# Public Cloud › Network › Security Groups API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Public Cloud product's sections: https://developers.eu.ovhcloud.com/reference/public-cloud/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 5 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/public-cloud/network/security-groups/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/public-cloud/network/security-groups.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/public-cloud/network/security-groups.json?format=openapi3

## Operations

- `GET /publicCloud/project/{projectId}/securityGroup` — List security groups
- `GET /publicCloud/project/{projectId}/securityGroup/{securityGroupId}` — Get a security group
- `POST /publicCloud/project/{projectId}/securityGroup` — Create a security group
- `DELETE /publicCloud/project/{projectId}/securityGroup/{securityGroupId}` — Delete a security group
- `PUT /publicCloud/project/{projectId}/securityGroup/{securityGroupId}` — Update a security group

## List security groups

`GET /v2/publicCloud/project/{projectId}/securityGroup`

Link: https://developers.eu.ovhcloud.com/reference/public-cloud/network/security-groups/#getSecurityGroups

**Status:** Stable production version  
**IAM actions:** `publicCloudProject:apiovh:securityGroup/get`

Returns the security groups of the project.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |
| `projectId` | path | string | yes | Project ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | publicCloud.securityGroup.SecurityGroup[] | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Computed hash representing the current target specification value |
| `createdAt` | string (date-time) | read-only | Creation date of the security group |
| `currentState` | publicCloud.securityGroup.SecurityGroupCurrentState | read-only | Current state of the security group |
| `currentState.defaultRules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | Default egress rules auto-created by OpenStack |
| `currentState.defaultRules[].description` | string | read-only | Rule description |
| `currentState.defaultRules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.defaultRules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.defaultRules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.defaultRules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.defaultRules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.defaultRules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.defaultRules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.defaultRules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentState.description` | string | read-only | Security group description |
| `currentState.location` | publicCloud.common.Location | read-only | Geographic location |
| `currentState.location.availabilityZone` | string |  | Availability zone within the region |
| `currentState.location.region` | string | yes | Region code |
| `currentState.name` | string | read-only | Security group name |
| `currentState.rules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | User-specified firewall rules |
| `currentState.rules[].description` | string | read-only | Rule description |
| `currentState.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.rules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.rules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.rules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.rules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentTasks` | common.CurrentTask[] | read-only | Ongoing asynchronous tasks related to the security group |
| `currentTasks[].errors` | common.TaskError[] | read-only | Errors that occurred on the task |
| `currentTasks[].errors[].message` | string | read-only | Error description |
| `currentTasks[].id` | string (uuid) | read-only | Identifier of the current task |
| `currentTasks[].link` | string | read-only | Link to the task details |
| `currentTasks[].status` | common.CurrentTaskStatusEnum | read-only | Current global status of the current task — one of `ERROR`, `PENDING`, `RUNNING`, `SCHEDULED`, `WAITING_USER_INPUT` |
| `currentTasks[].type` | string | read-only | Type of the current task |
| `id` | string (uuid) | read-only | Unique identifier of the security group |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Security group readiness in the system — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupTargetSpec | read-only | Last target specification of the security group |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.location` | publicCloud.common.Location | yes | Geographic location |
| `targetSpec.location.availabilityZone` | string |  | Availability zone within the region |
| `targetSpec.location.region` | string | yes | Region code |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |
| `updatedAt` | string (date-time) | read-only | Last update date of the security group |

```json
[
  {
    "checksum": "string",
    "createdAt": "2024-01-01T12:00:00Z",
    "currentState": {
      "defaultRules": [
        {
          "description": "string",
          "direction": "EGRESS",
          "ethernetType": "IPV4",
          "id": "00000000-0000-0000-0000-000000000000",
          "portRangeMax": 0,
          "portRangeMin": 0,
          "protocol": "AH",
          "remoteGroup": {
            "id": "00000000-0000-0000-0000-000000000000"
          },
          "remoteIpPrefix": "192.0.2.0/24"
        }
      ],
      "description": "string",
      "location": {
        "availabilityZone": "string",
        "region": "string"
      },
      "name": "string",
      "rules": [
        {
          "description": "string",
          "direction": "EGRESS",
          "ethernetType": "IPV4",
          "id": "00000000-0000-0000-0000-000000000000",
          "portRangeMax": 0,
          "portRangeMin": 0,
          "protocol": "AH",
          "remoteGroup": {
            "id": "00000000-0000-0000-0000-000000000000"
          },
          "remoteIpPrefix": "192.0.2.0/24"
        }
      ]
    },
    "currentTasks": [
      {
        "errors": [
          {
            "message": "string"
          }
        ],
        "id": "00000000-0000-0000-0000-000000000000",
        "link": "string",
        "status": "ERROR",
        "type": "string"
      }
    ],
    "id": "00000000-0000-0000-0000-000000000000",
    "resourceStatus": "CREATING",
    "targetSpec": {
      "description": "string",
      "location": {
        "availabilityZone": "string",
  …
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/publicCloud/project/{projectId}/securityGroup" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/publicCloud/project/{projectId}/securityGroup")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/publicCloud/project/{projectId}/securityGroup");

print_r($result);
?>
```

