---
title: "Create Network Security Group"
method: POST
path: "/v2/org/{org}/nico/network-security-group"
tags: ["Network Security Group"]
---

# Create Network Security Group

`POST /v2/org/{org}/nico/network-security-group`

Create a Network Security Group for Tenant.

Org must have a Tenant entity. User must have authorization role with `TENANT_ADMIN` suffix.

## Request body

- NetworkSecurityGroupCreateRequest — Request data to create a Network Security Group
  - `id` string, uuid — Optional user-specified UUID for the Network Security Group
  - `name` string, required — Name of the Network Security Group
  - `description` string, nullable — Description of the Network Security Group
  - `siteId` string, uuid, required — ID of the Site
  - `statefulEgress` boolean — Egress rules with protocol and destination ports defined but without source ports defined should automatically be made stateful.
  - `rules` NetworkSecurityGroupRule[] — Rules that belong to the Network Security Group
    - `name` string, nullable — Name of the Network Security Group rule
    - `direction` 'INGRESS' | 'EGRESS', required — Traffic direction the rule applies to
    - `sourcePortRange` string, nullable — Source port or port range matched by the rule
    - `destinationPortRange` string, nullable — Destination port or port range matched by the rule
    - `protocol` 'TCP' | 'UDP' | 'ICMP' | 'ICMP6' | 'ANY', required — Network protocol matched by the rule
    - `action` 'PERMIT' | 'DENY', required — Action applied when traffic matches the rule
    - `priority` integer — Rule priority used to order evaluation
    - `sourcePrefix` string, required — Source CIDR prefix matched by the rule
    - `destinationPrefix` string, required — Destination CIDR prefix matched by the rule
  - `labels` Labels

## Response `201`

Created

- NetworkSecurityGroup — Network Security Group is an aggregate of security policies
  - `id` string — Unique UUID v4 identifier for the Network Security Group
  - `name` string — Name of the Network Security Group
  - `description` string, nullable — Description of the Network Security Group
  - `siteId` string, uuid — ID of the Site
  - `tenantId` string, uuid — ID of the Tenant
  - `status` 'Pending' | 'Provisioning' | 'Ready' | 'Deleting' | 'Error' — Status values for Network Security Group objects
  - `statusHistory` StatusDetail[] — Chronological status history for the Network Security Group
    - `status` string — State of the associated entity at a particular time
    - `message` string, nullable — Description of the state and cause/remedy in case of error
    - `created` string, date-time — Date/time when the associated entity assumed the status
    - `updated` string, date-time — Date/time when the associated entity was last observed with this status
  - `statefulEgress` boolean — StatefulEgress defines whether a Network Security Group's egress rules will be automatically stateful
  - `rules` NetworkSecurityGroupRule[] — Rules that belong to the Network Security Group
    - `name` string, nullable — Name of the Network Security Group rule
    - `direction` 'INGRESS' | 'EGRESS', required — Traffic direction the rule applies to
    - `sourcePortRange` string, nullable — Source port or port range matched by the rule
    - `destinationPortRange` string, nullable — Destination port or port range matched by the rule
    - `protocol` 'TCP' | 'UDP' | 'ICMP' | 'ICMP6' | 'ANY', required — Network protocol matched by the rule
    - `action` 'PERMIT' | 'DENY', required — Action applied when traffic matches the rule
    - `priority` integer — Rule priority used to order evaluation
    - `sourcePrefix` string, required — Source CIDR prefix matched by the rule
    - `destinationPrefix` string, required — Destination CIDR prefix matched by the rule
  - `ruleCount` integer — Number of rules in the Network Security Group
  - `attachmentStats` NetworkSecurityGroupStats — Detailed attachment statistics for a Network Security Group
    - `inUse` boolean — Whether the Network Security Group is directly attached to at least one object
    - `directVpcAttachmentCount` integer — Number of VPCs that directly attach this Network Security Group
    - `directInstanceAttachmentCount` integer — Number of Instances that directly attach this Network Security Group
    - `totalDirectAttachmentCount` integer — Total number of objects that directly attach this Network Security Group
  - `labels` Labels
  - `created` string, date-time — Date/time when the Network Security Group was created
  - `updated` string, date-time — Date/time when the Network Security Group was last updated

## Other responses

- `400` — Error response when request data cannot be validated
- `403` — Error response when user is not authorized to call an endpoint or retrieve/modify objects
- `404` — Response when the API handler encounters an unexpected error
- `412` — Response when the API handler encounters an unexpected error
- `500` — Response when the API handler encounters an unexpected error
- `501` — Response when the API handler encounters an unexpected error

## Changes

- **2026-08-19** `484497856a94` — 2 warning
  - the `rules/items/priority` request property's max was set to `60000.00`
  - the `rules/items/priority` request property's min was set to `0.00`
- **2026-06-29** `b59a9fb65be8` — 1 info
  - added the new optional request property `id`
- **2026-06-11** `bc7cf73fe604` — 1 warning, 3 info
  - added the new `ICMP6` enum value to the `rules/items/protocol` response property for the response status `201`
  - added the new `ICMP6` enum value to the request property `rules/items/protocol`
  - added the optional property `attachmentStats` to the response with the `201` status
  - added the optional property `ruleCount` to the response with the `201` status

[Change history](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api/changes/v2/org/:org/nico/network-security-group/post.md)

---

[API](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api.md) · [All operations](https://skmtc.dev/nvidia/apis/nvidia-infra-controller-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nvidia/nvidia-infra-controller-rest-api/revisions/2096eb1db2c1/schema)