---
title: "Security groups — API reference"
description: "Reusable allow lists (AWS security group model) for servers with the network firewall add-on. Up to 5 groups per server, evaluated after Gyro rules an"
url: https://www.gyrohosting.com/developers/en/api/security-groups.html
language: en
openapi: https://www.gyrohosting.com/developers/openapi.json
api_version: 2.30.0
---

# Security groups

Reusable allow lists (AWS security group model) for servers with the network firewall add-on. Up to 5 groups per server, evaluated after Gyro rules and your advanced ordered rules; with groups and no advanced rules inbound traffic is denied by default. Rules count against the server's rule allowance. A change that could cut SSH/RDP access runs as a 5 minute trial: confirm it.

Base URL: `https://www.gyrohosting.com/api/v1/client` · OpenAPI: https://www.gyrohosting.com/developers/openapi.json


## GET /cloud/security-groups

**List security groups** · operationId `listSecurityGroups` · scope `cloud_read` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/listSecurityGroups.json




### Responses

- **200**: Groups
- **401**: Missing, invalid or revoked key

### Examples

```bash
curl -s 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group list
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.get("https://www.gyrohosting.com/api/v1/client/cloud/security-groups", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## POST /cloud/security-groups

**Create a security group** · operationId `createSecurityGroup` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/createSecurityGroup.json

Name unique per account (2-64 characters). Without `rules` the group has one outbound rule (all traffic) and no inbound rule.


### Request body

| Field | Type | Description |
|---|---|---|
| `name` (required) | string |  |
| `description` | string |  |
| `rules` | array<SecurityGroupRule> |  |

### Responses

- **201**: Created
- **401**: Missing, invalid or revoked key
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X POST 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups' \
  -H "Authorization: Bearer $GYRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "string", "description": "string", "rules": [{"id": "string", "direction": "in", "type": "ssh", "protocol": "tcp", "port": "8080", "source": ["203.0.113.10/32"], "description": "string"}]}'
```
```bash
gyro security-group create --help    # all flags
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.post("https://www.gyrohosting.com/api/v1/client/cloud/security-groups", headers=h, json={"name": "string", "description": "string", "rules": [{"id": "string", "direction": "in", "type": "ssh", "protocol": "tcp", "port": "8080", "source": ["203.0.113.10/32"], "description": "string"}]}, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name": "string", "description": "string", "rules": [{"id": "string", "direction": "in", "type": "ssh", "protocol": "tcp", "port": "8080", "source": ["203.0.113.10/32"], "description": "string"}]}),
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## GET /cloud/security-groups/{sg}

**Get a security group** · operationId `getSecurityGroup` · scope `cloud_read` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/getSecurityGroup.json




### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `sg` (required) | path | string |  |

### Responses

- **200**: Group
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else

### Examples

```bash
curl -s 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group get
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.get("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## PATCH /cloud/security-groups/{sg}

**Rename / describe a security group** · operationId `updateSecurityGroup` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/updateSecurityGroup.json

Only the display name and description change; the group id and its rules stay.


### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `sg` (required) | path | string |  |

### Request body

| Field | Type | Description |
|---|---|---|
| `name` | string |  |
| `description` | string |  |

### Responses

- **200**: Group
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X PATCH 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1' \
  -H "Authorization: Bearer $GYRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "string", "description": "string"}'
```
```bash
gyro security-group update --help    # all flags
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.patch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1", headers=h, json={"name": "string", "description": "string"}, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1", {
  method: "PATCH",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"name": "string", "description": "string"}),
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## DELETE /cloud/security-groups/{sg}

**Delete a security group** · operationId `deleteSecurityGroup` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/deleteSecurityGroup.json

Only a group that is attached to no server (422 err_sg_attached).


### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `sg` (required) | path | string |  |

### Responses

- **200**: Deleted
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X DELETE 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group delete
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.delete("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1", {
  method: "DELETE",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## PUT /cloud/security-groups/{sg}/rules

**Replace the rules of a security group** · operationId `putSecurityGroupRules` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/putSecurityGroupRules.json

Full replace (inbound + outbound), max 60 rules. Applied to every attached server. If the change removes or narrows SSH (22) / RDP (3389) access for any source on an attached server, or cuts the calling address, it runs as a 5 minute trial (`trial: true`, `trial_seconds_left`) - the same rule as the panel, CLI and Terraform: confirm with POST .../confirm, otherwise the previous rules return. A server's rules (own + all attached groups) must fit its allowance (422 err_sg_quota).


### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `sg` (required) | path | string |  |

### Request body

| Field | Type | Description |
|---|---|---|
| `rules` (required) | array<SecurityGroupRule> |  |

### Responses

- **200**: Group (trial, corrections)
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X PUT 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1/rules' \
  -H "Authorization: Bearer $GYRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rules": [{"type": "https", "source": ["0.0.0.0/0"]}, {"type": "ssh", "source": ["203.0.113.10/32"], "description": "office"}, {"direction": "out", "type": "all", "source": ["0.0.0.0/0"]}]}'
```
```bash
gyro security-group rules set --help    # all flags
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.put("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1/rules", headers=h, json={"rules": [{"type": "https", "source": ["0.0.0.0/0"]}, {"type": "ssh", "source": ["203.0.113.10/32"], "description": "office"}, {"direction": "out", "type": "all", "source": ["0.0.0.0/0"]}]}, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1/rules", {
  method: "PUT",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"rules": [{"type": "https", "source": ["0.0.0.0/0"]}, {"type": "ssh", "source": ["203.0.113.10/32"], "description": "office"}, {"direction": "out", "type": "all", "source": ["0.0.0.0/0"]}]}),
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## POST /cloud/security-groups/{sg}/confirm

**Make the running rule trial permanent** · operationId `confirmSecurityGroup` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/confirmSecurityGroup.json




### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `sg` (required) | path | string |  |

### Responses

- **200**: Group
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X POST 'https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1/confirm' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group confirm
```
```hcl
# resource gyro_security_group: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/security_group
# Reusable allow lists (AWS security group model). Stateful: replies to allowed connections pass automatically.
resource "gyro_security_group" "web" {
  name        = "web"
  description = "HTTP/HTTPS for everyone"

  rule {
    type = "http"
  }
  rule {
    type = "https"
  }
}

resource "gyro_security_group" "admin" {
  name = "admin"

  rule {
    type        = "ssh"
    source      = ["203.0.113.10/32"]
    description = "office"
  }
  rule {
    type   = "custom_tcp"
    port   = "8000-8100"
    source = ["198.51.100.0/24"]
  }
  # outbound: a group without outbound rules does not restrict outbound traffic
  rule {
    direction = "out"
    type      = "all"
  }
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.post("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1/confirm", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/security-groups/1/confirm", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## GET /cloud/servers/{id}/security-groups

**Security groups attached to a server** · operationId `listServerSecurityGroups` · scope `cloud_read` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/listServerSecurityGroups.json




### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `id` (required) | path | integer | Server id (= service id in the client area) |

### Responses

- **200**: Attached groups
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **409**: firewall_not_enabled

