API reference

VpcService

api.plany.cloud:443Regional11 methods

Create private networks for your workloads, and control what can reach them with firewall rules. Every project gets a default network in each region, and you can create more: game servers on one network cannot reach a database on another unless you connect them. A network refuses inbound traffic unless a firewall rule allows it; rules Plany adds for a product's own needs are listed alongside yours and go when the workload does.

CreateVpc

Long-running

plany.vpc.v1.VpcService/CreateVpc

Creates a network.

Returns a long-running operation, which in the ordinary case is already done when it is returned.

Parameters

parentstringRequired
vpcVpcRequired
Show child attributesHide child attributes
- namestringIdentifier
  projects/{project}/locations/{location}/vpcs/{vpc}.
- display_namestring
- ipv4_cidrstringImmutable
  The address range workloads are given addresses from, e.g. "10.0.0.0/16".
  
  Your choice, and need not be unique: two networks — yours or anybody else's — can use the same range without conflict.
  
  Must be a private range (RFC 1918). A network numbered out of public space would cut its workloads off from whatever really lives at those addresses.
- dns_serversrepeated string
  DNS resolvers given to workloads on this network. Defaults to gateway_ipv4.
- lease_secondsint32
  How long a workload may hold an address before renewing it.
- labelsmap<string, string>
vpc_idstring
Desired short id. Empty generates one.
request_idstring
Idempotency key. Repeating a create with the same key returns the original operation — the project lifecycle consumer retries, and a project must not end up with two default networks.

Returns

An Operation that resolves to Vpc.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "parent": "",
4    "vpc": {
5      "display_name": "My server"
6    }
7  }' \
8  api.plany.cloud:443 plany.vpc.v1.VpcService/CreateVpc

Example response

1{
2  "name": "projects//locations//vpcs/",
3  "display_name": "My server",
4  "ipv4_cidr": "",
5  "gateway_ipv4": "",
6  "mtu": 0,
7  "dns_servers": [
8    ""
9  ],
10  "lease_seconds": 0,
11  "state": "VPC_STATE_CREATING",
12  "error": "",
13  "default_network": false,
14  "labels": {
15    "key": ""
16  },
17  "create_time": "2026-10-04T12:00:00Z",
18  "update_time": "2026-10-04T12:00:00Z",
19  "etag": "W/\"1\"",
20  "managed_by": ""
21}

GetVpc

Read

plany.vpc.v1.VpcService/GetVpc

Parameters

namestringRequired

Returns

Vpc.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "name": "projects//locations//vpcs/"
4  }' \
5  api.plany.cloud:443 plany.vpc.v1.VpcService/GetVpc

Example response

1{
2  "name": "projects//locations//vpcs/",
3  "display_name": "My server",
4  "ipv4_cidr": "",
5  "gateway_ipv4": "",
6  "mtu": 0,
7  "dns_servers": [
8    ""
9  ],
10  "lease_seconds": 0,
11  "state": "VPC_STATE_CREATING",
12  "error": "",
13  "default_network": false,
14  "labels": {
15    "key": ""
16  },
17  "create_time": "2026-10-04T12:00:00Z",
18  "update_time": "2026-10-04T12:00:00Z",
19  "etag": "W/\"1\"",
20  "managed_by": ""
21}

ListVpcs

Read

plany.vpc.v1.VpcService/ListVpcs

Parameters

parentstringRequired
projects/{project}/locations/{location}.
page_sizeint32
page_tokenstring

Returns

ListVpcsResponse.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "parent": "",
4    "page_size": 50
5  }' \
6  api.plany.cloud:443 plany.vpc.v1.VpcService/ListVpcs

Example response

1{
2  "vpcs": [
3    {
4      "name": "projects//locations//vpcs/",
5      "display_name": "My server",
6      "ipv4_cidr": "",
7      "gateway_ipv4": "",
8      "mtu": 0,
9      "dns_servers": [
10        ""
11      ],
12      "lease_seconds": 0,
13      "state": "VPC_STATE_CREATING",
14      "error": "",
15      "default_network": false,
16      "labels": {
17        "key": ""
18      },
19      "create_time": "2026-10-04T12:00:00Z",
20      "update_time": "2026-10-04T12:00:00Z",
21      "etag": "W/\"1\"",
22      "managed_by": ""
23    }
24  ],
25  "next_page_token": ""
26}

UpdateVpc

plany.vpc.v1.VpcService/UpdateVpc

Parameters

vpcVpcRequired
Show child attributesHide child attributes
- namestringIdentifier
  projects/{project}/locations/{location}/vpcs/{vpc}.
- display_namestring
- ipv4_cidrstringImmutable
  The address range workloads are given addresses from, e.g. "10.0.0.0/16".
  
