canonical: https://jentic.com/apis/amazonaws.com/aws-direct-connect

# AWS Direct Connect

Jentic publishes the only available OpenAPI specification for AWS Direct Connect, keeping it validated and agent-ready. AWS Direct Connect provides dedicated network links between on-premises networks and AWS, bypassing the public internet for lower latency and predictable throughput. The API covers the lifecycle of physical connections, link aggregation groups (LAGs), virtual interfaces (private, public, transit), Direct Connect gateways, and BGP/MACsec configuration. Use it when an agent needs to provision hybrid networking, accept hosted connections, or manage virtual interface attachments to VPCs and Transit Gateways.

## For AI agents

Provision and manage AWS Direct Connect connections, virtual interfaces, link aggregation groups, and Direct Connect gateways for hybrid network connectivity.

## Scope

Does not handle physical cross-connect installation, on-premises router configuration, or VPC routing tables - use for Direct Connect control-plane provisioning only.

## Capabilities

- Provision physical connections at Direct Connect locations and bundle them into LAGs for redundancy
- Create private, public, and transit virtual interfaces with CreatePrivateVirtualInterface, CreatePublicVirtualInterface, and CreateTransitVirtualInterface
- Associate virtual interfaces with VPCs through Direct Connect gateways and gateway associations
- Allocate hosted connections and virtual interfaces to other AWS accounts using Allocate operations
- Configure BGP peering and MACsec encryption keys on existing connections
- Inspect connectivity health via DescribeConnections, DescribeVirtualInterfaces, and DescribeLoa

## Use cases

### Stand Up a Hybrid Network Link

Provision a dedicated Direct Connect connection at a colocation facility, request the Letter of Authorisation, and once the cross-connect is in place, attach a private virtual interface to a Direct Connect gateway that fronts the production VPC. The result is a private, predictable link from on-premises to AWS without traversing the public internet.

Example prompt: Call CreateConnection with the location code and 10Gbps bandwidth, then DescribeLoa to retrieve the LOA, and CreatePrivateVirtualInterface once the connection is up.

### Multi-Account Hosted Connections

Direct Connect partners and large organisations allocate hosted connections to downstream AWS accounts so each team gets a slice of dedicated bandwidth. AllocateHostedConnection from the partner side and ConfirmConnection from the receiving account complete the handover, keeping ownership and billing aligned per workload.

Example prompt: Call AllocateHostedConnection with the OwnerAccount, Bandwidth, and Vlan parameters, and verify the receiving account confirms via ConfirmConnection.

### Connect a Direct Connect Gateway to Transit Gateway

Use Direct Connect gateways and transit virtual interfaces to attach an on-premises network to a Transit Gateway so multiple VPCs across regions share the same physical link. CreateDirectConnectGateway and CreateTransitVirtualInterface establish the path, and AssociateTransitGatewayVirtualInterface connects it to the Transit Gateway.

Example prompt: Call CreateDirectConnectGateway, then CreateTransitVirtualInterface bound to that gateway, and finally CreateDirectConnectGatewayAssociation against the Transit Gateway ID.

### Agent-Driven Hybrid Network Operations

An AI agent connected via Jentic can automate Direct Connect operational tasks - accepting partner allocations, rotating MACsec keys, or rebalancing virtual interfaces between LAGs - without bespoke AWS SDK code. Jentic returns the matching Direct Connect operation and schema so the agent can sequence calls correctly across confirmation states.

Example prompt: Search Jentic for 'create a private virtual interface', load the CreatePrivateVirtualInterface schema, and execute it with the connectionId, vlan, asn, and amazonAddress parameters.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /#X-Amz-Target=OvertureService.AllocateHostedConnection | Allocate a hosted connection to another account |
| POST | /#X-Amz-Target=OvertureService.AllocatePrivateVirtualInterface | Allocate a private virtual interface |
| POST | /#X-Amz-Target=OvertureService.AllocateTransitVirtualInterface | Allocate a transit virtual interface |
| POST | /#X-Amz-Target=OvertureService.AssociateConnectionWithLag | Associate a connection with a LAG |
| POST | /#X-Amz-Target=OvertureService.ConfirmConnection | Confirm an allocated connection |
| POST | /#X-Amz-Target=OvertureService.AssociateMacSecKey | Associate a MACsec key with a connection |
| POST | /#X-Amz-Target=OvertureService.AcceptDirectConnectGatewayAssociationProposal | Accept a Direct Connect gateway association proposal |

