> ## Documentation Index
> Fetch the complete documentation index at: https://docs.megaport.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating an MVE with the API

> This help topic describes how to use the Megaport API to create a Megaport Virtual Edge (MVE).

This topic describes the API procedure to create a Megaport Virtual Edge (MVE), including how to look up a deployment location, check available vendor images, and validate and complete the order.

Creating an MVE with the API involves these steps:

1. **Look up the MVE location** -- Identify a location where MVE is available and note its location ID.
2. **Check available MVE images** -- Retrieve the vendor images and software versions available for MVE.
3. **Validate the order** -- Test your configuration and review pricing before you order.
4. **Order the MVE** -- Submit the validated configuration to create the MVE.

You select the vendor appliance and software version through the required `imageId` field, taken from the images endpoint. There is no `vendor` field in the request. Each vendor also requires specific fields inside the `vendorConfig` object. For more information, see [Vendor-specific configurations](#vendor-specific-configurations).

Every request in this workflow requires the `Authorization: Bearer <accessToken>` header, including the two GET requests that look up locations and images. You reuse the same access token for every request. The requests use the `{baseUrl}` placeholder. Replace it with the production or staging API host. For more information, see [Environments](/api#environments).

Before you begin, obtain a valid access token. For more information, see [Creating an API Key](/api/api-key).

For more information about the APIs and parameters mentioned in this topic, see the API reference at
[https://dev.megaport.com](https://dev.megaport.com).

## Look up MVE location details

To create an MVE, first identify a location where MVE is available. The location response includes `mveAvailable` in each diversity zone to indicate MVE support.

**To look up MVE location details**

1. Send a GET request to the locations endpoint.
   This request requires no parameters or request body.

   ```http theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
   GET {baseUrl}/v3/locations
   ```

   Confirm the request was successful by looking for Status: 200 OK.

   The request returns hundreds of Megaport locations.

2. Search the response for a site where `mveAvailable` is `true` in the `diversityZones` object.

   To provision an MVE at a location, `mveAvailable` must be `true` in at least one diversity zone.

```json {2,24,30} theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "id": 60,
    "name": "CoreSite LA1",
    "address": {
        "street": "624 South Grand Avenue",
        "suburb": null,
        "city": "Los Angeles",
        "state": "CA",
        "postcode": "90017",
        "country": "USA"
    },
    "dataCentre": {
        "id": 18,
        "name": "CoreSite"
    },
    "metro": "Los Angeles",
    "market": "US",
    "status": "Active",
    "diversityZones": {
        "red": {
            "mcrSpeedMbps": [2500, 5000, 10000, 1000],
            "megaportSpeedMbps": [1000, 10000, 100000],
            "mveMaxCpuCoreCount": null,
            "mveAvailable": true
        },
        "blue": {
            "mcrSpeedMbps": [5000, 1000, 2500, 10000],
            "megaportSpeedMbps": [1000, 100000, 10000],
            "mveMaxCpuCoreCount": null,
            "mveAvailable": true
        }
    }
}
```

To create an MVE, you need the `id` value. In this example, the location ID is 60.

## Check available MVE images

Before you create an MVE, retrieve the list of available vendor images. This endpoint returns the vendors and software versions available for MVE.

Send a GET request to the images endpoint.

```http theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
GET {baseUrl}/v4/product/mve/images
```

