API reference

Private networks

Whole subnets behind a connector, reachable from Cloudraw Connect.

GETList private networks
POSTCreate a private network
GETGet a private network
PATCHUpdate a private network
DELETEDelete a private network

List private networks

GET/v0/tenants/{tenant_id}/private-networks

read-only token

Returns every private network (IP ranges and DNS zones reached through a connector), oldest first, with how many access rules grant each one and any DNS findings. Not paginated (bounded by the plan's private-network limit).

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Responses

200 All private networks.

application/json

itemsarray of PrivateNetworkrequired
items fields
- idstringrequired
- namestringrequired
- connector_idstringrequired
  Primary hosting connector (cannot be changed).
- connector_idsarray of string
  Every hosting connector (1-5).
- cidrsarray of stringrequired
  IPv4 ranges devices reach through the connector.
- dns_zonesarray of string
  DNS suffixes of this environment (e.g. corp.example.local); subdomains are included.
- dns_serversarray of string
  Your internal DNS servers (inside cidrs).
- dns_modestring
  overlay: the connector resolves names in dns_zones (address records only). forward: devices send DNS for the zones to dns_servers through the tunnel (full DNS, needed for a domain join).
  One of: overlay, forward.
- translateboolean
  Address translation is on (for ranges that overlap the devices' own networks).
- translated_cidrstring | null
  With translation on: the range devices use instead of cidrs[0] (from 100.65.0.0/16).
- guidesobject
  guides fields
  - networkone of
  - cidrone of
  - translateone of
- protocolsarray of string
  One of: tcp, udp.
- port_rangesarray of PrivateNetworkPortRange
  port_ranges fields
  - lowintegerrequired
    Range: 1–65535.
  - highintegerrequired
    Range: 1–65535.
- require_trusted_deviceboolean
  Access rules for this network also require a trusted device (default true).
- access_rule_countinteger
  Access rules that grant this network.
- notesarray of string
  Plain-English hints about the DNS setup.
- dns_findingsarray of object
  Zones / DNS servers outside private address space, and why they are allowed.
  dns_findings fields
  - kindstring
    One of: zone, dns_server.
  - valuestring
  - classstring
    One of: verified, operator, legacy, refused.
- statusobject
  status fields
  - phasestring
    One of: provisioning, ready, degraded.
  - observed_atstring (date-time)
  - messagestring | null
- versionintegerrequired
  Increases on every change; send as If-Match on PATCH.
- created_atstring (date-time)
- updated_atstring | null (date-time)
next_pagenull
Always null: the list is not paginated.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "items": [
    {
      "id": "pn_6b2x9q0wea",
      "name": "HQ servers",
      "connector_id": "cn0r4w8t2kq",
      "connector_ids": [
        "cn0r4w8t2kq"
      ],
      "cidrs": [
        "10.20.0.0/16"
      ],
      "dns_zones": [
        "corp.example.local"
      ],
      "dns_servers": [
        "10.20.0.10"
      ],
      "dns_mode": "forward",
      "translate": false,
      "translated_cidr": null,
      "guides": {
        "network": {
          "id": "network-private",
          "section": null,
          "title": "Private networks",
          "url": "https://cdapi.cloudraw.com/guides/network-private",
          "pdf_url": null
        },
        "cidr": {
          "id": "network-private",
          "section": null,
          "title": "Private networks",
          "url": "https://cdapi.cloudraw.com/guides/network-private",
          "pdf_url": null
        },
        "translate": {
          "id": "network-private",
          "section": null,
          "title": "Private networks",
          "url": "https://cdapi.cloudraw.com/guides/network-private",
          "pdf_url": null
        }
      },
      "protocols": [
        "tcp",
        "udp"
      ],
      "port_ranges": [
        {
          "low": 1,
          "high": 65535
        }
      ],
      "require_trusted_device": true,
      "access_rule_count": 0,
      "notes": [
        "Clients forward corp.example.local to 10.20.0.10 through the tunnel (client support: phase 2)."
      ],
      "dns_findings": [],
      "status": {
        "phase": "ready",
        "observed_at": "2026-10-13T09:24:11.000Z",
        "message": null
      },
      "version": 1,
      "created_at": "2026-10-13T09:24:11.000Z",
      "updated_at": "2026-10-13T09:24:11.000Z"
    }
  ],
  "next_page": null
}