## Key resources

- **Connection** — Physical Direct Connect connection at a location.
- **Virtual Interface** — Private, public, or transit VLAN attachments over a connection.
- **LAG** — Link aggregation group bundling multiple connections.
- **Direct Connect Gateway** — Multi-region anchor that virtual interfaces attach to.
- **Gateway Association** — Binding between a Direct Connect gateway and a VPC or Transit Gateway.
- **MACsec Key** — Layer 2 encryption keys associated with a connection.

## Why Jentic

- **Setup:** Wiring AWS Direct Connect by hand means building SigV4 request signing, resolving the regional directconnect.{region}.amazonaws.com host, and handling the X-Amz-Target action dispatch plus AWS retries yourself. Through Jentic you install once, import Direct Connect from the API Directory, store the AWS access keys once, and your agent calls it.
- **Permission scoping:** Direct Connect dispatches every action through a single endpoint with the operation named in the request, so scope the agent to the operations it needs, such as allocating a hosted connection or creating a private virtual interface. Destructive operations like deleting a connection or interface stay out of that set unless you add them.
- **Credential handling:** Your AWS access keys for Direct Connect are stored once, encrypted, by your own Jentic One instance and injected at execution time when the request is signed. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create a private virtual interface' or 'allocate a hosted connection', and Jentic returns the matching Direct Connect operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Amazon Elastic Compute Cloud** — Owns the VPCs, Transit Gateways, and route tables that Direct Connect virtual interfaces attach to.
- **AWS Global Accelerator** — Public network acceleration over the AWS backbone, no dedicated link required.
- **Amazon Route 53** — DNS management for hybrid environments served via Direct Connect.

## FAQ

### Why is there no official OpenAPI spec for AWS Direct Connect?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Direct Connect via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the AWS Direct Connect API use?

Direct Connect uses AWS Signature Version 4 (HMAC) signing with an AWS access key ID and secret access key. Through Jentic, those credentials live encrypted in your Jentic One instance and are injected into signed requests at execution time, so the agent never sees the raw secret access key.

### Can I create a transit virtual interface through this API?

Yes. Use CreateTransitVirtualInterface (or AllocateTransitVirtualInterface for cross-account allocation) with the connectionId, vlan, asn, and the Direct Connect gateway it should attach to. The transit VIF can then be associated with a Transit Gateway via CreateDirectConnectGatewayAssociation.

### What are the rate limits for the AWS Direct Connect API?

Direct Connect shares standard AWS service quotas, which are managed per account and region rather than published as fixed per-second limits in the spec. Provisioning operations are infrequent in practice, and ThrottlingException responses should trigger backoff.

### How do I provision a private virtual interface through Jentic?

Search Jentic for 'create a private virtual interface', load the CreatePrivateVirtualInterface schema, then execute it with connectionId, vlan, asn, virtualGatewayId or directConnectGatewayId, and customerAddress. Run pip install jentic to use the async SDK pattern.

### Does this API carry data traffic, or only manage configuration?

Only manages configuration. Actual customer traffic flows over the physical Direct Connect link and the configured virtual interfaces. The API itself is the control plane for provisioning, allocating, and associating those resources.

### Can I limit what my agent is allowed to do with the AWS Direct Connect API?

Yes. Because you run Jentic One yourself, your own rules decide which Direct Connect operations the agent may call and which AWS credentials it can use. Direct Connect dispatches every action through a single endpoint with the operation named in the request, so you scope the agent to only the operations it needs, such as AllocateHostedConnection or CreatePrivateVirtualInterface. Destructive operations like deleting a connection or virtual interface stay outside that set unless you explicitly add them.