Networking

Manage private connections and client access rules through the regional Supervisor API

VPC peering requires Performance or Enterprise. PrivateLink and Private Service Connect require Enterprise. The tenant plan must also enable private networking. Standard does not include these features. Tier and account requirements apply separately.

API Variables

ld-api-key

{tenant_id}

Set variables to auto-fill all examples and run requests in-browser.

Use the deployment's supervisor_url for networking requests. The regional Supervisor API is shown as {supervisor_url} below.

Network creation and deletion require deployment:network:manage. Reading lists or instructions requires deployment:network:read. Access rules use deployment:access:manage and deployment:access:read.

Network Info

Get Network Info

GET

{supervisor_url}/deployments/{deployment_id}/network/info

Retrieve the deployment's current network configuration, public/private IPs, and CIDR.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/info \
-H "ld-api-key: YOUR_API_KEY"

AWS VPC Peering

AWS Managed deployments support this feature on Performance or Enterprise, with private networking enabled in the account plan.

Create VPC Peering

POST

{supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering

Initiate a VPC peering connection from the deployment's VPC to your AWS VPC. Returns 204 No Content.

bash

curl -X POST {supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "name": "app-to-iggy",
  "peer_vpc_id": "vpc-0abc123def456789a",
  "peer_owner_id": "123456789012",
  "peer_vpc_cidr": "172.16.0.0/16",
  "peer_region": "us-west-2",
  "remarks": "Application VPC to deployment"
}'

Field	Required	Description
`name`	Yes	Name for the peering connection
`peer_vpc_id`	Yes	Your VPC ID (e.g. `vpc-0abc123...`)
`peer_owner_id`	Yes	Your 12-digit AWS Account ID
`peer_vpc_cidr`	Yes	Your VPC CIDR block. Must not overlap with the deployment subnet
`peer_region`	No	Your VPC region if different from the deployment region
`remarks`	No	Optional description

List VPC Peerings

GET

{supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering

List all VPC peering connections for this deployment.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering \
-H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "name": "app-to-iggy",
    "peering_connection_id": "pcx-0abc123def456789a",
    "requester_vpc_id": "vpc-deployment",
    "requester_cidr": "10.0.0.0/16",
    "accepter_vpc_id": "vpc-0abc123def456789a",
    "accepter_cidr": "172.16.0.0/16",
    "requester_region": "us-west-1",
    "accepter_region": "us-west-2",
    "requester_owner_id": "987654321098",
    "accepter_owner_id": "123456789012",
    "status": "pending_acceptance",
    "remarks": "Application VPC to deployment",
    "created_at": "2025-01-15T10:30:00Z"
  }
]

Peering statuses

initiating_requestpending_acceptanceprovisioningactiverejectedexpiredfaileddeletingdeleted

Get Peering Setup Instructions

GET

{supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering/{peering_id}/instructions

Get step-by-step instructions tailored to the current peering status, including the peering request ID to accept in the AWS Console.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering/{peering_id}/instructions \
-H "ld-api-key: YOUR_API_KEY"

Delete VPC Peering

DELETE

{supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering/{peering_id}

Remove a VPC peering connection. Also clean up routes and security groups in your own VPC.

bash

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/network/aws/vpc_peering/{peering_id} \
-H "ld-api-key: YOUR_API_KEY"

A successful request returns 204 No Content.

AWS PrivateLink

PrivateLink exposes an AWS Managed deployment as a VPC Endpoint Service. It requires Enterprise and private networking access in the account plan.

Create Endpoint Service

POST

{supervisor_url}/deployments/{deployment_id}/network/aws/private_link

Create an AWS VPC Endpoint Service backed by the deployment's Network Load Balancer.

bash

curl -X POST {supervisor_url}/deployments/{deployment_id}/network/aws/private_link \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "name": "iggy-endpoint-service",
  "acceptance_required": true,
  "allowed_principals": [
    "arn:aws:iam::123456789012:root"
  ],
  "remarks": "PrivateLink for production consumers"
}'

Field	Required	Description
`name`	Yes	Unique name for the endpoint service
`acceptance_required`	No	Require manual approval of each new endpoint connection (default `true`)
`allowed_principals`	No	AWS IAM ARNs permitted to create endpoints. Empty = any account can request.
`remarks`	No	Optional description