Create a private network

POST/v0/tenants/{tenant_id}/private-networks

full-access tokenidempotent

Publishes whole IPv4 ranges (and optionally the DNS zones of that environment, such as an Active Directory domain) through a connector, for legacy access like RDP, SMB or LDAP to a subnet. Zero trust: it grants no one until an access rule targets it, and by default such rules also require a trusted device. With dns_servers, devices forward DNS for dns_zones to your own servers (full DNS, needed for a domain join); without, the connector resolves the names itself. Zones outside private space must be a domain this workspace verified by DNS TXT; such zones raise a security alert. Audited.

Token: full access · Created by: owner

Idempotency: send Idempotency-Key to retry safely — the same key and body within 24 h returns the first answer.

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab

Headers

Idempotency-Keystring
A unique value (e.g. a UUID) per logical operation. Retrying with the same key and body within 24 hours returns the first answer instead of doing the work twice.
Example: 6f1c2b9e-3d4a-4c1e-9b8f-0a7d5e2c1b3f

Request body application/json

namestringrequired
1-64 characters, at least one letter or digit. Unique in the workspace.
Max length 64.
connector_idstringrequired
Hosting connector.
connector_idsarray of string
Optional extra hosting connectors (1-5 in total).
cidrsarray of stringrequired
1-32 IPv4 CIDR ranges, /8 or narrower, host bits zero, not overlapping each other or another private network. Loopback, link-local, multicast and 100.64.0.0/10 are refused.
dns_zonesarray of string
Up to 10 zones. A private suffix (.local, .internal, .lan, .corp, home.arpa, private reverse zones…) or a domain this workspace has verified by DNS TXT. Not wildcards.
dns_serversarray of string
Up to 4 private IPv4 addresses, each inside one of cidrs.
protocolsarray of string
Default ["tcp","udp"].
One of: tcp, udp.
port_rangesarray of PrivateNetworkPortRange
1-20 ranges. Default all ports.
port_ranges fields
- lowintegerrequired
  Range: 1–65535.
- highintegerrequired
  Range: 1–65535.
require_trusted_deviceboolean
Default true.
translateboolean
Address translation: needs exactly one range in cidrs, between /16 and /30.

Responses

201 The new private network.

application/json

idstringrequired
namestringrequired
connector_idstringrequired
Primary hosting connector (cannot be changed).
connector_idsarray of string
Every hosting connector (1-5).
cidrsarray of stringrequired
IPv4 ranges devices reach through the connector.
dns_zonesarray of string
DNS suffixes of this environment (e.g. corp.example.local); subdomains are included.
dns_serversarray of string
Your internal DNS servers (inside cidrs).
dns_modestring
overlay: the connector resolves names in dns_zones (address records only). forward: devices send DNS for the zones to dns_servers through the tunnel (full DNS, needed for a domain join).
One of: overlay, forward.
translateboolean
Address translation is on (for ranges that overlap the devices' own networks).
translated_cidrstring | null
With translation on: the range devices use instead of cidrs[0] (from 100.65.0.0/16).
guidesobject
guides fields
- networkone of
- cidrone of
- translateone of
protocolsarray of string
One of: tcp, udp.
port_rangesarray of PrivateNetworkPortRange
port_ranges fields
- lowintegerrequired
  Range: 1–65535.
- highintegerrequired
  Range: 1–65535.
require_trusted_deviceboolean
Access rules for this network also require a trusted device (default true).
access_rule_countinteger
Access rules that grant this network.
notesarray of string
Plain-English hints about the DNS setup.
dns_findingsarray of object
Zones / DNS servers outside private address space, and why they are allowed.
dns_findings fields
- kindstring
  One of: zone, dns_server.
- valuestring
- classstring
  One of: verified, operator, legacy, refused.
statusobject
status fields
- phasestring
  One of: provisioning, ready, degraded.
- observed_atstring (date-time)
- messagestring | null
versionintegerrequired
Increases on every change; send as If-Match on PATCH.
created_atstring (date-time)
updated_atstring | null (date-time)