The response groups the available MVE images by vendor and product under `mveImages`. The following example is representative and is trimmed to a few vendor groups.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "message": "MVE images",
    "terms": "This data is subject to the Acceptable Use Policy...",
    "data": {
        "mveImages": [
            {
                "vendor": "6WIND",
                "product": "6WIND Virtual Service Router",
                "vendorProductId": 1,
                "images": [
                    {
                        "id": 46,
                        "version": "6.0",
                        "productCode": "6wind-mve",
                        "releaseImage": true,
                        "availableSizes": ["MVE 2/8", "MVE 4/16", "MVE 8/32"],
                        "vendorDescription": "6WIND Virtual Service Router"
                    }
                ]
            },
            {
                "vendor": "ARUBA",
                "product": "Aruba EC-V",
                "vendorProductId": 2,
                "images": [
                    {
                        "id": 67,
                        "version": "ECOS-V 9.3",
                        "productCode": "aruba-ecv-v2",
                        "releaseImage": true,
                        "availableSizes": ["MVE 2/8", "MVE 4/16", "MVE 8/32"],
                        "vendorDescription": "Aruba EdgeConnect SD-WAN"
                    }
                ]
            },
            {
                "vendor": "PALO_ALTO",
                "product": "Palo Alto VM-Series",
                "vendorProductId": 3,
                "images": [
                    {
                        "id": 52,
                        "version": "11.1",
                        "productCode": "palo-vm",
                        "releaseImage": true,
                        "availableSizes": ["MVE 2/8", "MVE 4/16", "MVE 8/32"],
                        "vendorDescription": "Palo Alto VM-Series"
                    }
                ]
            }
        ]
    }
}
```

Each group carries the `vendor` code and `product` name, and lists the software versions under `images`. Note the `id` value for the image you want to deploy. The image `id` selects both the vendor appliance and the software version, and it is passed as `imageId` when you create the MVE. The `vendorProductId` in the response is informational only; you do not include it in the order body.

## Validate the MVE order

Before you order, validate the configuration to confirm that it passes validation and to review pricing.

**To test and validate the MVE order**

1. Send a POST request to the validate endpoint with the request body.

   ```http theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
   POST {baseUrl}/v3/networkdesign/validate
   ```

2. Confirm the response returns "Validation passed" and review the pricing details.

The request body is a JSON array that contains one order object. This example validates a 6WIND MVE.

```json {8,9,10} theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
[
    {
        "locationId": 60,
        "productName": "Test MVE",
        "productType": "MVE",
        "term": 12,
        "promoCode": null,
        "vendorConfig": {
            "imageId": 46,
            "mveLabel": "MVE 4/16",
            "sshPublicKey": "ssh-rsa AAAA...user@host"
        },
        "vnics": [
            { "description": "Data Plane" }
        ]
    }
]
```

The following table describes the request parameters.

| Parameter                | Required | Description                                                                                                                                                                                                            |
| :----------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| locationId               | Required | The `id` of the location where you deploy the MVE, from the locations endpoint.                                                                                                                                        |
| productName              | Required | A name for the MVE.                                                                                                                                                                                                    |
| productType              | Required | Must be `MVE`.                                                                                                                                                                                                         |
| term                     | Required | The contract term in months: 1, 12, 24, 36, 48, or 60.                                                                                                                                                                 |
| promoCode                | Optional | A promotional code, or `null` if none applies.                                                                                                                                                                         |
| vendorConfig             | Required | The configuration object for the MVE.<br />It holds `imageId`, the size field, and the vendor-specific fields together, with no `vendor` field. See [Vendor-specific configurations](#vendor-specific-configurations). |
| vendorConfig.imageId     | Required | The `id` of the vendor image from the images endpoint.<br />This value selects both the vendor appliance and the software version.                                                                                     |
| vendorConfig.mveLabel    | Required | The instance size, for example `MVE 4/16`.<br />See [Instance sizes](#instance-sizes).                                                                                                                                 |
| vendorConfig.productSize | Optional | Deprecated. A legacy alternative to `mveLabel`, retained for backward compatibility. See [Instance sizes](#instance-sizes).                                                                                            |
| vnics                    | Optional | An array of vNIC objects, as a sibling of `vendorConfig`.<br />If omitted, the vendor's minimum number of vNICs is allocated automatically. See [vNIC configuration](#vnic-configuration).                             |

A successful response passes validation and includes pricing details.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "message": "Validation passed",
    "terms": "This data is subject to the Acceptable Use Policy...",
    "data": [
        {
            "price": {
                "monthlyRate": 500.00,
                "currency": "USD",
                "productType": "MVE"
            },
            "serviceName": "Test MVE",
            "productType": "MVE",
            "productUid": "78aebd6b-7601-4331-82bc-dcd07f9f21a6"
        }
    ]
}
```

## Order the MVE

After validating the request and reviewing the pricing, place the same order object in the `networkDesign` array of the v4 request body, then POST the request to the buy endpoint to create the MVE.

