> ## Documentation Index > Fetch the complete documentation index at: https://docs.gcore.com/llms.txt > Use this file to discover all available pages before exploring further. # Update port > Updates port security, security groups, allowed address pairs, tags and IP assignments. **Behavior:** - Undefined fields remain unchanged; list fields replace the whole set, so send the full desired list (`[]` to clear, `ip_assignments` must keep at least one entry) - Tags are merged per key; a `null` value removes the key, and `tags: null` removes all user tags - If no changes are detected, no task is created and an empty task list is returned **Supported ports:** all compute types (instances, basic VMs, bare metal servers, GPU virtual servers, GPU bare metal servers), as long as the port `capabilities` report `true` for the field being changed. System-managed ports (DHCP, router, load balancer) and unattached ports are rejected. **Typical uses:** - Per-port firewall: `security_group_ids` applies to this port only, so ports on the same server can differ. While port security is enabled, an empty list permits no traffic - VIP failover (VRRP/keepalived): add the VIP address to `allowed_address_pairs` of every port allowed to claim it, all on the VIP's network - Routing and NAT appliances: `port_security_enabled: false` permits forwarding traffic with foreign source addresses; clear security groups and allowed address pairs in the same request - Additional addresses: `ip_assignments` adds or releases IPs (dual-stack, extra service IPs) without detaching the port; the guest OS must be configured for the extra ones. Send an entry with only `subnet_id` to get any free address of that subnet, which is the only option on a shared subnet whose free addresses the caller does not know. Such an entry keeps an address the port already has in that subnet, in the order the port reports them, so a shorter list releases the addresses at the end of that order. A request can replace all current addresses. A port an instance holds takes its addresses from one subnet per IP version, because the guest reaches one address range per version **Public network:** port security and allowed address pairs cannot be changed on ports in the region's public network. IP assignments can. Each IPv4 address there counts against the external IP quota, so a request that allocates one fails when the limit is full, and a request that releases one gives the quota back. IPv6 addresses in that network are not counted. ## OpenAPI ````yaml /api-reference/services_docs_mintlify_enriched/cloud_api.yaml patch /cloud/v1/ports/{project_id}/{region_id}/{port_id} openapi: 3.1.0 info: title: Gcore OpenAPI – Cloud API description: >- This OpenAPI is an aggregated OpenAPI specification that unifies all Gcore products into a single file. It covers Cloud, CDN, DNS, WAAP, DDoS Protection, Object Storage, Streaming, and FastEdge services. version: 24c37d8e14ce servers: - url: https://api.gcore.com security: - APIKey: [] tags: - name: Bare Metal - name: Container as a Service - name: Cost Reports - name: DDoS Protection - name: Everywhere Inference - name: Everywhere Inference Apps - name: File Shares - name: Floating IPs - name: Function as a Service - name: GPU Bare Metal - name: GPU Virtual - name: IP Ranges - name: Images - name: Instances - name: Load Balancers - name: Logging - name: Managed Kubernetes - name: Managed PostgreSQL - name: Networks - name: Placement Groups - name: Ports - name: Pricing - name: Projects - name: Quotas - name: Regions - name: Registry - name: Reservations - name: Reserved IPs - name: Routers - name: SSH Keys - name: Secrets - name: Security Groups - name: Snapshot Schedules - name: Snapshots - name: Tasks - name: User Actions - name: User Role Assignments - name: Volumes paths: /cloud/v1/ports/{project_id}/{region_id}/{port_id}: patch: tags: - Ports summary: Update port description: >- Updates port security, security groups, allowed address pairs, tags and IP assignments. **Behavior:** - Undefined fields remain unchanged; list fields replace the whole set, so send the full desired list (`[]` to clear, `ip_assignments` must keep at least one entry) - Tags are merged per key; a `null` value removes the key, and `tags: null` removes all user tags - If no changes are detected, no task is created and an empty task list is returned **Supported ports:** all compute types (instances, basic VMs, bare metal servers, GPU virtual servers, GPU bare metal servers), as long as the port `capabilities` report `true` for the field being changed. System-managed ports (DHCP, router, load balancer) and unattached ports are rejected. **Typical uses:** - Per-port firewall: `security_group_ids` applies to this port only, so ports on the same server can differ. While port security is enabled, an empty list permits no traffic - VIP failover (VRRP/keepalived): add the VIP address to `allowed_address_pairs` of every port allowed to claim it, all on the VIP's network - Routing and NAT appliances: `port_security_enabled: false` permits forwarding traffic with foreign source addresses; clear security groups and allowed address pairs in the same request - Additional addresses: `ip_assignments` adds or releases IPs (dual-stack, extra service IPs) without detaching the port; the guest OS must be configured for the extra ones. Send an entry with only `subnet_id` to get any free address of that subnet, which is the only option on a shared subnet whose free addresses the caller does not know. Such an entry keeps an address the port already has in that subnet, in the order the port reports them, so a shorter list releases the addresses at the end of that order. A request can replace all current addresses. A port an instance holds takes its addresses from one subnet per IP version, because the guest reaches one address range per version **Public network:** port security and allowed address pairs cannot be changed on ports in the region's public network. IP assignments can. Each IPv4 address there counts against the external IP quota, so a request that allocates one fails when the limit is full, and a request that releases one gives the