NSX Global Policy API Guide

NSX 4.1.2

Overview
API Methods
API Types
API Type Schemas
API Errors
Deprecated Types and Methods

Overview

Introduction

This guide is for the NSX Global Manager API endpoint and is only relevant for environments using NSX Federation. For all other use cases please look at the at the NSX Manager API guide.

Like for the local manager of NSX, in case of Federation the global manager provides a programmatic API to automate management activities.

The Global Manager aims to manage centrally the configuration of multiple NSX deployments (also called Local Managers) as part of NSX Federation. In those environments both the Global Manager and the Local Managers API endpoints are available, but objects created and managed (CRUD) from the Global Manager should only be managed at this level.

The Global Manager follows the same data-structure than the NSX Local Manager. The API follows a resource-oriented Representational State Transfer (REST) architecture, using JSON object encoding. Clients interact with the API using RESTful web service calls over the HTTPS protocol.

Each API method is identified by a request method and URI. Method parameters are specified as key-value pairs appended to the URI. Unless otherwise noted, request and response bodies are encoded using JSON, and must conform to the JSON schema associated with each method. The content type of each request and reply is "application/json" unless otherwise specified. Each request that can be made is documented in the API Methods section. The associated request and response body schemas are documented in the API Schemas section.

If you provide URL-encoded UTF-8 characters in the URL of your API request, you must include the header "Content-Type:charset=UTF-8" in your request.

API Policy: Changes, Deprecations and Removals

VMware NSX and associated firewall offerings may add new features in a NSX release. These new features may lead to additional APIs or backward compatible changes to existing APIs to support the new features.

Changes to the API that lead to incompatibility with previous releases will be announced at least one year prior to the change. APIs or API attributes that will be removed will be marked "deprecated" in the API Guide. These changes can be implemented in either major or minor releases of NSX.

NSX APIs marked as "experimental" or that are not documented in the NSX API Guide are not subject to this policy. This indicates that the API may be changed or removed without notice in a future NSX release.

Definitions:

Major Release: Designated by an increment of the "x" digit of the x.y.z product version.
Minor Release: Designated by an increment of the "y" digit of the x.y.z product version.

API Data Types and Allowed Ranges

The NSX API uses JSON to represent API request and response payloads, and uses JSONSchema to describe the schema of these payloads. The data types are:

string: a sequence of UTF-8 characters. If a particular string property has a maximum length, it is represented in the documentation with a maxLength property.

integer: a signed 64-bit value. Unless a minimum or maximum value is shown in the documentation, integer values may take on values in the range -9,223,372,036,854,775,808 to 9,223,372,036,854,775,807.

unsigned_integer: an unsigned 64-bit value. Unless a minimum or maximum value is shown in the documentation, integer values may take on values in the range 0 to 9,223,372,036,854,775,807.

int: a signed 32-bit value. Unless a minimum or maximum value is shown in the documentation, int values may take on values in the range -2,147,483,648 to 2,147,483,647.

number: a 64-bit floating point number. Unless a minimum or maximum value is shown in the documentation, number values may take on values in the range 4.9406564584124654 x 10^-324 to 1.7976931348623157 x 10³⁰⁸.

boolean: the values true or false. Do not use quotes when sending boolean values in payloads.

object: a nested JSON object.

array: an array of one of the above types.

Formats

Some API types have a required format, and payloads that do not conform to the required format will be rejected. If a property has a required format, it is listed in the "Notes" section in this API Guide. The following formats are used in NSX:

ipv4: Must be a valid Internet Protocol version 4 address, in dotted-quad notation. For example, "192.168.1.232".

ipv6: Must be a valid Internet Protocol version 6 address, as described in RFC 1924. For example, "2001:0db8:85a3:0000:0000:8a2e:0370:7334". Abbreviations are supported.

ip: Either an ipv4 or ipv6 address.

hostname: An internet hostname, as described in RFC 1123. For example, "example.com"

ipv4-cidr-block: An ipv4 Classless Inter-Domain Routing (CIDR) block, expressed as a base ipv4 address, a slash, and the number of bits in the subnet mask. For example, "10.1.0.1/24".

ipv6-cidr-block: An ipv6 Classless Inter-Domain Routing (CIDR) block, expressed as a base ipv6 address, a slash, and the number of bits in the subnet mask. For example, "2001:db8::/32".

ip-cidr-block: Either an ipv4-cidr-block or an ip-v6-cidr-block.

ipv4-address-range: A range of ipv4 addresses, expressed as a lower-bound ipv4 address, a dash, and an upper-bound ipv4 address. For example, "192.168.1.0-192.168.1.255"

ipv6-address-range: A range of ipv6 addresses, expressed as a lower-bound ipv6 address, a dash, and an upper-bound ipv6 address. For example, "fe80::0202:b3ff:fe1e:8329-fe80::0202:b3ff:fe1e:832a"

address-or-block-or-range: Either an ip address, an ip-cidr-block, an ipv4-address-range, or an ipv6-address-range.

port-or-range: A port number (an integer in the range 0 to 65535) or a range of port numbers, expressed as a lower and upper port number, separated by a dash. Examples: "80" or "997-1023".

hostname-or-ip: Either a hostname or an ip address.

hostname-or-ipv4: Either a hostname or an ipv4 address.

list-of-address-or-block-or-range: A comma-separated list address-or-block-or-range.

mac-address: A Media Access Control (MAC) address. MAC addresses are six hexadecimal numbers, separated by either colons ":" or dashes "-". Case is not significant. Examples: "20:f3:75:5e:47:f0" or "20-F3-75-5E-47-F0".

Request Failures

It is possible for any request to fail. Errors are reported using standard HTTP response codes. It should be assumed the following errors could be returned by any API method: 301 Moved Permanently, 307 Temporary Redirect, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 429 Too Many Requests, 500 Internal Server Error, 503 Service Unavailable. Where other errors may be returned, the type of error is indicated in the API method description. All errors are documented in the API Errors section. API requests may fail due to concurrent updates, where an API request collides with another API request, and NSX cannot reconcile the two operations. In that case, the client must re-fetch the resource, apply the changes, and re-submit the operation.

Request Authentication

Most API calls require authentication. This API supports several different authentication schemes, which are documented in this section. Multiple authentication schemes may not be used concurrently.

HTTP Basic Authentication

To authenticate a request using HTTP Basic authentication, the caller's credentials are passed using the 'Authorization' header. The header content should consist of a base64-encoded string containing the username and password separated by a single colon (":") character, as specified in RFC 1945 section 11.1.

For example, to authenticate a request using the credentials of user admin with password admin, include the following header with the request:

Authorization: Basic YWRtaW46YWRtaW4=

The following cURL command will authenticate to the manager using basic authentication and will issue a GET request for the top-level global-infra object.

curl -k -u USERNAME:PASSWORD https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

where:
USERNAME is the user to authenticate as,
PASSWORD is the password to provide, and
GLOBAL_MANAGER is the IP address or host name of the NSX global manager

For example:

curl -k -u admin:secretPw99 https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

Note: the -k argument instructs cURL to skip verifying the manager's self-signed X.509 certificate. It is more secure to verify that the server's certificate is signed by a Certificate Authority (CA) that you trust. To do that, omit the -k argument and use the --cacert <ca-file> option, where <ca-file> is a PEM-formatted file containing the CA certificate to trust.

For example:

curl --cacert /home/me/certs/rootca.crt  -u admin:secretPw99 https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

Additional cURL examples below use the -k flag, but you can always substitute the --rootca <ca-file> argument for additional security.

In the above examples, USERNAME may be:

A local user name. For example, "admin".
A remote user name, of the form "user@domain", for example, "[email protected]". The domain must match a domain for a configured VIDM identity source or a configured LDAP identity source.

Note: in earlier versions of NSX, in order to authenticate to VIDM, it was required that you provide an authentication header of the form "Authorization: Remote base64-encoded-username-and-password". This is no longer required, but still functions for backward compatibility.

Session-Based Authentication

Session-based authentication is used by calling the /api/session/create authentication API to manage a session cookie. The session cookie returned in the result of a successful login must be provided in subsequent requests in order to associate those requests with the session.

Session state is local to the server responding to the API request. Idle sessions will automatically time-out, or can be terminated immediately using the POST /api/session/destroy API.

To obtain a session cookie, POST form data to the server using the application/x-ww-form-urlencoded media type, with fields "j_username" and "j_password" containing the username and password separated by an ampersand. Since an ampersand is a UNIX shell metacharacter, you may need to surround the argument with single quotes.

If the user is a remote user, append "@domain" to the username, for example, "[email protected]". The domain must match a domain for a configured VIDM identity source or a configured LDAP identity source.

The following cURL command will authenticate to the server, will deposit the session cookie in the file "cookies.txt", and will write all HTTP response headers to the file headers.txt. One of these headers is the X-XSRF-TOKEN header that you will need to provide in subsequent requests.

curl -k -c cookies.txt -D headers.txt -X POST     -d 'j_username=USERNAME&j_password=PASSWORD'     https://GLOBAL_MANAGER/api/session/create

For example:

curl -k -c cookies.txt -D headers.txt -X POST     -d 'j_username=admin&j_password=secretPw99'     https://GLOBAL_MANAGER/api/session/create

The manager will respond with the roles and permissions granted to the user, and cURL will deposit the session cookie into the file "cookies.txt".

In subsequent cURL requests, use the -b argument to specify the cookie file. You also need to pass the X-XSRF-TOKEN header that was saved to the headers.txt file, using cURL's -H option:

curl -k -b cookies.txt -H "`grep -i X-XSRF-TOKEN headers.txt | tr -d '\r\n'`"     https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

When the session expires, the manager will respond with a 403 Forbidden HTTP response, at which point you must obtain a new session cookie and X-XSRF-TOKEN.

Session cookies can be destroyed by using the /api/session/destroy API:

curl -k -b cookies.txt -H "`grep -i X-XSRF-TOKEN headers.txt | tr -d '\r\n'`"     -X POST https://GLOBAL_MANAGER/api/session/destroy

Authentication using an X.509 certificate and a Principal Identity

NSX supports using an X.509 client certificate for authentication. The certificate is associated with a principal identity (a short name, similar to a username), and that principal identity can be bound to an NSX role. This is useful for automated processes or scripts that perform NSX API calls, and has the advantage that a user password does not need to be stored with the script.

For information on how to import a certificate and set up a principal identity, see the section "Add a Role Assignment or Principal Identity" in the NSX Administration Guide.

To use the client certificate to authenticate, your client must have access to the certificate and its associated private key. How to specify client authentication depends on the client you are using. For example, with curl, you use the --key argument to give the filename containing the private key and the --cert argument to give the filename containg the public certificate.

Example Requests and Responses

Example requests and responses are provided for most of the API calls below. Your actual response might differ from the example in the number of fields returned because optional empty fields are not returned when you make an API call.

Optimistic Concurrency Control and the _revision property

Overview

In order to prevent one client from overwriting another client's updates, NSX employs a technique called optimistic concurrency control.

All REST payloads contain a property named "_revision". This is an integer that is incremented each time an existing resource is updated. Clients must provide this property in PUT requests and it must match the current _revision or the update will be rejected. This guards against the following situation:

Client 1 reads resource A.

Client 2 reads resource A.

Client 1 replaces the display_name property of resource A and does a PUT to replace the resource.

Client 2 replaces is different property of resource A and attempts to perform a PUT operation.

Without optimistic concurrency control, Client 2's update would overwrite Client 1's update to the display_name property. Instead, Client 2 receives a 409 Conflict error. To recover, Client 2 must fetch the resource again, apply the change, and perform a PUT.

Exceptions for /policy APIs

APIs whose URI begins with /policy have slightly different behavior. For those APIs, the _revision property must not be set when PUT is used to create a new resource. Once the resource is created, however, the _revision property must be provided with PUT operations.

PATCH and _revision for /policy APIs

APIs whose URI begins with /policy support the PATCH operation. Those APIs do not require that the _revision property be provided. A client can, however, request that the _revision property be checked when it is performing a PATCH in the /infra path. To do this, the client should pass the query parameter enforce_revision_check, e.g. PATCH /infra?enforce_revision_check=true.

Partial patching of objects is a feature supported by NSX that allows patching a subset of properties of any object. This behavior needs to be explicitly enabled. When partial patching is deactivated (default behavior), the entire payload of object is expected to be provided in both PUT and PATCH operations for the /policy APIs.

In order to perform partial patching of existing objects using PATCH operation, partial patching should be activated using either one of the following approach:

System-wide partial patch configuration
Partial patch can be activated/deactivated in the system by using the Partial Patch Config api (i.e. PATCH /policy/api/v1/system-config/nsx-partial-patch-config) with sample request payload.

{ "enable_partial_patch": "true" }
Default is 'false'.
Note: If the API request header has 'nsx-enable-partial-patch' parameter, then the header takes precedence over this system-wide configuration.
Header parameter (request level configuration)
Partial patch can also be activated/deactivated using API request header parameter. This will override the system-wide configuration for a particular request.
To activate partial patch, use 'nsx-activate-partial-patch=true'
To deactivate partial patch, use 'nsx-activate-partial-patch=false'
If this parameter is not passed in header, the system level configuration will be considered for Partial Patch operation. This header parameter will be considered only for PATCH requests. For other requests (e.g. PUT, POST etc.), this header parameter will be ignored.

Some important considerations/notes on Partial Patch:

Array properties will be replaced entirely in partial patch.
If PATCH api is executed on a non-existing object, a new object will be created after performing all applicable validations.
There are cases where properties of an object are inter-dependent on each other e.g. username and password, IP address and thumbprint etc. In such cases, the partial patch request expects all such inter-dependent fields to be provided (either all or none).
Partial patch is not supported for 'Infra' object.
Certain types like Labels, Security Policies (for the 'rules' attribute) and Services have special handling for certain attributes in PATCH request. This behavior will not be overridden by Partial Patch.
For instance, specifying rules on Security policies as a part of the PATCH invocation merges the specified rules with the existing rules. For full replacement of rules, PUT operation needs to be performed on the Security Policy.
Partial patch will not work for properties accepting polymorphic types if the specified value has a type that is different from that of the existing value.

API Rate Limiting

The NSX API service has three settings that control the rate of incoming API requests:

1) A per-client rate limit, in requests per second. If a client makes more requests than this limit in one second, the API server will refuse to service the API request and will return an HTTP 429 Too Many Requests Error. By default, this limit is 100 requests per second.

2) A per-client concurrency limit. This is the maximum number of outstanding requests that a client can have. For example, a client can open multiple connections to NSX and submit operations on each connection. When this limit is exceeded, the server returns a 429 Too Many Requests error to the client. By default, this limit is 40 concurrent requests.

3) An overall maximum number of concurrent requests. This is the maximum number of API requests that can be in process on the server. If the server is at this limit, additional requests will be refused and the HTTP error 503 Service Unavailable will be returned to the client. By default, this limit is 199 concurrent requests.

The first two limits exist to provide some level of fairness across multiple clients of NSX, and are intended to prevent one greedy client from preventing other clients from making API requests.

The last limit is the server's way of protecting itself against an unintentional (or intentional) denial of service attack.

Each manager enforces the rate limit independently of the other managers. For example, in a 3-node cluster, each manager has a maximum concurrency of 199 requests, but across the cluster there may be a maximum of 199 * 3 = 597 concurrent requests.

While it is possible to configure these rate limits using the /api/v1/node/services/http API, it is not recommended. Instead, you should design your API client to gracefully deal with situations where limits are exceeded.

Designing API client code to work gracefully with rate limits

One approach is to build in throttling into the client code so that it never sends more than 100 requests in a given second and that it never has more than 40 concurrent requests in flight.

However, there isn't any way to ensure that the overall concurrency limits are never hit. That is because there may be other clients calling APIs, driving up the load on the server. API clients need to check for the HTTP error 503 Service Unavailable. In the event a 503 error is received, the simplest strategy is to insert a delay, possibly with an exponential backoff in the event that server load is high.

There are open-source libraries than can help you implement this retry/backoff behavior, such as Google's Retry helper in its Python google-api-core library. For an example of using this library with the NSX APIs, see https://github.com/vmware-samples/nsx-t/blob/master/python/basics/rate-limits.py

OpenAPI Specification of NSX APIs

You can download OpenAPI specifications for the NSX Global Policy API at the following URLs:

NSX Global Policy API:

GET https://<global-manager>/global-manager/api/v1/spec/openapi/nsx_global_policy_api.yaml
GET https://<global-manager>/global-manager/api/v1/spec/openapi/nsx_global_policy_api.json

API Methods

Toggle all tables +

Federation

Federation: Federation Configuration

Associated URIs:

GET /global-manager/api/v1/global-infra/federation-config
GET /global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data
PATCH /global-manager/api/v1/global-infra/global-manager-config
PUT /global-manager/api/v1/global-infra/global-manager-config
GET /global-manager/api/v1/global-infra/overridden-resources

Read federation config

Read a federation config from Global Manager. This API is only available when using VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/federation-config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/federation-config GET https://<global-mgr>/global-manager/api/v1/global-infra/federation-config Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationConfig+

Example Response: { "site_config" : [ { "site_id": "59ee0369-3d2b-4b2a-9221-594344f6ca4c", "rtep_ips": [ "10.192.201.163", "10.192.201.164" ], "site_index": 1, "site_path": "/global-infra/sites/paris" } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or fully replace Global Manager Config

Create or fully replace a Global Manager Config.
Revision is optional for creation and required for update.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/global-manager-config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/global-manager-config { "rtep_config" : { "ibgp_password": "secureme" }, "_revision": 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManagerConfig", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or patch Global Manager Config

Create or patch a Global Manager Config
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/global-manager-config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/global-manager-config { "rtep_config" : { "ibgp_password": "secureme" } } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read Global Manager config along with sensitive data

Read a Global Manager config along with sensitive data.
For example - rtep_config.ibgp_password
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<pglobal-mgr>/global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data GET https://<policy-mgr>/global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManagerConfig", "rtep_config" : { "ibgp_password": "secureme" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List overridden resources

List overridden resources This API is only available when using VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/overridden-resources

Request Headers:

n/a

Query Parameters:

OverrideListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/overridden-resources Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

OverriddenResourceListResult+

Example Response: { "results": [ { "intent_path": "/global-infra/spoofguard-profiles/spoofguard_disabled", "site_path": "/global-infra/sites/Paris", "resource_type": "OverriddenResource", "id": "SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "display_name": "/global-infra/overriden-objects/SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "path": "/global-infra/overriden-objects/SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "relative_path": "SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "parent_path": "/global-infra", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "system", "_create_time": 1580359905533, "_last_modified_user": "system", "_last_modified_time": 1580359905533, "_revision": 0 } ], "result_count": 1 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Full Synchronization

Associated URIs:

GET /global-manager/api/v1/global-infra/full-sync-states
GET /global-manager/api/v1/global-infra/full-sync-states/{full-sync-id}

List full sync states

List full sync state. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/full-sync-states

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/full-sync-states Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FullSyncStateListResult+

Example Response: { "result_count" : 1, "results" : [ "resource_type": "FullSyncState", "id": "1234", "full_sync_id": "1234", "last_completed_stage": "PROCESSED_DELTAS", "path": "/infra/fullsync-states/1234", "parent_path": "/infra", "relative_path": "1234", "_create_user": "SYSTEM", "_create_time": 1517262573524, "_last_modified_user": "SYSTEM", "_last_modified_time": 1517262573524, "_system_owned": true, "_revision": 2 ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get full sync state

Get full sync state. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/full-sync-states/{full-sync-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/full-sync-states/1234 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FullSyncState+

FullSyncState (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
errors	Errors occurred during full sync Errors occurred during full sync.	array of string	Readonly
full_sync_id	Full sync id Full sync id generated by Async Replicator (AR) service.	string	Readonly
id	Unique identifier of this resource	string	Sortable
last_completed_stage	Full sync stage that is last completed for this request. The current stage of full sync completion for ongoing sync. When Local Manager (LM) receives full sync data from AR, LM starts with workflow to prserve the state and restore the full sync from where it has left off in case of change of leadership of the service to different NSX node or LM is restarted. LM starts the full sync workflow with state INITIAL capturing the AR full sync id and data location details. The stage/state transition follows the order given below INITIAL - Full sync started PROCESSED_FULLSYNC_DATA - Compelted processing the full state data provided by AR PRCESSED_DELTAS - Completed processing pending delta changes provided by AR. DELETED_STALE_ENTITIES - Completed deletion of all global entities on LM that are not in GM anymore COMPLETED - Full sync handling is completed on LM ERROR - Full sync failed with errors on LM, in which case AR will re-attempt full sync later point in time for the LM ABORTED - Indicates that the full sync cancelled as per user request	string	Readonly Enum: INITIAL, PAUSE_DCNS, DELETED_STALE_ENTITIES, PROCESSED_FULLSYNC_DATA, PROCESSED_DELTAS, UNPAUSE_DCNS, COMPLETED, ERROR, ABORTED
last_upate_time	Deprecated, refer to last_update_time for the last update time stamp.	EpochMsTimestamp	Deprecated Readonly Sortable
last_update_time	Timestamp of last update, could be progress or success or error.	EpochMsTimestamp	Readonly Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value FullSyncState	string
start_time	Timestamp of Full Sync start.	EpochMsTimestamp	Readonly Sortable
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "FullSyncState", "id": "1234", "full_sync_id": "1234", "last_completed_stage": "PROCESSED_DELTAS", "path": "/infra/fullsync-states/1234", "parent_path": "/infra", "relative_path": "1234", "_create_user": "SYSTEM", "_create_time": 1517262573524, "_last_modified_user": "SYSTEM", "_last_modified_time": 1517262573524, "_system_owned": true, "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Global Managers

Associated URIs:

GET /global-manager/api/v1/gm-operational-state
GET /global-manager/api/v1/global-infra/global-managers
DELETE /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
GET /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
PATCH /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
PUT /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
GET /global-manager/api/v1/global-infra/site-cleanup-pending
GET /global-manager/api/v1/global-infra/upgrade-summary

Get Global Managed operational state

Global Manager operation state includes the current status, switchover status
of global manager nodes if any, errors if any and consolidated status of the
operation.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/gm-operational-state

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/gm-operational-state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GmOperationalState+

Example Response: { "status": "SWITCHING_TO_ACTIVE", "start_time": 2374925435, "end_time": 32342234, "consolidated_progress": "IN_PROGRESS", "nodes" :[ { "node-id": "23fae-332d-34243d-2342aa", "status": "COMPLETED", "start_time": 2374925435, "end_time": 32342234, }, { "node-id": "55fae-332d-34243d-2342fr", "status": "IN_PROGRESS", "start_time": 2374925435, "end_time": 32342234, } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Global Managers

List Global Managers under Infra.
This API is only available when using VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/global-managers

Request Headers:

n/a

Query Parameters:

GlobalManagerListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManagerListResult+

Example Response: { "result_count" : 2, "results" : [ { "resource_type": "GlobalManager", "id": "london", "gm_id": "aad93dd9-ea71-41d7-be0d-1b1fca616660", "display_name": "London GM", "path": "/infra/global-managers/london", "parent_path": "/infra/global-managers/london", "relative_path": "london", "mode": "ACTIVE", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 }, { "resource_type": "GlobalManager", "id": "Paris", "gm_id": "dfd93dd9-ea71-41d7-be0d-1b1fca616660", "display_name": "Paris GM", "path": "/infra/global-managers/Paris", "parent_path": "/infra/global-managers/Paris", "relative_path": "Paris", "mode": "STANDBY", "connection_info": [{ "fqdn": "10.190.201.163" }], "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ] } Required Permissions: read Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or patch a Global Manager

Create or patch a Global Manager under Infra.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
This API is only available when using VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

GlobalManagerSwitchOverRequestParameter+

Request Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/Paris { "display_name": "Paris GM", "mode": "ACTIVE" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read a Global Manager

Retrieve information about a particular configured global manager.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
This API is only available when using VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/london Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManager", "id": "london", "gm_id": "dfd93dd9-ea71-41d7-be0d-1b1fca616660", "display_name": "London GM", "path": "/infra/global-managers/london", "parent_path": "/infra/global-managers/london", "relative_path": "london", "mode": "ACTIVE", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete a Global Manager under Infra

Delete a particular global manager under Infra.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
This API is only available when using VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/london Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or fully replace a Global Manager under infra

Create or fully replace Global Manager under Infra.
Revision is optional for creation and required for update.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
This API is only available when using VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

GlobalManagerSwitchOverRequestParameter+

Request Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/Paris { "display_name": "Paris GM", "mode": "ACTIVE", "_revision" : 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManager", "id": "Paris", "display_name": "Paris GM", "path": "/infra/global-managers/Paris", "parent_path": "/infra/global-managers/Paris", "relative_path": "Paris", "mode": "ACTIVE", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List resources pending to be cleaned from set of sites.

Paginated list of resources pending to be cleaned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/site-cleanup-pending

Request Headers:

n/a

Query Parameters:

SiteCleanupPendingListRequestParameters+

Request Body:

n/a

Example Request: GET https://<global-manager>/global-manager/api/v1/global-infra/site-cleanup-pending?intent_path=/global-infra/tier-1s/t1&intent_path=/global-infra/tier-1s/t2 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteCleanupPendingListResult+

Example Response: { "results":[ { "resource_path":"/global-infra/tier-1s/t1", "mark_for_delete":true, "pending_sites":[ { "site_id":"0692bb40-f47f-4b16-b09d-b8493e2c37ee", "site_path":"/global-infra/sites/LM-London" }, { "site_id":"1225c8b2-10a3-4b43-b1a0-b11d3b3e0656", "site_path":"/global-infra/sites/LM-Paris" } ] }, { "resource_path":"/global-infra/tier-1s/t1/segments/segment1", "mark_for_delete":true, "pending_sites":[ { "site_id":"0692bb40-f47f-4b16-b09d-b8493e2c37ee", "site_path":"/global-infra/sites/LM-London" }, { "site_id":"1225c8b2-10a3-4b43-b1a0-b11d3b3e0656", "site_path":"/global-infra/sites/LM-Paris" } ] }, { "resource_path":"/global-infra/tier-1s/t2", "mark_for_delete":false, "pending_sites":[ { "site_id":"0692bb40-f47f-4b16-b09d-b8493e2c37ee", "site_path":"/global-infra/sites/LM-London" } ] } ], "result_count":3, "sort_by":"resource_path", "sort_ascending":true } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Upgrade summary

API will return high level summary of Upgrade across various sites.
This API is only available when using VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/upgrade-summary

Request Headers:

n/a

Query Parameters:

FederationUpgradeSummaryListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/upgrade-summary Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationUpgradeSummaryListResult+

Example Response: { "result_count" : 1, "results" : [ { "id": "30f127c3-aab3-42ec-81f8-223b46184695", "name": "Paris Site", "gpm_name": "Paris GM", "site_type": "ACTIVE_SITE", "overall_upgrade_status": "IN_PROGRESS", "current_version": "3.0.0.2.0.68976345", "target_version": "3.1.0.0.0.76898768", "last_upgrade_timestamp": "3425325235235325", "site_ip": "10.2.35.6", "component_status": [ { "component_type": "EDGE", "component_status": "SUCCESS", "progress_percent": "100", "current_version_node_summary": [ { "2.3.4.5.6", "node_count": "2" } ], "target_version": "3.4.5.6.7" }, { "component_type": "HOST", "component_status": "SUCCESS", "progress_percent": "100", "current_version_node_summary": [ { "version": "2.3.4.5.6", "node_count": "3" }, { "version":"2.3.4,5,5", "node_count": "1" } ], "target_version": "3.4.5.6.7" }, { "component_type": "MP", "component_status": "SUCCESS", "progress_percent": "100", "current_version_node_summary": [ { "2.3.4.5.6", "node_count": "3" } ], "target_version": "3.4.5.6.7" } ] } ] } Required Permissions: read Feature: utilities_upgrade Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Inter-Sites

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/site-span-info
GET /global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/status
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/bgp-summary
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/status
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/site-span-info
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/status

Get infra segment cross site forwarder placement and HA status

Get infra segment cross site forwarder placement and HA statuss.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/site-span-info

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/inter-site-forwarder/site-span-info?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentL2ForwarderSiteSpanInfo+

Example Response: { "segment_path": "/global-infra/segments/tier0-ls", "remote_macs_per_site": [ { "rtep_group_id": 2001, "remote_site": { "target_id": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true }, "remote_mac_addresses": [ "02:00:17:00:12:D3", "02:00:17:00:13:13" ], "remote_active_ips": [ "10.10.10.1" ], "remote_standby_ips": [ "20.20.20.1" ] } ], "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment cross site traffic statistics

Get infra segment cross site traffic statistics.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/status

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/inter-site-forwarder/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentCrossSiteTrafficStats+

Example Response: { "segment_path": "/global-infra/segments/tier0-ls", "rx": { "total_bytes": 56646, "total_packets": 342, "dropped_packets": 103 }, "tx": { "total_bytes": 1125548, "total_packets": 2235, "dropped_packets": 0 }, "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get RTEP span and mac address-table

Get RTEP span and mac address-table.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/bgp-summary

Request Headers:

n/a

Query Parameters:

ListByOptionalTransportNodeParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/tier0/locale-services/tier0localeservices/inter-site/bgp-summary Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterInterSiteBgpSummary+

PolicyEdgeClusterInterSiteBgpSummary (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
edge_cluster_path	Edge node path Edge cluster path whose status is being reported.	string	Required Readonly
edge_nodes	Individual edge nodes status Status of all edge nodes within cluster.	array of PolicyEdgeNodeInterSiteBgpSummary	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "edge_cluster_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/875381be-a4c5-4173-8aa7-ab71695a8129", "edge_nodes": [ { "edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/875381be-a4c5-4173-8aa7-ab71695a8129", "neighbor_status": [ { "source_address": "10.1.1.1", "neighbor_address": "10.1.2.1", "remote_as_number": "1", "remote_port": 179, "local_port": 179, "connection_state": "ESTABLISHED", "time_since_established": 45628, "messages_received": 12, "messages_sent": 10, "connection_drop_count": 0, "established_connection_count": 1, "hold_time": 180, "keep_alive_interval": 30, "graceful_restart": true, "graceful_restart_mode": "HELPER_ONLY", "total_in_prefix_count": 2, "total_out_prefix_count": 1, "address_families": [ { "type": "IPV4_UNICAST", "in_prefix_count": 2, "out_prefix_count": 1 } ], "remote_site": { "target_id": "cfaec4c7-45c2-439b-b7c6-2c3aeabd9976", "target_display_name": "PA Site", "is_valid": true } } ], "last_update_timestamp": 1457117071089 }, { "source_address": "10.1.1.1", "neighbor_address": "10.1.2.1", "remote_as_number": "1", "remote_port": 179, "local_port": 179, "connection_state": "ESTABLISHED", "time_since_established": 45628, "messages_received": 12, "messages_sent": 10, "connection_drop_count": 0, "established_connection_count": 1, "hold_time": 180, "keep_alive_interval": 30, "graceful_restart": true, "graceful_restart_mode": "HELPER_ONLY", "total_in_prefix_count": 2, "total_out_prefix_count": 1, "address_families": [ { "type": "IPV4_UNICAST", "in_prefix_count": 2, "out_prefix_count": 1 } ], "remote_site": { "target_id": "cfaec4c7-45c2-439b-b7c6-2c3aeabd9976", "target_display_name": "PA Site", "is_valid": true } } ], "last_update_timestamp": 1457117071089 } ], } Required Permissions: read Feature: policy_connectivity Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get RTEP mesh connectivity status

Get RTEP mesh connectivity status.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/status

Request Headers:

n/a

Query Parameters:

ListByOptionalTransportNodeParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/tier0/locale-services/tier0localeservices/inter-site/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterInterSiteStatus+