List Endpoint Services

GET

{supervisor_url}/deployments/{deployment_id}/network/aws/private_link

List all PrivateLink endpoint services for the deployment.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/aws/private_link \
-H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "name": "iggy-endpoint-service",
    "vpc_endpoint_service_id": "vpce-svc-0abc123def456789a",
    "service_name": "com.amazonaws.vpce.us-west-1.vpce-svc-0abc123def456789a",
    "acceptance_required": true,
    "allowed_principals": ["arn:aws:iam::123456789012:root"],
    "state": "available",
    "remarks": "PrivateLink for production consumers",
    "created_at": "2025-01-15T10:30:00Z"
  }
]

Endpoint service states

pendingavailabledeletingdeletedfailed

Delete Endpoint Service

DELETE

{supervisor_url}/deployments/{deployment_id}/network/aws/private_link/{service_id}

Remove the PrivateLink endpoint service. Active consumer endpoints will stop working.

bash

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/network/aws/private_link/{service_id} \
-H "ld-api-key: YOUR_API_KEY"

GCP VPC Peering

GCP Managed deployments support this feature on Performance or Enterprise, with private networking enabled in the account plan.

Create GCP VPC Peering

POST

{supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering

Initiate a VPC peering from the deployment's VPC to your GCP network. GCP requires both sides to establish the connection.

bash

curl -X POST {supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "name": "app-to-iggy",
  "peer_vpc_name": "my-vpc-network",
  "peer_project_id": "my-gcp-project",
  "peer_vpc_cidr": "172.16.0.0/16",
  "remarks": "Application VPC to deployment"
}'

Field	Required	Description
`name`	Yes	Name for the peering connection
`peer_vpc_name`	Yes	Your GCP VPC network name (lowercase, digits, hyphens, max 63 chars)
`peer_project_id`	Yes	Your GCP project ID (6-30 chars)
`peer_vpc_cidr`	Yes	Your VPC CIDR block. Must not overlap with the deployment subnet
`remarks`	No	Optional description

The endpoint returns 204 No Content. Peering remains inactive until you create its reciprocal connection in GCP Console.

List GCP VPC Peerings

GET

{supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering

List all GCP VPC peering connections.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering \
-H "ld-api-key: YOUR_API_KEY"

Peering states are inactive, active, and deleted.

Get GCP Peering Instructions

GET

{supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering/{peering_id}/instructions

Get step-by-step instructions for creating the reciprocal peering in your GCP Console, tailored to the current peering state.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering/{peering_id}/instructions \
-H "ld-api-key: YOUR_API_KEY"

Delete GCP VPC Peering

DELETE

{supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering/{peering_id}

Remove a GCP VPC peering connection.

bash

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/network/gcp/vpc_peering/{peering_id} \
-H "ld-api-key: YOUR_API_KEY"

A successful request returns 204 No Content.

GCP Private Service Connect

PSC exposes a GCP Managed deployment through a service attachment. It requires Enterprise and private networking access in the account plan.

Create Service Attachment

POST

{supervisor_url}/deployments/{deployment_id}/network/gcp/psc

Create a GCP PSC Service Attachment backed by the deployment's internal load balancer.

bash

curl -X POST {supervisor_url}/deployments/{deployment_id}/network/gcp/psc \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "name": "iggy-psc-attachment",
  "connection_preference": "accept_manual",
  "consumer_accept_lists": [
    "my-gcp-project-123"
  ],
  "enable_proxy_protocol": false,
  "remarks": "PSC for production consumers"
}'

Field	Required	Description
`name`	Yes	Unique name for the service attachment
`connection_preference`	No	`accept_manual` (default, requires approval) or `accept_automatic`
`consumer_accept_lists`	No	GCP project IDs allowed to connect. Empty = any project can request.
`enable_proxy_protocol`	No	Include original client IP in connection header (default `false`)
`remarks`	No	Optional description

A successful request returns 204 No Content.

List Service Attachments

GET

{supervisor_url}/deployments/{deployment_id}/network/gcp/psc

List all PSC service attachments for the deployment.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/psc \
-H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "name": "iggy-psc-attachment",
    "service_attachment_uri": "projects/ld-prod/regions/us-central1/serviceAttachments/iggy-psc-attachment",
    "connection_preference": "accept_manual",
    "consumer_accept_lists": ["my-gcp-project-123"],
    "state": "active",
    "remarks": "PSC for production consumers",
    "created_at": "2026-03-20T10:30:00Z"
  }
]

Attachment states are pending, active, and closed.