400 invalid-private-network

invalid-private-network: A field is invalid. errors[] lists each {path, message}; a CIDR with host bits set also carries suggestions (e.g. 10.20.5.0/24).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 private-network-quota-reached insufficient-scope insufficient-role tenant-assertion-mismatch

private-network-quota-reached: The workspace has reached its plan's private-network limit (default 5).

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 tenant-not-found

tenant-not-found: No workspace with this id.

409 private-network-name-taken name-conflicts-with-a-connection cidr-overlaps-another-private-network no-translated-range-left idempotency-key-reuse

private-network-name-taken: Another private network already uses this name.

name-conflicts-with-a-connection: The name collides with an application's internal name; choose another name.

cidr-overlaps-another-private-network: A range overlaps a range of another private network; conflict names it.

no-translated-range-left: Translation is on and the workspace has used all translated address ranges.

idempotency-key-reuse: The same Idempotency-Key was used with a different body within 24 hours.

502 provisioning-failed

provisioning-failed: The network could not be set up right now; nothing was created. Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X POST "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "HQ servers",
  "connector_id": "cn0r4w8t2kq",
  "cidrs": [
    "10.20.0.0/16"
  ],
  "dns_zones": [
    "corp.example.local"
  ],
  "dns_servers": [
    "10.20.0.10"
  ]
}'

PowerShell

$body = @'
{
  "name": "HQ servers",
  "connector_id": "cn0r4w8t2kq",
  "cidrs": [
    "10.20.0.0/16"
  ],
  "dns_zones": [
    "corp.example.local"
  ],
  "dns_servers": [
    "10.20.0.10"
  ]
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN"; "Idempotency-Key" = [guid]::NewGuid().ToString() }
Invoke-RestMethod -Method Post -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.post(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}", "Idempotency-Key": str(uuid.uuid4())},
    json={
        "name": "HQ servers",
        "connector_id": "cn0r4w8t2kq",
        "cidrs": [
            "10.20.0.0/16"
        ],
        "dns_zones": [
            "corp.example.local"
        ],
        "dns_servers": [
            "10.20.0.10"
        ]
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Idempotency-Key": crypto.randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "name": "HQ servers",
    "connector_id": "cn0r4w8t2kq",
    "cidrs": [
      "10.20.0.0/16"
    ],
    "dns_zones": [
      "corp.example.local"
    ],
    "dns_servers": [
      "10.20.0.10"
    ]
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 201 · application/json

{
  "id": "pn_6b2x9q0wea",
  "name": "HQ servers",
  "connector_id": "cn0r4w8t2kq",
  "connector_ids": [
    "cn0r4w8t2kq"
  ],
  "cidrs": [
    "10.20.0.0/16"
  ],
  "dns_zones": [
    "corp.example.local"
  ],
  "dns_servers": [
    "10.20.0.10"
  ],
  "dns_mode": "forward",
  "translate": false,
  "translated_cidr": null,
  "guides": {
    "network": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    },
    "cidr": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    },
    "translate": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    }
  },
  "protocols": [
    "tcp",
    "udp"
  ],
  "port_ranges": [
    {
      "low": 1,
      "high": 65535
    }
  ],
  "require_trusted_device": true,
  "access_rule_count": 0,
  "notes": [
    "Clients forward corp.example.local to 10.20.0.10 through the tunnel (client support: phase 2)."
  ],
  "dns_findings": [],
  "status": {
    "phase": "ready",
    "observed_at": "2026-10-13T09:24:11.000Z",
    "message": null
  },
  "version": 1,
  "created_at": "2026-10-13T09:24:11.000Z",
  "updated_at": "2026-10-13T09:24:11.000Z"
}

Get a private network

GET/v0/tenants/{tenant_id}/private-networks/{network_id}

read-only token

Returns one private network (same shape as in the list).