**To order the validated MVE**

1. Send a POST request to the order endpoint with the v4 request body shown below.

   ```http theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
   POST {baseUrl}/v4/networkdesign/buy
   ```

   <Warning>
     If you make this call on api.megaport.com, your account will be charged for the service. Alternatively, you can use the API in the staging (test) environment without charges, as in these examples.
   </Warning>

2. Review the response to confirm the MVE was created.

The v4 request body is an envelope object that wraps the order object in a `networkDesign` array. This example orders a standalone 6WIND MVE.

```json {2,18,19} theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "networkDesign": [
        {
            "locationId": 60,
            "productName": "Test MVE",
            "productType": "MVE",
            "term": 12,
            "promoCode": null,
            "vendorConfig": {
                "imageId": 46,
                "mveLabel": "MVE 4/16",
                "sshPublicKey": "ssh-rsa AAAA...user@host"
            },
            "vnics": [
                { "description": "Data Plane" }
            ]
        }
    ],
    "discountCodes": []
}
```

The following table describes the envelope parameters.

| Parameter     | Required | Description                                                                                                                                                       |
| :------------ | :------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| networkDesign | Required | The array of order objects to create. Place the MVE order object you validated here. For its inner fields, see [Validate the MVE order](#validate-the-mve-order). |
| discountCodes | Required | Include discount-code strings, or an empty array when no discount applies.                                                                                        |
| solutions     | Optional | An array used only when the order includes bundled products in the same request. Omit it when you order a standalone MVE.                                         |

A successful response confirms the MVE was created.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "message": "MVE [426fa830-4b66-41ad-95a1-197d55e074b1] created.",
    "terms": "This data is subject to the Acceptable Use Policy...",
    "data": [
        {
            "serviceName": "Test MVE",
            "technicalServiceUid": "426fa830-4b66-41ad-95a1-197d55e074b1",
            "productType": "MVE",
            "provisioningStatus": "DEPLOYABLE",
            "contractTermMonths": 12
        }
    ]
}
```

The new MVE appears in your working environment, either portal.megaport.com or portal-staging.megaport.com.

<Tip>
  For the authoritative list of endpoints and parameters, and to confirm the current endpoint version, see [https://dev.megaport.com](https://dev.megaport.com).
</Tip>

## Vendor-specific configurations

Each MVE vendor requires specific fields inside the `vendorConfig` object. The `vendorConfig` object contains no `vendor` key, the vendor appliance is chosen by the `imageId` value. Find your vendor below for its configuration requirements.

The per-vendor examples below show only the vendor-specific fields. In a real order, the `vendorConfig` object also includes `imageId` and the size field (`mveLabel`) alongside these fields. A complete order can also include the top-level `vnics` array, a sibling of `vendorConfig`, to control the number and naming of vNICs. If you omit `vnics`, the vendor's minimum number of vNICs is allocated automatically. For more information, see [Validate the MVE order](#validate-the-mve-order).

<Note>
  Obtain vendor licenses and credentials from the vendor. Consult the vendor's documentation for vNIC requirements. Available sizes and vendors vary by location. For more information, see [https://dev.megaport.com](https://dev.megaport.com).
</Note>

### 6WIND VSR

6WIND Virtual Service Router (VSR) requires an SSH public key for administrative access.

Prerequisites:

* Valid 6WIND license, obtained from 6WIND.
* SSH public key (RSA 2048-bit, in OpenSSH or RFC4716 format).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "sshPublicKey": "ssh-rsa AAAA...user@host"
}
```

| Parameter    | Required | Description                                                                          |
| :----------- | :------- | :----------------------------------------------------------------------------------- |
| sshPublicKey | Required | RSA 2048-bit public SSH key in OpenSSH or RFC4716 format, for administrative access. |

### Anapaya Alliance

Anapaya Alliance requires an SSH public key for administrative access.