Example Response: { "gateway_path": "/global-infra/tier-0s/tier0", "edge_cluster_path": "/global-infra/sites/default/enforcement-points/default/edge-clusters/875381be-a4c5-4173-8aa7-ab71695a8129", "edge_cluster_name": "Federation edge cluster", "member_status": [ { "edge_node": { "edge_node_path": "/global-infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "Edge node 1", "is_valid": true }, "total_bgp_sessions": 2, "established_bgp_sessions": 2, "neighbor_status": [ { "source_address": "192.100.20.10", "neighbor_address": "192.200.20.10", "connection_state": "ESTABLISHED", "remote_site": { "target_edge_node": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true } }, { "source_address": "192.300.20.10", "neighbor_address": "192.400.20.10", "connection_state": "ESTABLISHED", "remote_site": { "target_id": "235c52a2-c960-4005-4512-451dc54fa542", "target_display_name": "PA Site", "is_valid": true } } ] "status": "UP" }, { "edge_node": { "edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/77eead22-3bb9-4586-8de3-9412941f9116", "target_display_name": "Edge node 2", "is_valid": true }, "total_bgp_sessions": 1, "established_bgp_sessions": 0, "neighbor_status": [ { "source_address": "192.100.20.10", "neighbor_address": "192.200.20.10", "connection_state": "IDLE", "remote_site": { "target_edge_node": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true } } ] "status": "DOWN" } ], "overall_status": "DEGRADED", "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_connectivity Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment cross site forwarder placement and HA status

Get segment cross site forwarder placement and HA statuss.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/site-span-info

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/segments/tier1-ls/inter-site-forwarder/site-span-info?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentL2ForwarderSiteSpanInfo+

Example Response: { "segment_path": "/global-infra/tier-1s/tier1/segments/tier1-ls", "remote_macs_per_site": [ { "rtep_group_id": 2001, "remote_site": { "target_id": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true }, "remote_mac_addresses": [ "02:00:17:00:12:D3", "02:00:17:00:13:13" ], "remote_active_ips": [ "10.10.10.1" ], "remote_standby_ips": [ "20.20.20.1" ] } ], "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment cross site traffic statistics

Get segment cross site traffic statistics.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/status

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/segments/tier1-ls/inter-site-forwarder/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentCrossSiteTrafficStats+

Example Response: { "segment_path": "/global-infra/tier-1s/tier1/segments/tier1-ls", "rx": { "total_bytes": 56646, "total_packets": 342, "dropped_packets": 103 }, "tx": { "total_bytes": 1125548, "total_packets": 2235, "dropped_packets": 0 }, "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Observability

Associated URIs:

GET /global-manager/api/v1/observability/flow-details

Get monitoring info

Provides federation monitoring information, which includes all
config flows originating from the site where API is invoked.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/observability/flow-details

Request Headers:

n/a

Query Parameters:

SiteRequestParameter+

Request Body:

n/a

Example Request: GET https://<global-manager>/global-manager/api/v1/observability/flow-details GET https://<local-manager>/global-manager/api/v1/observability/flow-details Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

MonitoringInfo+

Example Response: On Global Manager { "monitoring_info": [{ "id": "rrrrrr-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_TO_LM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm2lm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "gm2lm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "36021bd5-9ebc-46e0-9d7a-5a4fa8bb3802", "to_site_path": "/global-infra/sites/Newyork", "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "from_site_path": "/global-infra/global-managers/LondonGM", "latency_millis": 123, "latency_measured_ts": 1590336614947, "last_full_sync": { "status": "COMPLETED", "id": "f6fda71a-d5f2-4000-8677-deaafd80641e", "reason_code": "10010", "reason": "Site onboarded", "stage": "COMPLETED", "data_streaming_from_source_progress": "Sending resources of type COMMUNICATION_MAP", "data_streaming_from_source_start_time": 1590335604947, "data_streaming_from_source_end_time": 1590336604947, "receiver_state": "COMPLETED", "receiver_start_time": 1590336614947, "receiver_end_time": 1590336714947, "start_time": 1590335604947, "end_time": 1590435604947, "errors": {}, "warnings": {} } } }, { "id": "asarrr-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_TO_LM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm2lm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "gm2lm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "to_site_path": "/global-infra/sites/Paris", "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "from_site_path": "/global-infra/global-managers/LondonGM", "latency_millis": 123, "latency_measured_ts": 1590336614947, "last_full_sync": { "status": "COMPLETED", "id": "f6fda71a-d5f2-4000-8677-deaafd80641e", "reason_code": "10010", "reason": "Site onboarded", "stage": "COMPLETED", "data_streaming_from_source_progress": "Sending resources of type COMMUNICATION_MAP", "data_streaming_from_source_start_time": 1590335604947, "data_streaming_from_source_end_time": 1590336604947, "receiver_state": "COMPLETED", "receiver_start_time": 1590336614947, "receiver_end_time": 1590336714947, "start_time": 1590335604947, "end_time": 1590435604947, "errors": {}, "warnings": {} } } }, { "id": "rrbbr-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_GM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "lm2gm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "lm2gm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "to_site_path": "/global-infra/global-managers/LondonGM", "from_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "from_site_path": "/global-infra/sites/Paris", "latency_millis": 125 } }, { "id": "ca00-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_GM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "lm2gm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "lm2gm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "to_site_path": "/global-infra/global-managers/NewyorkGM", "from_site_id": "BB021bd5-9ebc-46e0-9d7a-5a4fa8bb3155", "from_site_path": "/global-infra/sites/Newyork", "latency_millis": 120 "latency_measured_ts": 1590336614947, } }, { "id": "cab10-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_WORK_QUEUE", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm-work-queue", "namespace": "gm" } ] }, { "id": "dea0-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_DELETE_QUEUE", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm-delete-queue-1", "namespace": "gm" } ] } ] } On Local Manager { "monitoring_info": [ { "id": "we11-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_TO_LM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm2lm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "gm2lm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "to_site_path": "/global-infra/sites/Paris", "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "from_site_path": "/global-infra/global-managers/LondonGM", "latency_millis": 123, "latency_measured_ts": 1590336614947, "last_full_sync": { "status": "COMPLETED", "id": "f6fda71a-d5f2-4000-8677-deaafd80641e", "reason_code": "10010", "reason": "Site onboarded", "stage": "COMPLETED", "data_streaming_from_source_progress": "Sending resources of type COMMUNICATION_MAP", "data_streaming_from_source_start_time": 1590335604947, "data_streaming_from_source_end_time": 1590336604947, "receiver_state": "COMPLETED", "receiver_start_time": 1590336614947, "receiver_end_time": 1590336714947, "start_time": 1590335604947, "end_time": 1590435604947, "errors": {}, "warnings": {} } } }, { "id": "fg12-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_GM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "lm2gm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "lm2gm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "to_site_path": "/global-infra/global-managers/LondonGM", "from_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "from_site_path": "/global-infra/sites/Paris", "latency_millis": 125, "latency_measured_ts": 1590336614947, } }, { "id": "ff10-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_LM", "cross_site_flow_info": { "status": "GOOD", "to_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", // To NewYork (LM doesn't have site paths) "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "latency_millis": 123, "latency_measured_ts": 1590336614947, } } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Onboarding

Associated URIs:

POST /global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=check_conflict
POST /global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=start_onboarding
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/feature-summary
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/invalid-config-details
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences
PUT /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/status

Fetch conflicting entities summary for a Site

Get consolidated list of conflicting entities summary for each supported
feature for a site with an example.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/feature-summary

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET /global-infra/site/site-1/onboarding/feature-summary Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConflictingEntityListResponse+

Example Response: { "infra_descendants": [ { "feature": { "name": "NETWORK" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "LOCATION" }, "conflict_count": 0, "total_count": 2 }, { "feature": { "name": "DNS" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "DHCP" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "NETWORK_PROFILE" }, "conflict_count": 0, "total_count": 8 }, { "feature": { "name": "CONTEXT_PROFILE" }, "conflict_count": 0, "total_count": 126 }, { "feature": { "name": "SERVICE" }, "conflict_count": 0, "total_count": 2460 }, { "feature": { "name": "TIER1" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "TIER0" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "SECURITY_PROFILE" }, "conflict_count": 0, "total_count": 0 } ], "feature_descendants": [ { "feature": { "name": "UNKNOWN" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "IDS" }, "conflict_count": 0, "total_count": 2 }, { "feature": { "name": "SECURITY_POLICY" }, "conflict_count": 0, "total_count": 230 }, { "feature": { "name": "GATEWAY_PROFILE" }, "conflict_count": 0, "total_count": 4 }, { "feature": { "name": "GATEWAY_PROPERTY" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "IGNORE" }, "conflict_count": 0, "total_count": 2 }, { "feature": { "name": "NAT" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "GROUP" }, "conflict_count": 0, "total_count": 20 }, { "feature": { "name": "IP_ADDRESS_POOL" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "LB" }, "conflict_count": 0, "total_count": 17 }, { "feature": { "name": "VPN" }, "conflict_count": 0, "total_count": 29 } ], "feature_summary" : { "total_conflict_count": 0, "total_count" : 304 } "example": { "name": "service_14", "resource_type": "SERVICE", "path": "/infra/services/service_14" }, "feature_compatibility_data" : [ { "feature": { "name": "SECURITY_POLICY" }, "status" : "INCOMPATIBLE", "details" : [ { "status_code" : 40031, "status_message" : "Incompatible Security Policy order found on..." "attributes" : [ { "name" : "SP_SEQ_INCOMP_CNT", "value" : "12", "value_type" : "INTEGER" } ] } ] } ] } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Fetch feature entities summary details for a Site

Get feature summary details with invalid configuration for a feature.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/invalid-config-details

Request Headers:

n/a

Query Parameters:

FeatureSummaryRequestParameters+

Request Body:

n/a

Example Request: GET /global-infra/site/site-1/onboarding/invalid-config-details?feature=LB Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationInvalidConfigurationDetailsResponse+

Example Response: { "feature": { "name": "LB" }, "invalid_config_summary": [ { "category": "LB_POOL_GROUP_USE_COUNT", "resource_summary_details": [ { "resource_type": "Group", "resource_list": [ { "name": "group-8", "value": "/infra/domains/domain/groups/group-8", "value_type": "STRING" }, { "name": "group-2", "value": "/infra/domains/domain/groups/group-2", "value_type": "STRING" }, { "name": "group-1", "value": "/infra/domains/domain/groups/group-1", "value_type": "STRING" } ], "resource_count": 3 } ], "resource_count": 3 }, { "category": "LB_POOL_SHARED_SECTION_USE_COUNT", "resource_summary_details": [ { "resource_type": "CommunicationMap", "resource_list": [ { "name": "sec-11", "value": "/infra/domains/default/security-policies/sec-11", "value_type": "STRING" }, { "name": "sec-12", "value": "/infra/domains/default/security-policies/sec-12", "value_type": "STRING" }, { "name": "sec-5", "value": "/infra/domains/default/security-policies/sec-5", "value_type": "STRING" }, { "name": "sec-14", "value": "/infra/domains/default/security-policies/sec-14", "value_type": "STRING" }, { "name": "sec-1", "value": "/infra/domains/default/security-policies/sec-1", "value_type": "STRING" } ], "resource_count": 5 } ], "resource_count": 5 } ], "total_count": 8 } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Onboarding Preferences

Get user onboarding preferences for a site on global manager.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET /global-infra/sites/site-1/onboarding/user-preferences Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteOnboardingPreference+

SiteOnboardingPreference (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ignore_import	Ignore Import Preference Represents user's decision to ignore onboarding option for a site. User will not be shown onboarding message or will failing onboarding when ignore status is set to 'true'.	boolean	Required Readonly
resource_type	Must be set to the value SiteOnboardingPreference	string
site_id	Site Identifier Unique site identifier.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30

Example Response: { "site_id": "site-1", "ignore_import": false, "resource_type": "SiteOnboardingPreference", "id": "site-1", "display_name": "site-1", "_create_user": "admin", "_create_time": 1581541290117, "_last_modified_user": "admin", "_last_modified_time": 1581541290117, "_system_owned": false, "_revision": 0 } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Onboarding Preferences

Update user onboarding preferences to allow or reject site onboarding on
global manager.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SiteOnboardingPreference+

SiteOnboardingPreference (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ignore_import	Ignore Import Preference Represents user's decision to ignore onboarding option for a site. User will not be shown onboarding message or will failing onboarding when ignore status is set to 'true'.	boolean	Required Readonly
resource_type	Must be set to the value SiteOnboardingPreference	string
site_id	Site Identifier Unique site identifier.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30

Example Request: PUT /global-infra/sites/site-1/onboarding/user-preferences { "site_id": "site-1", "ignore_import": true, "resource_type": "SiteOnboardingPreference", "id": "site-1", "display_name": "site-1", "_create_user": "admin", "_create_time": 1581541290117, "_last_modified_user": "admin", "_last_modified_time": 1581541290117, "_system_owned": false, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteOnboardingPreference+

SiteOnboardingPreference (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ignore_import	Ignore Import Preference Represents user's decision to ignore onboarding option for a site. User will not be shown onboarding message or will failing onboarding when ignore status is set to 'true'.	boolean	Required Readonly
resource_type	Must be set to the value SiteOnboardingPreference	string
site_id	Site Identifier Unique site identifier.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30

Example Response: { "site_id": "site-1", "ignore_import": true, "resource_type": "SiteOnboardingPreference", "id": "site-1", "display_name": "site-1", "_create_user": "admin", "_create_time": 1581541290117, "_last_modified_user": "admin", "_last_modified_time": 1581541290117, "_system_owned": false, "_revision": 1 } Required Permissions: crud Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Onboarding status

Get onboarding status for a site. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET /global-infra/sites/site-1/onboarding/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConfigOnboardingStatus+

Example Response: { "site_id": "site-1", "status": "IN_PROGRESS", "details": { "import_progress": { "feature": { "name": "SERVICE" }, "stage": "LM_MIGRATION", "current_step": 1, "total_steps": 5 }, "site_backup_reference": "2020-01-28-Site-1-backup" }, "timestamp": 1581550365276 } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Check Onboarding configuration conflicts

Verifies and reports conflicting onboarding feature for a site. The
response will contain first conflicting feature for the site configuration
compared to corresponding global manager configuration.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=check_conflict

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ConfigOnboardingConflictRequest+

Example Request: POST /global-infra/sites/site-1/onboarding??action=check_conflict { "site_id" : "site-1", "suffix": "site-1-suffix" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConfigOnboardingConflictStatus+

Example Response: { "site_id": "site-1", "status": "CONFLICT_DETECTED", "details": { "resource_type" : "Tier0", "name": "routing-gateway", "path": "/infra/tier0s/routing-gateway" } } Required Permissions: crud Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Start or Check on-boarding for a Site

Initiate config on-boarding of a Site. The entire on-boarding is async
workflow controlled by API.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=start_onboarding

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ConfigOnboardingRequest+

Example Request: POST /global-infra/sites/site-1/onboarding?action=start_config_onboarding { "site_id" : "site-1", "suffix": "site-1-suffix", "site_backup_reference" : "2020-01-28-Site-1-backup" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConfigOnboardingStatus+

Example Response: { "site_id": "site-1", "status": "IN_PROGRESS", "supported_features": [], "details": { "import_progress": {}, "site_backup_reference": "2020-01-28-Site-1-backup" }, "timestamp": 1580609440765 } Required Permissions: crud Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Security: East West Security: Distributed Firewall: Settings

Federation: Security: East West Security: Distributed Firewall: Settings: Distributed Firewall Settings

Associated URIs:

GET /global-manager/api/v1/global-infra/sites/{site-id}/settings/firewall/security
PATCH /global-manager/api/v1/global-infra/sites/{site-id}/settings/firewall/security
PUT /global-manager/api/v1/global-infra/sites/{site-id}/settings/firewall/security
GET /global-manager/api/v1/global-infra/sites/settings/firewall/security

Patch global distributed firewall configuration for the specified site

Update the global distributed firewall configuration for the specified site.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/settings/firewall/security

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GlobalDfwConfiguration+

GlobalDfwConfiguration (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enable_firewall	Distributed firewall enable flag If set to true, distributed firewall is enabled on a specified site.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalDfwConfiguration	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/london/settings/firewall/security { "resource_type": "GlobalDfwConfiguration", "id": "security", "display_name": "security", "path": "/global-infra/sites/london/settings/firewall/security", "relative_path": "security", "marked_for_delete": false, "enable_firewall": true, "_create_user": "system", "_create_time": 1554274751846, "_last_modified_user": "admin", "_last_modified_time": 1554274751846, "_protection": "NOT_PROTECTED", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get global distributed firewall configuration for the specified site

Get global distributed firewall configuration for the specified site. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/settings/firewall/security

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/london/settings/firewall/security Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalDfwConfiguration+

GlobalDfwConfiguration (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enable_firewall	Distributed firewall enable flag If set to true, distributed firewall is enabled on a specified site.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalDfwConfiguration	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalDfwConfiguration", "id": "security", "display_name": "security", "path": "/global-infra/sites/london/settings/firewall/security", "relative_path": "security", "marked_for_delete": false, "enable_firewall": true, "_create_user": "system", "_create_time": 1554274751846, "_last_modified_user": "admin", "_last_modified_time": 1554274751846, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update global distributed firewall configuration for the specified site

Update the global distributed firewall configuration for the specified site.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/settings/firewall/security

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GlobalDfwConfiguration+

GlobalDfwConfiguration (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enable_firewall	Distributed firewall enable flag If set to true, distributed firewall is enabled on a specified site.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalDfwConfiguration	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/london/settings/firewall/security { "resource_type": "GlobalDfwConfiguration", "id": "security", "display_name": "security", "path": "/global-infra/sites/london/settings/firewall/security", "relative_path": "security", "marked_for_delete": false, "enable_firewall": true, "_create_user": "system", "_create_time": 1554274751846, "_last_modified_user": "admin", "_last_modified_time": 1554274751846, "_protection": "NOT_PROTECTED", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalDfwConfiguration+

GlobalDfwConfiguration (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enable_firewall	Distributed firewall enable flag If set to true, distributed firewall is enabled on a specified site.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GlobalDfwConfiguration	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalDfwConfiguration", "id": "security", "display_name": "security", "path": "/global-infra/sites/london/settings/firewall/security", "relative_path": "security", "marked_for_delete": false, "enable_firewall": true, "_create_user": "system", "_create_time": 1554274751846, "_last_modified_user": "admin", "_last_modified_time": 1554274751846, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get global distributed firewall configurations for all the sites

Get global distributed firewall configurations for all the sites. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/settings/firewall/security

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/settings/firewall/security Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalDfwConfigurationListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "GlobalDfwConfiguration", "id": "security", "display_name": "security", "path": "/global-infra/sites/london/settings/firewall/security", "relative_path": "security", "marked_for_delete": false, "enable_firewall": true, "_create_user": "system", "_create_time": 1554274751846, "_last_modified_user": "admin", "_last_modified_time": 1554274751846, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Federation: Sites

Associated URIs:

POST /global-manager/api/v1/global-infra/onboarding-check-compatibility
GET /global-manager/api/v1/global-infra/sites
DELETE /global-manager/api/v1/global-infra/sites/{site-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}
PATCH /global-manager/api/v1/global-infra/sites/{site-id}
PUT /global-manager/api/v1/global-infra/sites/{site-id}
GET /global-manager/api/v1/global-infra/sites/listener_certificate
GET /global-manager/api/v1/global-infra/span

Create or fully replace a Site under infra

Create or fully replace a Site under Infra.
Revision is optional for creation and required for update.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/onboarding-check-compatibility

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SiteNodeConnectionInfo+

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/onboarding-check-compatibility { "fqdn": "10.192.201.163", "username": "admin", "password": "Admin!23Admin", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CompatibilityCheckResult+

Example Response: { "rtt": 125, "rtt_exceeded": false, "nsx_version": "3.0.0", "version_compatible" : true } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Sites

List Sites under Infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites

Request Headers:

n/a

Query Parameters:

SiteListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteListResult+

Example Response: { "result_count" : 3, "results" : [ { "resource_type": "Site", "id": "casablanca", "display_name": "Casablanca, Morocco Site", "description" : "Site managing call center workloads in North Africa", "path": "/infra/sites/casablanca", "parent_path": "/infra/sites/casablanca", "relative_path": "casablanca", "site_connection_info": [{ "fqdn": "10.192.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 }, { "resource_type": "Site", "id": "tokyo", "display_name": "Tokyo, Japan Site", "description" : "Active Site managing production workloads in East Asia", "path": "/infra/sites/tokyo", "parent_path": "/infra/sites/tokyo", "relative_path": "tokyo", "site_connection_info": [{ "fqdn": "10.199.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 }, { "resource_type": "Site", "id": "paris", "display_name": "Paris, France Site", "description" : "StandBy Site managing business workloads in Central Europe", "path": "/infra/sites/paris", "parent_path": "/infra/sites/paris", "relative_path": "paris", "site_connection_info": [{ "fqdn": "10.190.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or patch Site

Create or patch Site under Infra.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/Paris { "site_connection_info": [{ "fqdn": "10.192.201.163", "username": "admin", "password": "Admin!23Admin", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_rtep_misconfigured": true "display_name": "Paris, EU Site", "description" : "Site managing call center workloads in western Europe", } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete a site

Delete a site under Infra.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

SiteActionParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/sites/Paris Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or fully replace a Site under infra

Create or fully replace a Site under Infra.
Revision is optional for creation and required for update.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/Paris { "site_connection_info": [{ "fqdn": "10.192.201.163", "username": "admin", "password": "Admin!23Admin", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_rtep_misconfigured": true "display_name": "Paris, EU Site", "description" : "Site managing call center workloads in western Europe", "_revision" : 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Site", "id": "Paris", "display_name": "Paris, EU Site", "description" : "Site managing call center workloads in western Europe", "path": "/infra/sites/Paris", "parent_path": "/infra/sites/Paris", "relative_path": "Paris", "site_connection_info": [{ "fqdn": "10.192.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_rtep_misconfigured": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read a site

Read a site under Infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/casablanca Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Site", "id": "casablanca", "display_name": "Casablanca, Morocco Site", "description" : "Site managing call center workloads in North Africa", "path": "/infra/sites/casablanca", "parent_path": "/infra/sites/casablanca", "relative_path": "casablanca", "site_connection_info": [{ "fqdn": "10.192.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Returns the certificate of the listener

Connects to the given IP and port, and, if an SSL listener is present, returns
the certificate of the listener.
Intent of this API is "Do you trust this certificate?".
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/listener_certificate

Request Headers:

n/a

Query Parameters:

TlsListenerEndpointAddressRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-policy/api/v1/global-infra/sites/listener_certificate?address=10.22.122.7&port=443 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsListenerCertificate+

Example Response: { "result": "SUCCESS", "certificate": { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" }, "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get span for an entity with specified path

Get span for an entity with specified path. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/span

Request Headers:

n/a

Query Parameters:

IntentPathRequestParameter+

Request Body:

n/a

Example Request: GET https://<global-manager>/global-manager/api/v1/global-infra/span?intent_path=/global-infra/tier-0s/t0 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Span+

Span (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Span	string
sites	List of SpanSiteInfos List of SpanSiteInfos representing the strech of the entity.	array of SpanSiteInfo	Readonly
span_leader	Policy resource type of span leader Represents Policy resource type streached entity's span leader.	string	Readonly
span_resource	Policy resource path Represents Policy resource path of streached entity.	string	Readonly
span_resource_type	Policy resource type Policy resource type of the streached entity.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SPAN", "span_resource_type": "PROVIDER", "span_resource": "/global-infra/tier-0s/t0", "span_leader": "/global-infra/tier-0s/t0", "site_ids": [ "51a1294a-b1d5-40a9-a382-2b1aeb62c41a", "3d497d3f-2f9a-4983-9db0-d1f5f7cbc3d0" ], "marked_for_delete": false, "overridden": false } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Management Plane API: NSX Component Administration

Management Plane API: NSX Component Administration: Appliance Management

Associated URIs:

GET /api/v1/cluster/{cluster-node-id}/node/services/applianceproxy
GET /api/v1/node/services/applianceproxy
POST /api/v1/cluster/{cluster-node-id}/node/services/applianceproxy?action=restart
POST /api/v1/cluster/{cluster-node-id}/node/services/applianceproxy?action=start
POST /api/v1/cluster/{cluster-node-id}/node/services/applianceproxy?action=stop
POST /api/v1/node/services/applianceproxy?action=restart
POST /api/v1/node/services/applianceproxy?action=start
POST /api/v1/node/services/applianceproxy?action=stop
GET /api/v1/cluster/{cluster-node-id}/node/services/applianceproxy/status
GET /api/v1/node/services/applianceproxy/status

Read the Appliance Proxy service properties

Request:

Method:

GET

URI Path(s):

/api/v1/cluster/{cluster-node-id}/node/services/applianceproxy

/api/v1/node/services/applianceproxy

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

NodeServiceProperties+

Required Permissions: read Feature: system_administration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read the Appliance Proxy service status

Request:

Method:

GET

URI Path(s):

/api/v1/cluster/{cluster-node-id}/node/services/applianceproxy/status

/api/v1/node/services/applianceproxy/status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

NodeServiceStatusProperties+

Required Permissions: read Feature: system_administration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Restart, start or stop the Appliance Proxy Service

Request:

Method:

POST

URI Path(s):

/api/v1/cluster/{cluster-node-id}/node/services/applianceproxy?action=restart

/api/v1/cluster/{cluster-node-id}/node/services/applianceproxy?action=start

/api/v1/cluster/{cluster-node-id}/node/services/applianceproxy?action=stop

/api/v1/node/services/applianceproxy?action=restart

/api/v1/node/services/applianceproxy?action=start

/api/v1/node/services/applianceproxy?action=stop

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

NodeServiceStatusProperties+

Required Permissions: crud Feature: system_administration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy

Associated URIs:

GET /global-manager/api/v1/global-infra/group-service-associations

Get the list of services where the given group is consumed.

The API by default returns all the DFW services associated with the given Group.
The API returns DFW or IPFIX services based on the service_type parameter.
It also returns the services associated with the parent groups of
the given group.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/group-service-associations

Request Headers:

n/a

Query Parameters:

PolicyGroupServiceAssociationsRequestParameters+

PolicyGroupServiceAssociationsRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
intent_path	Path of the entity Path of the entity for which associated services are to be fetched.	string	Required
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
service_type		string	Enum: firewall, ipfix
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://10.193.41.70/global-manager/api/v1/global-infra/group-service-associations?intent_path=/global-infra/domains/default/groups/ChildGroup Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceListResult+

Example Response: { "results": [ { "path": "/infra/domains/default/security-policies/91e2b990-feed-11e9-be9e-b16debafe148/rules/bc9cd5d0-feed-11e9-be9e-b16debafe148", "target_id": "bc9cd5d0-feed-11e9-be9e-b16debafe148", "target_display_name": "Policy1", "target_type": "CommunicationEntry" }, { "path": "/infra/domains/default/security-policies/91e2b990-feed-11e9-be9e-b16debafe148/rules/bc496930-feee-11e9-be9e-b16debafe148", "target_id": "bc496930-feee-11e9-be9e-b16debafe148", "target_display_name": "Policy2", "target_type": "CommunicationEntry" }, { "path": "/infra/domains/default/security-policies/91e2b990-feed-11e9-be9e-b16debafe148/rules/b8c65fe0-ff91-11e9-9a36-cbe55de635f8", "target_id": "b8c65fe0-ff91-11e9-9a36-cbe55de635f8", "target_display_name": "Policy3", "target_type": "CommunicationEntry" } ], "result_count": 3, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Certificates

Policy: Infra: Certificates: CSR

Associated URIs:

GET /global-manager/api/v1/global-infra/csrs
POST /global-manager/api/v1/global-infra/csrs?action=self_sign
DELETE /global-manager/api/v1/global-infra/csrs/{csr-id}
GET /global-manager/api/v1/global-infra/csrs/{csr-id}
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=self_sign
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=create
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=import
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=upload
GET /global-manager/api/v1/global-infra/csrs/{csr-id}/pem-file

Return All the Generated CSRs

Returns information about all of the CSRs that have been created. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/csrs

Request Headers:

n/a

Query Parameters:

ListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/csrs Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCsrListResult+

Example Response: { "result_count": 1, "results": [ { "resource_type": "Csr", "id": "example-csr-id", "display_name": "example-csr-id", "path": "/infra/csrs/example-csr-id", "parent_path": "/infra/csrs/example-csr-id", "relative_path": "example-csr-id", "pem_encoded": "-----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST-----\n", "key_size": 2048, "subject": { "attributes": [ { "value": "Jane", "key": "CN" }, { "value": "VMware", "key": "O" }, { "value": "NSBU", "key": "OU" }, { "value": "US", "key": "C" }, { "value": "CA", "key": "ST" }, { "value": "PA", "key": "L" } ] }, "algorithm": "RSA", "is_ca": false, "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete a CSR

Removes a specified CSR. If a CSR is not used for verification, you can
delete it. Note that the CSR import and upload POST actions automatically
delete the associated CSR.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Show CSR Data for the Given CSR ID

Returns information about the specified CSR. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCsr+

TlsCsr (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCsr	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Csr", "id": "example-csr-id", "display_name": "example-csr-id", "path": "/infra/csrs/example-csr-id", "parent_path": "/infra/csrs/example-csr-id", "relative_path": "example-csr-id", "pem_encoded": "-----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST-----\n", "key_size": 2048, "subject": { "attributes": [ { "value": "Jane", "key": "CN" }, { "value": "VMware", "key": "O" }, { "value": "NSBU", "key": "OU" }, { "value": "US", "key": "C" }, { "value": "CA", "key": "ST" }, { "value": "PA", "key": "L" } ] }, "algorithm": "RSA", "is_ca": false, "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get CSR PEM File for the Given CSR ID

Downloads the CSR PEM file for a specified CSR. Clients must include an Accept: text/plain request header. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}/pem-file

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id/pem-file Accept: text/plain Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/plain;charset=UTF-8

Response Body:

string

Example Response: -----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST----- Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Generate a New Certificate Signing Request

Creates a new certificate signing request (CSR). A CSR is encrypted text that
contains information about your organization (organization name, country,
and so on) and your Web server's public key, which is a public certificate
the is generated on the server that can be used to forward this request to a
certificate authority (CA). A private key is also usually created at the
same time as the CSR.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=create

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCsr+

TlsCsr (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCsr	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=create { "subject": { "attributes": [ {"key":"CN","value":"Jane"}, {"key":"O","value":"VMware"}, {"key":"OU","value":"NSBU"}, {"key":"C","value":"US"}, {"key":"ST","value":"CA"}, {"key":"L","value":"PA"} ] }, "key_size": "2048", "algorithm": "RSA", "is_ca": false } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCsr+

TlsCsr (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCsr	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCsr", "id": "example-csr-id", "display_name": "example-csr-id", "path": "/infra/csrs/example-csr-id", "parent_path": "/infra/csrs", "relative_path": "example-csr-id", "pem_encoded": "-----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST-----\n", "key_size": 2048, "subject": { "attributes": [ { "value": "Jane", "key": "CN" }, { "value": "VMware", "key": "O" }, { "value": "NSBU", "key": "OU" }, { "value": "US", "key": "C" }, { "value": "CA", "key": "ST" }, { "value": "PA", "key": "L" } ] }, "algorithm": "RSA", "is_ca": false, "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Import a Certificate Associated with an Approved CSR

Imports a certificate authority (CA)-signed certificate for a CSR. This
action links the certificate to the private key created by the CSR. The
pem_encoded string in the request body is the signed certificate provided by
your CA in response to the CSR that you provide to them. The import POST
action automatically deletes the associated CSR.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=import

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsTrustData+

TlsTrustData (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key_algo	Key algorithm contained in this certificate.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
passphrase	Password for private key encryption.	secure_string
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
private_key	private key data	secure_string
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsTrustData	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=import { "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n" } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "display_name": "example-csr-id", "path": "/infra/certificates/669f4e8f-061e-4c73-8cfb-1044181eb365", "parent_path": "/infra", "relative_path": "example-csr-id", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "Jane", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "realization_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "marked_for_delete": false, "overridden": false, "has_private_key": true, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Self-Sign the CSR

Self-signs the previously generated CSR. This action is similar to the
import certificate action, but instead of using a public certificate signed
by a CA, the self_sign POST action uses a certificate that is signed with
NSX's own private key.
For validity of non-CA certificates, if a value greater than 825 days is
provided, it will be set to 825 days. No limit is set for CA certificates.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=self_sign

Request Headers:

n/a

Query Parameters:

