Create a traffic filter

POST /api/v1/serverless/traffic-filters

Api key

Creates a traffic filter that consists of a set of rules.

See Private connectivity for setup guides and regional service names.

AWS PrivateLink (`type: vpce`)

Each rule must include:

source — the VPC endpoint ID (format: vpce- followed by 17 lowercase hex characters).

Do not set azure_endpoint_name or azure_endpoint_guid on AWS rules.

Azure Private Link (`type: private_endpoint`)

Each rule must include:

azure_endpoint_name — the Azure Private Endpoint resource name (2–80 characters).
azure_endpoint_guid — the PE resource GUID (properties.resourceGuid), a lowercase UUID. This is not the ARM resource ID.

Do not set source on Azure rules.

application/json

Body Required

The specification for traffic filter.

name string Required

Name of the traffic filter

Minimum length is 1, maximum length is 128.
description string

Description of the traffic filter

Minimum length is 0, maximum length is 512.
type string Required
Type of the traffic filter. Determines which rule fields are valid:
- ip — IP/CIDR allowlist (source)
- vpce — AWS PrivateLink VPC endpoint (source)
- private_endpoint — Azure Private Link (azure_endpoint_name, azure_endpoint_guid)
Minimum length is 1, maximum length is 32. Values are ip, vpce, or private_endpoint.
include_by_default boolean

Should the traffic filter be automatically included in the new projects
region string Required

Serverless region ID the filter applies to (e.g. azure-australiaeast, aws-eu-west-1). The filter can only be attached to projects in this region.

Minimum length is 1, maximum length is 32.
rules array[object]

List of rules. Required fields depend on type: ip/vpce use source; private_endpoint uses azure_endpoint_name and azure_endpoint_guid (not source).
Hide rules attributes Show rules attributes object
A single traffic filter rule. Which fields are required depends on the parent filter's type — the fields are mutually exclusive between Azure and IP/VPC rules.
- description string
  
  Optional human-readable description of the rule.
- source string
  
  Allowed source for ip or vpce filters: an IP address, CIDR mask, or AWS VPC endpoint ID (vpce- followed by 17 lowercase hex characters). Must not be set for private_endpoint filters.
- azure_endpoint_name string
  
  Azure Private Endpoint resource name. Required for private_endpoint filters; not applicable to ip or vpce filters. Must be 2–80 characters, start with an alphanumeric character, and end with an alphanumeric character or underscore. May contain alphanumerics, underscores, periods, and hyphens.
  
  Minimum length is 2, maximum length is 80. Format should match the following pattern: ^[a-zA-Z0-9][-\w.]{0,78}[\w]$.
- azure_endpoint_guid string
  
  Azure Private Endpoint resource GUID (properties.resourceGuid from the Azure resource). Required for private_endpoint filters. Must be a lowercase UUID. This is not the ARM resource ID.
  
  Format should match the following pattern: ^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$.

Responses

201 application/json

The traffic filter definition is valid and the creation has started.
Hide headers attribute Show headers attribute
- ETag string
Hide response attributes Show response attributes object
- id string Required
  
  The traffic filter ID
  
  Minimum length is 32, maximum length is 32.
- name string Required
  
  Name of the traffic filter
  
  Minimum length is 1, maximum length is 128.
- description string
  
  Description of the traffic filter
  
  Minimum length is 0, maximum length is 512.
- type string Required
  
  Type of the traffic filter. Determines which rule fields are valid:
  
  ip — IP/CIDR allowlist (source)
  
  vpce — AWS PrivateLink VPC endpoint (source)
  
  private_endpoint — Azure Private Link (azure_endpoint_name, azure_endpoint_guid)
  
  Minimum length is 1, maximum length is 32. Values are ip, vpce, or private_endpoint.
- include_by_default boolean Required
  
  Should the traffic filter be automatically included in the new projects
- region string Required
  
  The traffic filter can be attached only to projects in the specific region
  
  Minimum length is 1, maximum length is 32.
- rules array[object] Required
  
  List of rules
  
  Hide rules attributes Show rules attributes object
  
  A single traffic filter rule. Which fields are required depends on the parent filter's type — the fields are mutually exclusive between Azure and IP/VPC rules.
  