Token: read-only or full access · Created by: owner or security admin

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
network_idstringrequired
Private network id.
Example: pn_6b2x9q0wea

Responses

200 The private network.

application/json

idstringrequired
namestringrequired
connector_idstringrequired
Primary hosting connector (cannot be changed).
connector_idsarray of string
Every hosting connector (1-5).
cidrsarray of stringrequired
IPv4 ranges devices reach through the connector.
dns_zonesarray of string
DNS suffixes of this environment (e.g. corp.example.local); subdomains are included.
dns_serversarray of string
Your internal DNS servers (inside cidrs).
dns_modestring
overlay: the connector resolves names in dns_zones (address records only). forward: devices send DNS for the zones to dns_servers through the tunnel (full DNS, needed for a domain join).
One of: overlay, forward.
translateboolean
Address translation is on (for ranges that overlap the devices' own networks).
translated_cidrstring | null
With translation on: the range devices use instead of cidrs[0] (from 100.65.0.0/16).
guidesobject
guides fields
- networkone of
- cidrone of
- translateone of
protocolsarray of string
One of: tcp, udp.
port_rangesarray of PrivateNetworkPortRange
port_ranges fields
- lowintegerrequired
  Range: 1–65535.
- highintegerrequired
  Range: 1–65535.
require_trusted_deviceboolean
Access rules for this network also require a trusted device (default true).
access_rule_countinteger
Access rules that grant this network.
notesarray of string
Plain-English hints about the DNS setup.
dns_findingsarray of object
Zones / DNS servers outside private address space, and why they are allowed.
dns_findings fields
- kindstring
  One of: zone, dns_server.
- valuestring
- classstring
  One of: verified, operator, legacy, refused.
statusobject
status fields
- phasestring
  One of: provisioning, ready, degraded.
- observed_atstring (date-time)
- messagestring | null
versionintegerrequired
Increases on every change; send as If-Match on PATCH.
created_atstring (date-time)
updated_atstring | null (date-time)

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-role tenant-assertion-mismatch

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 private-network-not-found tenant-not-found

private-network-not-found: No private network with this id in the workspace.

tenant-not-found: No workspace with this id.

curl

curl -sS -X GET "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Get -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea" -Headers $headers

Python

import os, uuid, requests

r = requests.get(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "pn_6b2x9q0wea",
  "name": "HQ servers",
  "connector_id": "cn0r4w8t2kq",
  "connector_ids": [
    "cn0r4w8t2kq"
  ],
  "cidrs": [
    "10.20.0.0/16"
  ],
  "dns_zones": [
    "corp.example.local"
  ],
  "dns_servers": [
    "10.20.0.10"
  ],
  "dns_mode": "forward",
  "translate": false,
  "translated_cidr": null,
  "guides": {
    "network": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    },
    "cidr": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    },
    "translate": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    }
  },
  "protocols": [
    "tcp",
    "udp"
  ],
  "port_ranges": [
    {
      "low": 1,
      "high": 65535
    }
  ],
  "require_trusted_device": true,
  "access_rule_count": 0,
  "notes": [
    "Clients forward corp.example.local to 10.20.0.10 through the tunnel (client support: phase 2)."
  ],
  "dns_findings": [],
  "status": {
    "phase": "ready",
    "observed_at": "2026-10-13T09:24:11.000Z",
    "message": null
  },
  "version": 1,
  "created_at": "2026-10-13T09:24:11.000Z",
  "updated_at": "2026-10-13T09:24:11.000Z"
}

Update a private network

PATCH/v0/tenants/{tenant_id}/private-networks/{network_id}

full-access token

Changes the name, ranges, DNS zones / servers, protocols, ports, hosting connectors, translation or the trusted-device requirement. Changes apply live and existing access rules keep pointing at the network; changing require_trusted_device re-applies every rule that grants it. The primary connector_id cannot be changed (create a new network instead). A DNS change is audited and, outside private space, raises a security alert. If an update fails half-way, the previous settings are kept. Send If-Match: <version> to fail with 409 version-conflict instead of overwriting a change made in the meantime.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
network_idstringrequired
Private network id.
Example: pn_6b2x9q0wea

