---
title: "Update a subnet"
method: PUT
path: "/api/v1/subnets/{id}"
tags: ["Subnets"]
---

# Update a subnet

`PUT /api/v1/subnets/{id}`

Updates subnet properties. If the CIDR is being changed, validates that
all existing ip_addresses on this subnet have IPs within the new CIDR range.

## Path parameters

- `id` string, uuid, required

## Request body

- Subnet
  - `cidr` string, required — Subnet in CIDR notation, IPv4 or IPv6.
  - `description` string, nullable — Free-text notes about the subnet.
  - `name` string, required — Human-facing name for this subnet.
  - `network_id` string, uuid, required — The network this entity belongs to.
  - `source` union, required
    - object
      - `type` 'Manual', required
    - object
      - `type` 'System', required
    - object
      - `type` 'Discovery', required
    - object
      - `details` MatchDetails, required
        - `confidence` 'NotApplicable' | 'Low' | 'Medium' | 'High' | 'Certain', required
        - `reason` union, required — Match reason - either a simple reason string or a container with nested reasons
          - object
            - `data` string, required — Why the service was matched.
            - `type` 'reason', required
          - object
            - `data` unknown[], required — Tuple of [name: string, children: MatchReason[]]
              - …
            - `type` 'container', required
      - `type` 'DiscoveryWithMatch', required
    - object
      - `type` 'Unknown', required
  - `subnet_type` 'Internet' | 'Remote' | 'Gateway' | 'VpnTunnel' | 'Dmz' | 'Lan' | 'WiFi' | 'IoT' | 'Guest' | 'DockerBridge' | 'PodmanBridge' | 'MacVlan' | 'IpVlan' | 'Management' | 'Storage' | 'Loopback' | 'Unknown', required
  - `tags` string[], required — Tags assigned to this entity.
  - `virtualization_service_id` string, uuid, nullable, required — The container runtime service that owns this bridge network. Load-bearing for dedup: the same CIDR on two different Docker daemons is two distinct subnets, so bridge rows only merge when this matches as well as the CIDR and network. A foreign key rather than a field inside a JSONB blob because a stale value here is precisely what made a scan add a duplicate bridge row every time (GH #650) — now it cannot be written at all.
  - `created_at` string, date-time, required — When this record was first created.
  - `first_discovery_id` string, uuid, nullable — The discovery that first observed this entity.
  - `id` string, uuid, required — Server-assigned unique identifier.
  - `last_discovery_id` string, uuid, nullable — The most recent discovery that observed this entity.
  - `last_seen_at` string, date-time — When a discovery last observed this entity.
  - `lineage_id` string, uuid, nullable — Stable identifier shared by every revision of the same entity across its history.
  - `updated_at` string, date-time, required — When this record was last modified.
  - `valid_from` string, date-time — Start of the interval this revision was current for (SCD2 history).
  - `valid_to` string, date-time, nullable — End of the interval this revision was current for. `null` while it is the live revision.

## Response `200`

Subnet updated

- ApiResponseSubnet
  - `data` object — The result payload. Omitted on failure.
    - `cidr` string, required — Subnet in CIDR notation, IPv4 or IPv6.
    - `description` string, nullable — Free-text notes about the subnet.
    - `name` string, required — Human-facing name for this subnet.
    - `network_id` string, uuid, required — The network this entity belongs to.
    - `source` union, required
      - object
        - `type` 'Manual', required
      - object
        - `type` 'System', required
      - object
        - `type` 'Discovery', required
      - object
        - `details` MatchDetails, required
          - `confidence` 'NotApplicable' | 'Low' | 'Medium' | 'High' | 'Certain', required
          - `reason` union, required — Match reason - either a simple reason string or a container with nested reasons
            - object
              - …
            - object
              - …
        - `type` 'DiscoveryWithMatch', required
      - object
        - `type` 'Unknown', required
    - `subnet_type` 'Internet' | 'Remote' | 'Gateway' | 'VpnTunnel' | 'Dmz' | 'Lan' | 'WiFi' | 'IoT' | 'Guest' | 'DockerBridge' | 'PodmanBridge' | 'MacVlan' | 'IpVlan' | 'Management' | 'Storage' | 'Loopback' | 'Unknown', required
    - `tags` string[], required — Tags assigned to this entity.
    - `virtualization_service_id` string, uuid, nullable, required — The container runtime service that owns this bridge network. Load-bearing for dedup: the same CIDR on two different Docker daemons is two distinct subnets, so bridge rows only merge when this matches as well as the CIDR and network. A foreign key rather than a field inside a JSONB blob because a stale value here is precisely what made a scan add a duplicate bridge row every time (GH #650) — now it cannot be written at all.
    - `created_at` string, date-time, required — When this record was first created.
    - `first_discovery_id` string, uuid, nullable — The discovery that first observed this entity.
    - `id` string, uuid, required — Server-assigned unique identifier.
    - `last_discovery_id` string, uuid, nullable — The most recent discovery that observed this entity.
    - `last_seen_at` string, date-time — When a discovery last observed this entity.
    - `lineage_id` string, uuid, nullable — Stable identifier shared by every revision of the same entity across its history.
    - `updated_at` string, date-time, required — When this record was last modified.
    - `valid_from` string, date-time — Start of the interval this revision was current for (SCD2 history).
    - `valid_to` string, date-time, nullable — End of the interval this revision was current for. `null` while it is the live revision.
  - `error` string, nullable — Human-readable failure message. Omitted on success.
  - `meta` ApiMeta, required — API metadata included in all responses
    - `api_version` integer, required — API version (integer, increments on breaking changes)
    - `server_version` string, required — Server version (semver)
  - `success` boolean, required — `true` when the request succeeded. `false` responses carry `error` instead of `data`.

## Other responses

- `400` — CIDR change would orphan existing ip_addresses
- `404` — Subnet not found

## Changes

- **2026-08-03** `28e466341947` — 1 breaking, 2 warning, 1 info
  - added the new required request property `allOf[#/components/schemas/SubnetBase]/virtualization_service_id`
  - removed the request property `allOf[#/components/schemas/SubnetBase]/virtualization`
  - removed the optional property `data/allOf[#/components/schemas/SubnetBase]/virtualization` from the response with the `200` status
  - added the required property `data/allOf[#/components/schemas/SubnetBase]/virtualization_service_id` to the response with the `200` status
- **2026-07-29** `51af15be596e` — 3 breaking, 3 info
  - removed `subschema #1, subschema #2` from the `allOf[#/components/schemas/SubnetBase]/source/oneOf[subschema #4: DiscoveryWithMatch]/details/reason` request property `oneOf` list
  - added the pattern `^[0-9A-Fa-f.:]+/\d{1,3}$` to the request property `allOf[#/components/schemas/SubnetBase]/cidr`
  - added `subschema #1: Reason, subschema #2: Container` to the `data/allOf[#/components/schemas/SubnetBase]/source/oneOf[subschema #4: DiscoveryWithMatch]/details/reason` response property `oneOf` list for the response status `200`
  - added `subschema #1: Reason, subschema #2: Container` to the `allOf[#/components/schemas/SubnetBase]/source/oneOf[subschema #4: DiscoveryWithMatch]/details/reason` request property `oneOf` list
  - …2 more
- …earlier changes not shown

[Full history](https://skmtc.dev/scanopy/apis/scanopy-api/changes/api/v1/subnets/:id/put.md)

---

[API](https://skmtc.dev/scanopy/apis/scanopy-api.md) · [All operations](https://skmtc.dev/scanopy/apis/scanopy-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/scanopy/scanopy-api/revisions/d061209476f3/schema)