SelfSignedActionParameter+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=self_sign&days_valid=365 Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "display_name": "example-csr-id", "path": "/infra/certificates/669f4e8f-061e-4c73-8cfb-1044181eb365", "parent_path": "/infra", "relative_path": "669f4e8f-061e-4c73-8cfb-1044181eb365", "details": [ { "issuer_cn": "Jane", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "is_ca": false, "subject_cn": "Jane", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "realization_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Upload the Certificate PEM File Signed by the CA Associated with a CSR

Uploads the certificate authority (CA)-signed certificate. After you send
the certificate request to the CA of your choice, and the CA sends back the
signed certificate, you can use the upload POST action to upload the signed
certificate. The upload action is similar to the import action, but the
upload action allows you to directly upload the PEM-encoded file (signed
certificate) provided by the CA. Like the import POST action, the upload
POST action automatically deletes the associated CSR.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=upload

Request Headers:

n/a

Query Parameters:

UploadFileRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=upload Content-Type: multipart/form-data; boundary=2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f --2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f Content-Disposition: form-data; name="file"; filename="mycert.pem" -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Generate a new self-signed certificate

Creates a new self-signed certificate. A private key is also created at the
same time. This is convenience call that will generate a CSR and then self-sign it.
For validity of non-CA certificates, if a value greater than 825 days is
provided, it will be set to 825 days. No limit is set for CA certificates.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs?action=self_sign

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCsrWithDaysValid+

TlsCsrWithDaysValid (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
days_valid	Number of days the certificate will be valid, default 825 days	integer	Minimum: 1 Maximum: 10000 Default: "825"
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCsrWithDaysValid	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs?action=self_sign { "subject": { "attributes": [ {"key":"CN","value":"Jane"}, {"key":"O","value":"VMware"}, {"key":"OU","value":"NSBU"}, {"key":"C","value":"US"}, {"key":"ST","value":"CA"}, {"key":"L","value":"PA"} ] }, "key_size": "2048", "algorithm": "RSA", "days_valid": 365, } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "display_name": "example-csr-id", "path": "/infra/certificates/669f4e8f-061e-4c73-8cfb-1044181eb365", "parent_path": "/infra", "relative_path": "669f4e8f-061e-4c73-8cfb-1044181eb365", "details": [ { "issuer_cn": "Jane", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "is_ca": false, "subject_cn": "Jane", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "realization_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Certificates: Certificates

Associated URIs:

GET /global-manager/api/v1/global-infra/cabundles
DELETE /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
GET /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
PATCH /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
POST /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
PUT /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
GET /global-manager/api/v1/global-infra/cabundles/{cabundle-id}/pem-file
GET /global-manager/api/v1/global-infra/certificates
DELETE /global-manager/api/v1/global-infra/certificates/{certificate-id}
GET /global-manager/api/v1/global-infra/certificates/{certificate-id}
PATCH /global-manager/api/v1/global-infra/certificates/{certificate-id}
PUT /global-manager/api/v1/global-infra/certificates/{certificate-id}

Returns information about all the CA bundles

Returns information about all the bundles of trusted CA certificates.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cabundles

Request Headers:

n/a

Query Parameters:

ListCertParameter+

ListCertParameter (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
details	whether to expand the pem data and show all its details	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
node_id	Node ID of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular node ID.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
type	Type of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular usage. Passing cluster_certificate will return the certificate used for the cluster wide API service.	string	Enum: cluster_api_certificate, api_certificate

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundleListResult+

Example Response: { "result_count": 2, "results": [ { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" }, { "_create_time": 1611941474997, "_create_user": "unknown", "_last_modified_time": 1611941474997, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": true, "display_name": "default_trusted_public_ca_bundle", "earliest_not_after": 1616006013000, "id": "default_trusted_public_ca_bundle", "marked_for_delete": false, "not_after_list": [2289338164000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/default_trusted_public_ca_bundle", "relative_path": "default_trusted_public_ca_bundle", "resource_type": "CaBundle", "unique_id": "293185d4-07e5-4a5e-b7b8-bd3a86fa270e"}], } ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Adds or replaces a CA bundle

Adds or replaces a new bundle of trusted CA certificates.
The multipart-uploaded file must be a concatenation of one or more
PEM-encoded certificates.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

UploadFileRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Content-Type: multipart/form-data; boundary=243332e4709e58a3bd679ef3c7b1259a --243332e4709e58a3bd679ef3c7b1259a Content-Disposition: form-data; name="file"; filename="example-cabundle.pem" -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- [...] --243332e4709e58a3bd679ef3c7b1259a-- Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Adds or replaces a CA bundle

Adds or replaces a new bundle of trusted CA certificates.
The bundle must be a concatenation of one or more
PEM-encoded certificates.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id { "pem_encoded": "-----BEGIN CERTIFICATE-----\n[...]\n-----END CERTIFICATE-----", } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Adds or updates a CA bundle

Adds or updates a new bundle of trusted CA certificates.
The bundle must be a concatenation of one or more
PEM-encoded certificates. The PEM-encoded bundle is replaced
with the one provided in the request.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id { "pem_encoded": "-----BEGIN CERTIFICATE-----\n[...]\n-----END CERTIFICATE-----", } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 1, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Deletes CA bundle

Deletes the specified bundle of trusted CA certificates.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Returns information about a CA bundle

Returns information about the specified bundle of trusted CA
certificates.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "certificates": [ { "is_ca": true, "is_valid": true, "issuer": "CN=test.local,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU", "issuer_cn": "test.local", "not_after": 1688688782000, "not_before": 1602202382000, "public_key_algo": "RSA", "public_key_length": 2048, "rsa_public_key_exponent": "10001", "rsa_public_key_modulus": "00 cf ...", "serial_number": "abffbac5ca0a1934357be127156f6615cc14400", "signature": "1e 81 ...", "signature_algorithm": "SHA256WITHRSA", "subject": "CN=test.local,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU", "subject_cn": "test.local", "version": "3", }, ... ], "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Downloads a CA bundle

Downloads the specified PEM-encoded bundle of trusted CA certificates.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}/pem-file

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/plain;charset=UTF-8

Response Body:

string

Example Response: -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- [...] Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Return All the User-Facing Components' Certificates

Returns all certificate information viewable by the user, including each
certificate's id; pem_encoded data; and history of the
certificate (who created or modified it and when). For additional
information, include the ?details=true modifier at the end of the request
URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/certificates

Request Headers:

n/a

Query Parameters:

ListCertParameter+

ListCertParameter (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
details	whether to expand the pem data and show all its details	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
node_id	Node ID of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular node ID.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
type	Type of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular usage. Passing cluster_certificate will return the certificate used for the cluster wide API service.	string	Enum: cluster_api_certificate, api_certificate

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/certificates Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCertificateList+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 2, "results": [ { "resource_type": "TlsCertificate", "id": "caCert", "display_name": "caCert", "path": "/infra/certificates/caCert", "parent_path": "/infra", "relative_path": "caCert", "details": [ ... ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": false, "tls_certificate_type": "CERTIFICATE_CA", "_create_user": "admin", "_create_time": 1516329725649, "_last_modified_user": "admin", "_last_modified_time": 1516329725649, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "TlsCertificate", "id": "selfSignedCert", "display_name": "selfSignedCert", "path": "/infra/certificates/selfSignedCert", "parent_path": "/infra", "relative_path": "selfSignedCert", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "realization_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Certificate for the Given Certificate ID

Removes the specified certificate. The private key associated with the
certificate is also deleted.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/certificates/signedDigitalCert Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Add a New Certificate

Adds a new private-public certificate and, optionally, a private key that
can be applied to one of the user-facing components (appliance management
or edge). The certificate and the key should be stored in PEM format. If
no private key is provided, the certificate is used as a client
certificate in the trust store.
A private key can be uploaded for a CA certificate only if the "purpose"
parameter is set to "signing-ca".
A certificate chain will not be expanded
into separate certificate instances for reference, but would be pushed to
the enforcement point as a single certificate. This patch method does
not modify an existing certificate.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsTrustData+

TlsTrustData (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key_algo	Key algorithm contained in this certificate.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
passphrase	Password for private key encryption.	secure_string
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
private_key	private key data	secure_string
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsTrustData	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/certificates/certificate-1 { "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "private_key": "-----BEGIN RSA PRIVATE KEY----------END RSA PRIVATE KEY-----\n", "passphrase": "1234" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Show Certificate Data for the Given Certificate ID

Returns information for the specified certificate ID, including the
certificate's id; pem_encoded data; and history of the
certificate (who created or modified it and when). For additional
information, include the ?details=true modifier at the end of the request
URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

GetCertParameter+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/certificates/selfSignedCertificate Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "selfSignedCert", "display_name": "selfSignedCert", "path": "/infra/certificates/selfSignedCert", "parent_path": "/infra", "relative_path": "selfSignedCert", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "realization_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Add a New Certificate

Adds a new private-public certificate and, optionally, a private key that
can be applied to one of the user-facing components (appliance management
or edge). The certificate and the key should be stored in PEM format. If
no private key is provided, the certificate is used as a client
certificate in the trust store.
A private key can be uploaded for a CA certificate only if the "purpose"
parameter is set to "signing-ca".
A certificate chain will not be expanded
into separate certificate instances for reference, but would be pushed to
the enforcement point as a single certificate. This PUT method does
not modify an existing certificate.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsTrustData+

TlsTrustData (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key_algo	Key algorithm contained in this certificate.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
passphrase	Password for private key encryption.	secure_string
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
private_key	private key data	secure_string
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsTrustData	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/certificates/selfSignedCert { "_revision":"0", "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "private_key": "-----BEGIN RSA PRIVATE KEY----------END RSA PRIVATE KEY-----\n", "passphrase": "1234" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "selfSignedCert", "display_name": "selfSignedCert", "path": "/infra/certificates/selfSignedCert", "parent_path": "/infra", "relative_path": "selfSignedCert", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "realization_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Certificates: Certification Revocation List

Associated URIs:

GET /global-manager/api/v1/global-infra/crls
DELETE /global-manager/api/v1/global-infra/crls/{crl-id}
GET /global-manager/api/v1/global-infra/crls/{crl-id}
PATCH /global-manager/api/v1/global-infra/crls/{crl-id}
POST /global-manager/api/v1/global-infra/crls/{crl-id}?action=upload
POST /global-manager/api/v1/global-infra/crls/{crl-id}?action=import
PUT /global-manager/api/v1/global-infra/crls/{crl-id}

Return All Added CRLs

Returns information about all CRLs. For additional information, include the
?details=true modifier at the end of the request URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/crls

Request Headers:

n/a

Query Parameters:

ListCertParameter+

ListCertParameter (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
details	whether to expand the pem data and show all its details	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
node_id	Node ID of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular node ID.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
type	Type of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular usage. Passing cluster_certificate will return the certificate used for the cluster wide API service.	string	Enum: cluster_api_certificate, api_certificate

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/crls?details=true Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrlListResult+

Example Response: { "result_count": 1, "results": [ { "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "details": { "next_update": "945220365000", "issuer": "1.2.840.113549.1.9.1=#161d726f6f744069676c6f6f2e6974732e756e696d656c622e6564752e6175,CN=igloo Certificate Authority,OU=Certificates Administration,O=igloo CA,L=Melbourne,ST=Victoria,C=AU", "version": "1" }, "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1, "_last_modified_user": "admin", "_last_modified_time": 1413387436438, "_create_time": 1413386249116, "_create_user": "admin" }, { "crl_type": "OneCRL", "one_crl": "{\"data\":[ <...> ]}", "details_revoked_by_issuer_and_serial_number": [ <...> ], "details_revoked_by_subject_and_public_key_hash": [ <...> ], "resource_type": "TlsCrl", "id": "default_public_crl", "display_name": "default_public_crl", "path": "/infra/crls/default_public_crl", "relative_path": "default_public_crl", "parent_path": "/infra", "unique_id": "91503436-5215-4d13-93e0-094c7473e30d", "realization_id": "91503436-5215-4d13-93e0-094c7473e30d", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_user": "system", "_create_time": 1630097138768, "_last_modified_user": "admin", "_last_modified_time": 1630107914252, "_protection": "NOT_PROTECTED", "_revision": 1 }, ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Show CRL Data for the Given CRL id.

Returns information about the specified CRL. For additional information,
include the ?details=true modifier at the end of the request URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

GetCertParameter+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/crls/revokedCerts?details=true Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "details": { "next_update": "945220365000", "issuer": "1.2.840.113549.1.9.1=#161d726f6f744069676c6f6f2e6974732e756e696d656c622e6564752e6175,CN=igloo Certificate Authority,OU=Certificates Administration,O=igloo CA,L=Melbourne,ST=Victoria,C=AU", "version": "1" }, "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1, "_last_modified_user": "admin", "_last_modified_time": 1413387436438, "_create_time": 1413386249116, "_create_user": "admin" } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete a CRL

Deletes an existing CRL. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCerts Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or fully replace a Certificate Revocation List

Create or replace a Certificate Revocation List for the given id. The CRL is used to
verify the client certificate status against the revocation lists published by the CA.
For this reason, the administrator needs to add the CRL in certificate repository as well.
The CRL must contain PEM data for a single CRL. Revision is required.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCerts { "display_name": "Revoked Certificates", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "_revision": 1, "crl_type": "X509" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "details": { "next_update": "945220365000", "issuer": "1.2.840.113549.1.9.1=#161d726f6f744069676c6f6f2e6974732e756e696d656c622e6564752e6175,CN=igloo Certificate Authority,OU=Certificates Administration,O=igloo CA,L=Melbourne,ST=Victoria,C=AU", "version": "1" }, "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1, "_last_modified_time": 1413386249116, "_create_time": 1413386249116, "_create_user": "admin", "_last_modified_user": "admin" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or patch a Certificate Revocation List

Create or patch a Certificate Revocation List for the given id. The CRL is used to
verify the client certificate status against the revocation lists published by the CA.
For this reason, the administrator needs to add the CRL in certificate repository as well.
The CRL must contain PEM data for a single CRL.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCertsb { "display_name": "Revoked Certificates", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "crl_type": "X509" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 Ok Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create a new Certificate Revocation List

Adds a new certificate revocation list (CRLs). The CRL is used to verify the client
certificate status against the revocation lists published by the CA. For this reason,
the administrator needs to add the CRL in certificate repository as well.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
An X.509 CRL can contain a single CRL or multiple CRLs depending on the PEM data.
- Single CRL: a single CRL is created with the given id.
- Composite CRL: multiple CRLs are generated. Each of the CRL is created with an id
generated based on the given id. First CRL is created with crl-id, second with crl-id-1,
third with crl-id-2, etc.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}?action=import

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCrlListResult+

Example Response: { "results": [{ "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0, "_last_modified_user": "admin", "_last_modified_time": 1413387436438, "_create_time": 1413386249116, "_create_user": "admin" }] } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Upload a new or updated Certificate Revocation List

Adds or replaces a certificate revocation list (CRLs). The CRL is used to verify the client
certificate status against the revocation lists published by the CA. For this reason,
the administrator needs to add the CRL in certificate repository as well.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the upload content.
An X.509 CRL can contain a single CRL or multiple CRLs depending on the PEM data.
- Single CRL: a single CRL is created with the given id.
- Composite CRL: multiple CRLs are generated. Each of the CRL is created with an id
generated based on the given id. First CRL is created with crl-id, second with crl-id-1,
third with crl-id-2, etc.
Differently from action=import, this method allows multi-part upload of the CRL(s).
The TlsCrl resource returned in the body of the response will have an empty pem_encoded
field, as it may be large. Use a GET request to retrieve the PEM-encoded CRL.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}?action=upload

Request Headers:

n/a

Query Parameters:

UploadTlsCrlRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCerts?action=import Content-Type: multipart/form-data; boundary=2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f --2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f Content-Disposition: form-data; name="file"; filename="mycrl.pem" -----BEGIN X509 CRL----- -----END X509 CRL----- Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra

Policy: Infra: Constraints

Associated URIs:

GET /global-manager/api/v1/global-infra/constraints
GET /global-manager/api/v1/global-infra/constraints/{constraint-id}

List tenant Constraints.

List tenant constraints. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/constraints

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>policy/api/v1/global-infra/constraints Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConstraintListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 3, "results": [ { "constraint_expression": { "resource_type": "RelatedAttributeConditionalExpression", "condition": { "value_constraint": { "resource_type": "ValueConstraintExpression", "values": [ "/infra/services/HTTP", "/infra/services/HTTPS" ], "operator": "INCLUDES", "_protection": "NOT_PROTECTED" }, "rhs_value": [ "/infra/domains/mgw/groups/VCENTER" ], "operator": "INCLUDES" }, "related_attribute": { "attribute": "destinationGroups" }, "_protection": "NOT_PROTECTED" }, "target": { "target_resource_type": "CommunicationEntry", "attribute": "services", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }, "_protection": "NOT_PROTECTED" }, { "constraint_expression": { "resource_type": "ValueConstraintExpression", "values": [ "ALLOW" ], "operator": "EQUALS", "_protection": "NOT_PROTECTED" }, "target": { "target_resource_type": "CommunicationEntry", "attribute": "action", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }, "_protection": "NOT_PROTECTED" }, { "constraint_expression": { "resource_type": "ValueConstraintExpression", "values": [ "/infra/domains/amar/groups/VCENTER" ], "operator": "INCLUDES", "_protection": "NOT_PROTECTED" }, "target": { "target_resource_type": "CommunicationEntry", "attribute": "destinationGroups", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }, "_protection": "NOT_PROTECTED" }, { "constraint_expressions": [{ "resource_type": "EntityCountConstraintExpression", "target_resource_type": "Group", "operator": "<", "count" : 2 }, { "resource_type": "EntityCountConstraintExpression", "target_resource_type": "Vpc", "operator": "<", "count" : 2 }] "targets": [{ "path_prefix": "/orgs/org1/projects/project1/" }, { "path_prefix": "/orgs/org1/projects/project2/" }] "_protection": "NOT_PROTECTED" } ] } Required Permissions: read Feature: policy_constraints Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read tenant Constraint.

Read tenant constraint. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/constraints/{constraint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>policy/api/v1/global-infra/constraints/related-attribute-constraint Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Constraint+

Constraint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
constraint_expression	Expression to constrain the target attribute value. This property is deprecated. Please use the "constraint_expressions" property instead to specify one or more constraint expressions. If this property is populated, then the "constraint_expressions" value is ignored.	ConstraintExpression (Abstract type: pass one of the following concrete types) EntityInstanceCountConstraintExpression FieldSanityConstraintExpression RelatedAttributeConditionalExpression ValueConstraintExpression	Deprecated
constraint_expressions	Expressions to constrain the target attribute value.	array of ConstraintExpression (Abstract type: pass one of the following concrete types) EntityInstanceCountConstraintExpression FieldSanityConstraintExpression RelatedAttributeConditionalExpression ValueConstraintExpression
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
message	User friendly message to be shown to users upon violation.	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Constraint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
target	Target resource attribute details. This property is deprecated. Please use the "targets" property instead to specify one or more targets. If this property is populated, then the "targets" value is ignored.	ConstraintTarget	Deprecated
target_owner_type	Constraint target's owner type	string	Enum: GM, LM, ALL
targets	Collection of target resources attribute details.	array of ConstraintTarget
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "constraint_expressions": [{ "resource_type": "RelatedAttributeConditionalExpression", "condition": { "value_constraint": { "resource_type": "ValueConstraintExpression", "values": [ "/infra/services/HTTP", "/infra/services/HTTPS" ], "operator": "INCLUDES", "_protection": "NOT_PROTECTED" }, "rhs_value": [ "/infra/domains/mgw/groups/VCENTER" ], "operator": "INCLUDES" }, "related_attribute": { "attribute": "destinationGroups" }, "_protection": "NOT_PROTECTED" }], "targets": [{ "target_resource_type": "CommunicationEntry", "attribute": "services", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }], "_protection": "NOT_PROTECTED" } Required Permissions: read Feature: policy_constraints Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Domains

Policy: Infra: Domains: Domain

Associated URIs:

GET /global-manager/api/v1/global-infra/domains
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}
GET /global-manager/api/v1/global-infra/domains/{domain-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}
PUT /global-manager/api/v1/global-infra/domains/{domain-id}

List domains for infra

Paginated list of all domains for infra.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains

Request Headers:

n/a

Query Parameters:

DomainListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DomainListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Domain", "description": "VMC Domain", "id": "vmc", "display_name": "VMC domain", "path": "/infra/domains/vmc", "parent_path": "/infra/domains/vmc", "relative_path": "vmc", "_create_user": "admin", "_create_time": 1517307910473, "_last_modified_user": "admin", "_last_modified_time": 1517307910473, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read domain

Read a domain.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Domain+

Domain (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDomainDeploymentMap ChildForwardingPolicy ChildGatewayPolicy ChildGroup ChildSecurityPolicy
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Domain	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Domain", "description": "VMC Domain", "id": "vmc", "display_name": "VMC domain", "path": "/infra/domains/vmc", "parent_path": "/infra/domains/vmc", "relative_path": "vmc", "_create_user": "admin", "_create_time": 1517307910473, "_last_modified_user": "admin", "_last_modified_time": 1517307910473, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a domain

If a domain with the domain-id is not already present, create a new
domain. If it already exists, update the domain including the nested
groups. This is a full replace
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Domain+

Domain (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDomainDeploymentMap ChildForwardingPolicy ChildGatewayPolicy ChildGroup ChildSecurityPolicy
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Domain	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc { "description": "VMC Domain", "display_name": "VMC domain", "_revision":0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Domain+

Domain (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDomainDeploymentMap ChildForwardingPolicy ChildGatewayPolicy ChildGroup ChildSecurityPolicy
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Domain	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Domain and all the entities contained by this domain

Delete the domain along with all the entities contained by this domain.
The groups that are a part of this domain are also deleted along with
the domain.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a domain

If a domain with the domain-id is not already present, create a new
domain. If it already exists, patch the domain
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Domain+

Domain (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDomainDeploymentMap ChildForwardingPolicy ChildGatewayPolicy ChildGroup ChildSecurityPolicy
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Domain	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc { "description": "VMC Domain Patched", "display_name": "VMC domain", "_revision":0 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Domains: Domain Deployment Maps

Associated URIs:

GET /global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}
GET /global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}
PUT /global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}

List Domain Deployment maps for infra

Paginated list of all Domain Deployment Entries for infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps

Request Headers:

n/a

Query Parameters:

DomainDeploymentMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains//domain-deployment-maps Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DomainDeploymentMapListResult+

Example Response: { "results": [ { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "resource_type": "DomainDeploymentMap", "id": "ddm5", "display_name": "ddm5", "path": "/infra/domains/SecureWorkload/domain-deployment-maps/ddm5", "relative_path": "ddm5", "parent_path": "/infra/domains/SecureWorkload", "unique_id": "f7aef601-4e4b-420f-8fe2-a3d1ab709ae7", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1604097081666, "_last_modified_user": "admin", "_last_modified_time": 1604097081669, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create a new Domain Deployment Map under infra

If the passed Domain Deployment Map does not already exist, create a new Domain Deployment Map.
If it already exist, replace it.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DomainDeploymentMap+

DomainDeploymentMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enforcement_point_path	Absolute path of enforcement point Path of enforcement point on which domain shall be enforced.	string	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value DomainDeploymentMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/domains//domain-deployment-maps/ { "enforcement_point":"/global-infra/deployment-zones/default/enforcement-points/nsxt-ep", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DomainDeploymentMap+

DomainDeploymentMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enforcement_point_path	Absolute path of enforcement point Path of enforcement point on which domain shall be enforced.	string	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value DomainDeploymentMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "resource_type": "DomainDeploymentMap", "id": "ddm1", "display_name": "ddm1", "path": "/infra/domains/SecureWorkload/domain-deployment-maps/ddm1", "relative_path": "ddm1", "parent_path": "/infra/domains/SecureWorkload", "unique_id": "bc9a38cf-7807-4f53-9bf3-d1140d1fc5db", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1604096029230, "_last_modified_user": "admin", "_last_modified_time": 1604096029236, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read a DomainDeploymentMap

Read a Domain Deployment Map
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains//domain-deployment-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DomainDeploymentMap+

DomainDeploymentMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enforcement_point_path	Absolute path of enforcement point Path of enforcement point on which domain shall be enforced.	string	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value DomainDeploymentMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "resource_type": "DomainDeploymentMap", "id": "ddm5", "display_name": "ddm5", "path": "/infra/domains/SecureWorkload/domain-deployment-maps/ddm5", "relative_path": "ddm5", "parent_path": "/infra/domains/SecureWorkload", "unique_id": "f7aef601-4e4b-420f-8fe2-a3d1ab709ae7", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1604097081666, "_last_modified_user": "admin", "_last_modified_time": 1604097081669, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Domain Deployment Map

Delete Domain Deployment Map Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains//domain-deployment-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: domain_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch Domain Deployment Map under infra

If the passed Domain Deployment Map does not already exist, create a new Domain Deployment Map.
If it already exist, patch it.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/domain-deployment-maps/{domain-deployment-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DomainDeploymentMap+

DomainDeploymentMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enforcement_point_path	Absolute path of enforcement point Path of enforcement point on which domain shall be enforced.	string	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value DomainDeploymentMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains//domain-deployment-maps/ { "enforcement_point":"/global-infra/deployment-zones/default/enforcement-points/nsxt-ep", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Enforcement Points

Associated URIs:

GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points
POST /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}?action=full-sync
DELETE /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
PATCH /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
POST /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}?action=reload
PUT /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{edge-node-id}

List enforcementpoints under Site

Paginated list of all enforcementpoints under Site.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points

Request Headers:

n/a

Query Parameters:

EnforcementPointListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPointListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Full sync EnforcementPoint from Site

Full sync EnforcementPoint from Site Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}?action=full-sync

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/external-ep?action=full-sync Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create/update a new Enforcement Point under Site

If the passed Enforcement Point does not already exist, create a new Enforcement Point.
If it already exists, replace it.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep { "connection_info": { "enforcement_point_address":"10.192.201.163", "resource_type":"NSXTConnectionInfo", "username":"admin", "password":"Admin!23Admin", "thumbprint":"f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Response: { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete EnforcementPoint from Site

Delete EnforcementPoint from Site Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a new Enforcement Point under Site

If the passed Enforcement Point does not already exist, create a new Enforcement Point.
If it already exists, patch it.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep { "connection_info": { "enforcement_point_address":"10.192.201.163", "resource_type":"NSXTConnectionInfo", "username":"admin", "password":"Admin!23Admin", "thumbprint":"f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" } } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read an Enforcement Point under Infra/Site

Read an Enforcement Point under Infra/Site
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Response: { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Edge Clusters under an Enforcement Point

Paginated list of all Edge Clusters under an Enforcement Point
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters

Request Headers:

n/a

Query Parameters:

PolicyEdgeClusterListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep/edge-clusters Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PolicyEdgeCluster", "id": "ec", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "parent_path": "/infra/sites/default/enforcement-points/nsxt-ep", "relative_path": "ec", "nsx_id": "8ce97b79-e2da-4d73-bc3b-4723ccab0600", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read a Edge Cluster under an Enforcement Point

Read a Edge Cluster under an Enforcement Point
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeCluster+

PolicyEdgeCluster (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeNode
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
inter_site_forwarding_enabled	Inter site forwarding is enabled if true Flag to indicate status of inter site l2 and l3 forwarding in federation.	boolean	Readonly
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
member_node_type	Node type of the cluster members Edge cluster is homogenous collection of transport nodes. Hence all transport nodes of the cluster must be of same type. This readonly field shows the type of transport nodes.	EdgeClusterNodeType	Readonly
nsx_id	Edge Cluster UUID on NSX-T Enforcement Point UUID of Edge Cluster on NSX-T enforcement point.	string	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyEdgeCluster	string
rtep_ips	Remote tunnel endpoint IP addresses. List of remote tunnel endpoint ipaddress configured on edge cluster.	array of IPAddress	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyEdgeCluster", "id": "ec", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "parent_path": "/infra/sites/default/enforcement-points/nsxt-ep", "relative_path": "ec", "nsx_id": "8ce97b79-e2da-4d73-bc3b-4723ccab0600", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Edge Nodes under an Enforcement Point, Edge Cluster

Paginated list of all Edge Nodes under an Enforcement Point, Edge Cluster
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes

Request Headers:

n/a

Query Parameters:

PolicyEdgeNodeListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec/edge-nodes Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeNodeListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PolicyEdgeNode", "id": "en", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec/edge-nodes/en", "path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec/edge-nodes/en", "parent_path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "relative_path": "en", "nsx_id": "8ce97b79-e2da-4d73-bc3b-4723ccab0600", "member_index": 0, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read a Edge Node under an Enforcement Point, Edge Cluster

Read a Edge Node under an Enforcement Point, Edge Cluster
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{edge-node-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec/edge-nodes/en Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeNode+

PolicyEdgeNode (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
member_index	Member Index The numerical value of the member index in the edge cluster that this object represents and to which the edge node connects.	integer	Readonly
nsx_id	Edge Node UUID on NSX-T Enforcement Point UUID of edge node on NSX-T enforcement point.	string	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyEdgeNode	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyEdgeNode", "id": "en", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec/edge-nodes/en", "path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec/edge-nodes/en", "parent_path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "relative_path": "en", "nsx_id": "8ce97b79-e2da-4d73-bc3b-4723ccab0600", "member_index": 0, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Reload an Enforcement Point under Site

Reload an Enforcement Point under Site. This will read and update
fabric configs from enforcement point.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}?action=reload

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep?action=reload Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Response: { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Hierarchical API

Associated URIs:

GET /global-manager/api/v1/global-infra
PATCH /global-manager/api/v1/global-infra
PUT /global-manager/api/v1/global-infra

Update the infra object

Updates only the single infra object. This does not allow hierarchical
updates of entities.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Infra+

Infra (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildBfdProfile ChildCaBundle ChildConstraint ChildConstraintGlobalConfig ChildDhcpRelayConfig ChildDhcpServerConfig ChildDnsSecurityProfile ChildDomain ChildEvpnTenantConfig ChildFloodProtectionProfile ChildFullSyncState ChildGatewayQosProfile ChildGlobalManager ChildGlobalManagerConfig ChildIPDiscoveryProfile ChildIpv6DadProfile ChildIpv6NdraProfile ChildMacDiscoveryProfile ChildPolicyContextProfile ChildPolicyDnsForwarderZone ChildPolicyDraft ChildPolicyFirewallScheduler ChildPolicyFirewallSessionTimerProfile ChildPolicyLabel ChildPolicyLatencyStatProfile ChildPolicyTransportZoneProfile ChildQoSProfile ChildSegment ChildSegmentSecurityProfile ChildService ChildSite ChildSpan ChildSpoofGuardProfile ChildTier0 ChildTier1 ChildTlsCertificate ChildTlsCrl ChildTlsCsr ChildTraceflowConfig ChildVMTagReplicationPolicy
connectivity_strategy	Connectivity strategy used by this tenant The connectivity strategy is deprecated. Use default layer3 rule, /infra/domains/default/security-policies/default-layer3-security-policy/rules/default-layer3-rule. This field indicates the default connectivity policy for the infra or tenant space WHITELIST - Adds a default drop rule. Administrator can then use "allow" rules (aka whitelist) to allow traffic between groups BLACKLIST - Adds a default allow rule. Admin can then use "drop" rules (aka blacklist) to block traffic between groups WHITELIST_ENABLE_LOGGING - Whitelisting with logging enabled BLACKLIST_ENABLE_LOGGING - Blacklisting with logging enabled NONE - No default rules are added.	string	Deprecated Enum: WHITELIST, BLACKLIST, WHITELIST_ENABLE_LOGGING, BLACKLIST_ENABLE_LOGGING, NONE
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domains	Domains for infra This field is used while creating or updating the infra space.	array of Domain
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Infra	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra { "display_name": "infra", "path": "/global-infra", "relative_path": "infra", "connectivity_strategy": "NONE", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Infra+

