---
title: "Create security group"
method: POST
path: "/api/v1/security-groups"
tags: ["Networking"]
---

# Create security group

`POST /api/v1/security-groups`

Create a new security group with a set of inbound/outbound rules.

Optionally seed from a template (`template_id` from `GET /api/v1/security-groups/templates`) — its rules are copied as the starting set, then merged with any explicit `rules` you pass.

## Headers

- `X-Project-ID` string, uuid, required

## Request body

- CreateSecurityGroupRequest
  - `name` string, required
  - `description` string
  - `template_id` string — Seed from a template. Template rules are copied, then merged with any explicit `rules`.
  - `rules` SecurityGroupRule[]
    - `protocol` 'TCP' | 'UDP' | 'ICMP' | 'ICMPV6' | 'IPSEC' | 'ALL', required — Network protocol.
    - `rule_type` 'INBOUND' | 'OUTBOUND', required — Direction of traffic.
    - `range` string — Port or port range. Single port (`80`) or range (`8000:9000`). Empty for ICMP/ALL.
    - `ip` string — Source/destination IP for the rule. Empty means any.
    - `size` integer — CIDR block size (e.g. `24` for /24). Used with `ip` to allow a network range.
    - `icmp_type` integer — ICMP message type (only for ICMP/ICMPV6 protocols).

## Response `201`

Security group created

- object
  - `success` boolean
  - `data` SecurityGroup — A security group — a named set of inbound/outbound rules that can be attached to VM NICs.
    - `id` string, uuid, required — Security group ID.
    - `name` string, required
    - `description` string
    - `rules` SecurityGroupRule[], required
      - `protocol` 'TCP' | 'UDP' | 'ICMP' | 'ICMPV6' | 'IPSEC' | 'ALL', required — Network protocol.
      - `rule_type` 'INBOUND' | 'OUTBOUND', required — Direction of traffic.
      - `range` string — Port or port range. Single port (`80`) or range (`8000:9000`). Empty for ICMP/ALL.
      - `ip` string — Source/destination IP for the rule. Empty means any.
      - `size` integer — CIDR block size (e.g. `24` for /24). Used with `ip` to allow a network range.
      - `icmp_type` integer — ICMP message type (only for ICMP/ICMPV6 protocols).
    - `vm_count` integer — Number of VM NICs currently using this security group.
    - `project_id` string, uuid
    - `created_at` string, date-time
    - `updated_at` string, date-time

## Other responses

- `400` — Invalid request parameters
- `401` — Authentication required

## Changes

- **2026-05-06** `9e13a6e23934` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/rafftechnologies/apis/raff-api/changes/api/v1/security-groups/post.md)

---

[API](https://skmtc.dev/rafftechnologies/apis/raff-api.md) · [All operations](https://skmtc.dev/rafftechnologies/apis/raff-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/rafftechnologies/raff-api/revisions/9e13a6e23934/schema)