Prerequisites:

* Valid Anapaya license.
* SSH public key (RSA 2048-bit).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "sshPublicKey": "ssh-rsa AAAA...user@host"
}
```

| Parameter    | Required | Description                                            |
| :----------- | :------- | :----------------------------------------------------- |
| sshPublicKey | Required | RSA 2048-bit public SSH key for administrative access. |

### Arista VeloCloud

Arista VeloCloud requires SSH access and activation against your VeloCloud Orchestrator.

Prerequisites:

* Valid Arista VeloCloud license.
* Access to your VeloCloud Orchestrator.
* SSH public key (RSA 2048-bit).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "sshPublicKey": "ssh-rsa AAAA...user@host",
    "vcoAddress": "orchestrator.example.com",
    "vcoActivationCode": "<vco-activation-code>"
}
```

| Parameter         | Required | Description                                                             |
| :---------------- | :------- | :---------------------------------------------------------------------- |
| sshPublicKey      | Required | RSA 2048-bit public SSH key for administrative access.                  |
| vcoAddress        | Required | The IPv4 address, IPv6 address, or FQDN of your VeloCloud Orchestrator. |
| vcoActivationCode | Required | The activation code for the edge device from the Orchestrator.          |

### Aruba EC-V

Aruba EdgeConnect Virtual (EC-V) requires your Orchestrator account credentials.

Prerequisites:

* Valid Aruba EdgeConnect license.
* Aruba Orchestrator account name and account key.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "accountName": "<account-name>",
    "accountKey": "<account-key>"
}
```

| Parameter   | Required | Description                                                   |
| :---------- | :------- | :------------------------------------------------------------ |
| accountName | Required | The account name from your Aruba Orchestrator or CSP account. |
| accountKey  | Required | The account key from your Aruba Orchestrator or CSP account.  |

### Aviatrix

Aviatrix requires a cloud-init configuration file from your Aviatrix Controller.

Prerequisites:

* Aviatrix Controller with the appropriate edge license.
* Cloud-init configuration file from the controller.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "cloudInit": "<base64-encoded-cloud-init-file>"
}
```

| Parameter | Required | Description                                                                 |
| :-------- | :------- | :-------------------------------------------------------------------------- |
| cloudInit | Required | Base64-encoded cloud-init configuration file from your Aviatrix Controller. |

### Check Point CloudGuard

Check Point CloudGuard requires an administrator password and an SSH public key.

Prerequisites:

* Valid Check Point CloudGuard license.
* SSH public key (RSA 2048-bit).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminPassword": "<admin-password>",
    "sshPublicKey": "ssh-rsa AAAA...user@host"
}
```

| Parameter     | Required | Description                                                                                                                            |
| :------------ | :------- | :------------------------------------------------------------------------------------------------------------------------------------- |
| adminPassword | Required | Plain text administrator password, 9 to 100 characters. The double-quote, carriage return, and line feed characters are not permitted. |
| sshPublicKey  | Required | RSA 2048-bit public SSH key for administrative access.                                                                                 |

### Cisco

Cisco offers multiple MVE appliances. Select the configuration for your deployment model.

#### Cisco C8000 SD-WAN mode

Cisco C8000 in SD-WAN mode joins a Cisco Catalyst SD-WAN overlay and requires a cloud-init configuration.

Prerequisites:

* Cisco SD-WAN subscription and vManage access.
* Cloud-init configuration file.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "cloudInit": "<base64-encoded-cloud-init-file>"
}
```

| Parameter | Required | Description                                   |
| :-------- | :------- | :-------------------------------------------- |
| cloudInit | Required | Base64-encoded cloud-init configuration file. |

<Note>
  Cisco SD-WAN MVEs are typically created through vManage rather than through the Megaport API directly. For more information, see [Creating an MVE Integrated with Cisco SD-WAN](/mve/cisco/creating/creating-mve).
</Note>

#### Cisco C8000 autonomous mode

Cisco C8000 in autonomous mode operates as a standalone router and requires an SSH public key.