  Your choice, and need not be unique: two networks — yours or anybody else's — can use the same range without conflict.
  
  Must be a private range (RFC 1918). A network numbered out of public space would cut its workloads off from whatever really lives at those addresses.
- dns_serversrepeated string
  DNS resolvers given to workloads on this network. Defaults to gateway_ipv4.
- lease_secondsint32
  How long a workload may hold an address before renewing it.
- labelsmap<string, string>
update_maskFieldMaskRequired

Returns

Vpc.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "vpc": {
4      "display_name": "My server"
5    },
6    "update_mask": "display_name"
7  }' \
8  api.plany.cloud:443 plany.vpc.v1.VpcService/UpdateVpc

Example response

1{
2  "name": "projects//locations//vpcs/",
3  "display_name": "My server",
4  "ipv4_cidr": "",
5  "gateway_ipv4": "",
6  "mtu": 0,
7  "dns_servers": [
8    ""
9  ],
10  "lease_seconds": 0,
11  "state": "VPC_STATE_CREATING",
12  "error": "",
13  "default_network": false,
14  "labels": {
15    "key": ""
16  },
17  "create_time": "2026-10-04T12:00:00Z",
18  "update_time": "2026-10-04T12:00:00Z",
19  "etag": "W/\"1\"",
20  "managed_by": ""
21}

DeleteVpc

Long-running

plany.vpc.v1.VpcService/DeleteVpc

Deletes a network.

Refused while anything is still using an address on it, and always refused for the project's default network.

Parameters

namestringRequired
etagstring

Returns

An Operation that resolves to Empty.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "name": "projects//locations//vpcs/"
4  }' \
5  api.plany.cloud:443 plany.vpc.v1.VpcService/DeleteVpc

Example response

{}

CreateFirewallRule

plany.vpc.v1.VpcService/CreateFirewallRule

Creates a firewall rule on a network.

Counted against vpc.plany.cloud/firewall_rules. Takes effect on every host running a workload on the network within seconds; nothing restarts.

Parameters

parentstringRequired
The network, projects/{project}/locations/{location}/vpcs/{vpc}.
firewall_ruleFirewallRuleRequired
Show child attributesHide child attributes
- actionFirewallRule.ActionRequired
  ACTION_ALLOWACTION_DENY
- source_rangesrepeated stringRequired
  Where the traffic comes from, as CIDRs: "0.0.0.0/0" is anywhere, the network's own range is the workloads on it. Required — a rule that named no source would read as "nobody" to one person and "everybody" to another.
- namestringIdentifier
- display_namestring
- descriptionstring
- priorityint32
  0 to 65535, lowest first. Defaults to 1000.
- protocolsrepeated FirewallRule.Protocol
  What traffic the rule matches. Empty matches every protocol and port.
  Show child attributesHide child attributes
  protocolstringRequired
  "tcp", "udp", "icmp" or "all".
  
  portsrepeated string
  Ports or inclusive ranges, e.g. "25565" or "7000-8000". Empty is every port. Only meaningful for tcp and udp.
- target_tagsrepeated string
  Which workloads on the network the rule applies to. Empty is all of them.
- disabledbool
  A disabled rule is kept and ignored.
- labelsmap<string, string>
firewall_rule_idstringRequired
Lowercase letters, digits and hyphens. Required: a retried create with a generated id would be a second rule.

