId` string, uuid, nullable — ID of the default NVLink Logical Partition that GPUs for all Instances in the VPC will attach to
  - `labels` Labels

## Response `201`

Created

- VPC — VPCs are grouping constructs that bind resources together
  - `id` string, uuid — ID of the VPC
  - `name` string — Name of the VPC
  - `description` string, nullable — Description of the VPC, can be empty
  - `org` string — Organization the VPC belongs to
  - `tenantId` string, uuid — ID of the Tenant the VPC belongs to
  - `siteId` string, uuid — ID of the Site the VPC belongs to
  - `controllerVpcId` string, uuid, nullable — Legacy attribute, contains the same value as ID
  - `networkVirtualizationType` 'ETHERNET_VIRTUALIZER' | 'FNN' | 'FLAT', nullable — Network virtualization type of the VPC. Flat VPCs hold instances on zero-DPU hosts (or hosts with their DPU in NIC mode); their interfaces are bound to underlay (HostInband) network segments and NICo does not drive their data plane.
  - `slaacEnabled` boolean — Whether this VPC uses SLAAC allocation mode for instance IPv6 interfaces. When true, Core allocates a `/64` to each interface that includes IPv6 and retains the prefix without assigning a concrete IPv6 host address. This value is fixed when the VPC is created. NICo does not yet configure router advertisements (RAs); that support is tracked by https://github.com/NVIDIA/infra-controller/issues/2398.
  - `routingProfile` string, nullable — Routing profile type for the VPC. Populated when Site has Native Networking enabled and network virtualization type is `FNN`.
  - `routingProfileOverrides` VpcRoutingProfileOverrides — Presence-aware routing-profile properties set directly on a VPC. Each present property replaces the corresponding named-profile value; omitted properties inherit from that profile.
    - `routeTargetImports` VpcRouteTarget[], nullable — Route targets imported into the VPC. An empty array overrides the named profile with no imports.
      - `asn` integer — Autonomous system number.
      - `vni` integer — Route-target VNI.
    - `routeTargetsOnExports` VpcRouteTarget[], nullable — Route targets attached to VPC exports. An empty array overrides the named profile with no export targets.
      - `asn` integer — Autonomous system number.
      - `vni` integer — Route-target VNI.
    - `leakDefaultRouteFromUnderlay` boolean, nullable — Whether the underlay default route is leaked into the VPC.
    - `leakTenantHostRoutesToUnderlay` boolean, nullable — Whether tenant host routes are leaked into the underlay.
    - `tenantLeakCommunitiesAccepted` boolean, nullable — Whether tenant-supplied route-leak communities are honored.
    - `acceptedLeaksFromUnderlay` string[], nullable — IPv4 or IPv6 CIDR prefixes allowed to leak from the underlay. An empty array disables explicitly accepted leaks.
    - `allowedAnycastPrefixes` string[], nullable — IPv4 or IPv6 CIDR prefixes tenant hosts may announce as anycast routes. An empty array disables anycast announcements.
  - `effectiveRoutingProfile` VpcEffectiveRoutingProfile — Fully resolved routing profile computed by Core from the named profile and the VPC overrides.
    - `routeTargetImports` VpcRouteTarget[], required
      - `asn` integer — Autonomous system number.
      - `vni` integer — Route-target VNI.
    - `routeTargetsOnExports` VpcRouteTarget[], required
      - `asn` integer — Autonomous system number.
      - `vni` integer — Route-target VNI.
    - `leakDefaultRouteFromUnderlay` boolean, required
    - `leakTenantHostRoutesToUnderlay` boolean, required
    - `tenantLeakCommunitiesAccepted` boolean, required
    - `acceptedLeaksFromUnderlay` string[], required
    - `allowedAnycastPrefixes` string[], required
    - `internal` boolean, required — Operator-controlled internal-routing classification inherited from the named profile.
    - `accessTier` integer, required — Operator-controlled access tier inherited from the named profile.
  - `requestedVni` integer, nullable — Explicitly requested VNI for the VPC if one was requested at creation time
  - `vni` integer, nullable — Active VNI assigned to the VPC
  - `networkSecurityGroupId` string, nullable — ID of the Network Security Group attached to the VPC
  - `networkSecurityGroupPropagationDetails` NetworkSecurityGroupPropagationDetails — The Network Security Group propagation details for a VPC or Instance
    - `objectId` string, uuid — The ID of the object (VPC/Instance etc.)
    - `detailedStatus` 'None' | 'Partial' | 'Full' | 'Unknown' | 'Error' — The detailed propagation status that was actually returned from NICo
    - `status` 'Synchronizing' | 'Synchronized' | 'Error' — Status values for Network Security Group propagation
    - `details` string, nullable — Additional details for the status
    - `unpropagatedInstanceIds` string[] — IDs of Instances associated with the object that have not yet updated their Network Security Group rules
    - `relatedInstanceIds` string[] — IDs of the instances involved in determining the propagation status
    - `deprecations` Deprecation[] — Deprecations active for this resource. Returned only if there are active deprecations.
      - `attribute` string, nullable — Name of the attribute that is deprecated. Omitted if queryParam or endpoint is being deprecated.
      - `queryParam` string, nullable — Query parameter that is deprecated. Omitted if attribute or endpoint is being deprecated.
      - `endpoint` string, nullable — API endpoint that is deprecated. Omitted if attribute or queryParam is being deprecated.
      - `replacedBy` string, nullable — Name of the attribute, query parameter, or endpoint that replaces the deprecated item. Omitted if no replacement is available.
      - `takeActionBy` string, date-time — Date/time by which clients should migrate away from the deprecated API surface
      - `notice` string — Message describing the deprecation
  - `nvLinkLogicalPartitionId` string, uuid, nullable — ID of the default NVLink Logical Partition that GPUs for all Instances in the VPC will attach to
  - `labels` Labels
  - `status` 'Pending' | 'Provisioning' | 'Ready' | 'Configuring' | 'Deleting' | 'Error' — Status values for VPC objects
  - `statusHistory` StatusDetail[] — History of status changes for the VPC
    - `status` string — State of the associated entity at a particular time
    - `message` string, nullable — Description of the state and cause/remedy in case of error
    - `created` string, date-time — Date/time when the associated entity assumed the status
    - `updated` string, date-time — Date/time when the associated entity was last observed with this status
  - `created` string, date-time — Date/time when VPC was created
  - `updated` string, date-time — Date/time when VPC was last updated

