Networking (neutron) API
Reference
July 19, 2014 API v2.0 and extensions
13
2. General API information
Authentication and authorization ................................................................................. 13
Request and response formats ...................................................................................... 14
Filtering and column selection ....................................................................................... 14
Synchronous versus asynchronous plug-in behavior ........................................................ 15
Bulk-create .................................................................................................................... 15
Pagination ..................................................................................................................... 16
Sorting .......................................................................................................................... 19
Extensions ..................................................................................................................... 20
Faults ............................................................................................................................ 21
The Networking API v2.0 is a ReSTful HTTP service that uses all aspects of the HTTP protocol
including methods, URIs, media types, response codes, and so on. Providers can use
existing features of the protocol including caching, persistent connections, and content
compression. For example, providers who employ a caching layer can respond with a 203
code instead of a 200 code when a request is served from the cache. Additionally, providers
can offer support for conditional GET requests by using ETags, or they may send a redirect
in response to a GET request. Create clients so that these differences are accounted for.
Authentication and authorization
The Networking API v2.0 uses the Keystone Identity Service as the default authentication
service. When Keystone is enabled, users that submit requests to the OpenStack
Networking service must provide an authentication token in X-Auth-Token request header.
You obtain the token by authenticating to the Keystone endpoint. For more information
about Keystone, see the OpenStack Identity Service API v2.0 Reference.
When Keystone is enabled, the tenant_id attribute is not required in create requests
because the tenant ID is derived from the authentication token.
The default authorization settings allow only administrative users to create resources on
behalf of a different tenant.
OpenStack Networking uses information received from Keystone to authorize user
requests. OpenStack Networking handles the following types of authorization policies:
• Operation-based policies specify access criteria for specific operations, possibly with fine-
grained control over specific attributes.
• Resource-based policies access a specific resource. Permissions might or might not be
granted depending on the permissions configured for the resource. Currently available
for only the network resource.
The actual authorization policies enforced in OpenStack Networking might vary from
deployment to deployment.