Returns

FirewallRule.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "parent": "projects//locations//vpcs/",
4    "firewall_rule": {
5      "display_name": "My server",
6      "action": "ACTION_ALLOW",
7      "source_ranges": []
8    },
9    "firewall_rule_id": "my-firewall-rule"
10  }' \
11  api.plany.cloud:443 plany.vpc.v1.VpcService/CreateFirewallRule

Example response

1{
2  "name": "projects//locations//vpcs//firewallRules/my-firewall-rule",
3  "display_name": "My server",
4  "description": "",
5  "action": "ACTION_ALLOW",
6  "priority": 0,
7  "protocols": [
8    {
9      "protocol": "",
10      "ports": [
11        ""
12      ]
13    }
14  ],
15  "source_ranges": [
16    ""
17  ],
18  "target_tags": [
19    ""
20  ],
21  "disabled": false,
22  "managed_by": "",
23  "labels": {
24    "key": ""
25  },
26  "create_time": "2026-10-04T12:00:00Z",
27  "update_time": "2026-10-04T12:00:00Z",
28  "etag": "W/\"1\""
29}

GetFirewallRule

Read

plany.vpc.v1.VpcService/GetFirewallRule

Parameters

namestringRequired

Returns

FirewallRule.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "name": "projects//locations//vpcs//firewallRules/my-firewall-rule"
4  }' \
5  api.plany.cloud:443 plany.vpc.v1.VpcService/GetFirewallRule

Example response

1{
2  "name": "projects//locations//vpcs//firewallRules/my-firewall-rule",
3  "display_name": "My server",
4  "description": "",
5  "action": "ACTION_ALLOW",
6  "priority": 0,
7  "protocols": [
8    {
9      "protocol": "",
10      "ports": [
11        ""
12      ]
13    }
14  ],
15  "source_ranges": [
16    ""
17  ],
18  "target_tags": [
19    ""
20  ],
21  "disabled": false,
22  "managed_by": "",
23  "labels": {
24    "key": ""
25  },
26  "create_time": "2026-10-04T12:00:00Z",
27  "update_time": "2026-10-04T12:00:00Z",
28  "etag": "W/\"1\""
29}

ListFirewallRules

Read

plany.vpc.v1.VpcService/ListFirewallRules

Lists a network's rules, the platform's included.

Parameters

parentstringRequired
page_sizeint32
page_tokenstring

Returns

ListFirewallRulesResponse.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "parent": "projects//locations//vpcs/",
4    "page_size": 50
5  }' \
6  api.plany.cloud:443 plany.vpc.v1.VpcService/ListFirewallRules

Example response

1{
2  "firewall_rules": [
3    {
4      "name": "projects//locations//vpcs//firewallRules/my-firewall-rule",
5      "display_name": "My server",
6      "description": "",
7      "action": "ACTION_ALLOW",
8      "priority": 0,
9      "protocols": [
10        {
11          "protocol": "",
12          "ports": [
13            ""
14          ]
15        }
16      ],
17      "source_ranges": [
18        ""
19      ],
20      "target_tags": [
21        ""
22      ],
23      "disabled": false,
24      "managed_by": "",
25      "labels": {
26        "key": ""
27      },
28      "create_time": "2026-10-04T12:00:00Z",
29      "update_time": "2026-10-04T12:00:00Z",
30      "etag": "W/\"1\""
31    }
32  ],
33  "next_page_token": ""
34}

UpdateFirewallRule

plany.vpc.v1.VpcService/UpdateFirewallRule

Refused for a rule the platform manages.

Parameters

firewall_ruleFirewallRuleRequired
Show child attributesHide child attributes
- actionFirewallRule.ActionRequired
  ACTION_ALLOWACTION_DENY
- source_rangesrepeated stringRequired
  Where the traffic comes from, as CIDRs: "0.0.0.0/0" is anywhere, the network's own range is the workloads on it. Required — a rule that named no source would read as "nobody" to one person and "everybody" to another.
- namestringIdentifier
- display_namestring
- descriptionstring
- priorityint32
  0 to 65535, lowest first. Defaults to 1000.
- protocolsrepeated FirewallRule.Protocol
  What traffic the rule matches. Empty matches every protocol and port.
  Show child attributesHide child attributes
  protocolstringRequired
  "tcp", "udp", "icmp" or "all".
  
  portsrepeated string
  Ports or inclusive ranges, e.g. "25565" or "7000-8000". Empty is every port. Only meaningful for tcp and udp.
- target_tagsrepeated string
  Which workloads on the network the rule applies to. Empty is all of them.
- disabledbool
  A disabled rule is kept and ignored.
- labelsmap<string, string>
update_maskFieldMaskRequired

