---
title: "POST /v1/{+parent}/networkPolicies"
method: POST
path: "/v1/{+parent}/networkPolicies"
tags: ["projects"]
---

# POST /v1/{+parent}/networkPolicies

`POST /v1/{+parent}/networkPolicies`

Creates a new network policy in a given VMware Engine network of a project and location (region). A new network policy cannot be created if another network policy already exists in the same scope.

## Path parameters

- `parent` string, required

## Query parameters

- `networkPolicyId` string
- `requestId` string
- `validateOnly` boolean

## Request body

- NetworkPolicy — Represents a network policy resource. Network policies are regional resources. You can use a network policy to enable or disable internet access and external IP access. Network policies are associated with a VMware Engine network, which might span across regions. For a given region, a network policy applies to all private clouds in the VMware Engine network associated with the policy.
  - `vmwareEngineNetwork` string — Optional. The relative resource name of the VMware Engine network. Specify the name in the following form: `projects/{project}/locations/{location}/vmwareEngineNetworks/{vmware_engine_network_id}` where `{project}` can either be a project number or a project ID.
  - `externalIp` NetworkService — Represents a network service that is managed by a `NetworkPolicy` resource. A network service provides a way to control an aspect of external access to VMware workloads. For example, whether the VMware workloads in the private clouds governed by a network policy can access or be accessed from the internet.
    - `state` 'STATE_UNSPECIFIED' | 'UNPROVISIONED' | 'RECONCILING' | 'ACTIVE' — Output only. State of the service. New values may be added to this enum when appropriate.
    - `enabled` boolean — True if the service is enabled; false otherwise.
  - `uid` string — Output only. System-generated unique identifier for the resource.
  - `createTime` string, google-datetime — Output only. Creation time of this resource.
  - `internetAccess` NetworkService — Represents a network service that is managed by a `NetworkPolicy` resource. A network service provides a way to control an aspect of external access to VMware workloads. For example, whether the VMware workloads in the private clouds governed by a network policy can access or be accessed from the internet.
    - `state` 'STATE_UNSPECIFIED' | 'UNPROVISIONED' | 'RECONCILING' | 'ACTIVE' — Output only. State of the service. New values may be added to this enum when appropriate.
    - `enabled` boolean — True if the service is enabled; false otherwise.
  - `edgeServicesCidr` string — Required. IP address range in CIDR notation used to create internet access and external IP access. An RFC 1918 CIDR block, with a "/26" prefix, is required. The range cannot overlap with any prefixes either in the consumer VPC network or in use by the private clouds attached to that VPC network.
  - `name` string — Output only. Identifier. The resource name of this network policy. Resource names are schemeless URIs that follow the conventions in https://cloud.google.com/apis/design/resource_names. For example: `projects/my-project/locations/us-central1/networkPolicies/my-network-policy`
  - `updateTime` string, google-datetime — Output only. Last update time of this resource.
  - `vmwareEngineNetworkCanonical` string — Output only. The canonical name of the VMware Engine network in the form: `projects/{project_number}/locations/{location}/vmwareEngineNetworks/{vmware_engine_network_id}`
  - `description` string — Optional. User-provided description for this network policy.

## Response `200`

Successful response

---

[API](https://skmtc.dev/google/apis/vmwareengine.md) · [All operations](https://skmtc.dev/google/apis/vmwareengine/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/google/vmwareengine/revisions/23816cc0f25a/schema)