Prerequisites:

* Valid Cisco C8000V license.
* SSH public key (RSA 2048-bit).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "sshPublicKey": "ssh-rsa AAAA...user@host"
}
```

| Parameter    | Required | Description                                            |
| :----------- | :------- | :----------------------------------------------------- |
| sshPublicKey | Required | RSA 2048-bit public SSH key for administrative access. |

#### Cisco Secure Firewall Threat Defense Virtual (FTDV)

Cisco Secure Firewall Threat Defense Virtual (FTDV) requires an administrator password and a management mode. When you manage the firewall through a Firewall Management Center (FMC), set `manageLocally` to `false` and provide the FMC details.

Prerequisites:

* Valid Cisco Secure Firewall license.
* For remote management, a reachable Firewall Management Center (FMC).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminPassword": "<admin-password>",
    "manageLocally": false,
    "fmcIpAddress": "198.51.100.10",
    "fmcRegistrationKey": "<fmc-registration-key>",
    "fmcNatId": "<fmc-nat-id>"
}
```

| Parameter          | Required                                 | Description                                                                                                                                             |
| :----------------- | :--------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------ |
| adminPassword      | Required                                 | Plain text administrator password, 9 to 100 characters. The double-quote, carriage return, and line feed characters are not permitted.                  |
| manageLocally      | Required                                 | Boolean. Set to `true` to manage the firewall locally, or `false` to manage it through an FMC.                                                          |
| fmcIpAddress       | Required when `manageLocally` is `false` | The IPv4 address, IPv6 address, or FQDN of the FMC.                                                                                                     |
| fmcRegistrationKey | Required when `manageLocally` is `false` | FMC registration key, 1 to 37 characters.<br />Allowed characters are A-Z, a-z, 0-9, and hyphen.                                                        |
| fmcNatId           | Optional                                 | NAT ID for FMC registration, 1 to 37 characters, using the same character set as `fmcRegistrationKey`. Applicable only when `manageLocally` is `false`. |

<Note>
  Cisco Secure Firewall does not support the MVE 2/8 size.
</Note>

#### Cisco Meraki vMX

Cisco Meraki vMX requires an authentication token from the Meraki dashboard.

Prerequisites:

* Valid Meraki SD-WAN license.
* Authentication token from the Meraki dashboard.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "token": "<meraki-api-token>"
}
```

| Parameter | Required | Description                                            |
| :-------- | :------- | :----------------------------------------------------- |
| token     | Required | The API token generated in the Cisco Meraki dashboard. |

### F5 BIG-IP

F5 BIG-IP requires an administrator password hash and an SSH public key.

Prerequisites:

* Valid F5 BIG-IP license.
* SSH public key (RSA 2048-bit or ED25519).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminPasswordHash": "$6$example...sha512crypt...hash",
    "adminSshPublicKey": "ssh-rsa AAAA...user@host"
}
```

| Parameter         | Required | Description                                                         |
| :---------------- | :------- | :------------------------------------------------------------------ |
| adminPasswordHash | Required | sha512crypt hash of the administrator password.                     |
| adminSshPublicKey | Required | Public SSH key (RSA 2048-bit or ED25519) for administrative access. |

### Fortinet FortiGate-VM

Fortinet FortiGate-VM requires an SSH public key and optionally a license file.