Infra (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildBfdProfile ChildCaBundle ChildConstraint ChildConstraintGlobalConfig ChildDhcpRelayConfig ChildDhcpServerConfig ChildDnsSecurityProfile ChildDomain ChildEvpnTenantConfig ChildFloodProtectionProfile ChildFullSyncState ChildGatewayQosProfile ChildGlobalManager ChildGlobalManagerConfig ChildIPDiscoveryProfile ChildIpv6DadProfile ChildIpv6NdraProfile ChildMacDiscoveryProfile ChildPolicyContextProfile ChildPolicyDnsForwarderZone ChildPolicyDraft ChildPolicyFirewallScheduler ChildPolicyFirewallSessionTimerProfile ChildPolicyLabel ChildPolicyLatencyStatProfile ChildPolicyTransportZoneProfile ChildQoSProfile ChildSegment ChildSegmentSecurityProfile ChildService ChildSite ChildSpan ChildSpoofGuardProfile ChildTier0 ChildTier1 ChildTlsCertificate ChildTlsCrl ChildTlsCsr ChildTraceflowConfig ChildVMTagReplicationPolicy
connectivity_strategy	Connectivity strategy used by this tenant The connectivity strategy is deprecated. Use default layer3 rule, /infra/domains/default/security-policies/default-layer3-security-policy/rules/default-layer3-rule. This field indicates the default connectivity policy for the infra or tenant space WHITELIST - Adds a default drop rule. Administrator can then use "allow" rules (aka whitelist) to allow traffic between groups BLACKLIST - Adds a default allow rule. Admin can then use "drop" rules (aka blacklist) to block traffic between groups WHITELIST_ENABLE_LOGGING - Whitelisting with logging enabled BLACKLIST_ENABLE_LOGGING - Blacklisting with logging enabled NONE - No default rules are added.	string	Deprecated Enum: WHITELIST, BLACKLIST, WHITELIST_ENABLE_LOGGING, BLACKLIST_ENABLE_LOGGING, NONE
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domains	Domains for infra This field is used while creating or updating the infra space.	array of Domain
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Infra	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Infra", "id": "infra", "display_name": "infra", "path": "/infra", "relative_path": "infra", "connectivity_strategy": "NONE", "_create_user": "system", "_create_time": 1517296394552, "_last_modified_user": "system", "_last_modified_time": 1517296394552, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read infra

Read infra. Returns only the infra related properties. Inner object
are not populated.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra

Request Headers:

n/a

Query Parameters:

ChildTypesRequestParameter+

ChildTypesRequestParameter (schema)

Name	Description	Type	Notes
base_path	Base Path for retrieving hierarchical intent Base path of the resource for which user wants to retrieve the hierarchy. This should be the fully qualified path for the resource. - Sample examples - base_path=/infra/domains/default/groups/Group1 base_path=/infra/domains/default/security-policies/SecurityPolicy1/rules/Rule1	string
filter	Filter string as java regex Filter string, can contain multiple or single java regular expressions separated by ';'. By default populates immediate child resources of the resource indicated by the URL. These child resources will be filtered by the type provided in the filter. It is recommended to use type_filter parameter instead of filter parameter. - Sample query string to prevent loading services and deployment zones: filter=Type-^(?!.?(?:Service\|DeploymentZone)).$ - Sample query string to populate all the Group objects under Infra & Domain: filter=Type-Domain%7CGroup - Sample query string to load every policy object under Infra: filter=Type-.*	string
type_filter	Filter string to retrieve hierarchy. Advanced filter string in which user can directly specify the resourceTypes to be filtered. Can be used in conjunction with base_path. - Sample example of type_filter to load all groups - type_filter=Group - Sample example of multiple type_filter - type_filter=Group;SercurityPolicy;RedirectionPolicy - Sample example to load all groups in default domain using base_path in conjunction with type_filter - base_path=/infra/domains/default&type_filter=Group	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Infra+

Infra (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildBfdProfile ChildCaBundle ChildConstraint ChildConstraintGlobalConfig ChildDhcpRelayConfig ChildDhcpServerConfig ChildDnsSecurityProfile ChildDomain ChildEvpnTenantConfig ChildFloodProtectionProfile ChildFullSyncState ChildGatewayQosProfile ChildGlobalManager ChildGlobalManagerConfig ChildIPDiscoveryProfile ChildIpv6DadProfile ChildIpv6NdraProfile ChildMacDiscoveryProfile ChildPolicyContextProfile ChildPolicyDnsForwarderZone ChildPolicyDraft ChildPolicyFirewallScheduler ChildPolicyFirewallSessionTimerProfile ChildPolicyLabel ChildPolicyLatencyStatProfile ChildPolicyTransportZoneProfile ChildQoSProfile ChildSegment ChildSegmentSecurityProfile ChildService ChildSite ChildSpan ChildSpoofGuardProfile ChildTier0 ChildTier1 ChildTlsCertificate ChildTlsCrl ChildTlsCsr ChildTraceflowConfig ChildVMTagReplicationPolicy
connectivity_strategy	Connectivity strategy used by this tenant The connectivity strategy is deprecated. Use default layer3 rule, /infra/domains/default/security-policies/default-layer3-security-policy/rules/default-layer3-rule. This field indicates the default connectivity policy for the infra or tenant space WHITELIST - Adds a default drop rule. Administrator can then use "allow" rules (aka whitelist) to allow traffic between groups BLACKLIST - Adds a default allow rule. Admin can then use "drop" rules (aka blacklist) to block traffic between groups WHITELIST_ENABLE_LOGGING - Whitelisting with logging enabled BLACKLIST_ENABLE_LOGGING - Blacklisting with logging enabled NONE - No default rules are added.	string	Deprecated Enum: WHITELIST, BLACKLIST, WHITELIST_ENABLE_LOGGING, BLACKLIST_ENABLE_LOGGING, NONE
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domains	Domains for infra This field is used while creating or updating the infra space.	array of Domain
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Infra	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update the infra including all the nested entities

Patch API at infra level can be used in two flavours
1. Like a regular API to update Infra object
2. Hierarchical API: To create/update/delete entire or part of intent
hierarchy
Hierarchical API: Provides users a way to create entire or part of
intent in single API invocation. Input is expressed in a tree format.
Each node in tree can have multiple children of different types.
System will resolve the dependencies of nodes within the intent tree
and will create the model. Children for any node can be specified using
ChildResourceReference or ChildPolicyConfigResource.
If a resource is specified using ChildResourceReference then it will
not be updated only its children will be updated. If Object is specified
using ChildPolicyConfigResource, object along with its children will be
updated.
Hierarchical API can also be used to delete any sub-branch of entire tree.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra

Request Headers:

n/a

Query Parameters:

ForceRevisionCheckRequestParameter+

Request Body:

Infra+

Infra (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildBfdProfile ChildCaBundle ChildConstraint ChildConstraintGlobalConfig ChildDhcpRelayConfig ChildDhcpServerConfig ChildDnsSecurityProfile ChildDomain ChildEvpnTenantConfig ChildFloodProtectionProfile ChildFullSyncState ChildGatewayQosProfile ChildGlobalManager ChildGlobalManagerConfig ChildIPDiscoveryProfile ChildIpv6DadProfile ChildIpv6NdraProfile ChildMacDiscoveryProfile ChildPolicyContextProfile ChildPolicyDnsForwarderZone ChildPolicyDraft ChildPolicyFirewallScheduler ChildPolicyFirewallSessionTimerProfile ChildPolicyLabel ChildPolicyLatencyStatProfile ChildPolicyTransportZoneProfile ChildQoSProfile ChildSegment ChildSegmentSecurityProfile ChildService ChildSite ChildSpan ChildSpoofGuardProfile ChildTier0 ChildTier1 ChildTlsCertificate ChildTlsCrl ChildTlsCsr ChildTraceflowConfig ChildVMTagReplicationPolicy
connectivity_strategy	Connectivity strategy used by this tenant The connectivity strategy is deprecated. Use default layer3 rule, /infra/domains/default/security-policies/default-layer3-security-policy/rules/default-layer3-rule. This field indicates the default connectivity policy for the infra or tenant space WHITELIST - Adds a default drop rule. Administrator can then use "allow" rules (aka whitelist) to allow traffic between groups BLACKLIST - Adds a default allow rule. Admin can then use "drop" rules (aka blacklist) to block traffic between groups WHITELIST_ENABLE_LOGGING - Whitelisting with logging enabled BLACKLIST_ENABLE_LOGGING - Blacklisting with logging enabled NONE - No default rules are added.	string	Deprecated Enum: WHITELIST, BLACKLIST, WHITELIST_ENABLE_LOGGING, BLACKLIST_ENABLE_LOGGING, NONE
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domains	Domains for infra This field is used while creating or updating the infra space.	array of Domain
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Infra	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: Example 1: ---------- PATCH https://<policy-mgr>/global-manager/api/v1/global-infra { "display_name": "infra", "path": "/global-infra", "relative_path": "infra", "connectivity_strategy": "NONE" } Example 2: ---------- # Below sample creates domain, groups, services and and security-policies in one call PATCH https://<policy-mgr>/global-manager/api/v1/global-infra { "resource_type":"Infra", "children": [ { "resource_type":"ChildDomain", "Domain": { "id":"domain-test", "resource_type":"Domain", "description":"domain-test", "display_name":"domain-test", "children":[ { "resource_type":"ChildGroup", "Group":{ "resource_type":"Group", "description":"g1", "display_name":"g1", "id":"g1", "expression":[ { "member_type":"VirtualMachine", "value":"webvm", "key":"Tag", "operator":"EQUALS", "resource_type":"Condition" } ] } }, { "resource_type":"ChildGroup", "Group":{ "resource_type":"Group", "description":"g2", "display_name":"g2", "id":"g2", "expression":[ { "member_type":"VirtualMachine", "value":"dbvm", "key":"Tag", "operator":"EQUALS", "resource_type":"Condition" } ] } }, { "resource_type":"ChildSecurityPolicy", "SecurityPolicy":{ "id":"sp1", "resource_type":"SecurityPolicy", "description":"SecurityPolicy", "display_name":"SecurityPolicy", "rules":[ { "resource_type":"Rule", "description":"Rule", "display_name":"r1", "sequence_number":1, "source_groups":[ "/global-infra/domains/domain-test/groups/g2" ], "destination_groups":[ "/global-infra/domains/domain-test/groups/g1" ], "services": [ "/global-infra/services/HTTP", "/global-infra/services/AD_Server", "/global-infra/services/CIM-HTTP" ], "action": "ALLOW" } ] } } ] } }, { "resource_type":"ChildService", "Service": { "id":"s1", "resource_type":"Service", "description":"L4Service", "display_name":"L4Service", "service_entries": [ { "resource_type":"L4PortSetServiceEntry", "display_name":"L4ServiceEntry", "destination_ports": [ "464" ], "l4_protocol":"TCP" } ] } } ] } Example 3: ---------- #Hierarchical delete example #Below example deletes domain-test including all its #children(groups, security policies, services) PATCH https://<policy-mgr>/global-manager/api/v1/global-infra { "resource_type":"Infra", "children":[ { "resource_type":"ChildDomain", "marked_for_delete": true, "Domain":{ "id":"domain-test", "resource_type":"Domain" } } ] } Example 4: ---------- #Example using ChildResourceReference in hierarchical API #Below example updates group g1 in 'domain-test' without updating domain and without #requiring to populate domain object completely in request payload. PATCH https://<policy-mgr>/global-manager/api/v1/global-infra { "resource_type":"Infra", "children":[ { "resource_type":"ChildResourceReference", "id":"domain-test", "target_type":"Domain", "children":[ { "resource_type":"ChildGroup", "Group":{ "resource_type":"Group", "description":"web group update", "display_name":"webgroup", "id":"g1", "expression":[ { "member_type":"VirtualMachine", "value":"web", "key":"Tag", "operator":"EQUALS", "resource_type":"Condition" } ] } } ] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: no_rbac Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Labels

Associated URIs:

GET /global-manager/api/v1/global-infra/labels
GET /global-manager/api/v1/global-infra/labels/{label-id}

List labels for infra

Paginated list of all labels for infra.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/labels

Request Headers:

n/a

Query Parameters:

PolicyLabelListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/labels Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyLabelListResult+

Example Response: { "results": [ { "type": "Domain", "refs": [ "/infra/domains/mydomain3", "/infra/domains/mydomain2", "/infra/domains/mydomain1" ], "resource_type": "PolicyLabel", "id": "my-domains-label", "display_name": "my-domains-label", "path": "/infra/labels/my-domains-label", "relative_path": "my-domains-label", "parent_path": "/infra/labels/my-domains-label", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544641564432, "_last_modified_user": "admin", "_last_modified_time": 1544641564432, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_label Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read lable

Read a label.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/labels/{label-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/labels/my-domains-label Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyLabel+

PolicyLabel (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
refs	Policy entity paths referred by the label instance Policy entity paths referred by the label instance	array of string
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyLabel	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
type	Policy intent entity type from PolicyResourceType Policy intent entity type from PolicyResourceType	string	Required
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "type": "Domain", "refs": [ "/infra/domains/mydomain3", "/infra/domains/mydomain2", "/infra/domains/mydomain1" ], "resource_type": "PolicyLabel", "id": "my-domains-label", "display_name": "my-domains-label", "path": "/infra/labels/my-domains-label", "relative_path": "my-domains-label", "parent_path": "/infra/labels/my-domains-label", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544641564432, "_last_modified_user": "admin", "_last_modified_time": 1544641564432, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_label Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Monitoring

Associated URIs:

GET /global-manager/api/v1/global-infra/config
GET /global-manager/api/v1/global-infra/health
GET /global-manager/api/v1/global-infra/opstats
GET /global-manager/api/v1/global-infra/performance

Get configs for policy

Get configs from policy like node-version,product-version.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/config Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyMonitoringConfig+

Example Response: { "product_version": "4.0.0.0.0.55730837", "properties": { "datareaper.task.maxrecordstoreap": "1000000", "switching.autoTN.taskExecutor.pool.size": "5", "switching.profile.ipDiscovery.overlay.default.id": "64814784-7896-3901-9741-badeff705639", "switching.cluster.resources.cleanup.delay": "120000", "rp.network.if.name": "eth0", "audit.excluded_properties": "password, passphrase, secret_key, shared_secret, account_shared_secret, private_key", "crl.x509.max_size_mb": "40" } } Required Permissions: read Feature: policy_migration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get health stats for policy modules

Get health stats for policy modules with success and failure counters
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/health

Request Headers:

n/a

Query Parameters:

HealthRequestParameters+

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/health Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

object

Example Response: { "status": 0, "reason": "healthy", "basic": { "cert_realizer": { "status": 1, "reason": "certification successful" }, "api-rest": { "status": 1, "reason": "rest api server up and running" } }, "integrated": { "gm_to_lm_connection": { "status": 1, "reason": "gm to lm connection is up" }, "lm_to_gm_connection": { "status": 1, "reason": "lm to gm connection is up" }, "site-manager": { "status": 0, "reason": "Connection to Site Manager refused or timed out. Site manager may be down" }, "ar_tx": { "status": 1, "reason": "connection to ar operational" }, "corfu_connection": { "status": 1, "reason": "connect to corfu successful" } } } Required Permissions: read Feature: policy_migration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get operational stats for policy modules

Get operational stats for policy modules with success and failure counters
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/opstats

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/opstats Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

object

Example Response: { "Service":{ service_create_success = 2, service_create_invalid_service_element = 1, service_update_cannot_modify_service_element = 1 } "Grouping":{ group_create_success = 4, group_create_invalid_expression_type = 1, group_update_unsupported_expression = 2 } } Required Permissions: read Feature: policy_migration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get performance metrics for policy

Get performance metrics for policy JVM
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/performance

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/performance Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

object

Example Response: { "cpu":"80" } Required Permissions: read Feature: policy_migration Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Infra: Realized State

Associated URIs:

GET /global-manager/api/v1/global-infra/realized-state/alarms
GET /global-manager/api/v1/global-infra/realized-state/realized-entities
POST /global-manager/api/v1/global-infra/realized-state/realized-entity?action=refresh
GET /global-manager/api/v1/global-infra/realized-state/status

List All alarms in the system

Paginated list of all alarms.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/realized-state/alarms

Request Headers:

n/a

Query Parameters:

PolicyAlarmResourceListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/realized-state/alarms Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyAlarmResourceListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PolicyAlarmResource", "id": "PROVIDER_INVOCATION_FAILURE", "display_name": "e88f4514-fd2d-4e91-b4b7-e8c9f594ae49", "parent_path": "*/alarms/realized-state", "relative_path": "e88f4514-fd2d-4e91-b4b7-e8c9f594ae49", "message": "I/O error on POST request for \"http://127.0.0.1:7440/nsxapi/api/v1/firewall/sections\": Connect to 127.0.0.1:7440 [/127.0.0.1] failed: Connection refused (Connection refused); nested exception is org.apache.http.conn.HttpHostConnectException: Connect to 127.0.0.1:7440 [/127.0.0.1] failed: Connection refused (Connection refused)", "source_reference": "/infra/realized-state/enforcement-points/default/firewalls/firewall-sections/7f4ce9e1-e1d9-11e8-8ce3-f56aad4808c4.38989010-e1db-11e8-8ce3-f56aad4808c4", "_create_user": "system", "_create_time": 1541519266261, "_last_modified_user": "system", "_last_modified_time": 1541519266261, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get list of realized objects associated with intent object

Get list of realized entities associated with intent object,
specified by path in query parameter
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/realized-state/realized-entities

Request Headers:

n/a

Query Parameters:

IntentPathRequestParameter+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/realized-state/realized-entities?intent_path=/global-infra/domains/d1/groups/g1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GenericPolicyRealizedResourceListResult+

Example Response: { "result_count": 1, "results": [ { "resource_type": "GenericPolicyRealizedResource", "id": "DOMAIN-d1-g1", "display_name": "DOMAIN-d1-g1", "path": "/infra/realized-state/enforcement-points/nsx-1/groups/nsgroups/DOMAIN-d1-g1", "parent_path": "/infra/realized-state/enforcement-points/nsx-1", "relative_path": "DOMAIN-d1-g1", "intent_reference": [ "/infra/domains/d1/groups/g1" ], "realization_specific_identifier": "22db5ae1-f1d7-4fa0-aa98-6176a3b80d0d", "alarms": [], "state": "REALIZED", "runtime_status": "UNKNOWN", "publish_status": "UNKNOWN", "operational_status" : "UNKNOWN", "extended_attributes": [ { "values": [ "/infra/realized-state/enforcement-points/nsx-1/virtual-machines/564d1fb9-f50d-5533-d189-550394ba7252", "/infra/realized-state/enforcement-points/nsx-1/virtual-machines/564d2588-5ccf-7825-32f9-d5e1f344fe40", "/infra/realized-state/enforcement-points/nsx-1/virtual-machines/564d6341-5655-5cdb-2a90-fad1b762789b", "/infra/realized-state/enforcement-points/nsx-1/virtual-machines/564d922d-f3cb-ae5c-3e3d-d76a55990905" ], "data_type": "STRING", "key": "VIRTUAL_MACHINES", "multivalue": true } ], "entity_type": "RealizedGroup", "_create_user": "system", "_create_time": 1519051314478, "_last_modified_user": "admin", "_last_modified_time": 1519057587852, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 5 } ] } Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Refresh all realized entities associated with the intent-path

Refresh the status and statistics of all realized entities associated
with given intent path synchronously. The vmw-async: True HTTP header
cannot be used with this API.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/realized-state/realized-entity?action=refresh

Request Headers:

n/a

Query Parameters:

RealizedStateRequestParameter+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/realized-state/realized-entity?action=refresh&intent_path=/global-infra/domains/d1/groups/g1&enforcement_point_path=/global-infra/deployment-zones/default/enforcement-points/ep1 Successful Response:

Response Code:

204 No Content

Response Headers:

n/a

Response Body:

n/a

Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get consolidated status of an intent object

Get Consolidated Status of an intent object (with or without enforcement specific status details).
The request is evaluated as follows:
- <intent_path>: the request is evaluated on all enforcement points for the given intent without
enforcement point specific details.
- <intent_path, include_enforced_status>: the request is evaluated on all enforcement points for
the given intent with enforcement point specific details.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/realized-state/status

Request Headers:

n/a

Query Parameters:

IntentStatusRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/realized-state/status?intent_path=/global-infra/domains/default/security-policies/block-external&include_enforced_status=true Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConsolidatedRealizedStatus+

ConsolidatedRealizedStatus (schema)

Name	Description	Type	Notes
consolidated_status	Consolidated Realized Status Consolidated Realized Status across enforcement points.	ConsolidatedStatus	Readonly
consolidated_status_per_enforcement_point	List of Consolidated Realized Status per Enforcement Point List of Consolidated Realized Status per enforcement point.	array of ConsolidatedStatusPerEnforcementPoint	Readonly
intent_path	String Path of the intent object Intent path of object, forward slashes must be escaped using %2F.	string	Required Readonly
intent_version	Intent version for the status Represent highest intent version across all realized objects	string	Readonly
publish_status	Aggregated Realization state of this object	string	Required Enum: UNAVAILABLE, UNREALIZED, REALIZED, ERROR
publish_time	Publish time of the intent This is the time when our system detects that data has been pushed to the transport nodes. This is based on a poll mechanism and hence this is not the accurate time when the intent was published at the data path. The value of -1 indicates that either the publishing is still in progress or the runtime status is UNKNOWN and hence not available. The Runtime status can be UNKNOWN if one or more hosts are down and the rules could not be sent to those hosts. When the host comes up, the runtime status will change to SUCCESS but the publish_time will show the value of the last realization time. Any new configuration change after this will start reflecting the proper value for publish_time	EpochMsTimestamp	Readonly Sortable
site_uuid	id of Site Site UUID supplied for realized site.	string
time_taken_for_realization	Appoximate time taken in milliseconds for end to end realization. This is an approximate time taken for the realization of the intent to the data path. The actual time taken could be lesser than what is reported here. The value of -1 indicates that either the publishing is still in progress or the runtime status is UNKNOWN and hence not available. The Runtime status can be UNKNOWN if one or more hosts are down and the rules could not be sent to those hosts. When the host comes up, the runtime status will change to SUCCESS but the time taken for realization will show the value of the last realization time. Any new configuration change after this will start reflecting the proper value for time_taken_for_realization.	integer

Example Response: { "consolidated_status": { "consolidated_status": "ERROR" }, "consolidated_status_per_enforcement_point": [ { "enforced_status": { "enforced_status_info": { "enforced_status": { "status": "UNKNOWN" }, "enforced_status_per_scope": [ { "enforced_status_per_transport_node": [ { "path": "/infra/sites/default/enforcement-points/default/edge-clusters/ec/edge-nodes/c578e7ba-5ce5-11e9-acec-41d19997391c", "enforced_status": { "status": "FAILURE", "status_message": "Internal error(1101) occurred on transport node c578e7ba-5ce5-11e9-acec-41d19997391c." } }, { "path": "/infra/sites/default/enforcement-points/default/edge-clusters/ec/edge-nodes/a744cd7e-5ce5-11e9-a24b-df71fdc87f85", "enforced_status": { "status": "SUCCESS" } }, { "path": "/infra/sites/default/enforcement-points/default/edge-clusters/ec/edge-nodes/77af8e10-5ce5-11e9-9149-5bb770f7c6c7", "enforced_status": { "status": "SUCCESS" } }, { "path": "/infra/sites/default/enforcement-points/default/edge-clusters/ec/edge-nodes/93ecd452-5ce5-11e9-8c18-bdce5885e998", "enforced_status": { "status": "SUCCESS" } } ], "resource_type": "TransportNodeSpanEnforcedStatus" } ] }, "pending_changes_info": { "pending_changes_flag": false } }, "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "enforcement_point_id": "default", "consolidated_status": { "consolidated_status": "UNKNOWN" } } ], "intent_path": "/infra/domains/default/security-policies/block-external" } Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Inventory: Groups

Policy: Inventory: Groups: Group Members

Associated URIs:

GET /global-manager/api/v1/global-infra/cloud-native-service-group-associations
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/member-types
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/cloud-native-service-instances
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/consolidated-effective-ip-addresses
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvpg
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvports
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/identity-groups
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-addresses
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-groups
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-ports
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-switches
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/physical-servers
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/pods
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segment-ports
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segments
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/transport-nodes
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/vifs
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/virtual-machines
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/tags
GET /global-manager/api/v1/global-infra/group-associations
GET /global-manager/api/v1/global-infra/identity-group-associations
GET /global-manager/api/v1/global-infra/ip-address-group-associations
GET /global-manager/api/v1/global-infra/physical-server-group-associations
GET /global-manager/api/v1/global-infra/pod-group-associations
GET /global-manager/api/v1/global-infra/virtual-machine-group-associations
GET /global-manager/api/v1/global-infra/virtual-network-interface-group-associations

Get groups for which the given Cloud Native Service Instance is a member

Get policy groups for which the given Cloud Native Service Instance is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cloud-native-service-group-associations

Request Headers:

n/a

Query Parameters:

CNSGroupAssociationRequestParams+

CNSGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cns_external_id	Cloud Native Service external ID	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cloud-native-service-group-associations?cns_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

Example Response: { "result_count": 2, "results": [ { { "path" : "/infra/domains/domain1/groups/g1", "target_id" : "g1", "target_display_name" : "group-1", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308" }, { "path" : "/infra/domains/domain1/groups/g2", "target_id" : "g2", "target_display_name" : "group-2", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308" } } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get member types for a given Group

It retrieves member types for a given group. In case of nested groups, it calculates
member types of child groups as well. Considers member type for members added
via static members and dynamic membership criteria.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/member-types

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/member-types Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupMemberTypeListResult+

Example Response: { "resultCount": 1, "results" : ["VirtualMachine"] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Effective Cloud Native Service Instances that belong to this group.

Returns Effective Cloud Native Service Instances that belong to this group.
This API is applicable only for Groups containing CloudNativeServiceInstance member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/cloud-native-service-instances

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/cloud-native-service-instances?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "cursor" : "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "result_count" : 1, "results" : [ { "display_name" : "CNS-2", "id" : "420e72c9-55e7-a4f7-81bf-673a2af1a6cf" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get consolidated effective IPAddress translated from this group across site

Returns the consolidated effective IP address members of the specified Group. This is applicable in the case of a
federated/NSX+ environment. The response includes a site-wise list of static and dynamically translated effective IP
address members. If the group evaluation on a site is empty, the response will contain the site-id with empty list.
If a group is a reference group on a site, then its consolidated effective IP response will contain the effective IPs
from other sites, and the response will contain an empty list of IPs for the sites where is it a reference group.

This API is applicable only for Global and NSX+ Groups that contain (either directly or via nesting) VirtualMachine,
VIF, Segment, SegmentPort, or IPSet member types. Please use the cursor value in the response to fetch the next page.
If there is no cursor value in the response, it indicates that it is the last page of results for the query.
This API is only available when using VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/consolidated-effective-ip-addresses

Request Headers:

n/a

Query Parameters:

ConsolidatedEffectiveIPListRequestParameters+

ConsolidatedEffectiveIPListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point on which the API needs to be executed. Forward slashes must be escaped using %2F.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
ip_filter	An IPAddress or subnet for filtering the results. This filter can be used to verify an ip membership in the effective results	IPElement
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
site_id	UUID of the site from which the effective IP addresses are to be fetched	string
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: Group demo1 have dynamic criteria based on vm name contains 'vm' and 2 static IPs "fd01:0:101:2600:20c:29ff:fe23:eef3","25.1.1.4/30". Request for Group in Federation environment on Paris LM: GET https://{{paris-site-ip}}/global-manager/api/v1/global-infra/domains/default/groups/demo1/members/consolidated-effective-ip-addresses?enforcement_point_path=/global-infra/sites/Paris/enforcement-points/default Request for Group in NSX+ environment on Paris LM: GET https://{{paris-site-ip}}/global-manager/api/v1/global-infra/domains/global/groups/demo1/members/consolidated-effective-ip-addresses?enforcement_point_path=/global-infra/sites/Paris/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConsolidatedEffectiveIPAddressMemberListResult+

Example Response: { "results": [ { "site_id": "e977e929-255e-41c0-a938-a35d12f860ee", "effective_ips": [ "fd01:0:101:2600:20c:29ff:fe23:eef3", "25.1.1.4/30", "10.160.8.45", "10.160.16.77" ] }, { "site_id": "210d7017-5dca-4901-bfcc-c63928215160", "effective_ips": [ "fd01:0:101:2600:20c:29ff:fe23:eef3", "25.1.1.4/30", "10.160.10.118", "10.160.27.172" ] }, { "site_id": "fa8be70f-b592-4cb1-add9-b89ccdfd3ee3", "effective_ips": [ "fd01:0:101:2600:20c:29ff:fe23:eef3", "25.1.1.4/30", "10.160.15.134", "10.160.26.223" ] } ], "cursor": "7806177147493-0" } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Discovered Port Groups that belong to this Group

Get Discovered Port Groups that belong to this Group
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvpg

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/dvpg?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "dvpg-1", "display_name": "segment-1", "path": "/infra/segments/segment-1" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get discovered ports that belong to this Group

Get discovered ports that belong to this Group
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvports

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/segment-ports?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "default:4a5a3cd0-6f0a-40b0-a31a-1f55d51e1824", "display_name": "nbokare-10.160.129.166-vdtest-97902/VM-1-10.160.129.166-20190505-122351-03783733@b089f7e1-433f-4ecc-9722-ab5f2b66d391", "path": "/infra/segments/segment-1/ports/default:4a5a3cd0-6f0a-40b0-a31a-1f55d51e1824" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Effective Identity Groups that belong to this group.

Returns Effective Identiy Groups that belong to this group.
This API is applicable only for Groups containing IdentityGroup member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/identity-groups

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/identity-groups?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "cursor": "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "sort_ascending": true, "result_count": 2, "results": [ { "id" : "fcb51d1d-b141-4f5b-a0b9-1063a1470a63", "display_name" : "ADGroup1" }, { "id" : "3eecac54-15e7-4a0d-b418-001052fcfdcd", "display_name" : "ADGroup2" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get IP addresses that belong to this Group

Get IP addresses that belong to this Group.
This API is applicable for Groups containing either VirtualMachine, VIF,
Segment ,Segment Port or IP Address member type.For Groups containing other
member types,an empty list is returned
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-addresses

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/ip-addresses?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupIPMembersListResult+

Example Response: { "result_count": 3, "results": [ "192.168.0.0/24", "192.168.0.1", "192.168.0.1-192.168.0.100" ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Effective IPGroups that belong to this group.

Returns effective IPGroups that belong to this group.
This API is applicable only for Groups containing IPSet member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-groups

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/ip-groups?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "cursor": "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "sort_ascending": true, "result_count": 2, "results": [ { "target_id" : "fcb51d1d-b141-4f5b-a0b9-1063a1470a63", "target_display_name" : "IPSet1", "target_type" : "IPSet", }, { "id" : "3eecac54-15e7-4a0d-b418-001052fcfdcd", "display_name" : "IPSet2", "target_type" : "IPSet" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get logical ports that belong to this Group

Get logical ports that belong to this Group
This API is applicable for Groups containing either VirtualMachine, VIF,
Segment or Segment Port member type.For Groups containing other
member types,an empty list is returned.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-ports

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/logical-ports?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "result_count": 2, "results": [ { "id" : "20c1ac1f-58b5-4241-a352-f8e82c4a8c65", "display_name" : "LP-HR1" }, { "id" : "c07005fe-4a9a-47f1-9a1e-2db65a285124", "display_name" : "LP-HR2" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get logical switches that belong to this Group

Get logical switches that belong to this Group.
This API is applicable for Groups containing Segment member type.
For Groups containing other member types, an empty list is returned.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-switches

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/logical-switches?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "result_count": 2, "results": [ { "id" : "20c1ac1f-58b5-4241-a352-f8e82c4a8c65", "display_name" : "LS-HR1" }, { "id" : "c07005fe-4a9a-47f1-9a1e-2db65a285124", "display_name" : "LS-HR2" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Effective Physical Server Members that belong to this group.

