Partially update a dedicated Gateway. All fields are optional — flat body, no nesting.
Returns 404 if the gateway does not exist or belongs to a different tenant — never 403,
to avoid confirming the existence of gateways owned by other tenants.
tenantIds are validated against the caller's organization — 403 on mismatch.
When datacenter changes, availabilityZones must match the new datacenter prefix
— returns 400 on mismatch.
Sending ipsec.left.secret: null explicitly returns 400 IPSEC_SECRET_CLEAR_NOT_SUPPORTED
— omit the field to leave the existing secret unchanged.
Sending ipsec: null explicitly returns 400 IPSEC_REMOVAL_NOT_SUPPORTED
— IPSec configuration cannot be removed from a gateway that has it.
Partial IPSec update: When ipsec is present in the patch, sub-fields are
deep-merged — you may supply only left.secret to rotate the PSK without replacing
the rest of the configuration, or supply the full ipsec block to replace cipher
suites and endpoint addresses simultaneously.
contact: null is rejected. Setting contact to null in a merge-patch returns
409 — the contact field cannot be removed from a dedicated gateway.
tenantIds: [] is rejected. Setting tenantIds to an empty array returns 400
— a dedicated gateway must always have at least one tenant (minItems: 1 enforced by schema).
Known limitation: Concurrent modifications to the same gateway may overwrite each
other — no optimistic locking is in place for this release.
Datacenter change is destructive: Expect a connectivity outage while the gateway is
re-provisioned. status.state resets to PENDING immediately; status.tunnelState resets
to null; status records for the old datacenter are expired. dedicatedIps.ips are not
cleared immediately — treat them as unreliable until VSC completes provisioning in the new datacenter.
Required Permissions: ztna:update
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Gateway updated.
Gateway not found or belongs to a different tenant.