Create a security group
Updated at：2025-10-20
Use this API to create security groups and configure security group rules.
- Within the same security group, rules are uniquely identified based on the combination of remark, protocol, direction, portRange, sourceIp|destIp, and sourceGroupId|destGroupId. Adding duplicate rules will result in a 409 error.
- Protocol options are tcp, udp, and icmp. By default, this field is left empty, meaning all protocols are allowed.
Request structure
Plain Text
1POST /v{version}/securityGroup?clientToken={clientToken} HTTP/1.1
2Host: bcc.bj.baidubce.com
3Authorization: authorization stringRequest headers
There are no special headers required beyond the common headers.
Request parameters
| Parameter name | Types | Whether required | Parameter location | Description |
|---|---|---|---|---|
| version | String | Yes | URL parameter | API version number |
| clientToken | String | Yes | Query | Idempotency Token, which is an ASCII string with a length not exceeding 64 bits, see details in [ClientToken Idempotency](BCC/API Reference/General Description.md#Idempotence). |
| name | String | Yes | RequestBody | Specify the name of the security group to be created. It supports uppercase and lowercase letters, numbers, Chinese characters, and special characters -\ _ /, must start with a letter, and can be between 1-65 characters long. |
| vpcId | String | No | RequestBody | The vpcId to which the security group belongs. |
| desc | String | No | RequestBody | Description information of the created security group |
| rules | List<[SecurityGroupRuleModel](BCC/API Reference/Appendix.md#SecurityGroupRuleModel)> | Yes | RequestBody | List of security group rules bound when creating the security group |
| tags | List<[Tag](BCC/Tag Service API Reference/Appendix 1.md#Tag)> | No | RequestBody | List of tags bound when creating the security group |
Response headers
No special headers are required beyond the standard ones.
Response parameters
| Parameter name | Types | Description |
|---|---|---|
| securityGroupId | String | ID of the created security group |
Error codes
| Error code | Error description | HTTP status code | Chinese explanation |
|---|---|---|---|
| SecurityGroup.RuleRemarkTooLong | Security group description is too long. | 400 | Remark field of the security group rule exceeds the limit |
| BadRequest | protocol is invalid. | 400 | Protocol type error |
| SecurityGroup.RulePortOrderInvalid | The order of security group rule port is incorrect. | 400 | The port order of the security group rule is incorrect |
| SecurityGroup.RulePortRangeInvalid | The value of security group rule port is exceeded. | 400 | The port number of the security group rule is out of the allowed range |
| SecurityGroup.RulePortInvalid | The value of security group rule port must be number. | 400 | The port of the security group rule is non-numeric |
| SecurityGroup.RuleCIDRAddressError | Security group rule ip(cidr) address is incorrect. | 400 | Security group rule source (destination) address error |
| SecurityGroup.RuleDirectionError | Security group rule direction is incorrect. | 400 | Security group rule direction does not conform |
| SecurityGroup.RuleNumberExceededLimit | Security groups that contain rule number exceed limit. | 413 | Count of rules contained in the security group exceeds the limit |
| SecurityGroup.RuleDuplicated | Security group rule is duplicated. | 409 | Security group rules are duplicated |
Request example
Plain Text
1POST /v2/securityGroup?clientToken=be31b98c-5e41-4838-9830-9be700de5a20 HTTP/1.1
2Host: bcc.bj.baidubce.com
3Authorization: bce-auth-v1/f81d3b34e48048fbb2634dc7882d7e21/2015-08-11T04:17:29Z/3600/host/74c506f68c65e26c633bfa104c863fffac5190fdec1ec24b7c03eb5d67d2e1de
4
5{
6 "name": "test-security-group",
7 "desc": "create a security group for api doc",
8 "vpcId": "vpc-uxjret8rnv",
9 "rules": [
10 {
11 "remark": "Remarks",
12 "protocol": "tcp",
13 "portRange": "1-65535",
14 "direction": "ingress",
15 "sourceIp": "",
16 "sourceGroupId": ""
17 },
18 {
19 "remark": "All protocols",
20 "protocol": "",
21 "portRange": "",
22 "direction": "egress",
23 "destIp": "",
24 "destGroupId": ""
25 }
26 ]
27}Response example
Plain Text
1HTTP/1.1 200 OK
2x-bce-request-id: 1214cca7-4ad5-451d-9215-71cb844c0a50
3Date: Wed, 03 Dec 2014 06:42:19 GMT
4Content-Type: application/json;charset=UTF-8
5Server: BWS
6
7{
8 "securityGroupId": "g-nky7qeom"
9}