Returns Effective Physical Server Members that belong to this group.
This API is applicable only for Groups containing Physical Server member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/physical-servers

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/physical-servers?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "cursor" : "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "result_count" : 1, "results" : [ { "display_name" : "PhysicalServer-1", "id" : "420e72c9-55e7-a4f7-81bf-673a2af1a6cf" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get pods that belong to this Group

Get pods that belong to this Group. This API is applicable for Groups
containing either Pod, Cluster, Namespace, Service member type. For
Groups containing other member types an empty list is returned
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/pods

Request Headers:

n/a

Query Parameters:

ContainerListRequestParameters+

ContainerListRequestParameters (schema)

Name	Description	Type	Notes
cluster_id	Cluster ID ID of the cluster to query	string
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/pods?enforcement_point_path=/global-infra/sites/default/enforcement-points/default&cluster_id=6ar43cd0-6f0a-40b0-a31a-1f55d51e1824 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContainerGroupMembersListResult+

Example Response: { "results": [ { "cluster_id":"6ar43cd0-6f0a-40b0-a31a-1f55d51e1824", "pods":[ { "id": "4a5a3cd0-6f0a-40b0-a31a-1f55d51e1824", "display_name": "Container1" }, { "id": "54R3W356-6f0a-40b0-a31a-1f55d51e1824", "display_name": "Container2" } ] } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment ports that belong to this Group

Get segment ports that belong to this Group
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segment-ports

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segments that belong to this Group

Get segments that belong to this Group
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segments

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/segments?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "segment-1", "display_name": "segment-1", "path": "/infra/segments/segment-1" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get effective transport node members that belong to this group

Get effective transport node members that belong to this Group.
This API is applicable only for Groups containing TransportNode member type.
For Groups containing other member types,an empty list is returned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/transport-nodes

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/transport-nodes?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "id": "5327b241-7fdd-4d41-9e93-76e006b8a4c2", "display_name" : "TransportNode-1" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Virtual Network Interface instances that belong to this Group

Get Virtual Network Interface instances that belong to this Group.
This API is applicable for Groups containing VirtualNetworkInterface and VirtualMachine member types.
For Groups containing other member types,an empty list is returned.target_id in response
is external_id of VirtualNetworkInterface or VirtualMachine.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/vifs

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/vifs?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VirtualNetworkInterfaceListResult+

Example Response: { "results": [ { "external_id": "564dda4e-bc05-061c-dac7-7a314e0e0c9c-4000", "owner_vm_id": "1778a2b0-7f9b-4c64-806c-bc13d6d60762", "owner_vm_type": "REGULAR", "host_id": "28477562-ea6f-11e9-9c84-f98983786a98", "vm_local_id_on_host": "1", "device_key": "4000", "device_name": "Network adapter 1", "mac_address": "00:0c:29:0e:0c:9c", "ip_address_info": [ { "source": "VM_TOOLS", "ip_addresses": [ "10.170.66.155", "fd01:3:4:2825:c5dc:25a5:fbb9:6762", "fd01:3:4:2825:2c49:a400:48df:23dd", "fd01:3:4:2825:34ca:5670:96e0:6edf", "fd01:3:4:2825:d9e4:5e51:6df6:c93e", "fd01:3:4:2825:b002:86da:30d4:1030", "fd01:3:4:2825:20c:29ff:fe0e:c9c", "fe80::20c:29ff:fe0e:c9c", "fd01:3:4:2825:eddf:5879:67d5:6293", "fd01:3:4:2825:f027:6316:8de5:3a29" ] } ], "resource_type": "VirtualNetworkInterface", "display_name": "Network adapter 1", "_last_sync_time": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Virtual machines that belong to this Group

Get Virtual machines that belong to this Group.
This API is applicable for Groups containing VirtualMachine,member type.
For Groups containing other member types,an empty list is returned.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/virtual-machines

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/virtual-machines?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

RealizedVirtualMachineListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "RealizedVirtualMachine", "id": "564de333-15ac-de52-da90-974fe099a17b", "display_name": "1-vm_ubuntu_1404_srv_64-local-586-bb9bbaf4-7f29-4e7a-9216-ef33890bf081", "path": "/infra/realized-state/enforcement-points/nsx-1/virtual-machines/564de333-15ac-de52-da90-974fe099a17b", "parent_path": "/infra/realized-state/enforcement-points/nsx-1", "relative_path": "564de333-15ac-de52-da90-974fe099a17b", "intent_reference": [], "realization_specific_identifier": "564de333-15ac-de52-da90-974fe099a17b", "alarms": [], "state": "REALIZED", "runtime_status": "UNKNOWN", "compute_ids": [ "moIdOnHost:1", "hostLocalId:1", "locationId:564de333-15ac-de52-da90-974fe099a17b", "instanceUuid:bb9bbaf4-7f29-4e7a-9216-ef33890bf081", "externalId:564de333-15ac-de52-da90-974fe099a17b", "biosUuid:564de333-15ac-de52-da90-974fe099a17b" ], "power_state": "vm_running", "_create_user": "system", "_create_time": 1519383616259, "_last_modified_user": "system", "_last_modified_time": 1519383616259, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tags used to define conditions inside a Group

Get tags used to define conditions inside a Group. Also
includes tags inside nested groups.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/tags

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/tags Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupTagsList+

Example Response: { "result_count": 2, "results": [ { "member_type" : "IPSet", "tags" : [ "Web", "DB", "App" ] }, { "member_type" : "VirtualMachine", "tags" : [ "Linux", "Windows", "Mac" ] } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given object is a member

Get policy groups for which the given object is a member.
In Federation environment, if the given object is a global entity
(eg: global segment) and if the entity is not stretched to the site
specified in the enforcement_point_path parameter,then the following is returned:-
1)If the entity is a member of any global group and that group is stretched
to the enforcement_point_path site,then the API returns an empty list.
2)If the entity is not a member of any global group,this API returns
an 'invalid path' error message.
3)If both the entity and its corresponding groups are stretched to the
enforcement_point_path site , then the API returns the groups list.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/group-associations

Request Headers:

n/a

Query Parameters:

IntentEnforcementPointListRequestParams+

IntentEnforcementPointListRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
intent_path	String path of the intent object	string	Required
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/group-associations?intent_path=/global-infra/segment/s1&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

Example Response: { "result_count": 2, "results": [ { { "path" : "/infra/domains/domain1/groups/g1", "target_id" : "g1", "target_display_name" : "group-1", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308" }, { "path" : "/infra/domains/domain1/groups/g2", "target_id" : "g2", "target_display_name" : "group-2", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308", } } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given Identity Group is a member

Get policy groups for which the given Identity Group is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/identity-group-associations

Request Headers:

n/a

Query Parameters:

IdentityGroupAssociationRequestParams+

IdentityGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
identity_group_external_id	Identity Group external ID	string	Required
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/identity-group-associations?identity_group_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given IP address is a member

Get policy groups for which the given IP address is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/ip-address-group-associations

Request Headers:

n/a

Query Parameters:

IPAddressGroupAssociationRequestParams+

IPAddressGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
ip_address	IPAddress	string	Required
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/ip-address-group-associations?ip_address=10.1.19.10&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given Physical Server is a member

Get policy groups for which the given Physical Server is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/physical-server-group-associations

Request Headers:

n/a

Query Parameters:

BMSGroupAssociationRequestParams+

BMSGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
physical_server_external_id	Physical external ID	string	Required
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/physical-server-group-associations?physical_server_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given pod is a member

Get policy groups for which the given pod is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/pod-group-associations

Request Headers:

n/a

Query Parameters:

ContainerApplicationInstanceGroupAssociationRequestParams+

ContainerApplicationInstanceGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
pod_id	ContainerApplicationInstance	string	Required
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/pod-group-associations?pod_id=64dde333-15ac-de52-da90-974de459a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given VM is a member

Get policy groups for which the given VM is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/virtual-machine-group-associations

Request Headers:

n/a

Query Parameters:

VMGroupAssociationRequestParams+

VMGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
vm_external_id	Virtual machine external ID	string	Required

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/virtual-machine-group-associations?vm_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get groups for which the given VIF is a member

Get policy groups for which the given VIF is a member.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/virtual-network-interface-group-associations

Request Headers:

n/a

Query Parameters:

VIFGroupAssociationRequestParams+

VIFGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
vif_external_id	Virtual network interface external ID	string	Required

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/virtual-network-interface-group-associations?vif_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Inventory: Groups: Groups

Associated URIs:

GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
PUT /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

List Groups for a domain

List Groups for a domain. Groups can be filtered using member_types query parameter,
which returns the groups that contains the specified member types. Multiple member types
can be provided as comma separated values. The API also return groups having member
type that are subset of provided member_types.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups

Request Headers:

n/a

Query Parameters:

GroupListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Group", "description": "web group", "id": "webgroup", "display_name": "web group", "path": "/infra/domains/vmc/groups/webgroup", "parent_path": "/infra/domains/vmc", "relative_path": "webgroup", "expression": [ { "resource_type": "Condition", "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "_protection": "NOT_PROTECTED" } ], "_create_user": "admin", "_create_time": 1517308749250, "_last_modified_user": "admin", "_last_modified_time": 1517308749250, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Group

Delete the group with group_id under domain domain_id. The force query parameter supported on the
API is deprecated. Usage of the force query parameter does not alter the behaviour of the API. The
API just ignores the force parameter.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

GroupDeleteRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read group

Read group This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed 500. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group	string	Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Group", "description": "web group", "id": "webgroup", "display_name": "web group", "path": "/infra/domains/vmc/groups/webgroup", "parent_path": "/infra/domains/vmc", "relative_path": "webgroup", "expression": [ { "resource_type": "Condition", "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "_protection": "NOT_PROTECTED" } ], "_create_user": "admin", "_create_time": 1517308749250, "_last_modified_user": "admin", "_last_modified_time": 1517308749250, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a group

If a group with the group-id is not already present, create a new group.
If it already exists, update the group.
Avoid creating groups with multiple MACAddressExpression and IPAddressExpression.
In future releases, group will be restricted to contain a single
MACAddressExpression and IPAddressExpression along with other expressions.
To group IPAddresses or MACAddresses, use nested groups instead of multiple
IPAddressExpressions/MACAddressExpression.
Group created with Kubernetes membership criteria includes only Antrea reported inventory as its members.
Once created, Groups with Identity (Directory) Group members should be updated with the new Distinguished Name in case it is changed on AD Server.
Maximum of 500 malicious IP Groups (i.e Group with criteria having IPAddress equals All MALICIOUS_IP) should be created.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed 500. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group	string	Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group", "_revision":0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed 500. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group	string	Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a group

If a group with the group-id is not already present, create a new group.
If it already exists, patch the group.
Group created with Kubernetes membership criteria includes only Antrea reported inventory as its members.
Once created, Groups with Identity (Directory) Group members should be updated with the new Distinguished Name in case it is changed on AD Server.
Maximum of 500 malicious IP Groups (i.e Group with criteria having IPAddress equals All MALICIOUS_IP) should be created.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed 500. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group	string	Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a group external ID expression

If a group ExternalIDexpression with the expression-id is not already present, create a new ExternalIDexpresison.
If it already exists, replace the existing ExternalIDexpression.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ExternalIDExpression+

ExternalIDExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
external_ids	Array of external IDs for the specified member type This array can consist of one or more external IDs for the specified member type.	array of string	Required Minimum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
member_type	External ID member type	string	Required Enum: VirtualMachine, VirtualNetworkInterface, CloudNativeServiceInstance, PhysicalServer
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ExternalIDExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/external-id-expressions/exp1 { "member_type": "VirtualMachine", "external_ids": [ "00989582-0920-459e-a8a6-ebf65a140aa9" ], "resource_type": "ExternalIDExpression", "id": "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Add or Remove external id based members from/to a Group

It will add or remove the specified members having external ID for a given expression of a group.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

GroupMemberList+

Example Request: POST /global-infra/domains/default/groups/VMGroup/external-id-expressions/vmexp?action=add { "members": [ "527ef6f5-0fea-b910-1efb-0991e41e44cd", "527ef6f5-0fea-b910-1efb-0991e41e44ce" ] } POST /global-infra/domains/default/groups/VMGroup/external-id-expressions/vmexp?action=remove { "members": [ "527ef6f5-0fea-b910-1efb-0991e41e44cd", "527ef6f5-0fea-b910-1efb-0991e41e44ce" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Group External ID Expression

Delete Group External ID Expression This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/external-id-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Group IPAddressExpression

Delete Group IPAddressExpression This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/ip-address-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a group IP Address expression

If a group IPAddressExpression with the expression-id is not already present, create a new IPAddressExpression.
If it already exists, replace the existing IPAddressExpression.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

IPAddressExpression+

IPAddressExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_addresses	Array of IP addresses This array can consist of a single IP address, IP address range or a subnet. Its type can be of either IPv4 or IPv6. Both IPv4 and IPv6 addresses within one expression is not allowed. Supported list of formats are, "192.168.1.1", "192.168.1.1-192.168.1.100", "192.168.0.0/24", "fe80::250:56ff:fe83:318c", "fe80::250:56ff:fe83:3181-fe80::250:56ff:fe83:318c", "fe80::250:56ff:fe83:318c/64".	array of IPElement	Required Minimum items: 1 Maximum items: 6000
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPAddressExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/ip-address-expressions/exp1 { "ip_addresses": [ "10.110.9.21", "10.112.9.22" ], "resource_type": "IPAddressExpression", "id" : "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Add or Remove IP Addresses from/to a Group

It will add or remove the specified IP Addresses from a given expression of a group.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

IPAddressList+

Example Request: POST /global-infra/domains/default/groups/IPGroup/ip-address-expressions/ipaddressexp?action=add { "ip_addresses": [ "10.110.9.4-10.110.9.10", "10.110.9.3/24" ] } POST /global-infra/domains/default/groups/IPGroup/ip-address-expressions/ipaddressexp?action=remove { "ip_addresses": [ "10.110.9.4-10.110.9.10", "10.110.9.3/24" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Add or Remove MAC Addresses from/to a Group

It will add or remove the specified MAC Addresses from a given expression of a group.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

MACAddressList+

Example Request: POST /global-infra/domains/default/groups/MACGroup/mac-address-expressions/macaddressexp?action=add { "mac_addresses": [ "00:0a:95:9d:68:16", "00:0a:95:9d:68:17" ] } POST /global-infra/domains/default/groups/MACGroup/mac-address-expressions/macaddressexp?action=remove { "mac_addresses": [ "00:0a:95:9d:68:16", "00:0a:95:9d:68:17" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a group MAC Address expression

If a group MACAddressExpression with the expression-id is not already present, create a new MACAddressExpression.
If it already exists, replace the existing MACAddressExpression.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

MACAddressExpression+

MACAddressExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mac_addresses	Array of MAC addresses This array can consist of one or more MAC addresses.	array of MACAddress	Required Minimum items: 1 Maximum items: 4000
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value MACAddressExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/mac-address-expressions/exp1 { "mac_addresses": [ "00:0a:95:9d:68:21", "00:0a:95:9d:68:22" ], "resource_type": "MACAddressExpression", "id" : "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Group MACAddressExpression

Delete Group MACAddressExpression This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/mac-address-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a group path expression

If a group path_expression with the expression-id is not already present, create a new pathexpresison.
If it already exists, replace the existing pathexpression.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PathExpression+

PathExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
paths	Array of policy paths This array can consist of one or more policy paths. Only policy paths of groups, segments and policy logical ports are allowed.	array of string	Required Minimum items: 1
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PathExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/path-expression/exp1 { "paths": [ "/global-infra/domains/default/groups/childgroup8" ], "resource_type": "PathExpression", "id": "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Group Path Expression

Delete Group Path Expression This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/path-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Add or Remove path based members from/to a Group

It will add or remove the specified members having path for a given expression of a group.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

GroupMemberList+

Example Request: POST /global-infra/domains/default/groups/NestedGroup/path-expressions/pathexp?action=add { "members": [ "/global-infra/domains/default/groups/GroupTag", "/global-infra/domains/default/groups/VMGroup" ] } POST /global-infra/domains/default/groups/NestedGroup/path-expressions/pathexp?action=remove { "members": [ "/global-infra/domains/default/groups/GroupTag", "/global-infra/domains/default/groups/VMGroup" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Inventory: Profiles

Policy: Inventory: Profiles: Context Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/context-profiles
DELETE /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
GET /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
PATCH /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
PUT /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
GET /global-manager/api/v1/global-infra/context-profiles/attributes
PATCH /global-manager/api/v1/global-infra/context-profiles/custom-attributes (Deprecated)
POST /global-manager/api/v1/global-infra/context-profiles/custom-attributes (Deprecated)
GET /global-manager/api/v1/global-infra/context-profiles/custom-attributes/default
PATCH /global-manager/api/v1/global-infra/context-profiles/custom-attributes/default
POST /global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Get PolicyContextProfiles

Get all PolicyContextProfiles
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles

Request Headers:

n/a

Query Parameters:

PolicyContextProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/ { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "TLS" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V13" ], "datatype":"STRING" }, { "key":"ENCRYPTION_ALGORITHM", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ], }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING" } ] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfileListResult+

Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create PolicyContextProfile

Creates/Updates a PolicyContextProfile, which encapsulates attribute and
sub-attributes of network services.
Rules for using attributes and sub-attributes in single PolicyContextProfile
1. One type of attribute can't have multiple occurrences. ( Eg. -
Attribute type APP_ID can be used only once per PolicyContextProfile.)
2. For specifying multiple values for an attribute, provide them in an array.
3. If sub-attribtes are mentioned for an attribute, then only single
value is allowed for that attribute.
4. To get a list of supported attributes and sub-attributes fire the following REST API
GET https://<policy-mgr>/policy/api/v1/infra/context-profiles/attributes
5. Do not create context profile with "custom_attributes" id
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "SSL" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V13" ], "datatype":"STRING" }, { "key":"TLS_CIPHER_SUITE", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ] }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get PolicyContextProfile

Get a single PolicyContextProfile by id
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "TLS" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V13" ], "datatype":"STRING" }, { "key":"ENCRYPTION_ALGORITHM", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ], }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Policy Context Profile

Deletes the specified Policy Context Profile. If the Policy Context
Profile is consumed in a firewall rule, it won't get deleted.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideDeleteRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create PolicyContextProfile

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "SSL" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value":[ "TLS_V13" ], "datatype":"STRING" }, { "key":"TLS_CIPHER_SUITE", "value":[ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ] }, { "key":"DOMAIN_NAME", "value":[ "*.office365.com" ], "datatype":"STRING" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Policy Context Profile supported attributes and sub-attributes

Returns supported attribute and sub-attributes for specified
attribute key with their supported values, if provided in query/request
parameter, else will fetch all supported attributes and sub-attributes for
all supported attribute keys.
Alternatively, to get a list of supported attributes and sub-attributes fire the following REST API
GET https://<policy-mgr>/policy/api/v1/infra/context-profiles/attributes
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/attributes

Request Headers:

n/a

Query Parameters:

ProfileSupportedAttributesListRequestParameters+

ProfileSupportedAttributesListRequestParameters (schema)

Name	Description	Type	Notes
attribute_key	Fetch attributes and sub-attributes for the given attribute key It fetches attributes and subattributes for the given attribute key supported in the system which can be used for Policy Context Profile creation.	string
attribute_source	Source of the attribute, System Defined or custom It fetches attributes and sub attributes for the given attribute key based on the source of attribute which can be used for Policy Context Profile creation.	string	Enum: ALL, CUSTOM, SYSTEM Default: "SYSTEM"
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/attributes Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfileListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "attributes":[ { "key":"APP_ID", "value": [ "SSL" ], "datatype":"STRING", "description":"SSL (Secure Sockets Layer) is a cryptographic protocol that provides security over the Internet.", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V10", "TLS_V11", "TLS_V12", "TLS_V13" ], "datatype":"STRING" }, { "key":"TLS_CIPHER_SUITE", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5", "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA", ] "datatype":"STRING" } ], }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING", "description":"Office 365 url" } ] } ] } Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Adds/Removes custom attribute values from list (Deprecated)

This API adds/removes custom attribute values from list for a given attribute key.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes

Request Headers:

n/a

Query Parameters:

CustomAttributeAction+

Request Body:

PolicyAttributes+

PolicyAttributes (schema)

Name	Description	Type	Notes
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: SYSTEM, CUSTOM Default: "SYSTEM"
custom_url_partial_match	true value would be treated as a partial match for custom url True value for this flag will be treated as a partial match for custom url	boolean
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
isALGType	Is the value ALG type Describes whether the APP_ID value is ALG type or not.	boolean
key	Key for attribute URL_Reputation is currently not available. Please do not use it in Attribute Key while creating context profile	string	Required Enum: APP_ID, DOMAIN_NAME, URL_CATEGORY, URL_REPUTATION, CUSTOM_URL
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For URL CATEGORY key , it specified super category for url category value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes?action=add Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update custom object attribute value list for given attribute key (Deprecated)

This API updates custom attribute value list for given key.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyAttributes+

PolicyAttributes (schema)

Name	Description	Type	Notes
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: SYSTEM, CUSTOM Default: "SYSTEM"
custom_url_partial_match	true value would be treated as a partial match for custom url True value for this flag will be treated as a partial match for custom url	boolean
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
isALGType	Is the value ALG type Describes whether the APP_ID value is ALG type or not.	boolean
key	Key for attribute URL_Reputation is currently not available. Please do not use it in Attribute Key while creating context profile	string	Required Enum: APP_ID, DOMAIN_NAME, URL_CATEGORY, URL_REPUTATION, CUSTOM_URL
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For URL CATEGORY key , it specified super category for url category value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Adds/Removes custom attribute values from list

This API adds/removes custom attribute values from list for a given attribute key.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Request Headers:

n/a

Query Parameters:

CustomAttributeAction+

Request Body:

PolicyCustomAttributes+

PolicyCustomAttributes (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: CUSTOM, SYSTEM Default: "CUSTOM"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key	Key for attribute Policy Custom Attribute Key	string	Required Enum: DOMAIN_NAME, CUSTOM_URL
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For Custom URL key , it specified url type for url value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyCustomAttributes	string
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default?action=add Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update custom object attribute value list for given attribute key

This API updates custom attribute value list for given key.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyCustomAttributes+

PolicyCustomAttributes (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: CUSTOM, SYSTEM Default: "CUSTOM"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key	Key for attribute Policy Custom Attribute Key	string	Required Enum: DOMAIN_NAME, CUSTOM_URL
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For Custom URL key , it specified url type for url value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyCustomAttributes	string
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update custom object attribute value list for given attribute key

This API updates custom attribute value list for given key.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Request Headers:

n/a

Query Parameters:

ProfileSupportedAttributesListRequestParameters+

ProfileSupportedAttributesListRequestParameters (schema)

Name	Description	Type	Notes
attribute_key	Fetch attributes and sub-attributes for the given attribute key It fetches attributes and subattributes for the given attribute key supported in the system which can be used for Policy Context Profile creation.	string
attribute_source	Source of the attribute, System Defined or custom It fetches attributes and sub attributes for the given attribute key based on the source of attribute which can be used for Policy Context Profile creation.	string	Enum: ALL, CUSTOM, SYSTEM Default: "SYSTEM"
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default?attribute_key=CUSTOM_URL Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfileListResult+

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Inventory

Policy: Inventory: Services

Associated URIs:

GET /global-manager/api/v1/global-infra/services
DELETE /global-manager/api/v1/global-infra/services/{service-id}
GET /global-manager/api/v1/global-infra/services/{service-id}
PATCH /global-manager/api/v1/global-infra/services/{service-id}
PUT /global-manager/api/v1/global-infra/services/{service-id}
GET /global-manager/api/v1/global-infra/services/{service-id}/service-entries
DELETE /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}
GET /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}
PATCH /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}
PUT /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

List Services for infra

Paginated list of Services for infra.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services

Request Headers:

n/a

Query Parameters:

ServiceListRequestParameters+

ServiceListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
default_service	Fetch all default services If set to true, then it will display only default services. If set to false, then it will display all user defined services. If it is not provided, then complete (default as well as user defined) list of services will be displayed.	boolean
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ServiceListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 402, "results": [ { "resource_type": "Service", "description": "AD Server", "id": "AD_Server", "display_name": "AD Server", "path": "/infra/services/AD_Server", "parent_path": "/infra/services/AD_Server", "relative_path": "AD_Server", "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "id": "AD_Server", "display_name": "AD Server", "path": "/infra/services/AD_Server/service-entries/AD_Server", "parent_path": "/infra/services/AD_Server", "relative_path": "AD_Server", "destination_ports": [ "1024" ], "l4_protocol": "TCP", "_create_user": "system", "_create_time": 1517296380484, "_last_modified_user": "system", "_last_modified_time": 1517296380484, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "_create_user": "system", "_create_time": 1517296380468, "_last_modified_user": "system", "_last_modified_time": 1517296380468, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } } Required Permissions: read Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a Service

Create a new service if a service with the given ID does not already
exist. Creates new service entries if populated in the service.
If a service with the given ID already exists, patch the service
including the nested service entries.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, EITHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http { "description": "My HTTP Patched", "display_name": "My HTTP", "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Service

Delete Service This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read a service

Read a service This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, EITHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Service", "description": "My HTTP", "id": "my-http", "display_name": "My HTTP", "path": "/infra/services/my-http", "parent_path": "/infra/services/my-http", "relative_path": "my-http", "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "id": "MyHttpEntry", "display_name": "MyHttpEntry", "path": "/infra/services/my-http/service-entries/MyHttpEntry", "parent_path": "/infra/services/my-http", "relative_path": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517310677617, "_last_modified_user": "admin", "_last_modified_time": 1517310677617, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "_create_user": "admin", "_create_time": 1517310677604, "_last_modified_user": "admin", "_last_modified_time": 1517310677604, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a Service

Create a new service if a service with the given ID does not already
exist. Creates new service entries if populated in the service.
If a service with the given ID already exists, update the service
including the nested service entries. This is a full replace.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, EITHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http { "description": "My HTTP", "display_name": "My HTTP", "_revision": 0, "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, EITHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Service entries for the given service

Paginated list of Service entries for the given service
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries

Request Headers:

n/a

Query Parameters:

ServiceEntryListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ServiceEntryListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 2, "results": [ { "resource_type": "L4PortSetServiceEntry", "id": "MyHttpEntry", "display_name": "MyHttpEntry", "path": "/infra/services/my-http/service-entries/MyHttpEntry", "parent_path": "/infra/services/my-http", "relative_path": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517310677617, "_last_modified_user": "admin", "_last_modified_time": 1517310677617, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "L4PortSetServiceEntry", "id": "https", "display_name": "MyHttps", "path": "/infra/services/my-http/service-entries/https", "parent_path": "/infra/services/my-http", "relative_path": "https", "destination_ports": [ "7443" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517316057383, "_last_modified_user": "admin", "_last_modified_time": 1517316057383, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch a ServiceEntry

If a service entry with the service-entry-id is not already present,
create a new service entry. If it already exists, patch the service
entry.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	The Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol. Please note, protocol NBNS_BROADCAST and NBDG_BROADCAST are deprecated. Please use UDP protocol and create L4 Port Set type of service instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports		array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number		integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttps", "destination_ports": [ "9443" ], "l4_protocol": "TCP" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Service entry

Delete Service entry This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Service entry

Service entry This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	The Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol. Please note, protocol NBNS_BROADCAST and NBDG_BROADCAST are deprecated. Please use UDP protocol and create L4 Port Set type of service instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports		array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number		integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "L4PortSetServiceEntry", "id": "https", "display_name": "MyHttps", "path": "/infra/services/my-http/service-entries/https", "parent_path": "/infra/services/my-http", "relative_path": "https", "destination_ports": [ "7443" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517316057383, "_last_modified_user": "admin", "_last_modified_time": 1517316057383, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a ServiceEntry

If a service entry with the service-entry-id is not already present,
create a new service entry. If it already exists, update the service
entry.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	The Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol. Please note, protocol NBNS_BROADCAST and NBDG_BROADCAST are deprecated. Please use UDP protocol and create L4 Port Set type of service instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports		array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number		integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttps", "destination_ports": [ "7443" ], "l4_protocol": "TCP", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	The Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol. Please note, protocol NBNS_BROADCAST and NBDG_BROADCAST are deprecated. Please use UDP protocol and create L4 Port Set type of service instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports		array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number		integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Inventory: Tags

Associated URIs:

GET /global-manager/api/v1/global-infra/tags
GET /global-manager/api/v1/global-infra/tags/effective-resources
GET /global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}
PUT /global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}
GET /global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}/status

List all unique tags.

Returns paginated list of all unique tags. Supports filtering by scope, tag and
source from which tags are synced. Supports starts with, ends with, equals and
contains operators on scope and tag values.
To filter tags by starts with on scope or tag, use '*' as suffix after the value.
To filter tags by ends with on scope or tag, use '*' as prefix before the value.
To filter tags by contain on scope or tag, use '*' as prefix and suffix on the value.
Below special characters in the filter value needs to be escaped with hex values.
- Character '&' needs to be escaped as '%26'
- Character '[' needs to be escaped as '%5B'
- Character ']' needs to be escaped as '%5D'
- Character '+' needs to be escaped as '%2B'
- Character '#' needs to be escaped as '%23'
Sort option for list of unique tags is available only on tag and scope properties.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags

Request Headers:

n/a

Query Parameters:

TagInfoListRequestParameters+

TagInfoListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
scope	Tag scope	string
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source from which tags are synced.	string	Enum: Amazon, Azure, NSX, ANY
tag	Tag value	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagInfoListResult+

Example Response: { "results": [ { "scope": "os", "tag": "windows", "tagged_objects": 250 }, { "scope": "os", "tag": "ubantu", "tagged_objects": 100 } ], "result_count": 2 } { "results": [ { "scope": "os", "tag": "windows", "tagged_objects": 250 } ], "result_count": 1 } { "results": [ { "scope": "os", "tag": "ubantu", "tagged_objects": 100 } ], "result_count": 1 } Required Permissions: read Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List all objects assigned with matching scope and tag values

Paginated list of all objects assigned with matching scope and tag values. Objects
are represented in form of resource reference. Sort option is available only on
target_type and target_display_name properties.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags/effective-resources

Request Headers:

n/a

Query Parameters:

TaggedObjectsListRequestParameters+

TaggedObjectsListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
filter_text	Filter text to restrict tagged objects list with matching filter text.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
scope	Tag scope	string
sort_ascending		boolean
sort_by	Field by which records are sorted	string
tag	Tag value	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags/effective-resources?scope=type&tag=app Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceListResult+

Example Response: { "results": [ { "target_type": "VirtualMachine", "target_display_name": "App-VM-1", "target_id": "564d8b81-983d-b8ef-686b-161205939c58" }, { "target_type": "Group", "target_display_name": "app-vms", "path": "/infra/domains/default/groups/app-vms" } ], "result_count": 2 } Required Permissions: read Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Assign or Unassign tag on multiple Virtual Machines.

