> ## Documentation Index
> Fetch the complete documentation index at: https://www.cockroachlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Add an egress rule
This endpoint is in **Preview** and subject to change. Refer to the [API support policy](https://www.cockroachlabs.com/docs/stable/api-support-policy) for more details.
## OpenAPI
````yaml /openapi/cloud/2022-09-20.json post /api/v1/clusters/{cluster_id}/networking/egress-rules
openapi: 3.0.0
info:
contact:
email: support@cockroachlabs.com
name: Cockroach Labs Support
url: https://support.cockroachlabs.com
description: >-
This is a preview version of the Cloud API. The interface and output is
subject to change, and there may be bugs.
title: CockroachDB Cloud API
version: '2022-09-20'
servers:
- url: https://cockroachlabs.cloud
security:
- Bearer: []
tags:
- name: CockroachCloud
externalDocs:
description: Use the CockroachDB Cloud API
url: https://www.cockroachlabs.com/docs/cockroachcloud/cloud-api
paths:
/api/v1/clusters/{cluster_id}/networking/egress-rules:
post:
tags:
- CockroachCloud
summary: Add an egress rule
operationId: CockroachCloud_AddEgressRule
parameters:
- name: cluster_id
in: path
description: cluster_id identifies the cluster to which this egress rule applies.
required: true
schema:
type: string
requestBody:
required: true
content:
application/json:
schema:
description: AddEgressRuleRequest is the input for the rpc AddEgressRule().
type: object
properties:
description:
description: >-
description is text that serves to document the rules
purpose.
type: string
destination:
description: >-
destination is the endpoint (or subnetwork if CIDR) to which
traffic is
allowed.
type: string
idempotency_key:
description: >-
idempotency_key uniquely identifies this request. If not
set, it will be
set by the server.
type: string
name:
description: name is the name of the egress rule.
type: string
paths:
description: >-
paths are the allowed URL paths. If empty, all paths are
allowed. Only
valid if Type="FQDN".
type: array
items:
type: string
ports:
description: >-
ports are the allowed ports for TCP protocol. If Empty, all
ports are
allowed.
type: array
items:
type: integer
format: int32
type:
description: >-
type classifies the Destination field. Valid types include:
"FQDN",
"CIDR".
type: string
example:
cluster_id: 35c4abb2-bb66-46d7-afed-25ebef5ed100
description: egress for GCP storage buckets
destination: storage.googleapis.com
name: roach-buckets
paths:
- /customer-managed-bucket-1/*
- /customer-managed-bucket-2/*
ports:
- 443
- 80
type: FQDN
required:
- name
- type
- destination
- description
title: AddEgressRuleRequest
responses:
'200':
description: A successful response.
content:
application/json:
schema:
$ref: '#/components/schemas/AddEgressRuleResponse'
'400':
description: Returned when a request field is invalid.
content:
application/json:
schema: {}
'401':
description: Returned when the token bearer cannot be authenticated.
content:
application/json:
schema: {}
'403':
description: >-
Returned when the user does not have permission to access the
resource.
content:
application/json:
schema: {}
'404':
description: Returned when the resource does not exist.
content:
application/json:
schema: {}
'500':
description: Server error
content:
application/json:
schema: {}
default:
description: An unexpected error response.
content:
application/json:
schema:
$ref: '#/components/schemas/Status'
x-codeSamples:
- lang: curl
source: |-
curl --request POST \
--url https://cockroachlabs.cloud/api/v1/clusters/{cluster_id}/networking/egress-rules \
--header 'Authorization: Bearer REPLACE_BEARER_TOKEN' \
--header 'content-type: application/json' \
--data '{"cluster_id":"35c4abb2-bb66-46d7-afed-25ebef5ed100","description":"egress for GCP storage buckets","destination":"storage.googleapis.com","name":"roach-buckets","paths":["/customer-managed-bucket-1/*","/customer-managed-bucket-2/*"],"ports":[443,80],"type":"FQDN"}'
components:
schemas:
AddEgressRuleResponse:
description: AddEgressRuleResponse is the response message of the AddEgressRule RPC.