Returns

FirewallRule.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "firewall_rule": {
4      "display_name": "My server",
5      "action": "ACTION_ALLOW",
6      "source_ranges": []
7    },
8    "update_mask": "display_name"
9  }' \
10  api.plany.cloud:443 plany.vpc.v1.VpcService/UpdateFirewallRule

Example response

1{
2  "name": "projects//locations//vpcs//firewallRules/my-firewall-rule",
3  "display_name": "My server",
4  "description": "",
5  "action": "ACTION_ALLOW",
6  "priority": 0,
7  "protocols": [
8    {
9      "protocol": "",
10      "ports": [
11        ""
12      ]
13    }
14  ],
15  "source_ranges": [
16    ""
17  ],
18  "target_tags": [
19    ""
20  ],
21  "disabled": false,
22  "managed_by": "",
23  "labels": {
24    "key": ""
25  },
26  "create_time": "2026-10-04T12:00:00Z",
27  "update_time": "2026-10-04T12:00:00Z",
28  "etag": "W/\"1\""
29}

DeleteFirewallRule

plany.vpc.v1.VpcService/DeleteFirewallRule

Refused for a rule the platform manages: it goes when its workload does.

Parameters

namestringRequired
etagstring

Returns

Empty.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "name": "projects//locations//vpcs//firewallRules/my-firewall-rule"
4  }' \
5  api.plany.cloud:443 plany.vpc.v1.VpcService/DeleteFirewallRule

Example response

{}

ListIpLeases

Read

plany.vpc.v1.VpcService/ListIpLeases

Lists the addresses currently held on a network, and what holds each one.

Parameters

parentstringRequired
page_sizeint32
page_tokenstring

Returns

ListIpLeasesResponse.

1grpcurl -H "authorization: Bearer $PLANY_API_KEY" \
2  -d '{
3    "parent": "",
4    "page_size": 50
5  }' \
6  api.plany.cloud:443 plany.vpc.v1.VpcService/ListIpLeases

Example response

1{
2  "ip_leases": [
3    {
4      "name": "projects//locations//vpcs//ipLeases/my-ip-lease",
5      "instance": "",
6      "interface_id": "my-interface",
7      "ipv4": "",
8      "mac_address": "",
9      "state": "STATE_ACTIVE",
10      "create_time": "2026-10-04T12:00:00Z",
11      "expire_time": "2026-10-04T12:00:00Z"
12    }
13  ],
14  "next_page_token": ""
15}

The FirewallRule.Protocol object

What a rule matches on: one protocol, and optionally some of its ports.

Attributes

protocolstringRequired
"tcp", "udp", "icmp" or "all".
portsrepeated string
Ports or inclusive ranges, e.g. "25565" or "7000-8000". Empty is every port. Only meaningful for tcp and udp.

FirewallRule.Protocol

1{
2  "protocol": "",
3  "ports": [
4    ""
5  ]
6}

The IpLease object

projects//locations//vpcs//ipLeases/{{ip_lease}}

IpLease is one address held on a network by a game server, a sandbox or another workload.

Attributes

namestringIdentifier
instancestringOutput only
The workload this address was allocated for, and the interface within it.
interface_idstringOutput only
ipv4stringOutput only
mac_addressstringOutput only
The MAC address assigned with this address.
stateIpLease.StateOutput only
STATE_ACTIVESTATE_RELEASED
create_timeTimestampOutput only
expire_timeTimestampOutput only

IpLease

1{
2  "name": "projects//locations//vpcs//ipLeases/my-ip-lease",
3  "instance": "",
4  "interface_id": "my-interface",
5  "ipv4": "",
6  "mac_address": "",
7  "state": "STATE_ACTIVE",
8  "create_time": "2026-10-04T12:00:00Z",
9  "expire_time": "2026-10-04T12:00:00Z"
10}

The OperationMetadata object

OperationMetadata is progress on a long-running network change.

Attributes

targetstring
verbstring
status_messagestring
api_versionstring

OperationMetadata

1{
2  "target": "",
3  "verb": "",
4  "status_message": "",
5  "api_version": ""
6}

FirewallRule

FirewallRule decides which inbound traffic reaches the workloads on a network.

Inbound is denied unless a rule allows it. Replies to connections a workload opened itself are always allowed, as is traffic from the network's gateway — the host's DHCP, metadata and health checks. Outbound traffic is not filtered.

Rules are evaluated lowest priority first, and the first that matches decides; at equal priority a deny wins over an allow. A rule with no target_tags applies to every workload on the network.