quota back. IPv6 addresses in that network are not counted. operationId: PortDetailView.patch parameters: - in: path name: project_id required: true description: Project ID schema: description: Project ID example: 1 examples: - 1 title: Project Id type: integer - in: path name: region_id required: true description: Region ID schema: description: Region ID example: 1 examples: - 1 title: Region Id type: integer - in: path name: port_id required: true description: Port ID schema: description: Port ID example: 1f0ca628-a73b-42c0-bdac-7b10d023e097 examples: - 1f0ca628-a73b-42c0-bdac-7b10d023e097 format: uuid4 title: Port Id type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/PatchPortSerializer' responses: '200': description: Task IDs content: application/json: schema: $ref: '#/components/schemas/TaskIDsSerializer' components: schemas: PatchPortSerializer: properties: allowed_address_pairs: description: >- A set of zero or more allowed port address pair and/or subnet masks. Replaces the full set of allowed address pairs. Send `[]` to clear; omit the field to leave existing pairs unchanged. example: - ip_address: 192.168.123.20 - ip_address: 192.168.0.0/17 examples: - - ip_address: 192.168.123.20 - ip_address: 192.168.0.0/17 items: $ref: '#/components/schemas/PatchAllowedAddressPairsSerializer' maxItems: 10 title: Allowed Address Pairs type: array ip_assignments: description: >- IP assignments on the port. Replaces the full set. Subnets must belong to the port's network, and a port an instance holds supports one subnet per IP version. An entry without `ip_address` keeps an address the port already has in that subnet, in the order the port reports them, or takes a free one when the port has none. Addresses that no entry keeps are released. items: $ref: '#/components/schemas/IpAssignmentRequestSerializer' maxItems: 64 title: Ip Assignments type: array port_security_enabled: description: >- When true, the network driver enforces port security on this port (anti-spoofing checks and security-group filtering apply). When false, all traffic is allowed and security groups are not applied. title: Port Security Enabled type: boolean security_group_ids: description: >- List of security group IDs. Replaces the full set of security groups attached to the port. Send `[]` to detach all groups; omit the field to leave existing groups unchanged. example: - 351b0dd7-ca09-431c-be53-935db3785067 examples: - - 351b0dd7-ca09-431c-be53-935db3785067 items: format: uuid4 type: string maxItems: 10 title: Security Group Ids type: array tags: anyOf: - $ref: '#/components/schemas/UpdateTagsSerializer' - type: 'null' description: >- Update key-value tags using JSON Merge Patch semantics (RFC 7386). Provide key-value pairs to add or update tags. Set tag values to `null` to remove tags. Unspecified tags remain unchanged. Read-only tags are always preserved and cannot be modified. **Examples:** - **Add/update tags:** `{'tags': {'environment': 'production', 'team': 'backend'}}` adds new tags or updates existing ones. - **Delete tags:** `{'tags': {'old_tag': null}}` removes specific tags. - **Remove all tags:** `{'tags': null}` removes all user-managed tags (read-only tags are preserved). - **Partial update:** `{'tags': {'environment': 'staging'}}` only updates specified tags. - **Mixed operations:** `{'tags': {'environment': 'production', 'cost_center': 'engineering', 'deprecated_tag': null}}` adds/updates 'environment' and 'cost_center' while removing 'deprecated_tag', preserving other existing tags. - **Replace all:** first delete existing tags with null values, then add new ones in the same request. examples: - my-tag: my-tag-value my-tag-to-remove: null title: PatchPortSerializer type: object TaskIDsSerializer: properties: tasks: description: >- List of task IDs representing asynchronous operations. Use these IDs to monitor operation progress: - `GET /v1/tasks/{task_id}` - Check individual task status and details Poll task status until completion (`FINISHED`/`ERROR`) before proceeding with dependent operations. example: - d478ae29-dedc-4869-82f0-96104425f565 examples: - - d478ae29-dedc-4869-82f0-96104425f565 items: type: string title: Tasks type: array required: - tasks title: TaskIDsSerializer type: object PatchAllowedAddressPairsSerializer: properties: ip_address: anyOf: - format: ipvanyaddress type: string - format: ipvanynetwork type: string description: IP address or subnet of the allowed address pair title: Ip Address required: - ip_address title: PatchAllowedAddressPairsSerializer type: object IpAssignmentRequestSerializer: properties: ip_address: anyOf: - format: ipv4 type: string - format: ipv6 type: string description: >- IP address to assign. Omit it to get any free address of the subnet, which is the only option when the subnet's free addresses are not known to the caller. examples: - 192.168.123.20 title: Ip Address subnet_id: description: ID of the subnet example: b39792c3-3160-4356-912e-ba396c95cdcf examples: - b39792c3-3160-4356-912e-ba396c95cdcf format: uuid4 title: Subnet Id type: string required: - subnet_id title: IpAssignmentRequestSerializer type: object UpdateTagsSerializer: propertyNames: description: >- Tag key. Maximum 255 characters. Cannot contain spaces, tabs, newlines, empty string or '=' character. Cannot contain characters from U+0080 to U+00FF. Trailing or leading whitespaces will be stripped. examples: - my-tag maxLength: 255 minLength: 1 pattern: ^[^\s=]+$ title: UpdateTagsSerializer type: object additionalProperties: anyOf: - maxLength: 255 minLength: 1 pattern: ^[^ \t\n\r\f\v]([^\t\n\r\f\v]*[^ \t\n\r\f\v])?$ type: string - type: 'null' description: >- Tag value. Maximum 255 characters. Cannot contain tabs, newlines, empty string or start/end with whitespace. Cannot contain characters from U+0080 to U+00FF. Trailing or leading whitespaces will be stripped. Set to `null` in order to delete this tag. examples: - my-tag-value securitySchemes: APIKey: description: >- API key for authentication. Make sure to include the word `apikey`, followed by a single space and then your token. Example: `apikey 1234_abcdef` type: apiKey in: header name: Authorization ````