# Create

`POST /api/2.0/accounts/{account_id}/network-connectivity-configs`

Creates a network connectivity configuration (NCC), which provides stable Azure service
 subnets when accessing your Azure Storage accounts. You can also use a network connectivity configuration to create
 <Databricks> managed private endpoints so that <Databricks> serverless compute resources privately access your
 resources.

 **IMPORTANT**: After you create the network connectivity configuration, you must assign one or more workspaces to the new network connectivity configuration.
 You can share one network connectivity configuration with multiple workspaces from the same Azure region within
 the same <Databricks> account.
 See [configure serverless secure connectivity](https://learn.microsoft.com/azure/databricks/security/network/serverless-network-security).

API scopes: networking

**AWS**

Creates a network connectivity configuration (NCC), which provides stable IP CIDR blocks that are associated with your workspace.
You can assign an NCC to one or more workspaces in the same region. Once assigned, the workspace serverless compute
resources use the same set of stable IP CIDR blocks to access your resources.

## Path parameters

- `account_id` (string, optional)
  Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

## Request body

- `network_connectivity_config` (object, optional)
  - `network_connectivity_config_id` (string, optional)
    <Databricks> network connectivity configuration ID.
    Example: `d6df3889-eefc-4ddb-bbb4-613efcb30035`
  - `account_id` (string, optional)
    Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.
    Example: `449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65`
  - `name` (string, optional)
    The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,
     and underscores. The length must be between 3 and 30 characters. The name must match the regular
     expression ^[0-9a-zA-Z-_]{3,30}$
    Example: `my-example-ncc`
  - `region` (string, optional)
    The region for the network connectivity configuration.
     Only workspaces in the same region can be attached to the network connectivity configuration.
  - `egress_config` (object, optional)
    The network connectivity rules that apply to network traffic from your serverless compute resources.
    - `default_rules` (object, optional)
      The network connectivity rules that are applied by default without resource specific configurations. 
       You can find the stable network information of your serverless compute resources here.
      - `azure_service_endpoint_rule` (object, optional)
      - `aws_stable_ip_rule` (object, optional)
    - `target_rules` (object, optional)
      The network connectivity rules that configured for each destinations. These rules override default rules.
      - `azure_private_endpoint_rules` (array of object, optional)
      - `aws_private_endpoint_rules` (array of object, optional)
        AWS private endpoint rule controls the AWS private endpoint based egress rules.
  - `updated_time` (int64, optional)
    Time in epoch milliseconds when this object was updated.
    Example: `1691436121777`
  - `creation_time` (int64, optional)
    Time in epoch milliseconds when this object was created.
    Example: `1691436121706`

## Returns

- `network_connectivity_config_id` (string, optional)
  <Databricks> network connectivity configuration ID.
  Example: `d6df3889-eefc-4ddb-bbb4-613efcb30035`
- `account_id` (string, optional)
  Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.
  Example: `449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65`
- `name` (string, optional)
  The name of the network connectivity configuration. The name can contain alphanumeric characters, hyphens,
   and underscores. The length must be between 3 and 30 characters. The name must match the regular
   expression ^[0-9a-zA-Z-_]{3,30}$
  Example: `my-example-ncc`
- `region` (string, optional)
  The region for the network connectivity configuration.
   Only workspaces in the same region can be attached to the network connectivity configuration.
- `egress_config` (object, optional)
  The network connectivity rules that apply to network traffic from your serverless compute resources.
  - `default_rules` (object, optional)
    The network connectivity rules that are applied by default without resource specific configurations. 
     You can find the stable network information of your serverless compute resources here.
    - `azure_service_endpoint_rule` (object, optional)
      - `target_region` (string, optional)
        The Azure region in which this service endpoint rule applies..
        Example: `westus`
      - `target_services` (array of string, optional)
        The Azure services to which this service endpoint rule applies to.
        Possible values: `EGRESS_RESOURCE_TYPE_UNSPECIFIED`, `AZURE_BLOB_STORAGE`
      - `subnets` (array of string, optional)
        The list of subnets from which <Databricks> network traffic originates when accessing your Azure resources.
    - `aws_stable_ip_rule` (object, optional)
      - `cidr_blocks` (array of string, optional)
        The list of stable IP CIDR blocks from which <Databricks> network traffic originates when accessing your resources.
        Example: `10.0.0.0/24`
  - `target_rules` (object, optional)
    The network connectivity rules that configured for each destinations. These rules override default rules.
    - `azure_private_endpoint_rules` (array of object, optional)
      - `rule_id` (string, optional)
        The ID of a private endpoint rule.
        Example: `728c1541-d6d1-4290-9a53-cdf01dd32d60`
      - `network_connectivity_config_id` (string, optional)
        The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.
        Example: `d6df3889-eefc-4ddb-bbb4-613efcb30035`
      - `resource_id` (string, optional)
        The Azure resource ID of the target resource.
      - `group_id` (string, optional)
        Only used by private endpoints to Azure first-party services.
        