## Get a security group

`GET /v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}`

Link: https://developers.eu.ovhcloud.com/reference/public-cloud/network/security-groups/#getSecurityGroup

**Status:** Stable production version  
**IAM actions:** `publicCloudProject:apiovh:securityGroup/get`

Returns the security group, including its rules and default egress rules.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `projectId` | path | string | yes | Project ID |
| `securityGroupId` | path | string (uuid) | yes | Security group ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | publicCloud.securityGroup.SecurityGroup | successful operation |
| 404 | object | Error 404 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Computed hash representing the current target specification value |
| `createdAt` | string (date-time) | read-only | Creation date of the security group |
| `currentState` | publicCloud.securityGroup.SecurityGroupCurrentState | read-only | Current state of the security group |
| `currentState.defaultRules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | Default egress rules auto-created by OpenStack |
| `currentState.defaultRules[].description` | string | read-only | Rule description |
| `currentState.defaultRules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.defaultRules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.defaultRules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.defaultRules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.defaultRules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.defaultRules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.defaultRules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.defaultRules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentState.description` | string | read-only | Security group description |
| `currentState.location` | publicCloud.common.Location | read-only | Geographic location |
| `currentState.location.availabilityZone` | string |  | Availability zone within the region |
| `currentState.location.region` | string | yes | Region code |
| `currentState.name` | string | read-only | Security group name |
| `currentState.rules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | User-specified firewall rules |
| `currentState.rules[].description` | string | read-only | Rule description |
| `currentState.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.rules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.rules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.rules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.rules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentTasks` | common.CurrentTask[] | read-only | Ongoing asynchronous tasks related to the security group |
| `currentTasks[].errors` | common.TaskError[] | read-only | Errors that occurred on the task |
| `currentTasks[].errors[].message` | string | read-only | Error description |
| `currentTasks[].id` | string (uuid) | read-only | Identifier of the current task |
| `currentTasks[].link` | string | read-only | Link to the task details |
| `currentTasks[].status` | common.CurrentTaskStatusEnum | read-only | Current global status of the current task — one of `ERROR`, `PENDING`, `RUNNING`, `SCHEDULED`, `WAITING_USER_INPUT` |
| `currentTasks[].type` | string | read-only | Type of the current task |
| `id` | string (uuid) | read-only | Unique identifier of the security group |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Security group readiness in the system — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupTargetSpec | read-only | Last target specification of the security group |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.location` | publicCloud.common.Location | yes | Geographic location |
| `targetSpec.location.availabilityZone` | string |  | Availability zone within the region |
| `targetSpec.location.region` | string | yes | Region code |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |
| `updatedAt` | string (date-time) | read-only | Last update date of the security group |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "defaultRules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ],
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ]
  },
  "currentTasks": [
    {
      "errors": [
        {
          "message": "string"
        }
      ],
      "id": "00000000-0000-0000-0000-000000000000",
      "link": "string",
      "status": "ERROR",
      "type": "string"
    }
  ],
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
  …
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}");

print_r($result);
?>
```

## Create a security group

`POST /v2/publicCloud/project/{projectId}/securityGroup`

Link: https://developers.eu.ovhcloud.com/reference/public-cloud/network/security-groups/#createSecurityGroup

**Status:** Stable production version  
**IAM actions:** `publicCloudProject:apiovh:securityGroup/create`

Creates a security group with inline rules. OpenStack adds default egress rules automatically.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `projectId` | path | string | yes | Project ID |

### Request body (required)

Type: `publicCloud.securityGroup.SecurityGroupCreation`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupTargetSpec | yes | Desired target specification for the security group to create |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.location` | publicCloud.common.Location | yes | Geographic location |
| `targetSpec.location.availabilityZone` | string |  | Availability zone within the region |
| `targetSpec.location.region` | string | yes | Region code |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |

```json
{
  "targetSpec": {
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ]
  }
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | publicCloud.securityGroup.SecurityGroup | successful operation |
| 409 | object | Error 409 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Computed hash representing the current target specification value |
| `createdAt` | string (date-time) | read-only | Creation date of the security group |
| `currentState` | publicCloud.securityGroup.SecurityGroupCurrentState | read-only | Current state of the security group |
| `currentState.defaultRules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | Default egress rules auto-created by OpenStack |
| `currentState.defaultRules[].description` | string | read-only | Rule description |
| `currentState.defaultRules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.defaultRules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.defaultRules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.defaultRules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.defaultRules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.defaultRules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.defaultRules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.defaultRules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentState.description` | string | read-only | Security group description |
| `currentState.location` | publicCloud.common.Location | read-only | Geographic location |
| `currentState.location.availabilityZone` | string |  | Availability zone within the region |
| `currentState.location.region` | string | yes | Region code |
| `currentState.name` | string | read-only | Security group name |
| `currentState.rules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | User-specified firewall rules |
| `currentState.rules[].description` | string | read-only | Rule description |
| `currentState.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.rules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.rules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.rules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.rules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentTasks` | common.CurrentTask[] | read-only | Ongoing asynchronous tasks related to the security group |
| `currentTasks[].errors` | common.TaskError[] | read-only | Errors that occurred on the task |
| `currentTasks[].errors[].message` | string | read-only | Error description |
| `currentTasks[].id` | string (uuid) | read-only | Identifier of the current task |
| `currentTasks[].link` | string | read-only | Link to the task details |
| `currentTasks[].status` | common.CurrentTaskStatusEnum | read-only | Current global status of the current task — one of `ERROR`, `PENDING`, `RUNNING`, `SCHEDULED`, `WAITING_USER_INPUT` |
| `currentTasks[].type` | string | read-only | Type of the current task |
| `id` | string (uuid) | read-only | Unique identifier of the security group |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Security group readiness in the system — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupTargetSpec | read-only | Last target specification of the security group |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.location` | publicCloud.common.Location | yes | Geographic location |
| `targetSpec.location.availabilityZone` | string |  | Availability zone within the region |
| `targetSpec.location.region` | string | yes | Region code |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |
| `updatedAt` | string (date-time) | read-only | Last update date of the security group |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "defaultRules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ],
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ]
  },
  "currentTasks": [
    {
      "errors": [
        {
          "message": "string"
        }
      ],
      "id": "00000000-0000-0000-0000-000000000000",
      "link": "string",
      "status": "ERROR",
      "type": "string"
    }
  ],
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
  …
```

### Example

```bash
curl -X POST \
  "https://api.eu.ovhcloud.com/v2/publicCloud/project/{projectId}/securityGroup" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: publicCloud.securityGroup.SecurityGroupCreation
result = client.post("/v2/publicCloud/project/{projectId}/securityGroup",
	targetSpec = None, # Desired target specification for the security group to create (type: publicCloud.securityGroup.SecurityGroupTargetSpec)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: publicCloud.securityGroup.SecurityGroupCreation
$result = $ovh->post("/v2/publicCloud/project/{projectId}/securityGroup", array(
	targetSpec => null, // Desired target specification for the security group to create (type: publicCloud.securityGroup.SecurityGroupTargetSpec)
));

