--- title: How to Manage VPC Subnets (public) description: Create, list, update, and delete subnets in a VPC network, and list the resources attached to a subnet, using the DigitalOcean API. product: Networking url: https://docs.digitalocean.com/products/networking/vpc/how-to/manage-subnets/ last_updated: "2026-09-28" --- > **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document). # How to Manage VPC Subnets (public) A Virtual Private Cloud (VPC) is a private network interface for collections of DigitalOcean resources. VPC networks are inaccessible from the public internet and other VPC networks, and traffic on them doesn’t count against bandwidth usage. You can link VPC networks to each other using VPC peering connections. **Note**: VPC subnets and routes are in [public preview](https://docs.digitalocean.com/platform/product-lifecycle/index.html.md#public-preview) and available to all customers without opting in from the **Feature Preview** page. During the public preview, you manage subnets and routes with the DigitalOcean API. The Control Panel does not support them yet. [VPC subnets](https://docs.digitalocean.com/products/networking/vpc/concepts/subnets-and-routes/index.html.md) add IP address ranges to a VPC network as separate, named segments. During the public preview, you manage subnets using the DigitalOcean API. ## Prerequisites - [Create a personal access token](https://docs.digitalocean.com/reference/api/create-personal-access-token/index.html.md) and save it for use with the API. - The ID of the VPC network you want to manage. Retrieve it using the [`/v2/vpcs`](https://docs.digitalocean.com/reference/api/reference/vpcs/index.html.md#vpcs_list) endpoint. ## Create a Subnet To create a subnet, send a `POST` request to the `/v2/vpcs//subnets` endpoint, replacing `` with your VPC’s ID. The `name` field is required. The `ip_range` field must be an [RFC 1918](https://tools.ietf.org/html/rfc1918) CIDR with a prefix length between `/16` and `/28` that does not overlap with any other subnet on your team: ```shell curl -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \ -d '{ "name": "app-tier-subnet", "ip_range": "192.168.11.0/24" }' \ "https://api.digitalocean.com/v2/vpcs//subnets" ``` The response returns the new subnet, including its ID, URN, region, and type: ```json Output { "vpc_subnet": { "id": "4de7ac8b-495b-4884-9a69-1050c6793cd6", "urn": "do:vpc_subnet:4de7ac8b-495b-4884-9a69-1050c6793cd6", "name": "app-tier-subnet", "region": "nyc3", "ip_range": "192.168.11.0/24", "default": false, "type": "REGULAR", "created_at": "2026-07-30T12:00:00Z" } } ``` ## List Subnets To list all subnets in a VPC, send a `GET` request to the `/v2/vpcs//subnets` endpoint: ```shell curl -X GET \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \ "https://api.digitalocean.com/v2/vpcs//subnets" ``` The response is paginated and includes each subnet’s ID, name, IP range, and type. To retrieve a single subnet, send a `GET` request to the `/v2/vpcs//subnets/` endpoint with the subnet’s ID. ## Rename a Subnet To rename a subnet, send a `PATCH` request to the `/v2/vpcs//subnets/` endpoint with the new `name`. You cannot change a subnet’s IP range after creation: ```shell curl -X PATCH \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \ -d '{ "name": "web-tier-subnet" }' \ "https://api.digitalocean.com/v2/vpcs//subnets/" ``` ## How Resources Join a Subnet A resource joins a subnet when you create it, so there is no separate step to assign an existing resource to a subnet. This is why the members endpoint is read-only. To place a resource in a specific subnet, pass the subnet’s UUID when you create the resource and include the VPC’s ID: - **Droplets**: set `subnet_uuid` (which requires `vpc_uuid`) in the [create Droplet](https://docs.digitalocean.com/reference/api/reference/droplets/index.html.md#droplets_create) API request. - **DigitalOcean Kubernetes (DOKS)**: set `worker_subnet_uuid` (which requires `vpc_uuid`) in the [create cluster](https://docs.digitalocean.com/reference/api/reference/kubernetes/index.html.md#kubernetes_create_cluster) API request. - **Load Balancers and NAT gateways**: set the subnet’s UUID in the create API request. If you do not specify a subnet, the resource is placed in the VPC’s default subnet. You cannot move a resource to a different subnet after you create it. During the public preview, you can choose a subnet when you create a Droplet, DOKS cluster, Load Balancer, or NAT gateway. ## List Subnet Members To list the resources attached to a subnet, send a `GET` request to the `/v2/vpcs//subnets//members` endpoint. Use the optional `resource_type` query parameter to filter members by type: `droplet`, `loadbalancer`, or `kubernetes`: ```shell curl -X GET \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \ "https://api.digitalocean.com/v2/vpcs//subnets//members?resource_type=droplet" ``` The response lists each member’s URN, name, and creation time. ## Delete a Subnet To delete a subnet, send a `DELETE` request to the `/v2/vpcs//subnets/` endpoint: ```shell curl -X DELETE \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \ "https://api.digitalocean.com/v2/vpcs//subnets/" ``` A successful request returns a `204` status code with no response body. ## Next Steps To control how traffic from a subnet reaches its destination, see [How to Manage Routes](https://docs.digitalocean.com/products/networking/vpc/how-to/manage-subnet-routes/index.html.md).