Request body application/json

namestring
Max length 64.
connector_idsarray of string
Replaces the hosting connectors (1-5).
cidrsarray of string
dns_zonesarray of string
dns_serversarray of string
protocolsarray of string
One of: tcp, udp.
port_rangesarray of PrivateNetworkPortRange
port_ranges fields
- lowintegerrequired
  Range: 1–65535.
- highintegerrequired
  Range: 1–65535.
require_trusted_deviceboolean
translateboolean

Responses

200 The updated private network.

application/json

idstringrequired
namestringrequired
connector_idstringrequired
Primary hosting connector (cannot be changed).
connector_idsarray of string
Every hosting connector (1-5).
cidrsarray of stringrequired
IPv4 ranges devices reach through the connector.
dns_zonesarray of string
DNS suffixes of this environment (e.g. corp.example.local); subdomains are included.
dns_serversarray of string
Your internal DNS servers (inside cidrs).
dns_modestring
overlay: the connector resolves names in dns_zones (address records only). forward: devices send DNS for the zones to dns_servers through the tunnel (full DNS, needed for a domain join).
One of: overlay, forward.
translateboolean
Address translation is on (for ranges that overlap the devices' own networks).
translated_cidrstring | null
With translation on: the range devices use instead of cidrs[0] (from 100.65.0.0/16).
guidesobject
guides fields
- networkone of
- cidrone of
- translateone of
protocolsarray of string
One of: tcp, udp.
port_rangesarray of PrivateNetworkPortRange
port_ranges fields
- lowintegerrequired
  Range: 1–65535.
- highintegerrequired
  Range: 1–65535.
require_trusted_deviceboolean
Access rules for this network also require a trusted device (default true).
access_rule_countinteger
Access rules that grant this network.
notesarray of string
Plain-English hints about the DNS setup.
dns_findingsarray of object
Zones / DNS servers outside private address space, and why they are allowed.
dns_findings fields
- kindstring
  One of: zone, dns_server.
- valuestring
- classstring
  One of: verified, operator, legacy, refused.
statusobject
status fields
- phasestring
  One of: provisioning, ready, degraded.
- observed_atstring (date-time)
- messagestring | null
versionintegerrequired
Increases on every change; send as If-Match on PATCH.
created_atstring (date-time)
updated_atstring | null (date-time)

400 invalid-private-network

invalid-private-network: A field is invalid, unknown, connector_id was sent, or the body changes nothing. errors[] lists each {path, message}.

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 private-network-not-found tenant-not-found

private-network-not-found: No private network with this id in the workspace.

tenant-not-found: No workspace with this id.

409 version-conflict cidr-overlaps-another-private-network no-translated-range-left

version-conflict: If-Match does not match the current version.

cidr-overlaps-another-private-network: A new range overlaps a range of another private network.

no-translated-range-left: Translation is on and the workspace has used all translated address ranges.

502 provisioning-failed

provisioning-failed: The change could not be applied right now; the previous settings were kept. Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X PATCH "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "cidrs": [
    "10.20.0.0/16",
    "10.30.0.0/24"
  ],
  "require_trusted_device": true
}'

PowerShell

$body = @'
{
  "cidrs": [
    "10.20.0.0/16",
    "10.30.0.0/24"
  ],
  "require_trusted_device": true
}
'@
$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Patch -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea" -Headers $headers -ContentType "application/json" -Body $body

Python

import os, uuid, requests

r = requests.patch(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    json={
        "cidrs": [
            "10.20.0.0/16",
            "10.30.0.0/24"
        ],
        "require_trusted_device": True
    },
    timeout=30,
)
r.raise_for_status()
print(r.json())

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "cidrs": [
      "10.20.0.0/16",
      "10.30.0.0/24"
    ],
    "require_trusted_device": true
  }),
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(await res.json());