Prerequisites:

* SSH public key (RSA 2048-bit).
* Optionally, a FortiGate-VM license file. If you do not provide one, apply a license after deployment, for example through FortiFlex.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "sshPublicKey": "ssh-rsa AAAA...user@host",
    "licenseData": "<base64-encoded-license-file>"
}
```

| Parameter    | Required | Description                                                                                 |
| :----------- | :------- | :------------------------------------------------------------------------------------------ |
| sshPublicKey | Required | RSA 2048-bit public SSH key for administrative access.                                      |
| licenseData  | Optional | Base64-encoded license file. If omitted, apply a license after deployment or use FortiFlex. |

### Juniper

Juniper offers two MVE appliances. Select the configuration for your product.

#### Juniper SSR

Juniper Session Smart Router (SSR) requires a registration code from Juniper.

Prerequisites:

* Juniper Mist subscription.
* Registration code from Juniper.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "registrationCode": "<registration-code>"
}
```

| Parameter        | Required | Description                     |
| :--------------- | :------- | :------------------------------ |
| registrationCode | Required | Registration code from Juniper. |

#### Juniper vSRX

Juniper vSRX requires an administrator password hash and an SSH public key, with optional Mist onboarding.

Prerequisites:

* Valid Juniper vSRX license.
* SSH public key (RSA 2048-bit).
* Optionally, Juniper Mist onboarding details.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminPasswordHash": "$6$example...sha512crypt...hash",
    "adminSshPublicKey": "ssh-rsa AAAA...user@host",
    "mistDeviceId": "00000000-0000-4000-8000-000000000000",
    "mistPasswordHash": "$6$example...sha512...hash",
    "mistSecret": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "mistSshPublicKey": "ssh-rsa AAAA...user@host"
}
```

| Parameter         | Required | Description                                                |
| :---------------- | :------- | :--------------------------------------------------------- |
| adminPasswordHash | Required | sha512crypt hash of the administrator password.            |
| adminSshPublicKey | Required | RSA 2048-bit public SSH key for administrative access.     |
| mistDeviceId      | Optional | Juniper Mist device ID (UUID version 4).                   |
| mistPasswordHash  | Optional | SHA-512 hash for Mist onboarding.                          |
| mistSecret        | Optional | Mist secret, a 128-character lowercase hexadecimal string. |
| mistSshPublicKey  | Optional | RSA 3072-bit public SSH key for Mist onboarding.           |

### Netskope One Edge

Netskope One Edge requires an SSH public key and an administrator password hash, with optional activation details.

Prerequisites:

* Valid Netskope One license.
* SSH public key (RSA 2048-bit).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminSshPublicKey": "ssh-rsa AAAA...user@host",
    "adminPasswordHash": "$6$example...sha512...hash",
    "activationToken": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
    "activationUri": "https://example.goskope.com/activation"
}
```

| Parameter         | Required | Description                                                                                    |
| :---------------- | :------- | :--------------------------------------------------------------------------------------------- |
| adminSshPublicKey | Required | RSA 2048-bit public SSH key for administrative access.                                         |
| adminPasswordHash | Required | SHA-512 hash of the administrator password.                                                    |
| activationToken   | Optional | 64-character hexadecimal activation token.<br />If provided, `activationUri` is also required. |
| activationUri     | Optional | Activation URI. If provided, `activationToken` is also required.                               |

### OPNsense

OPNsense from Deciso requires an SSH public key and a bcrypt administrator password hash.

Prerequisites:

* Valid OPNsense license from Deciso.
* SSH public key (RSA 2048-bit, RSA 4096-bit, or ED25519).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminSshPublicKey": "ssh-rsa AAAA...user@host",
    "adminPasswordHash": "$2y$11$exampleBcryptHashPaddedToFiftyThreeCharacters01234567"
}
```

| Parameter         | Required | Description                                                                            |
| :---------------- | :------- | :------------------------------------------------------------------------------------- |
| adminSshPublicKey | Required | Public SSH key (RSA 2048-bit, RSA 4096-bit, or ED25519) for administrative access.     |
| adminPasswordHash | Required | bcrypt hash in the format `$2y$NN$` followed by 53 characters, 60 characters in total. |

### Peplink Fusion Hub

Peplink Fusion Hub requires an administrator password hash and a valid Peplink Fusion Hub license.

Prerequisites:

* Valid Peplink Fusion Hub license.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "adminPasswordHash": "0000000000000000000000000000000000000000",
    "licenseData": "EXAMPLE1LICENSE9"
}
```

| Parameter         | Required | Description                                                          |
| :---------------- | :------- | :------------------------------------------------------------------- |
| adminPasswordHash | Required | SHA-1 hash of the administrator password, 40 hexadecimal characters. |
| licenseData       | Required | License, exactly 16 alphanumeric characters.                         |

### Palo Alto

Palo Alto Networks offers two MVE appliances. Select the configuration for your product.