Tag can be assigned or unassigned on multiple objects. Supported object type is
restricted to Virtual Machine for now and support for other objects will be added
later. Permissions for tag bulk operation would be similar to virtual machine
tag permissions.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

TagBulkOperation+

TagBulkOperation (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
remove_from	List of resources from which tag needs to be removed List of resources from which tag needs to be removed.	array of ResourceInfo
resource_type	Must be set to the value TagBulkOperation	string
tag	Tag	Tag	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tags/tag-operations/win-vm-update { "tag": { "scope": "os", "tag": "windows" }, "apply_to": [ { "resource_type": "VirtualMachine", "resource_ids": [ "ee98a906-7b84-42ae-9413-d812cdb64543" ] } ], "remove_from":[ { "resource_type": "VirtualMachine", "resource_ids": [ "564d8b81-983d-b8ef-686b-161205939c58" ] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagBulkOperation+

TagBulkOperation (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
remove_from	List of resources from which tag needs to be removed List of resources from which tag needs to be removed.	array of ResourceInfo
resource_type	Must be set to the value TagBulkOperation	string
tag	Tag	Tag	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "tag": { "scope": "os", "tag": "windows" }, "apply_to": [ { "resource_type": "VirtualMachine", "resource_ids": [ "ee98a906-7b84-42ae-9413-d812cdb64543" ] } ], "remove_from":[ { "resource_type": "VirtualMachine", "resource_ids": [ "564d8b81-983d-b8ef-686b-161205939c58" ] } ], "resource_type": "TagBulkOperation", "id": "win-vm-update", "display_name": "win-vm-update", "path": "/infra/tags/tag-operations/win-vm-update", "relative_path": "win-vm-update", "parent_path": "/infra/tags/tag-operations", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544641564432, "_last_modified_user": "admin", "_last_modified_time": 1544641564432, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get details of tag bulk operation request

Get details of tag bulk operation request with which tag is applied or removed
on virtual machines.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags/tag-operations/win-vm-update Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagBulkOperation+

TagBulkOperation (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
remove_from	List of resources from which tag needs to be removed List of resources from which tag needs to be removed.	array of ResourceInfo
resource_type	Must be set to the value TagBulkOperation	string
tag	Tag	Tag	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get status of tag bulk operation

Get status of tag bulk operation with details of tag operation on each virtual machine.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}/status

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags/tag-operations/win-vm-update/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagBulkOperationStatus+

Example Response: { "tag": { "scope": "os", "tag": "windows" }, "status": "Error", "apply_to": [ { "resource_type": "VirtualMachine", "resource_tag_status": [ { "resource_id": "e98a906-7b84-42ae-9413-d812cdb64543", "tag_status": "Success" } ] } ], "remove_from":[ { "resource_type": "VirtualMachine", "resource_tag_status": [ { "resource_id": "564d8b81-983d-b8ef-686b-161205939c58", "tag_status": "Error", "details": "VM with external id not found" } ] } ], } Required Permissions: crud Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Inventory: Vm

Associated URIs:

GET /global-manager/api/v1/global-infra/vm-tag-replication-policies
DELETE /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}
GET /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}
PATCH /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}
PUT /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

List all VM tag replication policies

List all VM tag replication policies.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies

Request Headers:

n/a

Query Parameters:

VMTagReplicationPolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VMTagReplicationPolicyListResult+

Example Response: { "result_count": 1, "results": [ { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "vm_match_criteria": "MATCH_NSX_ATTACHMENT_ID", "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ], "id": "policy1", "path": "/global-infra/vm-tag-replication-policies/policy1", "_revision": 2 } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch the VM tag replication policy

Patch the VM tag replication policy.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

Example Request: PATCH https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "vm_match_criteria": "MATCH_BIOS_UUID_NAME", "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update the VM tag replication policy

Create or update the VM tag replication policy.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

Example Request: PUT https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

Example Response: { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "vm_match_criteria": "MATCH_NSX_ATTACHMENT_ID", "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ], "id": "policy1", "path": "/global-infra/vm-tag-replication-policies/policy1", "_revision": 2 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get the VM tag replication policy specified by id

Get the VM tag replication policy specified by id.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete the VM tag replication policy specified by id

Delete the VM tag replication policy specified by id.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Monitoring

Policy: Monitoring: Compliance

Associated URIs:

GET /global-manager/api/v1/compliance/status

Returns the compliance status

Returns the compliance status and details of non compliant configuration Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/compliance/status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/compliance/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyComplianceStatus+

Example Response: { "last_updated_time" : 1535016210856, "non_compliant_configs": [ { "description": "TLS version 1.0 used for establishing secure socket connection. It is recommended to run TLSv 1.1 or higher and fully deactivate TLSv1.0 that have protocol weaknesses.", "reported_by": { "target_display_name": "test-profile", "is_valid": true, "target_type": "LB_CLIENT_SSL_PROFILE", "target_id": "/infra/lb-client-ssl-profiles/test-profile", "path": "/infra/lb-client-ssl-profiles/test-profile" }, "non_compliance_code": 72022 } ] } Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Monitoring: Finetuning

Associated URIs:

GET /global-manager/api/v1/fine-tuning/resources

For each type of entity what are the attributes owned by policy.

This API provides field names of attributes in NSX types that are owned by
Policy, as opposed to those owned by the enforcement point. For any type on NSX,
some of the attributes of that type may be owned and set by Policy when realizing
the intent, while some others may be owned and set by the enforcement point itself.
This information can be used to deactivate updates to Policy owned attributes by the
advanced networking UI, while allowing tweaking to the attributes owned by the
management plane.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/fine-tuning/resources

Request Headers:

n/a

Query Parameters:

ResourceInfoSearchParameters+

Request Body:

n/a

Example Request: https://<policy-mgr>/global-manager/api/v1/fine-tuning/resources?type=InstanceDeploymentConfigDto Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ResourceInfoListResult+

Example Response: { "result_count": 1, "results": [{ "resource_name": "InstanceDeploymentConfigDto", "fields": [{ "sub_type": { "resource_name": "VmNicInfoDto", "fields": [{ "sub_type": { "resource_name": "NicInfoDto", "fields": [{ "field_name": "gateway_address" }, { "field_name": "network_id" }, { "field_name": "subnet_mask" }, { "field_name": "ip_address" }] }, "field_name": "nic_infos" }] }, "field_name": "vm_nic_infos" }, { "field_name": "compute_id" }, { "field_name": "storage_id" }, { "field_name": "context_id" }] }] } Required Permissions: read Feature: policy_fine_tuning Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Monitoring: Latency

Associated URIs:

GET /global-manager/api/v1/global-infra/latency-profiles
DELETE /global-manager/api/v1/global-infra/latency-profiles/{profile-id}
GET /global-manager/api/v1/global-infra/latency-profiles/{profile-id}
PATCH /global-manager/api/v1/global-infra/latency-profiles/{profile-id}
PUT /global-manager/api/v1/global-infra/latency-profiles/{profile-id}

List latency profiles

This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/latency-profiles

Request Headers:

n/a

Query Parameters:

PolicyLatencyStatProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/latency-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyLatencyStatProfileListResult+

Example Response: { [ { "resource_type": "PolicyLatencyStatProfile", "id": "profile1", "display_name": "/infra/latency-profiles/profile1", "path": "/infra/latency-profiles/profile1", "parent_path": "/infra", "relative_path": "profile1", "sampling_rate" : 120, "sampling_interval": 10, "pnic_latency_enabled" : false, "_create_user": "admin", "_create_time": 1517354268091, "_last_modified_user": "admin", "_last_modified_time": 1517354315280, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ], "result_count" : 1, "sort_by" : "display_name", "sort_ascending" : true } Required Permissions: read Feature: policy_ops Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or Replace latency profile

Create or Replace latency profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/latency-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyLatencyStatProfile+

PolicyLatencyStatProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
applied_to_group_path	Binding Policy group path The Policy group path to apply the latency profile.	string
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pnic_latency_enabled	Pnic latency enablement flag Activate or Deactivate pnic latency.	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyLatencyStatProfile	string
sampling_interval	Latency sampling interval Event nth milliseconds packet is sampled. When a value less than 1000 is given, the realized sampling interval will be 1000 milliseconds.	integer	Minimum: 1 Maximum: 1000000
sampling_rate	Latency sampling rate Event nth packet is sampled.	integer	Minimum: 100 Maximum: 1000000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/latency-profiles/profile1 { "sampling_rate": 100, "sampling_interval": 10, "pnic_latency_enabled": false, } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyLatencyStatProfile+

PolicyLatencyStatProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
applied_to_group_path	Binding Policy group path The Policy group path to apply the latency profile.	string
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pnic_latency_enabled	Pnic latency enablement flag Activate or Deactivate pnic latency.	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyLatencyStatProfile	string
sampling_interval	Latency sampling interval Event nth milliseconds packet is sampled. When a value less than 1000 is given, the realized sampling interval will be 1000 milliseconds.	integer	Minimum: 1 Maximum: 1000000
sampling_rate	Latency sampling rate Event nth packet is sampled.	integer	Minimum: 100 Maximum: 1000000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyLatencyStatProfile", "id": "profile1", "display_name": "/infra/latency-profiles/profile1", "path": "/infra/latency-profiles/profile1", "parent_path": "/infra", "relative_path": "profile1", "sampling_rate" : 100, "sampling_interval": 10, "pnic_latency_enabled" : false, "_create_user": "admin", "_create_time": 1517354268091, "_last_modified_user": "admin", "_last_modified_time": 1517354315280, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_ops Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch latency profile

Patch latency profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/latency-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyLatencyStatProfile+

PolicyLatencyStatProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
applied_to_group_path	Binding Policy group path The Policy group path to apply the latency profile.	string
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pnic_latency_enabled	Pnic latency enablement flag Activate or Deactivate pnic latency.	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyLatencyStatProfile	string
sampling_interval	Latency sampling interval Event nth milliseconds packet is sampled. When a value less than 1000 is given, the realized sampling interval will be 1000 milliseconds.	integer	Minimum: 1 Maximum: 1000000
sampling_rate	Latency sampling rate Event nth packet is sampled.	integer	Minimum: 100 Maximum: 1000000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/latency-profiles/profile1 { "sampling_rate": 120 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyLatencyStatProfile+

PolicyLatencyStatProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
applied_to_group_path	Binding Policy group path The Policy group path to apply the latency profile.	string
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pnic_latency_enabled	Pnic latency enablement flag Activate or Deactivate pnic latency.	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyLatencyStatProfile	string
sampling_interval	Latency sampling interval Event nth milliseconds packet is sampled. When a value less than 1000 is given, the realized sampling interval will be 1000 milliseconds.	integer	Minimum: 1 Maximum: 1000000
sampling_rate	Latency sampling rate Event nth packet is sampled.	integer	Minimum: 100 Maximum: 1000000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyLatencyStatProfile", "id": "profile1", "display_name": "/infra/latency-profiles/profile1", "path": "/infra/latency-profiles/profile1", "parent_path": "/infra", "relative_path": "profile1", "sampling_rate" : 120, "sampling_interval": 10, "pnic_latency_enabled" : false, "_create_user": "admin", "_create_time": 1517354268091, "_last_modified_user": "admin", "_last_modified_time": 1517354315280, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: crud Feature: policy_ops Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete latency profile

Delete an existing latency profile This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/latency-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/latency-profiles/profile1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_ops Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read latency profile

Read latency profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/latency-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/latency-profiles/profile1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyLatencyStatProfile+

PolicyLatencyStatProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
applied_to_group_path	Binding Policy group path The Policy group path to apply the latency profile.	string
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pnic_latency_enabled	Pnic latency enablement flag Activate or Deactivate pnic latency.	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PolicyLatencyStatProfile	string
sampling_interval	Latency sampling interval Event nth milliseconds packet is sampled. When a value less than 1000 is given, the realized sampling interval will be 1000 milliseconds.	integer	Minimum: 1 Maximum: 1000000
sampling_rate	Latency sampling rate Event nth packet is sampled.	integer	Minimum: 100 Maximum: 1000000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyLatencyStatProfile", "id": "profile1", "display_name": "/infra/latency-profiles/profile1", "path": "/infra/latency-profiles/profile1", "parent_path": "/infra", "relative_path": "profile1", "sampling_rate" : 120, "sampling_interval": 10, "pnic_latency_enabled" : false, "_create_user": "admin", "_create_time": 1517354268091, "_last_modified_user": "admin", "_last_modified_time": 1517354315280, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: read Feature: policy_ops Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Monitoring: Traceflow

Associated URIs:

GET /global-manager/api/v1/global-infra/traceflows
DELETE /global-manager/api/v1/global-infra/traceflows/{traceflow-id}
GET /global-manager/api/v1/global-infra/traceflows/{traceflow-id}
PATCH /global-manager/api/v1/global-infra/traceflows/{traceflow-id}
POST /global-manager/api/v1/global-infra/traceflows/{traceflow-id}
PUT /global-manager/api/v1/global-infra/traceflows/{traceflow-id}
GET /global-manager/api/v1/global-infra/traceflows/{traceflow-id}/observations
GET /global-manager/api/v1/global-infra/traceflows/{traceflow-id}/status

List TraceflowConfig for infra

Paginated list of all TraceflowConfig for infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/traceflows

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TraceflowConfigListResult+

Example Response: { "results": [ { "segment_port_path": "/infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:c8d7ac3f-1904-4088-a9ec-f0183b5b14d6", "packet": { "eth_header": { "src_mac": "00:50:56:8f:49:60", "dst_mac": "00:50:56:8f:2f:97", "eth_type": 2048 }, "ip_header": { "src_ip": "172.16.14.11", "dst_ip": "172.16.16.13", "protocol": 1, "ttl": 64, "flags": 0 }, "transport_header": { "icmp_echo_request_header": { "id": 0, "sequence": 0 } }, "payload": "", "resource_type": "FieldsPacketData", "frame_size": 128, "routed": true, "transport_type": "UNICAST" }, "timeout": 10, "resource_type": "TraceflowConfig", "id": "t7", "display_name": "t7", "path": "/infra/traceflows/t7", "relative_path": "t7", "parent_path": "/infra", "unique_id": "4dbe1a62-156c-46be-a70f-ea237344f1c3", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579195094519, "_last_modified_user": "admin", "_last_modified_time": 1579195094519, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Restart traceflow with same set of parameters used during create/update traceflow

This will retrace even if current traceflow has observations. Current
observations will be lost. Traceflow configuration will be cleaned up
by the system after two hours of inactivity.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}

Request Headers:

n/a

Query Parameters:

ActionRequest+

Request Body:

n/a

Example Request: https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t7?action=retrace Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TraceflowConfig+

TraceflowConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_transient	Marker to indicate if intent is transient This field indicates if intent is transient and will be cleaned up by the system if set to true	boolean	Default: "True"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
packet	Packet configuration Configuration of packet data	PacketData (Abstract type: pass one of the following concrete types) BinaryPacketData FieldsPacketData	Required
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TraceflowConfig	string
segment_port_path	Segment Port Path or UUID Policy path or UUID of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Ports auto-created by policy as part of connecting segment to Tier-0 or Tier-1 or DHCP server cannot be used. UUID is validated for syntax only. This configuration will be cleaned up by the system after two hours of inactivity.	string	Deprecated
source_id	Segment Port Path or UUID Policy path or UUID (validated for syntax only) of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Both overlay backed port and VLAN backed port are supported.	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
timeout	Timeout for traceflow observation results Maximum time in seconds the management plane will wait for observation result to be generated. The default, minimum and maximum timeout values, in seconds, for: Single site environment - minimum 5, default 10, maximum 15. Federated enviroment - minimum 15, default 30, maximum 60. These values are validated by the system based on type of environment.	integer	Minimum: 5 Maximum: 60 Default: "10"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "segment_port_path": "/infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:c8d7ac3f-1904-4088-a9ec-f0183b5b14d6", "packet": { "eth_header": { "src_mac": "00:50:56:8f:49:60", "dst_mac": "00:50:56:8f:2f:97", "eth_type": 2048 }, "ip_header": { "src_ip": "172.16.14.11", "dst_ip": "172.16.16.13", "protocol": 1, "ttl": 64, "flags": 0 }, "transport_header": { "icmp_echo_request_header": { "id": 0, "sequence": 0 } }, "payload": "", "resource_type": "FieldsPacketData", "frame_size": 128, "routed": true, "transport_type": "UNICAST" }, "timeout": 10, "resource_type": "TraceflowConfig", "id": "t7", "display_name": "t7", "path": "/infra/traceflows/t7", "relative_path": "t7", "parent_path": "/infra", "unique_id": "4dbe1a62-156c-46be-a70f-ea237344f1c3", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579195094519, "_last_modified_user": "admin", "_last_modified_time": 1579195094519, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a traceflow config

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}

Request Headers:

n/a

Query Parameters:

TraceflowStatusRequest+

Request Body:

TraceflowConfig+

TraceflowConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_transient	Marker to indicate if intent is transient This field indicates if intent is transient and will be cleaned up by the system if set to true	boolean	Default: "True"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
packet	Packet configuration Configuration of packet data	PacketData (Abstract type: pass one of the following concrete types) BinaryPacketData FieldsPacketData	Required
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TraceflowConfig	string
segment_port_path	Segment Port Path or UUID Policy path or UUID of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Ports auto-created by policy as part of connecting segment to Tier-0 or Tier-1 or DHCP server cannot be used. UUID is validated for syntax only. This configuration will be cleaned up by the system after two hours of inactivity.	string	Deprecated
source_id	Segment Port Path or UUID Policy path or UUID (validated for syntax only) of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Both overlay backed port and VLAN backed port are supported.	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
timeout	Timeout for traceflow observation results Maximum time in seconds the management plane will wait for observation result to be generated. The default, minimum and maximum timeout values, in seconds, for: Single site environment - minimum 5, default 10, maximum 15. Federated enviroment - minimum 15, default 30, maximum 60. These values are validated by the system based on type of environment.	integer	Minimum: 5 Maximum: 60 Default: "10"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t12 { "segment_port_path": "/global-infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:c8d7ac3f-1904-4088-a9ec-f0183b5b14d6", "packet": { "eth_header": { "src_mac": "00:50:56:8f:49:60", "dst_mac": "00:50:56:8f:2f:97", "eth_type": 2048 }, "ip_header": { "src_ip": "172.16.14.11", "dst_ip": "172.16.16.13", "protocol": 1, "ttl": 64, "flags": 0 }, "transport_header": { "icmp_echo_request_header": { "id": 0, "sequence": 0 } }, "payload": "", "resource_type": "FieldsPacketData", "frame_size": 128, "routed": true, "transport_type": "UNICAST" }, "timeout": 10 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: crud Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read traceflow config

Read traceflow config with id traceflow-id. This configuration
will be cleaned up by the system after two hours of inactivity.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TraceflowConfig+

TraceflowConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_transient	Marker to indicate if intent is transient This field indicates if intent is transient and will be cleaned up by the system if set to true	boolean	Default: "True"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
packet	Packet configuration Configuration of packet data	PacketData (Abstract type: pass one of the following concrete types) BinaryPacketData FieldsPacketData	Required
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TraceflowConfig	string
segment_port_path	Segment Port Path or UUID Policy path or UUID of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Ports auto-created by policy as part of connecting segment to Tier-0 or Tier-1 or DHCP server cannot be used. UUID is validated for syntax only. This configuration will be cleaned up by the system after two hours of inactivity.	string	Deprecated
source_id	Segment Port Path or UUID Policy path or UUID (validated for syntax only) of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Both overlay backed port and VLAN backed port are supported.	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
timeout	Timeout for traceflow observation results Maximum time in seconds the management plane will wait for observation result to be generated. The default, minimum and maximum timeout values, in seconds, for: Single site environment - minimum 5, default 10, maximum 15. Federated enviroment - minimum 15, default 30, maximum 60. These values are validated by the system based on type of environment.	integer	Minimum: 5 Maximum: 60 Default: "10"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete traceflow config

Delete traceflow config with id traceflow-id Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: read Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a traceflow config

If a traceflow config with the traceflow-id is not
already present, create a new traceflow config. If it already exists,
update the traceflow config. This is a full replace. This
configuration will be cleaned up by the system after two hours of inactivity.
To start traceflow on a DHCP port in a custom project, enforcement point path is required.
User needs to update the in-band network telemetry (INT) configuration to specify the DSCP
bit/value for traceflow crafted packet, if the source port of traceflow is on VLAN logical network.
The INT configuration is under global operations configuration so please refer NSX-T API document
Policy > Networking > Networking Profiles > Global Gateway Configuration to check how to set the
DSCP bit/value via global operations configuration related API.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}

Request Headers:

n/a

Query Parameters:

TraceflowStatusRequest+

Request Body:

TraceflowConfig+

TraceflowConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_transient	Marker to indicate if intent is transient This field indicates if intent is transient and will be cleaned up by the system if set to true	boolean	Default: "True"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
packet	Packet configuration Configuration of packet data	PacketData (Abstract type: pass one of the following concrete types) BinaryPacketData FieldsPacketData	Required
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TraceflowConfig	string
segment_port_path	Segment Port Path or UUID Policy path or UUID of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Ports auto-created by policy as part of connecting segment to Tier-0 or Tier-1 or DHCP server cannot be used. UUID is validated for syntax only. This configuration will be cleaned up by the system after two hours of inactivity.	string	Deprecated
source_id	Segment Port Path or UUID Policy path or UUID (validated for syntax only) of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Both overlay backed port and VLAN backed port are supported.	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
timeout	Timeout for traceflow observation results Maximum time in seconds the management plane will wait for observation result to be generated. The default, minimum and maximum timeout values, in seconds, for: Single site environment - minimum 5, default 10, maximum 15. Federated enviroment - minimum 15, default 30, maximum 60. These values are validated by the system based on type of environment.	integer	Minimum: 5 Maximum: 60 Default: "10"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t14?enforcement_point_path=/global-infra/sites/default/enforcement-points/default { "segment_port_path": "/global-infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:c8d7ac3f-1904-4088-a9ec-f0183b5b14d6", "packet": { "eth_header": { "src_mac": "00:55:56:8f:49:60", "dst_mac": "00:50:56:8f:2f:97", "eth_type": 2048 }, "ip_header": { "src_ip": "172.16.14.11", "dst_ip": "172.16.16.13", "protocol": 1, "ttl": 64, "flags": 0 }, "transport_header": { "icmp_echo_request_header": { "id": 0, "sequence": 0 } }, "payload": "", "resource_type": "FieldsPacketData", "frame_size": 128, "routed": true, "transport_type": "UNICAST" }, "timeout": 10 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TraceflowConfig+

TraceflowConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_transient	Marker to indicate if intent is transient This field indicates if intent is transient and will be cleaned up by the system if set to true	boolean	Default: "True"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
packet	Packet configuration Configuration of packet data	PacketData (Abstract type: pass one of the following concrete types) BinaryPacketData FieldsPacketData	Required
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value TraceflowConfig	string
segment_port_path	Segment Port Path or UUID Policy path or UUID of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Ports auto-created by policy as part of connecting segment to Tier-0 or Tier-1 or DHCP server cannot be used. UUID is validated for syntax only. This configuration will be cleaned up by the system after two hours of inactivity.	string	Deprecated
source_id	Segment Port Path or UUID Policy path or UUID (validated for syntax only) of segment port to start traceflow from. Auto-plumbed ports don't have corresponding policy path. Both overlay backed port and VLAN backed port are supported.	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
timeout	Timeout for traceflow observation results Maximum time in seconds the management plane will wait for observation result to be generated. The default, minimum and maximum timeout values, in seconds, for: Single site environment - minimum 5, default 10, maximum 15. Federated enviroment - minimum 15, default 30, maximum 60. These values are validated by the system based on type of environment.	integer	Minimum: 5 Maximum: 60 Default: "10"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "segment_port_path": "/infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:c8d7ac3f-1904-4088-a9ec-f0183b5b14d6", "packet": { "eth_header": { "src_mac": "00:55:56:8f:49:60", "dst_mac": "00:50:56:8f:2f:97", "eth_type": 2048 }, "ip_header": { "src_ip": "172.16.14.11", "dst_ip": "172.16.16.13", "protocol": 1, "ttl": 64, "flags": 0 }, "transport_header": { "icmp_echo_request_header": { "id": 0, "sequence": 0 } }, "payload": "", "resource_type": "FieldsPacketData", "frame_size": 128, "routed": true, "transport_type": "UNICAST" }, "timeout": 10, "resource_type": "TraceflowConfig", "id": "t14", "display_name": "t14", "path": "/infra/traceflows/t14", "relative_path": "t14", "parent_path": "/infra", "unique_id": "d3c59bf3-5de8-4d65-91cc-940458fc8860", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579243672065, "_last_modified_user": "admin", "_last_modified_time": 1579243672065, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read traceflow observations

Read traceflow observations for id traceflow-id. Traceflow configuration will be cleaned up by the system after two hours of inactivity. Enforcement Path is optional parameter. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}/observations

Request Headers:

n/a

Query Parameters:

TraceflowStatusRequest+

Request Body:

n/a

Example Request: https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t1/observations Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TraceflowObservationListResult+

Example Response: { "results": [ { "resource_type": "TraceflowObservationReceived", "sequence_no": 0, "transport_node_id": "b969a530-3823-11ea-9a27-5960b416cadc", "transport_node_name": "wdc-rdops-vm03-dhcp-29-221.eng.vmware.com", "transport_node_type": "ESX", "timestamp": 1579241381499, "timestamp_micro": 1579241381499596, "component_type": "PHYSICAL", "component_sub_type": "UNKNOWN", "component_name": "Physical" } ], "result_count": 1, "sort_by": "sequence_number", "sort_ascending": true, "cursor": "00011" } Required Permissions: read Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read traceflow status

Read traceflow status with id traceflow-id.
Traceflow configuration will be cleaned up by the system after
two hours of inactivity. Enforcement Path is optional parameter.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/traceflows/{traceflow-id}/status

Request Headers:

n/a

Query Parameters:

TraceflowStatusRequest+

Request Body:

n/a

Example Request: https://<policy-mgr>/global-manager/api/v1/global-infra/traceflows/t1/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Traceflow+

Traceflow (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
analysis	Traceflow result analysis notes	array of string	Readonly
counters	observation counters	TraceflowObservationCounters	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	The id of the traceflow round	string	Required Readonly
logical_counters	counters of observations from logical components	TraceflowObservationCounters	Readonly
lport_id	id of the source logical port used for injecting the traceflow packet	string	Readonly
operation_state	Represents the traceflow operation state	string	Required Readonly Enum: IN_PROGRESS, FINISHED, FAILED
request_status	Traceflow request status The status of the traceflow RPC request. SUCCESS - The traceflow request is sent successfully. TIMEOUT - The traceflow request gets timeout. SOURCE_PORT_NOT_FOUND - The source port of the request cannot be found. DATA_PATH_NOT_READY - The datapath component cannot be ready to receive request. CONNECTION_ERROR - There is connection error on datapath component. UNKNOWN - The status of traceflow request cannot be determined.	string	Readonly Enum: SUCCESS, TIMEOUT, SOURCE_PORT_NOT_FOUND, DATA_PATH_NOT_READY, CONNECTION_ERROR, UNKNOWN
resource_type	Must be set to the value Traceflow	string
result_overflowed	A flag, when set true, indicates some observations were deleted from the result set.	boolean	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
timeout	Timeout (in ms) for traceflow observations result list Maximum time (in ms) the management plane will be waiting for this traceflow round. Upper limit for federation case is 90000, for non-federation case is 15000, the maximum is set to 90000 as the higher of the two cases.	integer	Readonly Minimum: 5000 Maximum: 90000

Example Response: { "id": "/infra/traceflows/t1", "lport_id": "/infra/tier-1s/production_t1/segments/production-t1-seg/ports/default:13405ded-e4f7-4776-b0fe-16d0ba685f6c", "timeout": 10, "operation_state": "FINISHED", "result_overflowed": false, "counters": { "received_count": 1, "delivered_count": 0, "dropped_count": 0, "forwarded_count": 0 }, "logical_counters": { "received_count": 0, "delivered_count": 0, "dropped_count": 0, "forwarded_count": 0 }, "analysis": [], "request_status": "SUCCESS", "_protection": "NOT_PROTECTED" } Required Permissions: read Feature: policy_traceflow Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Routing

Policy: Networking: Connectivity: Routing: Tier-0 Gateways

Associated URIs:

POST /global-manager/api/v1/global-infra/tier-0s?action=site_failover

Recover of Tier0 and linked tier1 gateway(s).

API to recover specified Tier0 gateway and linked tier1 gateway from
primary site path to new primary site path. This will update intent of
affected Tier-0 and Tier-1 gateway.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s?action=site_failover

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GatewaySiteFailoverActionConfig+

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s?action=site_failover Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity

Policy: Networking: Connectivity: Segments

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/arp-proxy?format=csv
GET /global-manager/api/v1/global-infra/segments/{segment-id}/arp-proxy
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/arp-proxy?format=csv
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/arp-proxy

Get downlink port Address Resolution Protocol Proxies for infra segment

Returns ARP proxy table for downlink port on connected to the segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/arp-proxy

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/segments/test-segment/arp-proxy Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyArpProxyTableListResult+

Example Response: { "results": [ { "interface_arp_proxy" : [ { "service_id" : "0", "arp_proxy_ip" : "10.22.12.100" } ] } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get downlink port Address Resolution Protocol Proxies for infra segment in CSV format

Returns ARP proxy table for downlink port on connected to the segment in CSV format
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/arp-proxy?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/segments/test-segment/arp-proxy?format=csv Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

PolicyArpProxyTableCsvListResult+

Example Response: TODO smanikarnike Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get downlink port Address Resolution Protocol Proxies for tier-1 segment

Returns ARP proxy table for downlink port on connected to the segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/arp-proxy

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-1s//segments/test-segment/arp-proxy Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyArpProxyTableListResult+

Example Response: { "results": [ { "interface_arp_proxy" : [ { "service_id" : "0", "arp_proxy_ip" : "10.22.12.100" } ] } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get downlink port Address Resolution Protocol Proxies for tier-1 segment in CSV

Returns ARP proxy table for downlink port on connected to the segment in CSV
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/arp-proxy?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-1s//segments/test-segment/arp-proxy?format=csv Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

PolicyArpProxyTableCsvListResult+

Example Response: TODO smanikarnike Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Bridge Endpoints

Policy: Networking: Connectivity: Segments: Bridge Endpoints: Statistics

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/bep-statistics
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/bep-status

Get Tier-1 segment bridge end point statistics using segment ID and profile path.

Get detailed information on Tier-1 segment bridge end point statistics using segment ID and profile path.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/bep-statistics

Request Headers:

n/a

Query Parameters:

BridgeProfileRequestParameters+

Request Body:

n/a

Example Request: # TODO: change this sample request after api is tested GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment-1/bep-statistics?bridge_profile_path=/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BridgeEndpointStatistics+

Example Response: { # TODO: change this sample response after api is tested "tx_packets": { "total": 159, "dropped": 0, "multicast_broadcast": 0 }, "rx_bytes": { "total": 1028, "multicast_broadcast": 0 }, "tx_bytes": { "total": 10438, "multicast_broadcast": 0 }, "rx_packets": { "total": 11, "dropped": 0, "multicast_broadcast": 0 }, "last_update_timestamp": 1457518122686, "endpoint_id": "15269939-779a-4fa4-9a0a-792dbf9fac12" } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-1 segment bridge end point status using segment ID and profile path.