  description string
  
  Optional human-readable description of the rule.
  
  source string
  
  Allowed source for ip or vpce filters: an IP address, CIDR mask, or AWS VPC endpoint ID (vpce- followed by 17 lowercase hex characters). Must not be set for private_endpoint filters.
  
  azure_endpoint_name string
  
  Azure Private Endpoint resource name. Required for private_endpoint filters; not applicable to ip or vpce filters. Must be 2–80 characters, start with an alphanumeric character, and end with an alphanumeric character or underscore. May contain alphanumerics, underscores, periods, and hyphens.
  
  Minimum length is 2, maximum length is 80. Format should match the following pattern: ^[a-zA-Z0-9][-\w.]{0,78}[\w]$.
  
  azure_endpoint_guid string
  
  Azure Private Endpoint resource GUID (properties.resourceGuid from the Azure resource). Required for private_endpoint filters. Must be a lowercase UUID. This is not the ARM resource ID.
  
  Format should match the following pattern: ^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}$.
400 application/json

Bad request
Hide response attribute Show response attribute object
- errors array[object] Required
  
  An error response returned by the API.
  
  Hide errors attributes Show errors attributes object
  
  An error response returned by the API.
  
  message string Required
  
  A human-readable message of the error.
  
  code string Required
  
  An identifier for this type of error.
401 application/json

Unauthorized
Hide response attribute Show response attribute object
- errors array[object] Required
  
  An error response returned by the API.
  
  Hide errors attributes Show errors attributes object
  
  An error response returned by the API.
  
  message string Required
  
  A human-readable message of the error.
  
  code string Required
  
  An identifier for this type of error.
409 application/json

Conflict
Hide response attribute Show response attribute object
- errors array[object] Required
  
  An error response returned by the API.
  
  Hide errors attributes Show errors attributes object
  
  An error response returned by the API.
  
  message string Required
  
  A human-readable message of the error.
  
  code string Required
  
  An identifier for this type of error.
500 application/json

Internal server error
Hide response attribute Show response attribute object
- errors array[object] Required
  
  An error response returned by the API.
  
  Hide errors attributes Show errors attributes object
  
  An error response returned by the API.
  
  message string Required
  
  A human-readable message of the error.
  
  code string Required
  
  An identifier for this type of error.

POST /api/v1/serverless/traffic-filters

curl \
 --request POST 'https://api.elastic-cloud.com/api/v1/serverless/traffic-filters' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"name\": \"my-azure-pl-filter\",\n  \"description\": \"Allow traffic from office VNet\",\n  \"region\": \"azure-australiaeast\",\n  \"type\": \"private_endpoint\",\n  \"include_by_default\": false,\n  \"rules\": [\n    {\n      \"description\": \"Office VNet PE\",\n      \"azure_endpoint_name\": \"my-private-endpoint\",\n      \"azure_endpoint_guid\": \"7c0f05e4-e32b-4b10-a246-7b77f7dcc63c\"\n    }\n  ]\n}"'

Request examples

Use for Azure Private Link. Requires a pending PE connection created against the region's PLS alias from the metadata endpoint.

{
  "name": "my-azure-pl-filter",
  "description": "Allow traffic from office VNet",
  "region": "azure-australiaeast",
  "type": "private_endpoint",
  "include_by_default": false,
  "rules": [
    {
      "description": "Office VNet PE",
      "azure_endpoint_name": "my-private-endpoint",
      "azure_endpoint_guid": "7c0f05e4-e32b-4b10-a246-7b77f7dcc63c"
    }
  ]
}

{
  "name": "my-aws-pl-filter",
  "region": "aws-eu-west-1",
  "type": "vpce",
  "include_by_default": false,
  "rules": [
    {
      "source": "vpce-0123456789abcdef0"
    }
  ]
}

{
  "name": "my-ip-filter",
  "region": "aws-eu-west-1",
  "type": "ip",
  "include_by_default": false,
  "rules": [
    {
      "source": "203.0.113.0/24"
    }
  ]
}