print_r($result);
?>
```

## Delete a security group

`DELETE /v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}`

Link: https://developers.eu.ovhcloud.com/reference/public-cloud/network/security-groups/#deleteSecurityGroup

**Status:** Stable production version  
**IAM actions:** `publicCloudProject:apiovh:securityGroup/delete`

Deletes the security group. Deletion is not blocked for a group still attached to interfaces or the project's default group.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `projectId` | path | string | yes | Project ID |
| `securityGroupId` | path | string (uuid) | yes | Security group ID |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | publicCloud.securityGroup.SecurityGroup | successful operation |
| 404 | object | Error 404 response |
| 409 | object | Error 409 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Computed hash representing the current target specification value |
| `createdAt` | string (date-time) | read-only | Creation date of the security group |
| `currentState` | publicCloud.securityGroup.SecurityGroupCurrentState | read-only | Current state of the security group |
| `currentState.defaultRules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | Default egress rules auto-created by OpenStack |
| `currentState.defaultRules[].description` | string | read-only | Rule description |
| `currentState.defaultRules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.defaultRules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.defaultRules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.defaultRules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.defaultRules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.defaultRules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.defaultRules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.defaultRules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentState.description` | string | read-only | Security group description |
| `currentState.location` | publicCloud.common.Location | read-only | Geographic location |
| `currentState.location.availabilityZone` | string |  | Availability zone within the region |
| `currentState.location.region` | string | yes | Region code |
| `currentState.name` | string | read-only | Security group name |
| `currentState.rules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | User-specified firewall rules |
| `currentState.rules[].description` | string | read-only | Rule description |
| `currentState.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.rules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.rules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.rules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.rules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentTasks` | common.CurrentTask[] | read-only | Ongoing asynchronous tasks related to the security group |
| `currentTasks[].errors` | common.TaskError[] | read-only | Errors that occurred on the task |
| `currentTasks[].errors[].message` | string | read-only | Error description |
| `currentTasks[].id` | string (uuid) | read-only | Identifier of the current task |
| `currentTasks[].link` | string | read-only | Link to the task details |
| `currentTasks[].status` | common.CurrentTaskStatusEnum | read-only | Current global status of the current task — one of `ERROR`, `PENDING`, `RUNNING`, `SCHEDULED`, `WAITING_USER_INPUT` |
| `currentTasks[].type` | string | read-only | Type of the current task |
| `id` | string (uuid) | read-only | Unique identifier of the security group |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Security group readiness in the system — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupTargetSpec | read-only | Last target specification of the security group |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.location` | publicCloud.common.Location | yes | Geographic location |
| `targetSpec.location.availabilityZone` | string |  | Availability zone within the region |
| `targetSpec.location.region` | string | yes | Region code |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |
| `updatedAt` | string (date-time) | read-only | Last update date of the security group |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "defaultRules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ],
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ]
  },
  "currentTasks": [
    {
      "errors": [
        {
          "message": "string"
        }
      ],
      "id": "00000000-0000-0000-0000-000000000000",
      "link": "string",
      "status": "ERROR",
      "type": "string"
    }
  ],
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
  …
```

### Example

```bash
curl -X DELETE \
  "https://api.eu.ovhcloud.com/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.delete("/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->delete("/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}");

print_r($result);
?>
```

## Update a security group

`PUT /v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}`

Link: https://developers.eu.ovhcloud.com/reference/public-cloud/network/security-groups/#editSecurityGroup

**Status:** Stable production version  
**IAM actions:** `publicCloudProject:apiovh:securityGroup/edit`

Replaces the security group's name, description and rules as a whole.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `projectId` | path | string | yes | Project ID |
| `securityGroupId` | path | string (uuid) | yes | Security group ID |