Get PSC Setup Instructions

GET

{supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}/instructions

Get step-by-step instructions for consumers to connect to this service attachment.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}/instructions \
-H "ld-api-key: YOUR_API_KEY"

List PSC Connections

GET

{supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}/connections

List all active PSC endpoint connections to this attachment.

bash

curl {supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}/connections \
-H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "connection_id": "psc-conn-xyz789",
    "consumer_project_id": "my-gcp-project-123",
    "consumer_network": "projects/my-gcp-project-123/global/networks/default",
    "consumer_forwarding_rule": "projects/my-gcp-project-123/regions/us-central1/forwardingRules/psc-fr-1",
    "status": "accepted",
    "created_at": "2026-03-21T14:00:00Z"
  }
]

Connection statuses

pendingacceptedrejectedclosedneeds_attention

Delete Service Attachment

DELETE

{supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id}

Remove the PSC service attachment. Active consumer endpoints will stop working.

bash

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/network/gcp/psc/{attachment_id} \
-H "ld-api-key: YOUR_API_KEY"

A successful request returns 204 No Content.

Access Rules

Access rules permit source IP ranges. Paid deployments need a rule before clients can connect. Managed Free deployments include a global rule.

Free deployments use 0.0.0.0/0 initially. You can delete or replace it.

Create Access Rule

POST

{supervisor_url}/deployments/{deployment_id}/access_rules

Add an inbound access rule for specific CIDR blocks and protocols.

bash

curl -X POST {supervisor_url}/deployments/{deployment_id}/access_rules \
-H "ld-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
  "name": "production-api-access",
  "cidr_blocks": ["10.0.0.0/16", "172.16.0.0/12"],
  "rules": {
    "iggy_tcp": true,
    "iggy_http": true,
    "iggy_websocket": false,
    "iggy_udp": false
  },
  "valid_to": "2026-12-31T23:59:59Z",
  "remarks": "Production API servers"
}'

Field	Required	Description
`name`	Yes	Unique name within the deployment
`cidr_blocks`	Yes	Array of IPv4 CIDR blocks (at least one required)
`rules`	Yes	Object of protocol toggles: `iggy_tcp`, `iggy_http`, `iggy_websocket`, `iggy_udp`
`valid_to`	No	Optional expiry timestamp. Rule is no longer enforced after this time.
`remarks`	No	Optional description

iggy_http also controls Warden's HTTP proxy for Stream UI. Permit the browser IP with iggy_http: true. The browser connects directly, so no LaserData-owned IP is required.

List Access Rules

GET

{supervisor_url}/deployments/{deployment_id}/access_rules

List all access rules for the deployment.

bash

curl {supervisor_url}/deployments/{deployment_id}/access_rules \
-H "ld-api-key: YOUR_API_KEY"

[
  {
    "id": 1,
    "name": "production-api-access",
    "remarks": "Production API servers",
    "rules": {
      "iggy_http": true,
      "iggy_tcp": true,
      "iggy_websocket": false,
      "iggy_udp": false
    },
    "cidr_blocks": ["10.0.0.0/16", "172.16.0.0/12"],
    "valid_to": "2026-12-31T23:59:59Z",
    "created_at": "2025-01-15T10:30:00Z"
  }
]

Delete Access Rule

DELETE

{supervisor_url}/deployments/{deployment_id}/access_rules/{rule_id}

Remove an access rule. Takes effect immediately. Traffic from those CIDRs is blocked.

bash

curl -X DELETE {supervisor_url}/deployments/{deployment_id}/access_rules/{rule_id} \
-H "ld-api-key: YOUR_API_KEY"

Networking

Network Info

Get Network Info

AWS VPC Peering

Create VPC Peering

List VPC Peerings

Get Peering Setup Instructions

Delete VPC Peering

AWS PrivateLink

Create Endpoint Service

List Endpoint Services

Delete Endpoint Service

GCP VPC Peering

Create GCP VPC Peering

List GCP VPC Peerings

Get GCP Peering Instructions

Delete GCP VPC Peering

GCP Private Service Connect

Create Service Attachment

List Service Attachments

Get PSC Setup Instructions

List PSC Connections

Delete Service Attachment

Access Rules

Create Access Rule

List Access Rules

Delete Access Rule

VPC Peering Guide

PrivateLink Guide

PSC Guide

Access Rules Guide

On this page