Comment 1 for bug 1842666

Indeed, reproduced it on devstack master with:

$ cat bulk_secgroups.json
{
  "ports": [
    {
      "network_id": "226ac6be-753b-46d3-8636-5ad226297ab0",
      "security_groups": ["91e47ea5-3d9c-437b-a31e-0a2fd8d3181f"]
    }
  ]
}

$ export MY_TOKEN=$(openstack token issue -c id -f value)
$ curl -H "X-Auth-Token: $MY_TOKEN" -X POST http://127.0.0.1:9696/v2.0/ports -d @bulk_secgroups.json | jq .ports[0].id
"91ec92c1-4d9c-4a8b-b5d1-55769c4c75c2"
 openstack port show 91ec92c1-4d9c-4a8b-b5d1-55769c4c75c2|grep security_group
| security_group_ids | 91e47ea5-3d9c-437b-a31e-0a2fd8d3181f, fc3f8c84-118e-46c5-8dc7-18d02ef926af
$ openstack security group show default -f value -c id
fc3f8c84-118e-46c5-8dc7-18d02ef926af