         The sub-resource type (group ID) of the target resource.
         Note that to connect to workspace root storage (root DBFS), you need two endpoints, one for blob and one for dfs.
        Example: `blob`
      - `endpoint_name` (string, optional)
        The name of the Azure private endpoint resource.
        Example: `databricks-088781b3-77fa-4132-b429-1af0d91bc593-pe-3cb31234`
      - `connection_state` (string, optional)
        The current status of this private endpoint. The private endpoint rules are effective only if the connection state
         is ESTABLISHED. Remember that you must approve new endpoints on your resources in the Azure portal
         before they take effect.
         The possible values are:
         - INIT: (deprecated) The endpoint has been created and pending approval.
         - PENDING: The endpoint has been created and pending approval.
         - ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
         - REJECTED: Connection was rejected by the private link resource owner.
         - DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
         - EXPIRED: If the endpoint was created but not approved in 14 days, it will be EXPIRED.
        Possible values: `PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED`, `INIT`, `ESTABLISHED`, `REJECTED`, `DISCONNECTED`, `EXPIRED`, `PENDING`, `CREATING`, `CREATE_FAILED`
        Example: `ESTABLISHED`
      - `creation_time` (int64, optional)
        Time in epoch milliseconds when this object was created.
        Example: `1691436121706`
      - `updated_time` (int64, optional)
        Time in epoch milliseconds when this object was updated.
        Example: `1691436121777`
      - `deactivated` (boolean, optional)
        Whether this private endpoint is deactivated.
        Example: `false`
      - `deactivated_at` (int64, optional)
        Time in epoch milliseconds when this object was deactivated.
        Example: `1691436121706`
      - `domain_names` (array of string, optional)
        Not used by customer-managed private endpoint services.
        
         Domain names of target private link service.
         When updating this field, the full list of target domain_names must be specified.
        Example: `my-example.exampledomain.com`
      - `error_message` (string, optional)
    - `aws_private_endpoint_rules` (array of object, optional)
      AWS private endpoint rule controls the AWS private endpoint based egress rules.
      - `rule_id` (string, optional)
        The ID of a private endpoint rule.
        Example: `728c1541-d6d1-4290-9a53-cdf01dd32d60`
      - `network_connectivity_config_id` (string, optional)
        The ID of a network connectivity configuration, which is the parent resource of this private endpoint rule object.
        Example: `d6df3889-eefc-4ddb-bbb4-613efcb30035`
      - `account_id` (string, optional)
        <Databricks> account ID. You can find your account ID from the Accounts Console.
        Example: `449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65`
      - `endpoint_service` (string, optional)
        The full target AWS endpoint service name that connects to the destination resources of the private endpoint.
        Example: `com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123`
      - `domain_names` (array of string, optional)
        Only used by private endpoints towards a VPC endpoint service for customer-managed VPC endpoint service.
        
         The target AWS resource FQDNs accessible via the VPC endpoint service.
         When updating this field, we perform full update on this field. Please ensure a full list of desired domain_names is provided.
        Example: `testing.casg1cikhkce.us-east-1.rds.amazonaws.com`
      - `resource_names` (array of string, optional)
        Only used by private endpoints towards AWS S3 service.
        
         The globally unique S3 bucket names that will be accessed via the VPC endpoint.
         The bucket names must be in the same region as the NCC/endpoint service.
         When updating this field, we perform full update on this field.
         Please ensure a full list of desired resource_names is provided.
        Example: `mybucket1`
      - `vpc_endpoint_id` (string, optional)
        The AWS VPC endpoint ID. You can use this ID to identify VPC endpoint created by <Databricks>.
        Example: `vpce-02c2bd4e6dcd6c76d`
      - `connection_state` (string, optional)
        The current status of this private endpoint. The private endpoint rules are effective only if the connection state
         is ESTABLISHED. Remember that you must approve new endpoints on your resources in the AWS console
         before they take effect.
         The possible values are:
         - PENDING: The endpoint has been created and pending approval.
         - ESTABLISHED: The endpoint has been approved and is ready to use in your serverless compute resources.
         - REJECTED: Connection was rejected by the private link resource owner.
         - DISCONNECTED: Connection was removed by the private link resource owner, the private endpoint becomes informative and should be deleted for clean-up.
         - EXPIRED: If the endpoint is created but not approved in 14 days, it is EXPIRED.
        Possible values: `PRIVATE_LINK_CONNECTION_STATE_UNSPECIFIED`, `ESTABLISHED`, `REJECTED`, `DISCONNECTED`, `EXPIRED`, `PENDING`, `CREATING`, `CREATE_FAILED`
        Example: `ESTABLISHED`
      - `creation_time` (int64, optional)
        Time in epoch milliseconds when this object was created.
        Example: `1691436121706`
      - `updated_time` (int64, optional)
        Time in epoch milliseconds when this object was updated.
        Example: `1691436121777`
      - `deactivated` (boolean, optional)
        Whether this private endpoint is deactivated.
        Example: `false`
      - `deactivated_at` (int64, optional)
        Time in epoch milliseconds when this object was deactivated.
        Example: `1691436121706`
      - `enabled` (boolean, optional)
        Only used by private endpoints towards an AWS S3 service.
        
         Update this field to activate/deactivate this private endpoint to allow egress access from serverless compute resources.
        Example: `true`
      - `error_message` (string, optional)
        Example: `The provided endpoint service 'com.amazonaws.vpce.us-east-1.vpce-svc-123abcc1298abc123' could not be found.`
- `updated_time` (int64, optional)
  Time in epoch milliseconds when this object was updated.
  Example: `1691436121777`
- `creation_time` (int64, optional)
  Time in epoch milliseconds when this object was created.
  Example: `1691436121706`

## Response

```json
{
  "network_connectivity_config_id": "d6df3889-eefc-4ddb-bbb4-613efcb30035",
  "account_id": "449e7a5c-69d3-4b8a-aaaf-5c9b713ebc65",
  "name": "my-example-ncc",
  "region": "string",
  "egress_config": {
    "default_rules": {},
    "target_rules": {}
  },
  "updated_time": 1691436121777,
  "creation_time": 1691436121706
}
```