Get detailed information on Tier-1 segment bridge end point status using segment ID and profile path.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/bep-status

Request Headers:

n/a

Query Parameters:

BridgeProfileRequestParameters+

Request Body:

n/a

Example Request: # TODO: change this sample request after api is tested GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment-1/bep-status?bridge_profile_path=/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BridgeEndpointStatus+

Example Response: { # TODO: change this sample response after api is tested "active_nodes": [ /infra/sites/default/enforcement-points/default/host-transport-nodes/TN1 ], "last_update_timestamp": 1457547568679, "endpoint_id": "15269939-779a-4fa4-9a0a-792dbf9fac12" } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Edge Bridge Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles
DELETE /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}
PATCH /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}
PUT /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}

List L2 Bridge Endpoint Profiles

List all L2 bridge profiles Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles

Request Headers:

n/a

Query Parameters:

L2BridgeEndpointProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

L2BridgeEndpointProfileListResult+

Example Response: { "results": [ { "edge_paths": [ "/infra/sites/default/enforcement-points/default/edge-clusters/05e58fcb-8575-4b20-9c49-3f09a0d70572/edge-nodes/0" ], "ha_mode": "ACTIVE_STANDBY", "failover_mode": "PREEMPTIVE", "resource_type": "L2BridgeEndpointProfile", "id": "p2", "display_name": "p2", "path": "/infra/sites/default/enforcement-points/default/edge-bridge-profiles/p2", "relative_path": "p2", "parent_path": "/infra/sites/default/enforcement-points/default", "unique_id": "55971354-aa4b-45dd-bb4f-0a37aaea2181", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579296711399, "_last_modified_user": "admin", "_last_modified_time": 1579296711399, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete L2 Bridge Endpoint Profile

API will delete L2 bridge profile with ID profile-id Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update L2 Bridge Endpoint Profile

API will create or update L2 bridge profile with ID profile-id.
L2 Bridge profile is only allowed under an enforcement-point with path
/infra/sites/default/enforcement-points/default.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

L2BridgeEndpointProfile+

L2BridgeEndpointProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_paths	List of path of Edge nodes List of policy paths to edge nodes. Edge allocation for L2 bridging.	array of string	Minimum items: 1 Maximum items: 2
failover_mode	Failover mode for the edge bridge cluster	string	Enum: PREEMPTIVE, NON_PREEMPTIVE Default: "PREEMPTIVE"
ha_mode	High availability mode for the edge bridge cluster High avaialability mode can be active-active or active-standby. High availability mode cannot be modified after realization.	string	Enum: ACTIVE_STANDBY Default: "ACTIVE_STANDBY"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L2BridgeEndpointProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1 { "edge_paths": [ "/global-infra/sites/default/enforcement-points/default/edge-clusters/05e58fcb-8575-4b20-9c49-3f09a0d70572/edge-nodes/0" ], "ha_mode": "ACTIVE_STANDBY", "failover_mode": "PREEMPTIVE", } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

L2BridgeEndpointProfile+

L2BridgeEndpointProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_paths	List of path of Edge nodes List of policy paths to edge nodes. Edge allocation for L2 bridging.	array of string	Minimum items: 1 Maximum items: 2
failover_mode	Failover mode for the edge bridge cluster	string	Enum: PREEMPTIVE, NON_PREEMPTIVE Default: "PREEMPTIVE"
ha_mode	High availability mode for the edge bridge cluster High avaialability mode can be active-active or active-standby. High availability mode cannot be modified after realization.	string	Enum: ACTIVE_STANDBY Default: "ACTIVE_STANDBY"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L2BridgeEndpointProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "edge_paths": [ "/infra/sites/default/enforcement-points/default/edge-clusters/05e58fcb-8575-4b20-9c49-3f09a0d70572/edge-nodes/0" ], "ha_mode": "ACTIVE_STANDBY", "failover_mode": "PREEMPTIVE", "resource_type": "L2BridgeEndpointProfile", "id": "p1", "display_name": "p1", "path": "/infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1", "relative_path": "p1", "parent_path": "/infra/sites/default/enforcement-points/default", "unique_id": "e2292681-5309-4954-8ad9-4ee89430d10d", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579296574896, "_last_modified_user": "admin", "_last_modified_time": 1579296574896, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get L2 Bridge Endpoint Profile

Read L2 bridge profile with ID profile-id Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

L2BridgeEndpointProfile+

L2BridgeEndpointProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_paths	List of path of Edge nodes List of policy paths to edge nodes. Edge allocation for L2 bridging.	array of string	Minimum items: 1 Maximum items: 2
failover_mode	Failover mode for the edge bridge cluster	string	Enum: PREEMPTIVE, NON_PREEMPTIVE Default: "PREEMPTIVE"
ha_mode	High availability mode for the edge bridge cluster High avaialability mode can be active-active or active-standby. High availability mode cannot be modified after realization.	string	Enum: ACTIVE_STANDBY Default: "ACTIVE_STANDBY"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L2BridgeEndpointProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update L2 Bridge Endpoint Profile

API will create or update L2 bridge profile with ID profile-id.
L2 Bridge profile is only allowed under an enforcement-point with path
/infra/sites/default/enforcement-points/default.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}/edge-bridge-profiles/{profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

L2BridgeEndpointProfile+

L2BridgeEndpointProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_paths	List of path of Edge nodes List of policy paths to edge nodes. Edge allocation for L2 bridging.	array of string	Minimum items: 1 Maximum items: 2
failover_mode	Failover mode for the edge bridge cluster	string	Enum: PREEMPTIVE, NON_PREEMPTIVE Default: "PREEMPTIVE"
ha_mode	High availability mode for the edge bridge cluster High avaialability mode can be active-active or active-standby. High availability mode cannot be modified after realization.	string	Enum: ACTIVE_STANDBY Default: "ACTIVE_STANDBY"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value L2BridgeEndpointProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/default/edge-bridge-profiles/p1 { "edge_paths": [ "/global-infra/sites/default/enforcement-points/default/edge-clusters/05e58fcb-8575-4b20-9c49-3f09a0d70572/edge-nodes/0" ], "ha_mode": "ACTIVE_STANDBY", "failover_mode": "PREEMPTIVE", } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: MAC Table

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/mac-table?format=csv
GET /global-manager/api/v1/global-infra/segments/{segment-id}/mac-table
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/mac-table
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/mac-table?format=csv

Get infra segment MAC table

Returns MAC table for a segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/mac-table

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: https://policy-mgr/global-manager/api/v1/global-infra/segments/TIER0_DOWN_LINK_SWITCH/mac-table?source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentMacAddressListResult+

SegmentMacAddressListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of MacTableEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
transport_node_id	Transport node identifier	string	Readonly

Example Response: { "last_update_timestamp": 1591767144064, "results": [ { "mac_address": "00:0c:29:ce:0f:77", "tep_ip": "100.100.100.3", "tep_mac_address": "00:50:56:6a:af:ce" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment MAC table in CSV

Returns MAC table for a segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/mac-table?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER0_DOWN_LINK_SWITCH/mac-table?format=csv&source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

MacAddressCsvListResult+

Example Response: mac_address,mac_type 00:0c:29:ce:0f:77,STATIC Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-1 segment MAC table

Returns MAC table for a segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/mac-table

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: https://policy-mgr/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/TIER0_DOWN_LINK_SWITCH/mac-table?source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentMacAddressListResult+

SegmentMacAddressListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of MacTableEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
transport_node_id	Transport node identifier	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-1 segment MAC table in CSV

Returns MAC table for a segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/mac-table?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/TIER0_DOWN_LINK_SWITCH/mac-table?format=csv&source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

MacAddressCsvListResult+

Example Response: mac_address,mac_type 00:0c:29:ce:0f:77,STATIC Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Ports

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports
GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/effective-profiles
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/effective-profiles

List infra segment ports

List all the ports for an infra.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports

Request Headers:

n/a

Query Parameters:

SegmentPortListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/production-t1-seg/ports/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortListResult+

Example Response: { "results": [ { "resource_type": "SegmentPort", "id": "default:183a3789-826b-41fc-8642-a6834551d4bc", "display_name": "default:183a3789-826b-41fc-8642-a6834551d4bc", "path": "/infra/segments/production-t1-seg/ports/default:183a3789-826b-41fc-8642-a6834551d4bc", "relative_path": "default:183a3789-826b-41fc-8642-a6834551d4bc", "parent_path": "/infra/segments/production-t1-seg", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544503100539, "_last_modified_user": "system", "_last_modified_time": 1544503100539, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "SegmentPort", "id": "default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "display_name": "default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "path": "/infra/segments/production-t1-seg/ports/default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "relative_path": "default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "parent_path": "/infra/segments/production-t1-seg", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544503100542, "_last_modified_user": "system", "_last_modified_time": 1544503100542, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "SegmentPort", "id": "default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "display_name": "default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "path": "/infra/segments/production-t1-seg/ports/default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "relative_path": "default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "parent_path": "/infra/segments/production-t1-seg", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544503100524, "_last_modified_user": "system", "_last_modified_time": 1544503100524, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 3, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment port by ID

Get detail information on an infra segment port by giving ID.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier/ports/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPort+

SegmentPort (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the port Static address binding used for the port.	array of PortAddressBindingEntry	Maximum items: 512
admin_state	Represents desired state of the segment port	string	Enum: UP, DOWN Default: "UP"
attachment	VIF attachment Only VIF attachment is supported	PortAttachment
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPortDiscoveryProfileBindingMap ChildPortQoSProfileBindingMap ChildPortSecurityProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
extra_configs	Extra configs on segment port This property could be used for vendor specific configuration in key value string pairs. Segment port setting will override segment setting if the same key was set on both segment and segment port.	array of SegmentExtraConfig
id	Unique identifier of this resource	string	Sortable
ignored_address_bindings	Address bindings to be ignored by IP Discovery module IP Discovery module uses various mechanisms to discover address bindings being used on each segment port. If a user would like to ignore any specific discovered address bindings or prevent the discovery of a particular set of discovered bindings, then those address bindings can be provided here. Currently IP range in CIDR format is not supported.	array of PortAddressBindingEntry	Minimum items: 0 Maximum items: 16
init_state	Initial state of this logical ports Set initial state when a new logical port is created. 'UNBLOCKED_VLAN' means new port will be unblocked on traffic in creation, also VLAN will be set with corresponding logical switch setting. This port setting can only be configured at port creation, and cannot be modified. 'RESTORE_VIF' fetches and restores VIF attachment from ESX host.	string	Enum: UNBLOCKED_VLAN, RESTORE_VIF
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_id	ID of the distributed virtual port and the distributed virtual switch in the source vCenter ID populated by NSX when NSX on DVPG is used to indicate the source Distributed Virtual Port and the corresponding Distributed Virtual Switch. This ID is populated only for ports attached to discovered segments.	string	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentPort	string
source_site_id	source site(LM) id. This field will refer to the source site on which the segment port is discovered. This field is populated by GM, when it receives corresponding notification from LM.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentPort", "id": "port1", "display_name": "port1", "path": "/infra/segments/web-tier/ports/port1", "relative_path": "port1", "parent_path": "/infra/segments/web-tier", "address_bindings": [ { "ip_address":"1.1.1.1", "mac_address":"aa:bb:cc:dd:ee:ff" "vlan_id": 0 }, { "ip_address":"1.1.1.2", "mac_address":"aa:bb:cc:dd:ee:f1" "vlan_id": 0 } ], "tags": [ { "tag":"port-1 tag 1 from Policy", "scope":"Policy" } ], "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544503100539, "_last_modified_user": "admin", "_last_modified_time": 1544503100539, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List all effective profiles for infra segment port

List all effective profiles for this segment port on given enforcement point. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/effective-profiles

Request Headers:

n/a

Query Parameters:

EnforcementPointRequest+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/tier0-ls/port/p1/effective-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EffectiveProfilesResponse+

Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Tier-1 segment ports

List all the ports for a Tier-1 segment.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports

Request Headers:

n/a

Query Parameters:

SegmentPortListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/production_t1/segments/production-t1-seg/ports/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortListResult+

Example Response: { "results": [ { "resource_type": "SegmentPort", "id": "default:183a3789-826b-41fc-8642-a6834551d4bc", "display_name": "default:183a3789-826b-41fc-8642-a6834551d4bc", "path": "/infra/tier-1s/production_t1/segments/production-t1-seg/ports/default:183a3789-826b-41fc-8642-a6834551d4bc", "relative_path": "default:183a3789-826b-41fc-8642-a6834551d4bc", "parent_path": "/infra/tier-1s/production_t1/segments/production-t1-seg", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544503100539, "_last_modified_user": "system", "_last_modified_time": 1544503100539, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "SegmentPort", "id": "default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "display_name": "default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "path": "/infra/tier-1s/production_t1/segments/production-t1-seg/ports/default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "relative_path": "default:7555e0d8-f8f7-47c1-a93c-436eb5a6628a", "parent_path": "/infra/tier-1s/production_t1/segments/production-t1-seg", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544503100542, "_last_modified_user": "system", "_last_modified_time": 1544503100542, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "SegmentPort", "id": "default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "display_name": "default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "path": "/infra/tier-1s/production_t1/segments/production-t1-seg/ports/default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "relative_path": "default:ab5e6c6d-ca35-499d-b448-fbb82ed1664b", "parent_path": "/infra/tier-1s/production_t1/segments/production-t1-seg", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544503100524, "_last_modified_user": "system", "_last_modified_time": 1544503100524, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 3, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-1 segment port by ID

Get detail information on a Tier-1 segment port by giving ID.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments/web-tier/ports/port1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPort+

SegmentPort (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the port Static address binding used for the port.	array of PortAddressBindingEntry	Maximum items: 512
admin_state	Represents desired state of the segment port	string	Enum: UP, DOWN Default: "UP"
attachment	VIF attachment Only VIF attachment is supported	PortAttachment
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPortDiscoveryProfileBindingMap ChildPortQoSProfileBindingMap ChildPortSecurityProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
extra_configs	Extra configs on segment port This property could be used for vendor specific configuration in key value string pairs. Segment port setting will override segment setting if the same key was set on both segment and segment port.	array of SegmentExtraConfig
id	Unique identifier of this resource	string	Sortable
ignored_address_bindings	Address bindings to be ignored by IP Discovery module IP Discovery module uses various mechanisms to discover address bindings being used on each segment port. If a user would like to ignore any specific discovered address bindings or prevent the discovery of a particular set of discovered bindings, then those address bindings can be provided here. Currently IP range in CIDR format is not supported.	array of PortAddressBindingEntry	Minimum items: 0 Maximum items: 16
init_state	Initial state of this logical ports Set initial state when a new logical port is created. 'UNBLOCKED_VLAN' means new port will be unblocked on traffic in creation, also VLAN will be set with corresponding logical switch setting. This port setting can only be configured at port creation, and cannot be modified. 'RESTORE_VIF' fetches and restores VIF attachment from ESX host.	string	Enum: UNBLOCKED_VLAN, RESTORE_VIF
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_id	ID of the distributed virtual port and the distributed virtual switch in the source vCenter ID populated by NSX when NSX on DVPG is used to indicate the source Distributed Virtual Port and the corresponding Distributed Virtual Switch. This ID is populated only for ports attached to discovered segments.	string	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentPort	string
source_site_id	source site(LM) id. This field will refer to the source site on which the segment port is discovered. This field is populated by GM, when it receives corresponding notification from LM.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentPort", "id": "port1", "display_name": "port1", "path": "/infra/tier-1s/cgw/segments/web-tier/ports/port1", "relative_path": "port1", "parent_path": "/infra/tier-1s/cgw/segments/web-tier", "address_bindings": [ { "ip_address":"1.1.1.1", "mac_address":"aa:bb:cc:dd:ee:ff", "vlan_id": 0 }, { "ip_address":"1.1.1.2", "mac_address":"aa:bb:cc:dd:ee:f1", "vlan_id": 0 } ], "tags": [ { "tag":"port-1 tag 1 from Policy", "scope":"Policy" } ], "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544503100539, "_last_modified_user": "admin", "_last_modified_time": 1544503100539, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List all effective profiles for tier-1 segment port

List all effective profiles for this segment port on given enforcement point. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/effective-profiles

Request Headers:

n/a

Query Parameters:

EnforcementPointRequest+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/tier1-ls/ports/port1/effective-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EffectiveProfilesResponse+

Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Ports: MAC Table

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/mac-table?format=csv
GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/mac-table
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/mac-table?format=csv
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/mac-table

Get MAC table for infra segment port

Returns MAC table for a segment port
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/mac-table

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER0_DOWN_LINK_SWITCH/ports/default:d808cd01-b20b-485b-8e57-983a84fa7642/mac-table?source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortMacAddressListResult+

SegmentPortMacAddressListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of SegmentPortMacTableEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
transport_node_id	Transport node identifier	string	Readonly

Example Response: { "transport_node_id": "01b3242e-a7c8-11ea-9a01-278a0b44b8c9", "last_update_timestamp": 1591767152521, "results": [ { "mac_address": "00:0c:29:ce:0f:77", "mac_type": "STATIC" } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment port MAC table in CSV

Returns MAC table for a segment port
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/mac-table?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

SegmentPortMacAddressCsvListResult+

Example Response: mac_address,mac_type 00:0c:29:ce:0f:77,STATIC Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get MAC table for tier-1 segment port

Returns MAC table for a segment port
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/mac-table

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/TIER0_DOWN_LINK_SWITCH/ports/default:d808cd01-b20b-485b-8e57-983a84fa7642/mac-table?source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortMacAddressListResult+

SegmentPortMacAddressListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of SegmentPortMacTableEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
transport_node_id	Transport node identifier	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segment port MAC table in CSV

Returns MAC table for a segment port
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/mac-table?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

SegmentPortMacAddressCsvListResult+

Example Response: mac_address,mac_type 00:0c:29:ce:0f:77,STATIC Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Ports: State

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/state
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/state

Get infra segment port state

Returns infra segment port state on enforcement point
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/state

Request Headers:

n/a

Query Parameters:

PolicyRuntimeRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER0_DOWNLINK_SWITCH/ports/default:d03f67f8-efd0-491b-955e-82d8323cffa0/state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortState+

Example Response: { "transport_node_ids": [ "01b3242e-a7c8-11ea-9a01-278a0b44b8c9" ], "discovered_bindings": [ { "source": "VM_TOOLS", "binding": { "ip_address": "192.168.100.162", "mac_address": "00:0c:29:46:b0:72", "vlan": 0 }, "binding_timestamp": 1591432722000 }, { "source": "ARP_SNOOPING", "binding": { "ip_address": "192.168.100.162", "mac_address": "00:0c:29:46:b0:72", "vlan": 0 }, "binding_timestamp": 1591853619530 } ], "realized_bindings": [ { "source": "VM_TOOLS", "binding": { "ip_address": "192.168.100.162", "mac_address": "00:0c:29:46:b0:72", "vlan": 0 }, "binding_timestamp": 1591432722000 }, { "source": "ARP_SNOOPING", "binding": { "ip_address": "192.168.100.162", "mac_address": "00:0c:29:46:b0:72", "vlan": 0 }, "binding_timestamp": 1591434843090 } ], "duplicate_bindings": [], "attachment": { "id": "ef25f3f5-f19a-4aa2-9c6a-842e44d5297b", "state": "ATTACHED", "attachers": [ { "host": "01b3242e-a7c8-11ea-9a01-278a0b44b8c9", "entity": "/vmfs/volumes/5edb3cde-ed7a2d43-f9d3-0200637d79e5/32-vm_Client_VM_Ubuntu_1404-local-1700/32-vm_Client_VM_Ubuntu_1404-local-1700.vmx" } ] } } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segment port state

Returns tier-1 segment port state on enforcement point
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/state

Request Headers:

n/a

Query Parameters:

PolicyRuntimeRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/TIER1_DOWNLINK_SWITCH/ports/default:d03f67f8-efd0-491b-955e-82d8323cffa0/state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortState+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles

Policy: Networking: Connectivity: Segments: Segment Profiles: Discovery Profile Binding

Associated URIs:

GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{infra-segment-id}/ports/{infra-port-id}/port-discovery-profile-binding-maps
GET /global-manager/api/v1/global-infra/segments/{infra-segment-id}/ports/{infra-port-id}/port-discovery-profile-binding-maps/{port-discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
PATCH /global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-discovery-profile-binding-maps
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-discovery-profile-binding-maps/{port-discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Get Group discovery profile binding map

API will get Group discovery profile binding map Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps

Request Headers:

n/a

Query Parameters:

GroupDiscoveryProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/default/groups/group1/discovery-profile-binding-maps Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupDiscoveryProfileBindingMapListResult+

Example Response: { "results": [ { "sequence_number": 22, "resource_type": "GroupDiscoveryProfileBindingMap", "id": "bm1", "display_name": "bm1", "path": "/infra/domains/default/groups/group1/discovery-profile-binding-maps/bm1", "relative_path": "bm1", "parent_path": "/infra/domains/default/groups/group1", "unique_id": "35230872-f823-4c53-ab1a-5f8e06558bdc", "marked_for_delete": false, "profile_path": "/infra/ip-discovery-profiles/p2", "_last_modified_time": 1570048887730, "_system_owned": false, "_create_user": "admin", "_create_time": 1570048887730, "_last_modified_user": "admin", "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Group discovery profile binding map

API will delete Group discovery profile binding map Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/default/groups/group1/discovery-profile-binding-maps/bm1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update Group discovery profile binding map

API will create or update Group discovery profile binding map Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GroupDiscoveryProfileBindingMap+

GroupDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
profile_path	Profile Path PolicyPath of associated Profile	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GroupDiscoveryProfileBindingMap	string
sequence_number	Sequence number group discovery profile Binding Map Sequence number used to resolve conflicts betweeen two profiles applied on the same group. Lower sequence number takes higher precedence. Two binding maps applied to the same profile must have the same sequence number. User defined sequence numbers range from 1 through 100,000. System defined sequence numbers range from 100,001 through 200,000.	integer	Minimum: 1 Maximum: 100000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/default/groups/group1/discovery-profile-binding-maps/bm1 { "profile_path": "/global-infra/ip-discovery-profiles/p3", "sequence_number": 22 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Group discovery profile binding map

API will get Group discovery profile binding map Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/default/groups/group1/discovery-profile-binding-maps/bm1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupDiscoveryProfileBindingMap+

GroupDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
profile_path	Profile Path PolicyPath of associated Profile	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GroupDiscoveryProfileBindingMap	string
sequence_number	Sequence number group discovery profile Binding Map Sequence number used to resolve conflicts betweeen two profiles applied on the same group. Lower sequence number takes higher precedence. Two binding maps applied to the same profile must have the same sequence number. User defined sequence numbers range from 1 through 100,000. System defined sequence numbers range from 100,001 through 200,000.	integer	Minimum: 1 Maximum: 100000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "sequence_number": 22, "resource_type": "GroupDiscoveryProfileBindingMap", "id": "bm1", "display_name": "bm1", "path": "/infra/domains/default/groups/group1/discovery-profile-binding-maps/bm1", "relative_path": "bm1", "parent_path": "/infra/domains/default/groups/group1", "unique_id": "35230872-f823-4c53-ab1a-5f8e06558bdc", "marked_for_delete": false, "profile_path": "/infra/ip-discovery-profiles/p2", "_last_modified_time": 1570048887730, "_system_owned": false, "_create_user": "admin", "_create_time": 1570048887730, "_last_modified_user": "admin", "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Group discovery profile binding map

API will update Group discovery profile binding map Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/discovery-profile-binding-maps/{discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GroupDiscoveryProfileBindingMap+

GroupDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
profile_path	Profile Path PolicyPath of associated Profile	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GroupDiscoveryProfileBindingMap	string
sequence_number	Sequence number group discovery profile Binding Map Sequence number used to resolve conflicts betweeen two profiles applied on the same group. Lower sequence number takes higher precedence. Two binding maps applied to the same profile must have the same sequence number. User defined sequence numbers range from 1 through 100,000. System defined sequence numbers range from 100,001 through 200,000.	integer	Minimum: 1 Maximum: 100000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/domains/default/groups/group1/discovery-profile-binding-maps/bm1 { "profile_path": "/global-infra/ip-discovery-profiles/p3", "sequence_number": 22 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupDiscoveryProfileBindingMap+

GroupDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
profile_path	Profile Path PolicyPath of associated Profile	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value GroupDiscoveryProfileBindingMap	string
sequence_number	Sequence number group discovery profile Binding Map Sequence number used to resolve conflicts betweeen two profiles applied on the same group. Lower sequence number takes higher precedence. Two binding maps applied to the same profile must have the same sequence number. User defined sequence numbers range from 1 through 100,000. System defined sequence numbers range from 100,001 through 200,000.	integer	Minimum: 1 Maximum: 100000
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Infra Port Discovery Profile Binding Maps

API will list all Infra Port Discovery Profile Binding Maps in current port id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/ports/{infra-port-id}/port-discovery-profile-binding-maps

Request Headers:

n/a

Query Parameters:

PortDiscoveryProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortDiscoveryProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PortDiscoveryProfileBindingMap", "description": "", "id":"pdpbm_1", "display_name": "PortDiscoveryProfileBindingMap", "path": "/infra/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/pdpbm_1", "relative_path": "PortDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Infra Port Discovery Profile Binding Map

API will get Infra Port Discovery Profile Binding Map
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/ports/{infra-port-id}/port-discovery-profile-binding-maps/{port-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/pdpbm_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortDiscoveryProfileBindingMap+

PortDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PortDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PortDiscoveryProfileBindingMap", "description": "", "id":"pdpbm_1", "display_name": "PortDiscoveryProfileBindingMap", "path": "/infra/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/pdpbm_1", "relative_path": "PortDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Infra Segment Discovery Profile Binding Maps

API will list all Infra Segment Discovery Profile Binding Maps in current segment id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps

Request Headers:

n/a

Query Parameters:

SegmentDiscoveryProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-discovery-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentDiscoveryProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "SegmentDiscoveryProfileBindingMap", "description": "", "id":"sdpbm_1", "display_name": "SegmentDiscoveryProfileBindingMap", "path": "/infra/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1", "relative_path": "SegmentDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Infra Segment Discovery Profile Binding Map

API will get Infra Segment Discovery Profile Binding Map
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentDiscoveryProfileBindingMap", "description": "", "id":"sdpbm_1", "display_name": "SegmentDiscoveryProfileBindingMap", "path": "/infra/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1", "relative_path": "SegmentDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Segment Discovery Profile Binding Profile

API will delete Segment Discovery Profile Binding Profile This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create Infra Segment Discovery Profile Binding Map

API will create Infra Segment Discovery Profile Binding Map. For objects with no binding maps, default profile is applied. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 { "resource_type":" SegmentDiscoveryProfileBindingMap", "display_name": "SegmentDiscoveryProfileBindingMap Profile Production", "description":"", "mac_discovery_profile_path":"/global-infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/global-infra/ip-discovery-profiles/ipdp_1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Infra Segment Discovery Profile Binding Map

API will update Infra Segment Discovery Profile Binding Map. For objects with no binding maps, default profile is applied. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segments/{infra-segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 { "resource_type":" SegmentDiscoveryProfileBindingMap", "display_name": "SegmentDiscoveryProfileBindingMap Profile Production", "description":"", "mac_discovery_profile_path":"/global-infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/global-infra/ip-discovery-profiles/ipdp_1", "_revision": 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Port Discovery Profile Binding Maps

API will list all Port Discovery Profile Binding Maps in current port id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-discovery-profile-binding-maps

Request Headers:

n/a

Query Parameters:

PortDiscoveryProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortDiscoveryProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PortDiscoveryProfileBindingMap", "description": "", "id":"pdpbm_1", "display_name": "PortDiscoveryProfileBindingMap", "path": "/infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/pdpbm_1", "relative_path": "PortDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Port Discovery Profile Binding Map

API will get Port Discovery Profile Binding Map
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-discovery-profile-binding-maps/{port-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/pdpbm_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortDiscoveryProfileBindingMap+

PortDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PortDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PortDiscoveryProfileBindingMap", "description": "", "id":"pdpbm_1", "display_name": "PortDiscoveryProfileBindingMap", "path": "/infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-discovery-profile-binding-maps/pdpbm_1", "relative_path": "PortDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Segment Discovery Profile Binding Maps

API will list all Segment Discovery Profile Binding Maps in current segment id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps

Request Headers:

n/a

Query Parameters:

SegmentDiscoveryProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentDiscoveryProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "SegmentDiscoveryProfileBindingMap", "description": "", "id":"sdpbm_1", "display_name": "SegmentDiscoveryProfileBindingMap", "path": "/infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1", "relative_path": "SegmentDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Segment Discovery Profile Binding Map

API will update Segment Discovery Profile Binding Map. For objects with no binding maps, default profile is applied. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 { "resource_type":" SegmentDiscoveryProfileBindingMap", "display_name": "SegmentDiscoveryProfileBindingMap Profile Production", "description":"", "mac_discovery_profile_path":"/global-infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/global-infra/ip-discovery-profiles/ipdp_1", "_revision": 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentDiscoveryProfileBindingMap", "description": "", "id":"sdpbm_1", "display_name": "SegmentDiscoveryProfileBindingMap", "path": "/infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1", "relative_path": "SegmentDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create Segment Discovery Profile Binding Map

API will create Segment Discovery Profile Binding Map. For objects with no binding maps, default profile is applied. This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 { "resource_type":" SegmentDiscoveryProfileBindingMap", "display_name": "SegmentDiscoveryProfileBindingMap Profile Production", "description":"", "mac_discovery_profile_path":"/global-infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/global-infra/ip-discovery-profiles/ipdp_1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Segment Discovery Profile Binding Profile

API will delete Segment Discovery Profile Binding Profile This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Segment Discovery Profile Binding Map

API will get Segment Discovery Profile Binding Map
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-discovery-profile-binding-maps/{segment-discovery-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentDiscoveryProfileBindingMap+

SegmentDiscoveryProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_discovery_profile_path	IP Discovery Profile Path PolicyPath of associated IP Discovery Profile	string
mac_discovery_profile_path	Mac Discovery Profile Path PolicyPath of associated Mac Discovery Profile	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentDiscoveryProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentDiscoveryProfileBindingMap", "description": "", "id":"sdpbm_1", "display_name": "SegmentDiscoveryProfileBindingMap", "path": "/infra/tier-1s/tier-1/segments/segment_1/segment-discovery-profile-binding-maps/sdpbm_1", "relative_path": "SegmentDiscoveryProfileBindingMaps", "mac_discovery_profile_path":"/infra/mac-discovery-profiles/macdp_1", "ip_discovery_profile_path":"/infra/ip-discovery-profiles/ipdp_1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: IP Discovery Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/ip-discovery-profiles
DELETE /global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}
GET /global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}
PATCH /global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}
PUT /global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}

List IP Discovery Profiles

API will list all IP Discovery Profiles active in current discovery profile id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/ip-discovery-profiles

Request Headers:

n/a

Query Parameters:

IPDiscoveryProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/ip-discovery-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

IPDiscoveryProfileListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "IPDiscoveryProfile", "display_name": "IPDiscoveryProfile", "description": "", "path": "/infra/ip-discovery-profiles/ipdp1", "relative_path": "ipdp1", "ip_v4_discovery_options": { "arp_snooping_config": { "arp_snooping_enabled": false, "arp_binding_limit": 1 }, "dhcp_snooping_enabled": false, "vmtools_enabled": true }, "ip_v6_discovery_options": { "nd_snooping_config": { "nd_snooping_enabled": true, "nd_snooping_limit": 2 }, "dhcp_snooping_v6_enabled": true, "vmtools_v6_enabled": true }, "tofu_enabled": true, "arp_nd_binding_timeout": 10, "duplicate_ip_detection": { "duplicate_ip_detection_enabled": false }, "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get IP Discovery Profile

API will get IP Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/ip-discovery-profiles/ipdp1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

IPDiscoveryProfile+

IPDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
arp_nd_binding_timeout	ARP and ND cache timeout (in minutes) This property controls the ARP and ND cache timeout period. It is recommended that this property be greater than the ARP/ND cache timeout on the VM.	int	Minimum: 5 Maximum: 120 Default: "10"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
duplicate_ip_detection	Duplicate IP Dection Options Duplicate IP detection is used to determine if there is any IP conflict with any other port on the same logical switch. If a conflict is detected, then the IP is marked as a duplicate on the port where the IP was discovered last. The duplicate IP will not be added to the realized address binings for the port and hence will not be used in DFW rules or other security configurations for the port.rt.	DuplicateIPDetectionOptions
id	Unique identifier of this resource	string	Sortable
ip_v4_discovery_options	IPv4 Discovery options Indicates IPv4 Discovery options	IPv4DiscoveryOptions
ip_v6_discovery_options	IPv6 Discovery options Indicates IPv6 Discovery options	IPv6DiscoveryOptions
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tofu_enabled	Is TOFU enabled or not Indicates whether "Trust on First Use(TOFU)" paradigm is enabled.	boolean	Default: "True"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "IPDiscoveryProfile", "display_name": "IPDiscoveryProfile", "description": "", "path": "/infra/ip-discovery-profiles/ipdp1", "relative_path": "ipdp1", "ip_v4_discovery_options": { "arp_snooping_config": { "arp_snooping_enabled": false, "arp_binding_limit": 1 }, "dhcp_snooping_enabled": false, "vmtools_enabled": true }, "ip_v6_discovery_options": { "nd_snooping_config": { "nd_snooping_enabled": true, "nd_snooping_limit": 2 }, "dhcp_snooping_v6_enabled": true, "vmtools_v6_enabled": true }, "tofu_enabled": true, "arp_nd_binding_timeout": 10, "duplicate_ip_detection": { "duplicate_ip_detection_enabled": false }, "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete IP Discovery Profile

API will delete IP Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/ip-discovery-profiles/ipdp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update IP Discovery Profile

API will update IP Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

IPDiscoveryProfile+

IPDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
arp_nd_binding_timeout	ARP and ND cache timeout (in minutes) This property controls the ARP and ND cache timeout period. It is recommended that this property be greater than the ARP/ND cache timeout on the VM.	int	Minimum: 5 Maximum: 120 Default: "10"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
duplicate_ip_detection	Duplicate IP Dection Options Duplicate IP detection is used to determine if there is any IP conflict with any other port on the same logical switch. If a conflict is detected, then the IP is marked as a duplicate on the port where the IP was discovered last. The duplicate IP will not be added to the realized address binings for the port and hence will not be used in DFW rules or other security configurations for the port.rt.	DuplicateIPDetectionOptions
id	Unique identifier of this resource	string	Sortable
ip_v4_discovery_options	IPv4 Discovery options Indicates IPv4 Discovery options	IPv4DiscoveryOptions
ip_v6_discovery_options	IPv6 Discovery options Indicates IPv6 Discovery options	IPv6DiscoveryOptions
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tofu_enabled	Is TOFU enabled or not Indicates whether "Trust on First Use(TOFU)" paradigm is enabled.	boolean	Default: "True"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/ip-discovery-profiles/ipdp1 { "resource_type": "IPDiscoveryProfile", "display_name": "IPDiscoveryProfile", "description": "", "ip_v4_discovery_options": { "arp_snooping_config": { "arp_snooping_enabled": false, "arp_binding_limit": 1 }, "dhcp_snooping_enabled": false, "vmtools_enabled": true }, "ip_v6_discovery_options": { "nd_snooping_config": { "nd_snooping_enabled": true, "nd_snooping_limit": 2 }, "dhcp_snooping_v6_enabled": true, "vmtools_v6_enabled": true }, "tofu_enabled": true, "arp_nd_binding_timeout": 10, "duplicate_ip_detection": { "duplicate_ip_detection_enabled": false } } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