#### Palo Alto Prisma SD-WAN

Palo Alto Networks Prisma SD-WAN requires an ION key and a secret key from your Prisma SD-WAN controller.

Prerequisites:

* Valid Prisma SD-WAN license.
* ION key and secret key from the Prisma SD-WAN controller.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "ionKey": "0000000000-00000000-0000-0000-0000-000000000000",
    "secretKey": "0000000000000000000000000000000000000000"
}
```

| Parameter | Required | Description                                                                                                                 |
| :-------- | :------- | :-------------------------------------------------------------------------------------------------------------------------- |
| ionKey    | Required | ION key. Format: 10 hexadecimal characters, hyphen, 8 hexadecimal, hyphen, 4, hyphen, 4, hyphen, 4, hyphen, 12 hexadecimal. |
| secretKey | Required | Secret key, 40 hexadecimal characters.                                                                                      |

Prisma SD-WAN is available as two models. The 3108v model supports the MVE 2/8, MVE 4/16, and MVE 8/32 sizes. The 7108v model supports the MVE 8/32 size only.

#### Palo Alto VM-Series

Palo Alto Networks VM-Series requires an SSH public key and an administrator password hash, with an optional authorization code.

Prerequisites:

* Valid VM-Series license (authorization code).
* SSH public key (RSA 2048-bit).

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "sshPublicKey": "ssh-rsa AAAA...user@host",
    "adminPasswordHash": "$5$example...sha256crypt...hash",
    "licenseData": "000000000"
}
```

| Parameter         | Required | Description                                                             |
| :---------------- | :------- | :---------------------------------------------------------------------- |
| sshPublicKey      | Required | RSA 2048-bit public SSH key for administrative access.                  |
| adminPasswordHash | Required | sha256crypt hash of the administrator password.                         |
| licenseData       | Optional | VM-Series authorization code, 8 or 9 digits. Leading zeros are allowed. |

### Versa FlexVNF

Versa FlexVNF requires Director and Controller addresses and authentication identifiers.

Prerequisites:

* Valid Versa license.
* Access to your Versa Director and Controller.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "directorAddress": "director.example.com",
    "controllerAddress": "controller.example.com",
    "localAuth": "branch-01@example.com",
    "remoteAuth": "controller-01@example.com",
    "serialNumber": "<serial-number>"
}
```

| Parameter         | Required | Description                                                                    |
| :---------------- | :------- | :----------------------------------------------------------------------------- |
| directorAddress   | Required | The IPv4 address or FQDN of the Versa Director.                                |
| controllerAddress | Required | The IPv4 address or FQDN of the Versa Controller.                              |
| localAuth         | Required | Local authentication identifier, an ID string or email, up to 100 characters.  |
| remoteAuth        | Required | Remote authentication identifier, an ID string or email, up to 100 characters. |
| serialNumber      | Required | The device serial number, up to 100 characters.                                |

## Instance sizes

MVE instances are available in different sizes. Specify the size using the `mveLabel` field. The `productSize` field is a deprecated, legacy alternative that is retained for backward compatibility.

| Size (mveLabel) | Legacy productSize | vCPU | RAM    |
| :-------------- | :----------------- | :--- | :----- |
| MVE 2/8         | SMALL              | 2    | 8 GB   |
| MVE 4/16        | MEDIUM             | 4    | 16 GB  |
| MVE 8/32        | LARGE              | 8    | 32 GB  |
| MVE 16/64       | X\_LARGE\_16       | 16   | 64 GB  |
| MVE 32/128      | X\_LARGE\_32       | 32   | 128 GB |

Available sizes depend on the vendor and location. Confirm the sizes available for your deployment with the [MVE images endpoint](#check-available-mve-images) or the product variants endpoint (`{baseUrl}/v3/product/mve/variants`).

The following per-vendor size restrictions apply:

* Cisco Secure Firewall does not support the `MVE 2/8` size.
* Palo Alto Prisma SD-WAN 3108v supports the `MVE 2/8`, `MVE 4/16`, and `MVE 8/32` sizes.
* Palo Alto Prisma SD-WAN 7108v supports the `MVE 8/32` size only.

## vNIC configuration

Each MVE has 1 to 5 virtual network interfaces (vNICs). The maximum is 5 for all vendors, except Arista VeloCloud and Check Point, which support only 1, and Cisco Meraki vMX, which supports only 2. The number of vNICs cannot be changed after the MVE is created.

Provide the vNICs in the `vnics` array, as a sibling of `vendorConfig` on the order object. This example is trimmed to show the placement.