### Request body (required)

Type: `publicCloud.securityGroup.SecurityGroupUpdate`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string |  | Optional concurrency-control checksum. When supplied, it must match the resource's current checksum or the request is rejected with a 409 checksum-mismatch conflict. When omitted or empty, the concurrency check is skipped and the write is forced (last-write-wins). |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupUpdateTargetSpec | yes | Desired target specification for the security group |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |

```json
{
  "checksum": "string",
  "targetSpec": {
    "description": "string",
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ]
  }
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | publicCloud.securityGroup.SecurityGroup | successful operation |
| 404 | object | Error 404 response |
| 409 | object | Error 409 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Computed hash representing the current target specification value |
| `createdAt` | string (date-time) | read-only | Creation date of the security group |
| `currentState` | publicCloud.securityGroup.SecurityGroupCurrentState | read-only | Current state of the security group |
| `currentState.defaultRules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | Default egress rules auto-created by OpenStack |
| `currentState.defaultRules[].description` | string | read-only | Rule description |
| `currentState.defaultRules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.defaultRules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.defaultRules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.defaultRules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.defaultRules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.defaultRules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.defaultRules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.defaultRules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentState.description` | string | read-only | Security group description |
| `currentState.location` | publicCloud.common.Location | read-only | Geographic location |
| `currentState.location.availabilityZone` | string |  | Availability zone within the region |
| `currentState.location.region` | string | yes | Region code |
| `currentState.name` | string | read-only | Security group name |
| `currentState.rules` | publicCloud.securityGroup.SecurityGroupStateRule[] | read-only | User-specified firewall rules |
| `currentState.rules[].description` | string | read-only | Rule description |
| `currentState.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | read-only | Traffic flow — one of `EGRESS`, `INGRESS` |
| `currentState.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | read-only | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `currentState.rules[].id` | string (uuid) | read-only | Rule identifier from OpenStack |
| `currentState.rules[].portRangeMax` | integer | read-only | Maximum port number |
| `currentState.rules[].portRangeMin` | integer | read-only | Minimum port number |
| `currentState.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum | read-only | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `currentState.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef | read-only | Reference to remote security group |
| `currentState.rules[].remoteIpPrefix` | ipBlock | read-only | Remote CIDR prefix |
| `currentTasks` | common.CurrentTask[] | read-only | Ongoing asynchronous tasks related to the security group |
| `currentTasks[].errors` | common.TaskError[] | read-only | Errors that occurred on the task |
| `currentTasks[].errors[].message` | string | read-only | Error description |
| `currentTasks[].id` | string (uuid) | read-only | Identifier of the current task |
| `currentTasks[].link` | string | read-only | Link to the task details |
| `currentTasks[].status` | common.CurrentTaskStatusEnum | read-only | Current global status of the current task — one of `ERROR`, `PENDING`, `RUNNING`, `SCHEDULED`, `WAITING_USER_INPUT` |
| `currentTasks[].type` | string | read-only | Type of the current task |
| `id` | string (uuid) | read-only | Unique identifier of the security group |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Security group readiness in the system — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | publicCloud.securityGroup.SecurityGroupTargetSpec | read-only | Last target specification of the security group |
| `targetSpec.description` | string |  | Security group description |
| `targetSpec.location` | publicCloud.common.Location | yes | Geographic location |
| `targetSpec.location.availabilityZone` | string |  | Availability zone within the region |
| `targetSpec.location.region` | string | yes | Region code |
| `targetSpec.name` | string | yes | Security group name |
| `targetSpec.rules` | publicCloud.securityGroup.SecurityGroupTargetRule[] |  | Desired firewall rules |
| `targetSpec.rules[].description` | string |  | Rule description |
| `targetSpec.rules[].direction` | publicCloud.securityGroup.TrafficFlowEnum | yes | Traffic flow — one of `EGRESS`, `INGRESS` |
| `targetSpec.rules[].ethernetType` | publicCloud.securityGroup.EthernetTypeEnum | yes | IP version the rule applies to. A rule written for IPv4 does not affect IPv6 traffic, and the other way round. — one of `IPV4`, `IPV6` |
| `targetSpec.rules[].portRangeMax` | integer |  | Maximum port number |
| `targetSpec.rules[].portRangeMin` | integer |  | Minimum port number |
| `targetSpec.rules[].protocol` | publicCloud.securityGroup.ProtocolEnum |  | Network protocol — one of `AH`, `DCCP`, `EGP`, `ESP`, `GRE`, `ICMP`, `ICMPV6`, `IGMP`, `OSPF`, `PGM`, `RSVP`, `SCTP`, … |
| `targetSpec.rules[].remoteGroup` | publicCloud.securityGroup.SecurityGroupRef |  | Reference to remote security group (mutually exclusive with remoteIpPrefix) |
| `targetSpec.rules[].remoteIpPrefix` | ipBlock |  | Remote CIDR prefix (mutually exclusive with remoteGroup) |
| `updatedAt` | string (date-time) | read-only | Last update date of the security group |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "defaultRules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ],
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
        "ethernetType": "IPV4",
        "id": "00000000-0000-0000-0000-000000000000",
        "portRangeMax": 0,
        "portRangeMin": 0,
        "protocol": "AH",
        "remoteGroup": {
          "id": "00000000-0000-0000-0000-000000000000"
        },
        "remoteIpPrefix": "192.0.2.0/24"
      }
    ]
  },
  "currentTasks": [
    {
      "errors": [
        {
          "message": "string"
        }
      ],
      "id": "00000000-0000-0000-0000-000000000000",
      "link": "string",
      "status": "ERROR",
      "type": "string"
    }
  ],
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "description": "string",
    "location": {
      "availabilityZone": "string",
      "region": "string"
    },
    "name": "string",
    "rules": [
      {
        "description": "string",
        "direction": "EGRESS",
  …
```

### Example

```bash
curl -X PUT \
  "https://api.eu.ovhcloud.com/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: publicCloud.securityGroup.SecurityGroupUpdate
result = client.put("/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}",
	checksum = None, # Optional concurrency-control checksum. When supplied, it must match the resource's current checksum or the request is rejected with a 409 checksum-mismatch conflict. When omitted or empty, the concurrency check is skipped and the write is forced (last-write-wins). (type: string, nullable)
	targetSpec = None, # Desired target specification for the security group (type: publicCloud.securityGroup.SecurityGroupUpdateTargetSpec)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: publicCloud.securityGroup.SecurityGroupUpdate
$result = $ovh->put("/v2/publicCloud/project/{projectId}/securityGroup/{securityGroupId}", array(
	checksum => null, // Optional concurrency-control checksum. When supplied, it must match the resource's current checksum or the request is rejected with a 409 checksum-mismatch conflict. When omitted or empty, the concurrency check is skipped and the write is forced (last-write-wins). (type: string, nullable)
	targetSpec => null, // Desired target specification for the security group (type: publicCloud.securityGroup.SecurityGroupUpdateTargetSpec)
));

print_r($result);
?>
```