### Examples

```bash
curl -s 'https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group server list 12345
```
```hcl
# resource gyro_server_security_groups: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/server_security_groups
# Attach both groups to a server (order = evaluation order, max 5). Without gyro_firewall rules, inbound traffic
# that no group allows is denied.
resource "gyro_server_security_groups" "web1" {
  server_id          = 1234
  security_group_ids = [gyro_security_group.web.id, gyro_security_group.admin.id]
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.get("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups", {
  method: "GET",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## PUT /cloud/servers/{id}/security-groups

**Set the exact list of attached groups** · operationId `setServerSecurityGroups` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/setServerSecurityGroups.json

Attaches / detaches in one change (order = evaluation order, max 5). Answers 422 err_busy while the previous change of the server is being applied: retry after a few seconds.


### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `id` (required) | path | integer | Server id (= service id in the client area) |

### Request body

| Field | Type | Description |
|---|---|---|
| `security_groups` (required) | array<string> |  |

### Responses

- **200**: Attached groups
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **409**: firewall_not_enabled
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X PUT 'https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups' \
  -H "Authorization: Bearer $GYRO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"security_groups": ["string"]}'
```
```bash
gyro security-group server set 12345 --help    # all flags
```
```hcl
# resource gyro_server_security_groups: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/server_security_groups
# Attach both groups to a server (order = evaluation order, max 5). Without gyro_firewall rules, inbound traffic
# that no group allows is denied.
resource "gyro_server_security_groups" "web1" {
  server_id          = 1234
  security_group_ids = [gyro_security_group.web.id, gyro_security_group.admin.id]
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.put("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups", headers=h, json={"security_groups": ["string"]}, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups", {
  method: "PUT",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"security_groups": ["string"]}),
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## POST /cloud/servers/{id}/security-groups/{sg}

**Attach a security group to a server** · operationId `attachSecurityGroup` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/attachSecurityGroup.json




### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `id` (required) | path | integer | Server id (= service id in the client area) |
| `sg` (required) | path | string |  |

### Responses

- **200**: Attached groups
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **409**: firewall_not_enabled
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X POST 'https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups/1' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group attach 12345
```
```hcl
# resource gyro_server_security_groups: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/server_security_groups
# Attach both groups to a server (order = evaluation order, max 5). Without gyro_firewall rules, inbound traffic
# that no group allows is denied.
resource "gyro_server_security_groups" "web1" {
  server_id          = 1234
  security_group_ids = [gyro_security_group.web.id, gyro_security_group.admin.id]
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.post("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups/1", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups/1", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```


## DELETE /cloud/servers/{id}/security-groups/{sg}

**Detach a security group from a server** · operationId `detachSecurityGroup` · scope `cloud_write` · OpenAPI fragment: https://www.gyrohosting.com/developers/spec/ops/detachSecurityGroup.json




### Parameters

| Field | in | Type | Description |
|---|---|---|---|
| `id` (required) | path | integer | Server id (= service id in the client area) |
| `sg` (required) | path | string |  |

### Responses

- **200**: Attached groups
- **401**: Missing, invalid or revoked key
- **404**: Not found — also returned for objects owned by someone else
- **409**: firewall_not_enabled
- **422**: Validation or business rule failure (`confirm_required`, `invalid_image`, `tool_action_failed` ...)

### Examples

```bash
curl -s -X DELETE 'https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups/1' \
  -H "Authorization: Bearer $GYRO_TOKEN"
```
```bash
gyro security-group detach 12345
```
```hcl
# resource gyro_server_security_groups: https://registry.terraform.io/providers/gyro-hosting/gyro/latest/docs/resources/server_security_groups
# Attach both groups to a server (order = evaluation order, max 5). Without gyro_firewall rules, inbound traffic
# that no group allows is denied.
resource "gyro_server_security_groups" "web1" {
  server_id          = 1234
  security_group_ids = [gyro_security_group.web.id, gyro_security_group.admin.id]
}
```
```python
import os, uuid, requests

h = {"Authorization": "Bearer " + os.environ["GYRO_TOKEN"]}
r = requests.delete("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups/1", headers=h, timeout=60)
r.raise_for_status()
print(r.json()["data"])
```
```js
const res = await fetch("https://www.gyrohosting.com/api/v1/client/cloud/servers/12345/security-groups/1", {
  method: "DELETE",
  headers: {
    "Authorization": `Bearer ${process.env.GYRO_TOKEN}`,
  },
});
const { data, error } = await res.json();
if (!res.ok) throw new Error(`${error.code}: ${error.message}`);
```