## Other responses

- `400` — Error response when request data cannot be validated
- `403` — Error response when user is not authorized to call an endpoint or retrieve/modify objects
- `409` — A VPC with the requested `id` or `name` already exists. This can also occur when inventory reconciliation completes before an ambiguous create is retried.
- `412` — The latest successfully stored configuration inventory for the selected Site does not report Core support for SLAAC, or Core rejects another create prerequisite. The inventory check fails before REST persistence or workflow dispatch; a Core rejection occurs after dispatch and the REST transaction is rolled back.
- `500` — The API encountered an internal error resolving the selected Site client, persisting the VPC, starting the create workflow, or waiting for the workflow result. A failure before the workflow start request rolls back the REST transaction and no remote create is requested. An error returned while starting the workflow or waiting for its result also rolls back the REST transaction, but remote acceptance or creation may be unknown; a wait timeout triggers an attempted workflow termination.
- `503` — Core or the selected Site Agent returned unavailable after the create workflow was dispatched. REST rolls back the transaction in progress, but the outcome in Core may be unknown.

---

[API](https://skmtc.net/nvidia/apis/nvidia-infra-controller-rest-api.md) · [All operations](https://skmtc.net/nvidia/apis/nvidia-infra-controller-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/nvidia/nvidia-infra-controller-rest-api/revisions/e724745d8b90/schema)