Authorize security group rules
Updated at：2025-10-20
- This API is used to authorize new security group rules within a security group.
- Rules in the same security group are uniquely identified by a combination of a 6-tuple: remark, protocol, direction, portRange, sourceIp|destIp, and sourceGroupId|destGroupId. Duplicate rules will result in a 409 error.
Request structure
Plain Text
1PUT /v{version}/securityGroup/{securityGroupId}?{action}&clientToken={clientToken}&sgVersion={sgVersion} HTTP/1.1
2Host: bcc.bj.baidubce.com
3Authorization: authorization string
4
5{
6 "rule":
7 {
8 "remark": "Remarks",
9 "protocol": protocol,
10 "portRange": portRange,
11 "direction": direction,
12 "sourceIp": sourceIp,
13 "sourceGroupId": sourceGroupId
14 }
15}Request headers
There are no special headers required beyond the common headers.
Request parameters
| Parameter name | Types | Whether required | Parameter location | Description |
|---|---|---|---|---|
| version | String | Yes | URL parameter | API version number |
| sgVersion | long | No | Query | Security group version number |
| action | String | Yes | Query | Action performed on the security group, current value: authorizeRule |
| clientToken | String | Yes | Query | Idempotence Token, which is an ASCII string with a length not exceeding 64 bits, see details in [ClientToken Idempotence ](BCC/API Reference/General Description.md#Idempotence). |
| securityGroupId | String | Yes | URL parameter | ID of the security group for which new rules are to be authorized |
| rule | [SecurityGroupRuleModel](BCC/API Reference/Appendix.md#SecurityGroupRuleModel) | Yes | RequestBody | Security group rules to be authorized |
Response headers
No special headers are required beyond the standard ones.
Response parameters
There are no special response parameters
Error code
| Error code | Error description | HTTP status code | Chinese explanation |
|---|---|---|---|
| BadRequest | protocol is invalid. | 400 | Protocol type error |
| SecurityGroup.RulePortOrderInvalid | The order of security group rule port is incorrect. | 400 | The port order of the security group rule is incorrect |
| SecurityGroup.RulePortRangeInvalid | The value of security group rule port is exceeded. | 400 | The port number of the security group rule is out of the allowed range |
| SecurityGroup.RulePortInvalid | The value of security group rule port must be number. | 400 | The port of the security group rule is non-numeric |
| SecurityGroup.RuleCIDRAddressError | Security group rule ip(cidr) address is incorrect. | 400 | Security group rule source (destination) address error |
| SecurityGroup.RuleDirectionError | Security group rule direction is incorrect. | 400 | Security group rule direction does not conform |
| NoSuchObject | The specified object is not found or resource do not exist. | 404 | The target security group does not exist |
| SecurityGroup.RuleNumberExceededLimit | Security groups that contain rule number exceed limit. | 413 | Count of rules contained in the security group exceeds the limit |
| SecurityGroup.RuleDuplicated | Security group rule is duplicated. | 409 | Security group rules are duplicated |
| VersionMismatch | The sgVersion is mismatch. | 400 | The specified version number of the security group rule does not match the latest version. If the sgVersion parameter is not included in the request, this error code will not be returned. |
Request example
Plain Text
1PUT /v2/securityGroup/g-nky7qeom?authorizeRule&clientToken=be31b98c-5e41-4838-9830-9be700de5a20 HTTP/1.1
2Host: bcc.bj.baidubce.com
3Authorization: bce-auth-v1/f81d3b34e48048fbb2634dc7882d7e21/2015-08-11T04:17:29Z/3600/host/74c506f68c65e26c633bfa104c863fffac5190fdec1ec24b7c03eb5d67d2e1de
4
5{
6 "rule":
7 {
8 "remark": "Remarks",
9 "protocol": "tcp",
10 "portRange": "1-65535",
11 "direction": "ingress",
12 "sourceIp": "",
13 "sourceGroupId": ""
14 }
15}Response example
Plain Text
1HTTP/1.1 200 OK
2x-bce-request-id: 1214cca7-4ad5-451d-9215-71cb844c0a50
3Date: Wed, 03 Dec 2014 06:42:19 GMT
4Content-Type: application/json;charset=UTF-8
5Server: BWS