Some rules are the platform's: a product that runs a workload opens what that workload needs — a game server's ports, an Agones cluster's node traffic — as a rule with managed_by set. Those are visible, so nothing that reaches a workload is hidden, and cannot be edited or deleted except by removing the workload. A customer's own deny at a lower priority still overrides one.

actionFirewallRule.ActionRequired
ACTION_ALLOWACTION_DENY
source_rangesrepeated stringRequired
Where the traffic comes from, as CIDRs: "0.0.0.0/0" is anywhere, the network's own range is the workloads on it. Required — a rule that named no source would read as "nobody" to one person and "everybody" to another.
namestringIdentifier
display_namestring
descriptionstring
priorityint32
0 to 65535, lowest first. Defaults to 1000.
protocolsrepeated FirewallRule.Protocol
What traffic the rule matches. Empty matches every protocol and port.
Show child attributesHide child attributes
- protocolstringRequired
  "tcp", "udp", "icmp" or "all".
- portsrepeated string
  Ports or inclusive ranges, e.g. "25565" or "7000-8000". Empty is every port. Only meaningful for tcp and udp.
target_tagsrepeated string
Which workloads on the network the rule applies to. Empty is all of them.
disabledbool
A disabled rule is kept and ignored.
managed_bystringOutput only
The service that owns this rule, e.g. playpute.plany.cloud, when the platform created it for a workload. Empty for a customer's own.
labelsmap<string, string>
create_timeTimestampOutput only
update_timeTimestampOutput only
etagstringOutput only

ListFirewallRulesResponse

firewall_rulesrepeated FirewallRule
Show child attributesHide child attributes
- actionFirewallRule.ActionRequired
  ACTION_ALLOWACTION_DENY
- source_rangesrepeated stringRequired
  Where the traffic comes from, as CIDRs: "0.0.0.0/0" is anywhere, the network's own range is the workloads on it. Required — a rule that named no source would read as "nobody" to one person and "everybody" to another.
- namestringIdentifier
- display_namestring
- descriptionstring
- priorityint32
  0 to 65535, lowest first. Defaults to 1000.
- protocolsrepeated FirewallRule.Protocol
  What traffic the rule matches. Empty matches every protocol and port.
  Show child attributesHide child attributes
  protocolstringRequired
  "tcp", "udp", "icmp" or "all".
  
  portsrepeated string
  Ports or inclusive ranges, e.g. "25565" or "7000-8000". Empty is every port. Only meaningful for tcp and udp.
- target_tagsrepeated string
  Which workloads on the network the rule applies to. Empty is all of them.
- disabledbool
  A disabled rule is kept and ignored.
- managed_bystringOutput only
  The service that owns this rule, e.g. playpute.plany.cloud, when the platform created it for a workload. Empty for a customer's own.
- labelsmap<string, string>
- create_timeTimestampOutput only
- update_timeTimestampOutput only
- etagstringOutput only
next_page_tokenstring

ListIpLeasesResponse

ip_leasesrepeated IpLease
Show child attributesHide child attributes
- namestringIdentifier
- instancestringOutput only
  The workload this address was allocated for, and the interface within it.
- interface_idstringOutput only
- ipv4stringOutput only
- mac_addressstringOutput only
  The MAC address assigned with this address.
- stateIpLease.StateOutput only
  STATE_ACTIVESTATE_RELEASED
- create_timeTimestampOutput only
- expire_timeTimestampOutput only
next_page_tokenstring

ListVpcsResponse

vpcsrepeated Vpc
Show child attributesHide child attributes
- namestringIdentifier
  projects/{project}/locations/{location}/vpcs/{vpc}.
- display_namestring
- ipv4_cidrstringImmutable
  The address range workloads are given addresses from, e.g. "10.0.0.0/16".
  
  Your choice, and need not be unique: two networks — yours or anybody else's — can use the same range without conflict.
  
