All Products
Search

This Product

    Express Connect:GrantInstanceToExpressConnectRouter

    Document Center

    Express Connect:GrantInstanceToExpressConnectRouter

    Last Updated:Sep 24, 2026

    Grants a virtual private cloud (VPC) or virtual border router (VBR) authorization to a cross-account Express Connect Router (ECR).

    Operation description

    To associate a cross-account network instance with an Express Connect Router (ECR) instance, you must grant the network instance authorization to the Express Connect Router (ECR) instance.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    expressconnectrouter:GrantInstanceToExpressConnectRouter

    create

    VPC

    acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}

    VirtualBorderRouter

    acs:expressconnect:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId}
    • InstanceType
    		 None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    EcrId

    string

    Yes

    The instance ID of the associated Express Connect Router (ECR).

    ecr-mezk2idmsd0vx2****
    EcrOwnerAliUid

    integer

    Yes

    The ID of the Alibaba Cloud account that owns the Express Connect Router (ECR) instance that accepts the authorization.

    121012345612****
    InstanceId

    string

    Yes

    The ID of the network instance.

    vbr-j6cwxhgg0s5nuephp****

    InstanceType

    string

    Yes

    The type of the network instance. Valid values:

    • VBR: virtual border router instance.

    • VPC: virtual private cloud instance.

    VBR
    InstanceRegionId

    string

    Yes

    The region ID of the network instance to be authorized.

    cn-hangzhou
    DryRun

    boolean

    No

    Specifies whether to perform only a dry run. Valid values:

    • true: performs a dry run without modifying the EPS resource.

    • false (default): sends a normal request.

    true
    ClientToken

    string

    No

    The client token that is used to ensure the idempotence of the request.

    You can use the client to generate the token, but you must make sure that the token is unique among different requests. The token can contain only ASCII characters.

    Note

    If you do not specify this parameter, the system automatically uses the RequestId as the ClientToken. The RequestId may be different for each API request.

    02fb3da4-130e-11e9-8e44-00****

    Response elements

    Element

    Type

    Description

    Example

    object

    RpcResponse

    AccessDeniedDetail

    string

    The details about the access denial.

    Authentication is failed for ****

    Code

    string

    The response code. A value of 200 indicates success. Other values indicate failure. For more information, see error codes.

    200
    DynamicCode

    string

    The dynamic error code.

    IllegalParamFormat.EcrId

    DynamicMessage

    string

    The dynamic error message, which is used to replace the %s placeholder in the ErrMessage parameter.

    Note

    For example, if the value of ErrMessage is The Value of Input Parameter %s is not valid and the value of DynamicMessage is DtsJobId, the specified value of the DtsJobId request parameter is invalid.

    The param format of EcrId **** is illegal.

    HttpStatusCode

    integer

    The HTTP status code.

    200
    Message

    string

    The returned message.

    OK
    RequestId

    string

    The request ID.

    6FABF516-FED3-5697-BDA2-B18C5D9A****
    Success

    boolean

    Indicates whether the call was successful. Valid values:

    • True: The call was successful.

    • False: The call failed.

    True

    Examples

    Success response

    JSON format

    {
  "AccessDeniedDetail": "Authentication is failed for ****\n",
  "Code": "200",
  "DynamicCode": "IllegalParamFormat.EcrId\n",
  "DynamicMessage": "The param format of EcrId **** is illegal.\n",
  "HttpStatusCode": 200,
  "Message": "OK",
  "RequestId": "6FABF516-FED3-5697-BDA2-B18C5D9A****",
  "Success": true
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 IllegalParam.EcrOwnerAliUid The Ecr instance account parameter is invalid. The account number of the leased line gateway instance is invalid, please check and enter again.
    400 MissingParam.%s The param of %s is missing. The request parameters are not specified. Please check the corresponding parameters and try again.
    400 IllegalParamFormat.%s The param format of %s is illegal. Illegal parameter format
    400 IllegalParam.%s The param of %s is illegal. Illegal parameter
    400 Conflict.Lock There are other unfinished operations. You currently have other unfinished operations, please try again later
    400 IllegalParam.InstanceOwnerId Specified parameter InstanceOwnerId is not valid. The instance account is invalid. Please check and enter the parameter again.
    400 OperationFailed.OperateSharedVpc The operation failed because the VPC is a shared resource. The operation is not allowed to share the authorized VPC, please use the VPC owner account to perform the operation.
    400 QuotaExceeded.GrantCountPerVpc The maximum number of grants for the VPC is exceeded. The maximum number of ECR/CEN authorized by a single VPC has been reached.
    400 ResourceNotFound.VpcId The VpcId is not found. The specified VPC does not exist. Check whether the VpcId, region, and account are correct.
    400 ResourceNotFound.VbrId The VbrId is not found. The specified VBR does not exist. Check whether the VbrId, region, and account are correct.
    400 IncorrectStatus.Vpc The status of the VPC is incorrect. The current status of the VPC does not support this operation. Wait until the VPC returns to a stable state and try again.
    404 ResourceNotFound.EcrId EcrId not found. ECR instance does not exist

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.