```json theme={"theme":{"light":"github-light-high-contrast","dark":"github-dark-high-contrast"}}
{
    "vendorConfig": {
        "imageId": 46,
        "mveLabel": "MVE 4/16",
        "sshPublicKey": "ssh-rsa AAAA...user@host"
    },
    "vnics": [
        { "description": "Data Plane" },
        { "description": "Management Plane" }
    ]
}
```

The following table describes the vNIC parameters.

| Parameter   | Required | Description                                                                                                                                                                                                           |
| :---------- | :------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| vnics       | Optional | An array of 1 to 5 vNIC objects, as a sibling of `vendorConfig`. The maximum is 5. Per-vendor minimums are listed in the following note. If omitted, the vendor's minimum number of vNICs is allocated automatically. |
| description | Optional | A label for the vNIC, for example `Data Plane` or `Management Plane`.                                                                                                                                                 |

<Note>
  Consult your vendor's documentation for vNIC requirements. The confirmed per-vendor minimums are:

  * **6WIND VSR** -- minimum 1
  * **Anapaya Alliance** -- minimum 1
  * **Arista VeloCloud** -- exactly 1
  * **Aruba EC-V** -- minimum 2
  * **Aviatrix** -- minimum 1
  * **Check Point CloudGuard** -- exactly 1
  * **Cisco C8000** (autonomous and SD-WAN) -- minimum 1
  * **Cisco Secure Firewall (FTDV)** -- minimum 4
  * **Cisco Meraki vMX** -- exactly 2
  * **F5 BIG-IP** -- minimum 1
  * **Fortinet FortiGate-VM** -- minimum 1
  * **Juniper SSR** -- minimum 3
  * **Juniper vSRX** -- minimum 2
  * **Netskope One Edge** -- minimum 1
  * **OPNsense** -- minimum 2
  * **Palo Alto Prisma SD-WAN** -- minimum 4 (3108v) or 3 (7108v)
  * **Palo Alto VM-Series** -- minimum 2
  * **Versa FlexVNF** -- minimum 1
</Note>

## Next steps

After you create an MVE, the next steps include:

* Create a Megaport Internet connection for management and initial setup. For more information, see [Megaport Internet Overview](/megaport-internet).
* Connect VXCs to Cloud Service Providers. For more information, see:
  * [Creating a VXC between an MVE and AWS with the API](/api/api-mve-vxc-aws)
  * [Creating a VXC between an MVE and Azure with the API](/api/api-mve-vxc-azure)
  * [Creating a VXC between an MVE and Google Cloud with the API](/api/api-mve-vxc-google)

## Helpful references

* [Creating a Megaport Internet Connection for an MVE](/megaport-internet/mve)
* [Megaport API Documentation](https://dev.megaport.com)
* [Megaport Virtual Edge Locations](/mve/locations)
* [MVE Overview](/mve)
* [Types of vNIC Connections](/mve/vnic-connections)