  Must be a private range (RFC 1918). A network numbered out of public space would cut its workloads off from whatever really lives at those addresses.
- gateway_ipv4stringOutput only
  The first usable address in ipv4_cidr, reserved for the network itself and never given to a workload. It is every workload's default route, DHCP server, DNS resolver and metadata endpoint.
- mtuint32Output only
  The largest packet a workload may send on this network, in bytes: 1450. Output only.
- dns_serversrepeated string
  DNS resolvers given to workloads on this network. Defaults to gateway_ipv4.
- lease_secondsint32
  How long a workload may hold an address before renewing it.
- stateVpcStateOutput only
  VPC_STATE_CREATINGVPC_STATE_ACTIVEVPC_STATE_DELETINGVPC_STATE_ERROR
- errorstringOutput only
  Why the network is in ERROR, when it is.
- default_networkboolOutput only
  Whether Plany created this network with the project rather than a user asking for it. Every project gets one; deleting it would leave the project unable to run anything, so the service refuses. A workload that names no network is put on this one.
- labelsmap<string, string>
- create_timeTimestampOutput only
- update_timeTimestampOutput only
- etagstringOutput only
- managed_bystringOutput only
  The service that manages this network, e.g. sandbox.plany.cloud, when the platform created it for a product of its own. Empty for the default network and for every network a customer creates.
  
  A managed network is visible, so nothing running in a project is hidden from its owner. It cannot be renamed or deleted by a customer, is not counted against quota, and no workload can be put on it by naming it: only the product that owns it places anything there. It is numbered from 100.64.0.0/10, a range no customer network can use, so it can never overlap a network it is connected to.
next_page_tokenstring

Vpc

Vpc is one of a project's private networks in one region.

A project has a default network in every region and may hold more. Workloads on two networks of the same project are as isolated from each other as workloads of two different customers.

namestringIdentifier
projects/{project}/locations/{location}/vpcs/{vpc}.
display_namestring
ipv4_cidrstringImmutable
The address range workloads are given addresses from, e.g. "10.0.0.0/16".

Your choice, and need not be unique: two networks — yours or anybody else's — can use the same range without conflict.

Must be a private range (RFC 1918). A network numbered out of public space would cut its workloads off from whatever really lives at those addresses.
gateway_ipv4stringOutput only
The first usable address in ipv4_cidr, reserved for the network itself and never given to a workload. It is every workload's default route, DHCP server, DNS resolver and metadata endpoint.
mtuint32Output only
The largest packet a workload may send on this network, in bytes: 1450. Output only.
dns_serversrepeated string
DNS resolvers given to workloads on this network. Defaults to gateway_ipv4.
lease_secondsint32
How long a workload may hold an address before renewing it.
stateVpcStateOutput only
VPC_STATE_CREATINGVPC_STATE_ACTIVEVPC_STATE_DELETINGVPC_STATE_ERROR
errorstringOutput only
Why the network is in ERROR, when it is.
default_networkboolOutput only
Whether Plany created this network with the project rather than a user asking for it. Every project gets one; deleting it would leave the project unable to run anything, so the service refuses. A workload that names no network is put on this one.
labelsmap<string, string>
create_timeTimestampOutput only
update_timeTimestampOutput only
etagstringOutput only
managed_bystringOutput only
The service that manages this network, e.g. sandbox.plany.cloud, when the platform created it for a product of its own. Empty for the default network and for every network a customer creates.

A managed network is visible, so nothing running in a project is hidden from its owner. It cannot be renamed or deleted by a customer, is not counted against quota, and no workload can be put on it by naming it: only the product that owns it places anything there. It is numbered from 100.64.0.0/10, a range no customer network can use, so it can never overlap a network it is connected to.

Enums

FirewallRule.Action

Value	Description
ACTION_UNSPECIFIED
ACTION_ALLOW
ACTION_DENY

IpLease.State

Value	Description
STATE_UNSPECIFIED
STATE_ACTIVE	Held by a running workload, and counted against the network's range.
STATE_RELEASED	Handed back. The address is immediately available again — the scheme this replaces marked a lease released and left its unique index in place, so every address a VPC ever used was permanently spent.

VpcState

VpcState is where a network is in its life.

Value	Description
VPC_STATE_UNSPECIFIED
VPC_STATE_CREATING	Allocations are being made. Brief: it is four database writes, not a machine boot. A create that stays here has failed to find a free VNI or routing table.
VPC_STATE_ACTIVE	Normal operation. Workloads may join.
VPC_STATE_DELETING	Deletion requested. New attachments are refused and existing leases are being released; the VNI and routing table are held until the last one is.
VPC_STATE_ERROR	The network could not be created. `error` says why.