Behaviour to account for
Converge Cloud behaviour that a client is likely to handle incorrectly, ordered by impact.
A wrong X-TC-Version is indistinguishable from a missing action
allBoth return InvalidAction. An action sent with the wrong X-TC-Version is indistinguishable from an action that does not exist, so confirm the version for that service before concluding an action is unavailable. Each service's version is listed on its reference page.
CLB writes return 200 with a null id and silently do nothing
clbIn some cases a CLB write returns HTTP 200 with no Error object and a null identifier, and has no effect. Read back with DescribeLoadBalancers before treating a create, modify or delete as applied.
DeleteVpc cascades — it takes the subnets with it
vpcCalled with two subnets still in the VPC, it returned success in 1.9 seconds and the VPC and both subnets were gone. DeleteVpc does not reject a VPC that still holds subnets. One call destroys the whole network, and a deleted VPC reads back as an empty set rather than an error.
Deleting a NAT gateway orphans its elastic IP
vpcDeleteNatGateway returns success in 300 ms and the gateway is gone 7 seconds later, but its elastic IP address remains allocated with status UNBIND and continues to accrue charges while unattached. Converge Cloud recommends recording the PublicIpAddressSet of the gateway prior to deletion, then releasing the associated elastic IP addresses explicitly. CreateNatGateway takes the IP address string in PublicIpAddresses, not the AddressId. A gateway reports NetworkState AVAILABLE while State is still PENDING, so readiness is determined by State.
Deleting an ENI orphans its elastic IP
vpcDeleteNetworkInterface succeeds on an ENI that still has an EIP bound. The action unbinds the address without releasing it, so the EIP continues to accrue charges while unattached. Unattached addresses accumulate in an account this way. Converge Cloud recommends releasing the EIP explicitly after deleting the ENI.
A fresh network ACL permits all IPv6
vpcA newly created ACL ships with IPv4 'Drop all' but IPv6 'Accept all' in both directions. An ACL is four independent lists — ingress and egress, each split into IPv4 and IPv6 — each numbered from priority 1 and each replaced only when the request includes entries for that list. Writing IPv4 rules leaves the permissive IPv6 lists exactly as they were. Converge Cloud also appends an implicit 'all / Drop' catch-all to the end of every list that a request writes.
Never parse the error message. Read the Code.
vpcError messages are returned in Chinese on vpc and in English on cvm, clb, as and tke. Language can also vary between actions within a service. The Code field is stable; Message is not.
HTTP 200 does not mean success
allConverge Cloud returns HTTP 200 for errors as well as successes. The discriminator is the presence of Response.Error. Note also that Error.Code is occasionally the empty string, so test for the presence of the Error object rather than for a non-empty Code.
An EIP bound to an ENI reports BIND_ENI, not BIND
vpcAnything polling for AddressStatus === 'BIND' waits forever. Accept BIND, BIND_ENI and BINDING as bound. ReleaseAddresses is refused while bound with InvalidAddressId.StatusNotPermit — and that particular message comes back in English while nearly every other vpc error is Chinese, so do not assume a language per service either.
ModifySecurityGroupPolicies replaces per direction
vpcSending only Ingress wipes every existing ingress rule and leaves Egress untouched. The action is still an overwrite, but scoped to the keys in the request. Converge Cloud recommends reading the current policies for that direction and including them in the request. Separately, CreateSecurityGroupPolicies rejects Ingress and Egress in the same call with InvalidParameter.Coexist, so each direction requires a separate call.
Security groups report no attachment data at all
vpcDescribeSecurityGroups returns CreatedTime, IsDefault, ProjectId, Region, SecurityGroupDesc, SecurityGroupId, SecurityGroupName, TagSet and UpdateTime only. To determine whether a group is in use, call DescribeSecurityGroupAssociationStatistics. Joining cvm.SecurityGroupIds instead covers CVM attachments only and misses ENI and CLB attachments.
One bad id fails the whole batch, and the cap is exactly 100
vpcDescribeSecurityGroupAssociationStatistics accepts up to 100 ids and rejects 101 with InvalidParameterValue.LimitExceeded. An unknown id fails the entire batch with ResourceNotFound rather than being omitted, so a group deleted between the list call and the statistics call returns no results at all.
InstanceStatistics overlaps the top-level counters — take the max, never the sum
vpcThe per-group response carries top-level CVM/ENI/CLB/SG/CDB counts and an InstanceStatistics breakdown of roughly 31 resource types, including NATGW, ENDPOINT, EKS, LB-LAN and LB-WAN. LB-LAN and LB-WAN may be components of the CLB total, so the two sources overlap and should not be summed.
A missing or incorrect X-TC-Region returns InternalError
allEach request must include the X-TC-Region header, and luzon is the only accepted value. A request that omits the header, or sends any other value, fails with InternalError. For a missing header, the message is "[Type 3004] action endpoint: request region is empty". The error code is InternalError rather than a parameter error code, so a region error resembles a server fault.
The api3 ingress answers for any hostname
allAny hostname under api3.convergecloud.com resolves and responds, and the wildcard TLS certificate covers it. A successful DNS lookup or TLS handshake does not indicate that a service exists; only a signed API response does.
A credential cannot be resolved to an account
sts, camsts:GetCallerIdentity, sts:QueryApiKey and cam:GetUserAppId are not available, so a credential cannot be resolved to an account or principal through the API.
DR3 instance-type names lie about memory
cvmMemory in a DR3 type name does not match the allocated memory: DR3.2XLARGE32 has 16 GB, DR3.6XLARGE64 has 48 GB, DR3.8XLARGE96 has 64 GB and DR3.18XLARGE192 has 144 GB. Use the Memory field.
Case-duplicated fields in the image catalogue
cvmDescribeImages returns both IsSupportCloudinit and a lowercase isSupportCloudinit on the same record. A case-sensitive parser will match only one of them.
Unknown instance ids return an empty set, not an error
cvmDescribeInstances returns TotalCount 0 for instance ids that do not exist, rather than ResourceNotFound. Deleted VPCs, subnets, elastic IPs and templates also read back as an empty set, while security groups, network ACLs, route tables and network interfaces return ResourceNotFound.
Limit is capped at 100 on every service except tke
allLimit is capped at 100 on every service except tke. The cap also applies to cbs. On tke, DescribeClusters accepts Limit values of 101 and 1000 without error. Result sets larger than the Limit are paginated with Offset.
Object storage uses its own hosts and signature
cosObject storage (COS) is not served under api3.convergecloud.com. The service host is cos.luzon.convergecloudcos.com, and each bucket is addressed at <bucket>-<appid>.cos.luzon.convergecloudcos.com. COS requests are signed with q-sign-algorithm=sha1, not TC3-HMAC-SHA256, and do not carry the X-TC-Action header. The Object storage section documents the available operations.
Converge Cloud removes actions at sub-family granularity rather than per service. monitor, for example, offers its full alarm and metric surface while omitting the Prometheus family entirely. The presence or absence of one group of actions in a service does not predict the rest, so consult the per-service reference rather than generalising.