NAT Gateway and VPC use the same service address (endpoint). This means that when you call NAT Gateway APIs, HTTP GET requests are sent to the API end point of NAT Gateway, and the system responds according to the parameters set in the request. Both the requests and responses are UTF-8 encoded.

Request syntax

NAT Gateway APIs use RPC style. To call NAT Gateway APIs, send HTTP GET requests.

The structure of a NAT Gateway API request is as follows:

  • Endpoint: The endpoint of NAT Gateway APIs is
  • Action: the name of the action. For example, if you need to create a NAT Gateway, the action is CreateNatGateway.
  • Version: The version of the API. The version of NAT Gateway APIs is 2016-04-28.
  • Parameters: the request parameters. Separate multiple parameters by using ampersands (&).

    Request parameters include common parameters and API-specific parameters. Common parameters include API version and identity authentication information among other parameters. For more information, see Common parameters.

The following is an example of calling CreateNatGateway to create a NAT Gateway:
Note The following code has been edited to improve readability.

API authorization

To maintain account security, we recommend that you use the Access Keys (AKs) of RAM users to call APIs. Before you call APIs using the AKs of RAM users, you need to grant permissions to the RAM users by attaching corresponding policies to them.

For more information about the policies related to NAT Gateway APIs, see RAM authentication.

Request signature

Authentication is required by the NAT Gateway service for each API call, which is provided by the inclusion of signature information in the request.

NAT Gateway uses an AccessKeyID and AccessKeySecret pair (that is, an AK) and symmetric encryption to authenticate the identity of the request sender. AKs are certificates that Alibaba Cloud issues to Alibaba Cloud accounts and RAM users for authentication. It is similar to a logon password. The AccessKeyID is used to identify the visitor's identity. The AccessKeySecret is the key used to encrypt the signature string. The server uses the AccessKeySecret to decrypt the signature string. The AccessKeySecret must be kept confidential.

A request in an API call is signed in the following format:


Take the API call of CreateNatGateway as an example. If your AccessKey ID is testid, and your AccessKey Secret is testsecret, then, the URL in the signature is as follows:
To generate the signature, follow these steps:
  1. Create the string to be signed by using the request parameter.
  2. Calculate the HMAC value of the string.

    Add an ampersand (&) after the AccessKeySecret to add the key of the HMAC value. In this example, the key is testsecret&.

  3. Add the signature to the request parameter.