Response 200 · application/json

{
  "id": "pn_6b2x9q0wea",
  "name": "HQ servers",
  "connector_id": "cn0r4w8t2kq",
  "connector_ids": [
    "cn0r4w8t2kq"
  ],
  "cidrs": [
    "10.20.0.0/16",
    "10.30.0.0/24"
  ],
  "dns_zones": [
    "corp.example.local"
  ],
  "dns_servers": [
    "10.20.0.10"
  ],
  "dns_mode": "forward",
  "translate": false,
  "translated_cidr": null,
  "guides": {
    "network": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    },
    "cidr": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    },
    "translate": {
      "id": "network-private",
      "section": null,
      "title": "Private networks",
      "url": "https://cdapi.cloudraw.com/guides/network-private",
      "pdf_url": null
    }
  },
  "protocols": [
    "tcp",
    "udp"
  ],
  "port_ranges": [
    {
      "low": 1,
      "high": 65535
    }
  ],
  "require_trusted_device": true,
  "access_rule_count": 0,
  "notes": [
    "Clients forward corp.example.local to 10.20.0.10 through the tunnel (client support: phase 2)."
  ],
  "dns_findings": [],
  "status": {
    "phase": "ready",
    "observed_at": "2026-10-13T09:24:11.000Z",
    "message": null
  },
  "version": 2,
  "created_at": "2026-10-13T09:24:11.000Z",
  "updated_at": "2026-10-13T09:24:11.000Z"
}

Delete a private network

DELETE/v0/tenants/{tenant_id}/private-networks/{network_id}

full-access token

Removes the private network. Every access rule that targets it is revoked and deleted first, so no grant is left behind. Cannot be undone. Audited. The answer is a finished task.

Token: full access · Created by: owner

Path parameters

tenant_idstringrequired
Your workspace id (Settings → Workspace in the console; it is also in every console URL).
Example: tq7x2m9k4ab
network_idstringrequired
Private network id.
Example: pn_6b2x9q0wea

Responses

202 Deleted (the task is already done).

application/json

idstringrequired
tenant_idstring
statestringrequired
One of: pending, running, done, failed.
result_uristring | null
errorobject | string | null
Why it failed, or a short status note (e.g. revoke_pending).

401 unauthorized invalid-token token-expired

unauthorized: No Authorization: Bearer crw_… header was sent.

invalid-token: The token is unknown or was revoked.

token-expired: The token is past its expiry date. Create a new one.

403 insufficient-scope insufficient-role tenant-assertion-mismatch

insufficient-scope: The token is read-only and this call changes something.

insufficient-role: The token's role ceiling does not allow this call.

tenant-assertion-mismatch: The token belongs to another workspace than {tenant_id}.

404 private-network-not-found tenant-not-found

private-network-not-found: No private network with this id in the workspace.

tenant-not-found: No workspace with this id.

502 delete-failed

delete-failed: The network could not be removed right now (if the message says so, its access rules were already revoked). Retry.

503 busy

busy: Cloudraw is switching servers or cannot save right now. Retry after Retry-After seconds.

curl

curl -sS -X DELETE "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea" \
  -H "Authorization: Bearer $CLOUDRAW_TOKEN"

PowerShell

$headers = @{ Authorization = "Bearer $env:CLOUDRAW_TOKEN" }
Invoke-RestMethod -Method Delete -Uri "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea" -Headers $headers

Python

import os, uuid, requests

r = requests.delete(
    "https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea",
    headers={"Authorization": f"Bearer {os.environ['CLOUDRAW_TOKEN']}"},
    timeout=30,
)
r.raise_for_status()
print(r.status_code)

Node.js

const res = await fetch("https://cdapi.cloudraw.com/v0/tenants/tq7x2m9k4ab/private-networks/pn_6b2x9q0wea", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.CLOUDRAW_TOKEN}`,
  },
});
if (!res.ok) throw new Error((await res.json()).code);
console.log(res.status);

Response 202 · application/json

{
  "id": "task_8k2m0x9s1d",
  "tenant_id": "tq7x2m9k4ab",
  "state": "done",
  "result_uri": null,
  "error": null
}