Add a VPN device
Registers one WireGuard peer against the VPC’s WireGuard gateway. Enable that gateway first: without it the request is refused with 422.
The platform makes the keypair and keeps only the public half — the private key is never written to the database and never appears in an event. It waits 15 minutes for the daemon to report the device’s address, then expires.
So the device comes back pending with no address, and the configuration it needs is not in this response. Poll the device until status is active, then read GET /api/v1/vpcs/{uuid}/vpn_users/{user_uuid}/config once — that read empties the vault, and no endpoint can produce the file again. A device whose config expired unread has to be deleted and added afresh.
Authorizations
Bearer token for authentication. Format: 'Bearer {token}'
Headers
Workspace ID (uses default workspace if not provided)
Path Parameters
VPC UUID
Body
Add a VPN device
Device name, unique within the gateway. Lowercase letters, numbers and hyphens, 2 to 30 characters. This is the name the daemon identifies the peer by.
Response
Add a VPN device
Api_V1_Entities_VpnUser model
Unique device identifier
Device name, unique within the gateway
Current status (pending, active, failed)
The device's WireGuard public key. The private half is never stored and is returned only once, by the config endpoint
Address the device answers to inside the VPC, allocated from the VPN pool
Whether the configuration can still be downloaded. It can be read exactly once, and reading it empties the vault
Creation timestamp