type: object
properties:
Rule:
$ref: '#/components/schemas/EgressRule'
required:
- rule
title: AddEgressRuleResponse
Status:
type: object
properties:
code:
type: integer
format: int32
details:
type: array
items:
$ref: '#/components/schemas/Any'
message:
type: string
EgressRule:
description: EgressRule represents a network egress rule.
type: object
properties:
cluster_id:
description: cluster_id identifies the cluster to which this egress rule applies.
type: string
created_at:
description: >-
created_at is the time at which the time at which the egress rule
was
created.
type: string
format: date-time
crl_managed:
description: >-
crl_managed indicates this egress rule is managed by CockroachDB
Cloud
services. This field is set by the server.
type: boolean
description:
description: description is a longer that serves to document the rules purpose.
type: string
destination:
description: >-
destination is the endpoint (or subnetwork if CIDR) to which traffic
is
allowed.
type: string
id:
description: id uniquely identifies this egress rule.
type: string
name:
description: name is the name of the egress rule.
type: string
paths:
description: paths are the allowed URL paths. Only valid if Type="FQDN".
type: array
items:
type: string
ports:
description: >-
ports are the allowed ports for TCP protocol. If Empty, all ports
are
allowed.
type: array
items:
type: integer
format: int32
state:
description: state indicates the state of the egress rule.
type: string
type:
description: |-
type classifies the destination field. Valid types include: "FQDN",
"CIDR".
type: string
required:
- name
- id
- cluster_id
- type
- state
- crl_managed
- destination
- description
title: EgressRule
Any:
description: >-
`Any` contains an arbitrary serialized protocol buffer message along
with a
URL that describes the type of the serialized message.
Protobuf library provides support to pack/unpack Any values in the form
of utility functions or additional generated methods of the Any type.
Example 1: Pack and unpack a message in C++.
Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
...
}
Example 2: Pack and unpack a message in Java.
Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
foo = any.unpack(Foo.class);
}
Example 3: Pack and unpack a message in Python.
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
any.Unpack(foo)
...
Example 4: Pack and unpack a message in Go
foo := &pb.Foo{...}
any, err := ptypes.MarshalAny(foo)
...
foo := &pb.Foo{}
if err := ptypes.UnmarshalAny(any, foo); err != nil {
...
}
The pack methods provided by protobuf library will by default use
'type.googleapis.com/full.type.name' as the type URL and the unpack
methods only use the fully qualified type name after the last '/'
in the type URL, for example "foo.bar.com/x/y.z" will yield type
name "y.z".
JSON
====
The JSON representation of an `Any` value uses the regular
representation of the deserialized, embedded message, with an
additional field `@type` which contains the type URL. Example:
package google.profile;
message Person {
string first_name = 1;
string last_name = 2;
}
{
"@type": "type.googleapis.com/google.profile.Person",
"firstName": ,
"lastName":
}
If the embedded message type is well-known and has a custom JSON
representation, that representation will be embedded adding a field
`value` which holds the custom JSON in addition to the `@type`
field. Example (for message [google.protobuf.Duration][]):
{
"@type": "type.googleapis.com/google.protobuf.Duration",
"value": "1.212s"
}
type: object
properties:
'@type':
description: >-
A URL/resource name that uniquely identifies the type of the
serialized
protocol buffer message. This string must contain at least
one "/" character. The last segment of the URL's path must represent
the fully qualified name of the type (as in
`path/google.protobuf.Duration`). The name should be in a canonical
form
(e.g., leading "." is not accepted).
In practice, teams usually precompile into the binary all types that
they
expect it to use in the context of Any. However, for URLs which use
the
scheme `http`, `https`, or no scheme, one can optionally set up a
type
server that maps type URLs to message definitions as follows:
* If no scheme is provided, `https` is assumed.
* An HTTP GET on the URL must yield a [google.protobuf.Type][]
value in binary format, or produce an error.
* Applications are allowed to cache lookup results based on the
URL, or have them precompiled into a binary to avoid any
lookup. Therefore, binary compatibility needs to be preserved
on changes to types. (Use versioned type names to manage
breaking changes.)
Note: this functionality is not currently available in the official
protobuf release, and it is not used for type URLs beginning with
type.googleapis.com.
Schemes other than `http`, `https` (or the empty scheme) might be
used with implementation specific semantics.
type: string
additionalProperties: {}
securitySchemes:
Bearer:
type: http
scheme: bearer
````