Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

ESG and contract configuration in the REST API

Updated: April 17, 2026

Want to summarize with AI?

Log in

A REST API payload can create an endpoint security group (ESG), associate it with a virtual routing and forwarding (VRF) instance, apply contracts, and configure selectors.

REST API configuration represents an ESG and its policy relationships as managed objects under a tenant application profile.

  • The fvESg object defines the ESG and its preferred-group membership.

  • The fvRsScope object associates the ESG with a VRF instance.

  • The fvRsProv and fvRsCons objects associate provided and consumed contracts with the ESG.

  • The fvTagSelector, fvEPgSelector, and fvEPSelector objects configure tag, endpoint group (EPG), and IP subnet selectors.

XML payload

The following payload creates an ESG named ESG1, associates it with VRFA, applies provided and consumed contracts, and configures multiple selector types:

<polUni>
        <fvTenant name="t0">
        <fvAp name="ap0">
        <!-- Create ESG1 and exclude it from the preferred group. -->
        <fvESg name="ESG1" prefGrMemb="exclude">
        <!-- Associate the ESG with VRFA. -->
        <fvRsScope tnFvCtxName="VRFA"/>
        
        <!-- Configure provided and consumed contracts. -->
        <fvRsProv tnVzBrCPName="provided_contract1"/>
        <fvRsCons tnVzBrCPName="consumed_contract2"/>
        
        <!-- Configure tag selectors. -->
        <fvTagSelector matchKey="stage" matchValue="production"
        valueOperator="equals"/>
        <fvTagSelector matchKey="owner" matchValue="teamA"
        valueOperator="contains"/>
        <fvTagSelector matchKey="__vmm::vmname"
        matchValue="web_[0-9]+" valueOperator="regex"/>
        
        <!-- Match existing EPGs. -->
        <fvEPgSelector
        matchEpgDn="uni/tn-t0/ap-ap0/epg-EPG1-1"/>
        <fvEPgSelector
        matchEpgDn="uni/tn-t0/ap-ap0/epg-EPG1-2"/>
        
        <!-- Configure IP subnet selectors. -->
        <fvEPSelector matchExpression="ip=='192.168.0.1/32'"/>
        <fvEPSelector matchExpression="ip=='192.168.1.0/28'"/>
        <fvEPSelector matchExpression="ip=='2001:23:45::0:0/64'"/>
        </fvESg>
        </fvAp>
        </fvTenant>
        </polUni>
Note

The VRF instance, contracts, and EPGs referenced by the relationship and selector objects must exist before you submit the payload.