Enable a VPN gateway
Brings up one terminator on the VPC, so a network outside the platform can reach what is attached to it. A VPC runs at most one of each kind; asking for a kind it already has is refused with 422.
WireGuard needs nothing beyond the kind — the platform books the address and the port, and devices are added afterwards with the VPN user endpoints. Cloudflare WARP and Tailscale terminate in the customer’s own account, so each needs that account’s credentials, and each needs peer routes before the networks behind it are reachable.
IPsec is not enabled here: it comes up with the first site-to-site connection, which is what pays for the public address it holds.
Enabling one bills the workspace $29/mo for the VPN add-on. It is counted per gateway, not per VPC: a VPC running both WireGuard and Tailscale is charged twice, as are two VPCs each running WireGuard. Enterprise has it included.
Authorizations
Bearer token for authentication. Format: 'Bearer {token}'
Headers
Workspace ID (uses default workspace if not provided)
Path Parameters
VPC UUID
Body
Enable a VPN gateway
Terminator to enable: wireguard, cloudflare or tailscale
wireguard, cloudflare, tailscale Cloudflare Zero Trust team name. Required for cloudflare.
Cloudflare service token client ID. Required for cloudflare.
Cloudflare service token secret. Stored encrypted and never returned. Required for cloudflare.
Tailscale auth key. Stored encrypted and never returned. Required for tailscale.
Response
Enable a VPN gateway
Api_V1_Entities_VpnGateway model
Unique gateway identifier
Terminator: wireguard, tailscale, cloudflare or ipsec
Current status (pending, active, failed, disabling)
Address clients dial, once the platform has allocated one. Null for the terminators that dial out instead
Port on that address, for WireGuard
Public IPv4 held exclusively by this gateway. Only IPsec takes one
Devices registered against this gateway
Site-to-site tunnels terminating on it
Creation timestamp