IPDiscoveryProfile+

IPDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
arp_nd_binding_timeout	ARP and ND cache timeout (in minutes) This property controls the ARP and ND cache timeout period. It is recommended that this property be greater than the ARP/ND cache timeout on the VM.	int	Minimum: 5 Maximum: 120 Default: "10"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
duplicate_ip_detection	Duplicate IP Dection Options Duplicate IP detection is used to determine if there is any IP conflict with any other port on the same logical switch. If a conflict is detected, then the IP is marked as a duplicate on the port where the IP was discovered last. The duplicate IP will not be added to the realized address binings for the port and hence will not be used in DFW rules or other security configurations for the port.rt.	DuplicateIPDetectionOptions
id	Unique identifier of this resource	string	Sortable
ip_v4_discovery_options	IPv4 Discovery options Indicates IPv4 Discovery options	IPv4DiscoveryOptions
ip_v6_discovery_options	IPv6 Discovery options Indicates IPv6 Discovery options	IPv6DiscoveryOptions
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tofu_enabled	Is TOFU enabled or not Indicates whether "Trust on First Use(TOFU)" paradigm is enabled.	boolean	Default: "True"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "IPDiscoveryProfile", "display_name": "IPDiscoveryProfile", "description": "", "path": "/infra/ip-discovery-profiles/ipdp1", "relative_path": "ipdp1", "ip_v4_discovery_options": { "arp_snooping_config": { "arp_snooping_enabled": false, "arp_binding_limit": 1 }, "dhcp_snooping_enabled": false, "vmtools_enabled": true }, "ip_v6_discovery_options": { "nd_snooping_config": { "nd_snooping_enabled": true, "nd_snooping_limit": 2 }, "dhcp_snooping_v6_enabled": true, "vmtools_v6_enabled": true }, "tofu_enabled": true, "arp_nd_binding_timeout": 10, "duplicate_ip_detection": { "duplicate_ip_detection_enabled": false }, "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 0 } Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create IP Discovery Profile

API will create IP Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/ip-discovery-profiles/{ip-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

IPDiscoveryProfile+

IPDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
arp_nd_binding_timeout	ARP and ND cache timeout (in minutes) This property controls the ARP and ND cache timeout period. It is recommended that this property be greater than the ARP/ND cache timeout on the VM.	int	Minimum: 5 Maximum: 120 Default: "10"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
duplicate_ip_detection	Duplicate IP Dection Options Duplicate IP detection is used to determine if there is any IP conflict with any other port on the same logical switch. If a conflict is detected, then the IP is marked as a duplicate on the port where the IP was discovered last. The duplicate IP will not be added to the realized address binings for the port and hence will not be used in DFW rules or other security configurations for the port.rt.	DuplicateIPDetectionOptions
id	Unique identifier of this resource	string	Sortable
ip_v4_discovery_options	IPv4 Discovery options Indicates IPv4 Discovery options	IPv4DiscoveryOptions
ip_v6_discovery_options	IPv6 Discovery options Indicates IPv6 Discovery options	IPv6DiscoveryOptions
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value IPDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tofu_enabled	Is TOFU enabled or not Indicates whether "Trust on First Use(TOFU)" paradigm is enabled.	boolean	Default: "True"
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/ip-discovery-profiles/ipdp1 { "resource_type": "IPDiscoveryProfile", "display_name": "IPDiscoveryProfile", "description": "", "ip_v4_discovery_options": { "arp_snooping_config": { "arp_snooping_enabled": false, "arp_binding_limit": 1 }, "dhcp_snooping_enabled": false, "vmtools_enabled": true }, "ip_v6_discovery_options": { "nd_snooping_config": { "nd_snooping_enabled": true, "nd_snooping_limit": 2 }, "dhcp_snooping_v6_enabled": true, "vmtools_v6_enabled": true }, "tofu_enabled": true, "arp_nd_binding_timeout": 10, "duplicate_ip_detection": { "duplicate_ip_detection_enabled": false } } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: MAC Discovery Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/mac-discovery-profiles
DELETE /global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}
GET /global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}
PATCH /global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}
PUT /global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}

List Mac Discovery Profiles

API will list all Mac Discovery Profiles active in current discovery profile id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/mac-discovery-profiles

Request Headers:

n/a

Query Parameters:

MacDiscoveryProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/mac-discovery-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

MacDiscoveryProfileListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type":"MacDiscoveryProfile", "display_name": "MacDiscoveryProfile", "description": "", "path": "/infra/mac-discovery-profiles/mdp1", "relative_path": "mdp1", "mac_change_enabled": true, "mac_learning_enabled": true, "unknown_unicast_flooding_enabled": false, "mac_limit_policy": "ALLOW", "mac_limit": 1, "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Mac Discovery Profile

API will get Mac Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/mac-discovery-profiles/mdp1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

MacDiscoveryProfile+

MacDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mac_change_enabled	Is rule enabled or not Allowing source MAC address change	boolean	Default: "False"
mac_learning_aging_time	Aging time in seconds for learned MAC address Indicates how long learned MAC address remain.	int	Readonly Default: "600"
mac_learning_enabled	Is MAC learning enabled or not Allowing source MAC address learning	boolean	Required
mac_limit	Maximum number of MAC addresses learnt The maximum number of mac addresses that can be learnt on this port when mac learning is enabled.	int	Minimum: 0 Maximum: 4096 Default: "4096"
mac_limit_policy	Mac Limit Policy The policy after MAC Limit is exceeded	string	Enum: ALLOW, DROP Default: "ALLOW"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_overlay_mac_limit	The maximum number of MAC addresses learned on an overlay Logical Switch The maximum number of mac addresses learnt on an overlay logical switch, irrespective of whether mac learning is enabled on the segment ports. When this limit is reached, traffic for mac addresses that are not learnt will be flooded.	int	Minimum: 2048 Maximum: 8192 Default: "2048"
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value MacDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
unknown_unicast_flooding_enabled	Is unknown unicast flooding rule enabled or not Allowing flooding for unlearned MAC for ingress traffic	boolean	Default: "True"

Example Response: { "resource_type":"MacDiscoveryProfile", "display_name": "MacDiscoveryProfile", "description": "", "path": "/infra/mac-discovery-profiles/mdp1", "relative_path": "mdp1", "mac_change_enabled": true, "mac_learning_enabled": true, "unknown_unicast_flooding_enabled": false, "mac_limit_policy": "ALLOW", "mac_limit": 1, "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Mac Discovery Profile

API will update Mac Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

MacDiscoveryProfile+

MacDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mac_change_enabled	Is rule enabled or not Allowing source MAC address change	boolean	Default: "False"
mac_learning_aging_time	Aging time in seconds for learned MAC address Indicates how long learned MAC address remain.	int	Readonly Default: "600"
mac_learning_enabled	Is MAC learning enabled or not Allowing source MAC address learning	boolean	Required
mac_limit	Maximum number of MAC addresses learnt The maximum number of mac addresses that can be learnt on this port when mac learning is enabled.	int	Minimum: 0 Maximum: 4096 Default: "4096"
mac_limit_policy	Mac Limit Policy The policy after MAC Limit is exceeded	string	Enum: ALLOW, DROP Default: "ALLOW"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_overlay_mac_limit	The maximum number of MAC addresses learned on an overlay Logical Switch The maximum number of mac addresses learnt on an overlay logical switch, irrespective of whether mac learning is enabled on the segment ports. When this limit is reached, traffic for mac addresses that are not learnt will be flooded.	int	Minimum: 2048 Maximum: 8192 Default: "2048"
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value MacDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
unknown_unicast_flooding_enabled	Is unknown unicast flooding rule enabled or not Allowing flooding for unlearned MAC for ingress traffic	boolean	Default: "True"

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/mac-discovery-profiles/mdp1 { "resource_type":"MacDiscoveryProfile", "display_name": "MacDiscoveryProfile", "description": "", "mac_change_enabled": true, "mac_learning_enabled": true, "unknown_unicast_flooding_enabled": false, "mac_limit_policy": "ALLOW", "mac_limit": 1, "_revision": 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

MacDiscoveryProfile+

MacDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mac_change_enabled	Is rule enabled or not Allowing source MAC address change	boolean	Default: "False"
mac_learning_aging_time	Aging time in seconds for learned MAC address Indicates how long learned MAC address remain.	int	Readonly Default: "600"
mac_learning_enabled	Is MAC learning enabled or not Allowing source MAC address learning	boolean	Required
mac_limit	Maximum number of MAC addresses learnt The maximum number of mac addresses that can be learnt on this port when mac learning is enabled.	int	Minimum: 0 Maximum: 4096 Default: "4096"
mac_limit_policy	Mac Limit Policy The policy after MAC Limit is exceeded	string	Enum: ALLOW, DROP Default: "ALLOW"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_overlay_mac_limit	The maximum number of MAC addresses learned on an overlay Logical Switch The maximum number of mac addresses learnt on an overlay logical switch, irrespective of whether mac learning is enabled on the segment ports. When this limit is reached, traffic for mac addresses that are not learnt will be flooded.	int	Minimum: 2048 Maximum: 8192 Default: "2048"
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value MacDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
unknown_unicast_flooding_enabled	Is unknown unicast flooding rule enabled or not Allowing flooding for unlearned MAC for ingress traffic	boolean	Default: "True"

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create Mac Discovery Profile

API will create Mac Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

MacDiscoveryProfile+

MacDiscoveryProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mac_change_enabled	Is rule enabled or not Allowing source MAC address change	boolean	Default: "False"
mac_learning_aging_time	Aging time in seconds for learned MAC address Indicates how long learned MAC address remain.	int	Readonly Default: "600"
mac_learning_enabled	Is MAC learning enabled or not Allowing source MAC address learning	boolean	Required
mac_limit	Maximum number of MAC addresses learnt The maximum number of mac addresses that can be learnt on this port when mac learning is enabled.	int	Minimum: 0 Maximum: 4096 Default: "4096"
mac_limit_policy	Mac Limit Policy The policy after MAC Limit is exceeded	string	Enum: ALLOW, DROP Default: "ALLOW"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_overlay_mac_limit	The maximum number of MAC addresses learned on an overlay Logical Switch The maximum number of mac addresses learnt on an overlay logical switch, irrespective of whether mac learning is enabled on the segment ports. When this limit is reached, traffic for mac addresses that are not learnt will be flooded.	int	Minimum: 2048 Maximum: 8192 Default: "2048"
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value MacDiscoveryProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
unknown_unicast_flooding_enabled	Is unknown unicast flooding rule enabled or not Allowing flooding for unlearned MAC for ingress traffic	boolean	Default: "True"

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/mac-discovery-profiles/mdp1 { "resource_type":"MacDiscoveryProfile", "display_name": "MacDiscoveryProfile", "description": "", "mac_change_enabled": true, "mac_learning_enabled": true, "unknown_unicast_flooding_enabled": false, "mac_limit_policy": "ALLOW", "mac_limit": 1 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Mac Discovery Profile

API will delete Mac Discovery profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/mac-discovery-profiles/{mac-discovery-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/mac-discovery-profiles/mdp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: QOS Profile Binding

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps
GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps/{port-qos-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
PATCH /global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps/{port-qos-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

List Port QoS Profile Binding Maps

API will list all Port QoS Profile Binding Maps in current port id.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps

Request Headers:

n/a

Query Parameters:

PortQoSProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/ports/port_1/port-qos-profile-binding-maps Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortQoSProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PortQoSProfileBindingMap", "display_name": "1", "id": "1", "path": "/infra/segments/segment_1/ports/port_1/port-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path": "/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Port QoS Profile Binding Map

API will get Port QoS Profile Binding Map.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps/{port-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/ports/port_1/port-qos-profile-binding-maps/1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortQoSProfileBindingMap+

PortQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PortQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PortQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/segments/segment_1/ports/port_1/port-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Segment QoS Profile Binding Maps

API will list all Segment QoS Profile Binding Maps in current segment id.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps

Request Headers:

n/a

Query Parameters:

SegmentQoSProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-qos-profile-binding-maps Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentQoSProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "SegmentQoSProfileBindingMap", "display_name":"1", "id":"1", "path": "/infra/segments/segment_1/segment-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Segment QoS Profile Binding Map

API will update Segment QoS Profile Binding Map. For objects with no binding maps, default profile is applied. This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-qos-profile-binding-maps/1 { "resource_type":" SegmentQoSProfileBindingMap", "display_name":"1", "description":"", "qos_profile_path":"/global-infra/qos_profiles/1" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/segments/segment_1/segment-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Segment QoS Profile Binding Profile

API will delete Segment QoS Profile Binding Profile. This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-qos-profile-binding-maps/1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Segment QoS Profile Binding Map

API will get Segment QoS Profile Binding Map.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-qos-profile-binding-maps/1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/segments/segment_1/segment-qos-profile-binding-maps/1", "relative_path": "SegmentQoSProfileBindingMaps", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create Segment QoS Profile Binding Map

API will create segment QoS profile binding map. For objects with no binding maps, default profile is applied. This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-qos-profile-binding-maps/1 { "resource_type":" SegmentQoSProfileBindingMap", "display_name":"1", "qos_profile_path":"/global-infra/qos_profiles/1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Port QoS Profile Binding Maps

API will list all Port QoS Profile Binding Maps in current port id.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps

Request Headers:

n/a

Query Parameters:

PortQoSProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-qos-profile-binding-maps Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortQoSProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PortQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-qos-profile-binding-maps/1", "relative_path": "PortQoSProfileBindingMaps", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Port QoS Profile Binding Map

API will get Port QoS Profile Binding Map.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-qos-profile-binding-maps/{port-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-qos-profile-binding-maps/1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortQoSProfileBindingMap+

PortQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PortQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PortQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/tier-1s/tier-1/segments/segment_1/ports/port_1/port-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List Segment QoS Profile Binding Maps

API will list all Segment QoS Profile Binding Maps in current segment id.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps

Request Headers:

n/a

Query Parameters:

SegmentQoSProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentQoSProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "SegmentQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Segment QoS Profile Binding Map

API will get Segment QoS Profile Binding Map.
This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 1 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create Segment QoS Profile Binding Map

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1 { "resource_type":" SegmentQoSProfileBindingMap", "display_name":"1", "qos_profile_path":"/global-infra/qos_profiles/1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Segment QoS Profile Binding Profile

API will delete Segment QoS Profile Binding Profile. This API is available when using VMware NSX or VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers). Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update Segment QoS Profile Binding Map

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-qos-profile-binding-maps/{segment-qos-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<nsx-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1 { "resource_type":" SegmentQoSProfileBindingMap", "display_name":"1", "description":"", "qos_profile_path":"/global-infra/qos_profiles/1" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentQoSProfileBindingMap+

SegmentQoSProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
qos_profile_path	QoS Profile Path PolicyPath of associated QoS Profile	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentQoSProfileBindingMap	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentQoSProfileBindingMap", "description": "", "display_name":"1", "id":"1", "path": "/infra/tier-1s/tier-1/segments/segment_1/segment-qos-profile-binding-maps/1", "relative_path": "1", "qos_profile_path":"/infra/qos_profiles/1", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_revision": 0 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: QOS Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/qos-profiles
DELETE /global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}
GET /global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}
PATCH /global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}
PUT /global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}

List QoS Profiles

API will list all QoS profiles.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/qos-profiles

Request Headers:

n/a

Query Parameters:

QoSProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/qos-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

QoSProfileListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "QoSProfile", "id": "profile_2", "display_name": "/infra/qos-profiles", "path": "/infra/qos-profiles", "parent_path": "/infra", "relative_path": "profile_2", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353633527, "_system_owned": false, "_protection": "NOT_PROTECTED", "dscp": { "mode": "TRUSTED", "priority": 0 }, "shaper_configurations": [ { "resource_type": "IngressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 }, { "resource_type": "IngressBroadcastRateLimiter", "enabled": false, "burst_size": 0, "peak_bandwidth": 0, "average_bandwidth": 0 }, { "resource_type": "EgressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 } ], "class_of_service": 2, "_revision": 1 } ] } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch QoS profile.

Create a new QoS profile if the QoS profile with
given id does not already exist. If the QoS profile with the
given id already exists, patch with the existing QoS profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

QoSProfile+

QoSProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
class_of_service	Class of service Class of service groups similar types of traffic in the network and each type of traffic is treated as a class with its own level of service priority. The lower priority traffic is slowed down or in some cases dropped to provide better throughput for higher priority traffic.	int	Minimum: 0 Maximum: 7 Default: "0"
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dscp		QoSDscp
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value QoSProfile	string
shaper_configurations	Array of Rate limiter configurations to applied on Segment or Port.	array of QoSBaseRateLimiter (Abstract type: pass one of the following concrete types) EgressRateLimiter IngressBroadcastRateLimiter IngressRateLimiter	Minimum items: 0 Maximum items: 3
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/qos-profiles/profile_1 { "dscp": { "mode": "TRUSTED", "priority": 0 }, "shaper_configurations": [ { "resource_type": "IngressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 }, { "resource_type": "IngressBroadcastRateLimiter", "enabled": false, "burst_size": 0, "peak_bandwidth": 0, "average_bandwidth": 0 }, { "resource_type": "EgressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 } ], "class_of_service": 2 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or Replace QoS profile.

Create or Replace QoS profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

QoSProfile+

QoSProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
class_of_service	Class of service Class of service groups similar types of traffic in the network and each type of traffic is treated as a class with its own level of service priority. The lower priority traffic is slowed down or in some cases dropped to provide better throughput for higher priority traffic.	int	Minimum: 0 Maximum: 7 Default: "0"
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dscp		QoSDscp
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value QoSProfile	string
shaper_configurations	Array of Rate limiter configurations to applied on Segment or Port.	array of QoSBaseRateLimiter (Abstract type: pass one of the following concrete types) EgressRateLimiter IngressBroadcastRateLimiter IngressRateLimiter	Minimum items: 0 Maximum items: 3
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/qos-profiles/profile_2 { "dscp": { "mode": "TRUSTED", "priority": 0 }, "shaper_configurations": [ { "resource_type": "IngressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 }, { "resource_type": "IngressBroadcastRateLimiter", "enabled": false, "burst_size": 0, "peak_bandwidth": 0, "average_bandwidth": 0 }, { "resource_type": "EgressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 } ], "class_of_service": 2 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

QoSProfile+

QoSProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
class_of_service	Class of service Class of service groups similar types of traffic in the network and each type of traffic is treated as a class with its own level of service priority. The lower priority traffic is slowed down or in some cases dropped to provide better throughput for higher priority traffic.	int	Minimum: 0 Maximum: 7 Default: "0"
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dscp		QoSDscp
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value QoSProfile	string
shaper_configurations	Array of Rate limiter configurations to applied on Segment or Port.	array of QoSBaseRateLimiter (Abstract type: pass one of the following concrete types) EgressRateLimiter IngressBroadcastRateLimiter IngressRateLimiter	Minimum items: 0 Maximum items: 3
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "QoSProfile", "id": "profile_2", "display_name": "profile_2", "path": "/infra/qos-profiles/profile_2", "parent_path": "/infra", "relative_path": "profile_2", "dscp": { "mode": "TRUSTED", "priority": 0 }, "shaper_configurations": [ { "resource_type": "IngressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 }, { "resource_type": "IngressBroadcastRateLimiter", "enabled": false, "burst_size": 0, "peak_bandwidth": 0, "average_bandwidth": 0 }, { "resource_type": "EgressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 } ], "class_of_service": 2 "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete QoS profile

API will delete QoS profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/qos-profiles/profile_1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Details of QoS profile

API will return details of QoS profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/qos-profiles/{qos-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/qos-profiles/profile_2 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

QoSProfile+

QoSProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
class_of_service	Class of service Class of service groups similar types of traffic in the network and each type of traffic is treated as a class with its own level of service priority. The lower priority traffic is slowed down or in some cases dropped to provide better throughput for higher priority traffic.	int	Minimum: 0 Maximum: 7 Default: "0"
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dscp		QoSDscp
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value QoSProfile	string
shaper_configurations	Array of Rate limiter configurations to applied on Segment or Port.	array of QoSBaseRateLimiter (Abstract type: pass one of the following concrete types) EgressRateLimiter IngressBroadcastRateLimiter IngressRateLimiter	Minimum items: 0 Maximum items: 3
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "QoSProfile", "id": "profile_2", "display_name": "/infra/qos-profiles/profile_2", "path": "/infra/qos-profiles/profile_2", "parent_path": "/infra/domains/d1/groups/group_vm", "relative_path": "profile_2", "_create_user": "admin", "_create_time": 1516657975538, "_last_modified_user": "admin", "_last_modified_time": 1517353711231, "_system_owned": false, "_protection": "NOT_PROTECTED", "dscp": { "mode": "TRUSTED", "priority": 0 }, "shaper_configurations": [ { "resource_type": "IngressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 }, { "resource_type": "IngressBroadcastRateLimiter", "enabled": false, "burst_size": 0, "peak_bandwidth": 0, "average_bandwidth": 0 }, { "resource_type": "EgressRateLimiter", "enabled": false, "average_bandwidth": 0, "peak_bandwidth": 0, "burst_size": 0 } ], "class_of_service": 2, "_revision": 1 } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: Security Profile Binding

Associated URIs:

PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Patch segment security profile binding map

Create a new segment security profile binding map if the given security
profile binding map does not exist. Otherwise, patch the existing segment
security profile binding map.
For objects with no binding maps, default profile is applied.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 { "spoofguard_profile_path": "/global-infra/spoofguard-profiles/spoofguardprofile_1", "segment_security_profile_path": "/global-infra/segment-security-profiles/segmentsecurityprofile_1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: Segment Security Profile Binding

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps
GET /global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps/{port-security-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}
PATCH /global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps/{port-security-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

List infra segment port security profile binding maps

API will list all port security profile binding maps.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps

Request Headers:

n/a

Query Parameters:

PortSecurityProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/ports/port_1/port-security-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortSecurityProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PortSecurityProfileBindingMap", "id": "port-security-profile-binding-map_1", "display_name": "port-security-profile-binding-map_1", "path": "/infra/segments/segment_1/ports/port_1/port-security-profile-binding-maps/port-security-profile-binding-map_1", "parent_path": "/infra/segments/segment_1/ports/port_1", "relative_path": "port-security-profile-binding-map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "", "_create_user": "admin", "_create_time": 1539130261922, "_last_modified_user": "admin", "_last_modified_time": 1539130308980, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment port security profile binding map

API will return details of the port security profile binding map. If the
security profile binding map does not exist, it will return 404.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps/{port-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/ports/port_1/port-security-profile-binding-maps/port_security_binding_map_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortSecurityProfileBindingMap+

PortSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PortSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PortSecurityProfileBindingMap", "id": "port-security-profile-binding-map_1", "display_name": "port-security-profile-binding-map_1", "path": "/infra/segments/segment_1/ports/port_1/port-security-profile-binding-maps/port-security-profile-binding-map_1", "parent_path": "/infra/segments/segment_1/ports/port_1", "relative_path": "port-security-profile-binding-map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "_create_user": "admin", "_create_time": 1539130261922, "_last_modified_user": "admin", "_last_modified_time": 1539130261922, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List infra segment security profile binding maps

API will list all segment security profile binding maps.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps

Request Headers:

n/a

Query Parameters:

SegmentSecurityProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-security-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/infra/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "", "_create_user": "admin", "_create_time": 1539129491798, "_last_modified_user": "admin", "_last_modified_time": 1539129739799, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch infra segment security profile binding map

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 { "spoofguard_profile_path": "/global-infra/spoofguard-profiles/spoofguardprofile_1", "segment_security_profile_path": "/global-infra/segment-security-profiles/segmentsecurityprofile_1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment security profile binding map

API will return details of the segment security profile binding map. If the
binding map does not exist, it will return 404.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/infra/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "_create_user": "admin", "_create_time": 1539129491798, "_last_modified_user": "admin", "_last_modified_time": 1539129491798, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete infra segment security profile binding map

API will delete segment security profile binding map.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or replace infra segment security profile binding map

API will create or replace segment security profile binding map.
For objects with no binding maps, default profile is applied.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/global-infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/global-infra/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "segment_security_profile_path": "/global-infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "", "_create_user": "admin", "_create_time": 1539129491798, "_last_modified_user": "admin", "_last_modified_time": 1539129491798, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/infra/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/infra/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "", "_create_user": "admin", "_create_time": 1539129491798, "_last_modified_user": "admin", "_last_modified_time": 1539129739799, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List port security profile binding maps

API will list all port security profile binding maps.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps

Request Headers:

n/a

Query Parameters:

PortSecurityProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/ports/port_1/port-security-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortSecurityProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PortSecurityProfileBindingMap", "id": "port-security-profile-binding-map_1", "display_name": "port-security-profile-binding-map_1", "path": "/infra/tier-1s/tier1_1/segments/segment_1/ports/port_1/port-security-profile-binding-maps/port-security-profile-binding-map_1", "parent_path": "/infra/tier-1s/tier1_1/segments/segment_1/ports/port_1", "relative_path": "port-security-profile-binding-map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "", "_create_user": "admin", "_create_time": 1539130135604, "_last_modified_user": "admin", "_last_modified_time": 1539130486350, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get port security profile binding map

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/ports/{port-id}/port-security-profile-binding-maps/{port-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/ports/port_1/port-security-profile-binding-maps/port_security_binding_map_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PortSecurityProfileBindingMap+

PortSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value PortSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PortSecurityProfileBindingMap", "id": "port-security-profile-binding-map_1", "display_name": "port-security-profile-binding-map_1", "path": "/infra/tier-1s/tier1_1/segments/segment_1/ports/port_1/port-security-profile-binding-maps/port-security-profile-binding-map_1", "parent_path": "/infra/tier-1s/tier1_1/segments/segment_1/ports/port_1", "relative_path": "port-security-profile-binding-map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "_create_user": "admin", "_create_time": 1539130135604, "_last_modified_user": "admin", "_last_modified_time": 1539130135604, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List segment security profile binding maps

API will list all segment security profile binding maps.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps

Request Headers:

n/a

Query Parameters:

SegmentSecurityProfileBindingMapListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileBindingMapListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/infra/tier-1s/tier1_1/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "spoofguard_profile_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "_create_user": "admin", "_create_time": 1539129320511, "_last_modified_user": "admin", "_last_modified_time": 1539129593401, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment security profile binding map

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/infra/tier-1s/tier1_1/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "segment_security_profile_path": "/infra/segment-security-profiles/segmentsecurityprofile_1", "spoofguard_profile_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "_create_user": "admin", "_create_time": 1539129320511, "_last_modified_user": "admin", "_last_modified_time": 1539129320511, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete segment security profile binding map

API will delete segment security profile binding map.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or replace segment security profile binding map

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/segment-security-profile-binding-maps/{segment-security-profile-binding-map-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1 { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/global-infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/global-infra/tier-1s/tier1_1/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "spoofguard_profile_path": "/global-infra/spoofguard-profiles/spoofguardprofile_1", "segment_security_profile_path": "/global-infra/segment-security-profiles/segment_security_2", "_create_user": "admin", "_create_time": 1539129320511, "_last_modified_user": "admin", "_last_modified_time": 1539129320511, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileBindingMap+

SegmentSecurityProfileBindingMap (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfileBindingMap	string
segment_security_profile_path	Segment Security Profile Path The policy path of the asscociated Segment Security profile	string
spoofguard_profile_path	SpoofGuard Profile Path The policy path of the asscociated SpoofGuard profile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SegmentSecurityProfileBindingMap", "id": "segment_security_binding_map_1", "display_name": "segment_security_binding_map_1", "path": "/infra/tier-1s/tier1_1/segments/segment_1/segment-security-profile-binding-maps/segment_security_binding_map_1", "parent_path": "/infra/tier-1s/tier1_1/segments/segment_1", "relative_path": "segment_security_binding_map_1", "marked_for_delete": false, "spoofguard_profile_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "segment_security_profile_path": "/infra/segment-security-profiles/segment_security_2", "_create_user": "admin", "_create_time": 1539129320511, "_last_modified_user": "admin", "_last_modified_time": 1539129593401, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: Segment Security Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/segment-security-profiles
DELETE /global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}
GET /global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}
PATCH /global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}
PUT /global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}

List segment security profiles

API will list all segment security profiles.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segment-security-profiles

Request Headers:

n/a

Query Parameters:

SegmentSecurityProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segment-security-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfileListResult+

Example Response: { "results": [ { "bpdu_filter_enable": true, "bpdu_filter_allow": [ "01:80:c2:00:00:00", "01:80:c2:00:00:01" ], "dhcp_server_block_enabled": true, "dhcp_client_block_enabled": true, "non_ip_traffic_block_enabled": true, "dhcp_server_block_v6_enabled": true, "dhcp_client_block_v6_enabled": true, "ra_guard_enabled": true, "rate_limits_enabled": false, "resource_type": "SegmentSecurityProfile", "id": "my-segment-security-profile", "display_name": "MySegmentSecurityProfile", "description": "MySegmentSecurityProfile", "path": "/infra/segment-security-profiles/my-segment-security-profile", "relative_path": "my-segment-security-profile", "parent_path": "/infra/segment-security-profiles/my-segment-security-profile", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544566776526, "_last_modified_user": "admin", "_last_modified_time": 1544566776526, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "bpdu_filter_enable": true, "bpdu_filter_allow": [], "dhcp_server_block_enabled": true, "dhcp_client_block_enabled": false, "non_ip_traffic_block_enabled": false, "dhcp_server_block_v6_enabled": true, "dhcp_client_block_v6_enabled": false, "ra_guard_enabled": false, "rate_limits_enabled": false, "rate_limits": { "rx_broadcast": 0, "tx_broadcast": 0, "rx_multicast": 0, "tx_multicast": 0 }, "resource_type": "SegmentSecurityProfile", "id": "default-segment-security-profile", "display_name": "default-segment-security-profile", "path": "/infra/segment-security-profiles/default-segment-security-profile", "relative_path": "default-segment-security-profile", "parent_path": "/infra/segment-security-profiles/default-segment-security-profile", "marked_for_delete": false, "_create_user": "system", "_create_time": 1544555959907, "_last_modified_user": "system", "_last_modified_time": 1544555959907, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 2, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

PATCH segment security profile id

Create a new segment security profile if the segment security profile with given id does not
exist. Otherwise, PATCH the existing segment security profile
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

SegmentSecurityProfile+

SegmentSecurityProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
bpdu_filter_allow	Deactivate BPDU filtering on this allowlist Pre-defined list of allowed MAC addresses to be excluded from BPDU filtering. List of allowed MACs - 01:80:c2:00:00:00, 01:80:c2:00:00:01, 01:80:c2:00:00:02, 01:80:c2:00:00:03, 01:80:c2:00:00:04, 01:80:c2:00:00:05, 01:80:c2:00:00:06, 01:80:c2:00:00:07, 01:80:c2:00:00:08, 01:80:c2:00:00:09, 01:80:c2:00:00:0a, 01:80:c2:00:00:0b, 01:80:c2:00:00:0c, 01:80:c2:00:00:0d, 01:80:c2:00:00:0e, 01:80:c2:00:00:0f, 00:e0:2b:00:00:00, 00:e0:2b:00:00:04, 00:e0:2b:00:00:06, 01:00:0c:00:00:00, 01:00:0c:cc:cc:cc, 01:00:0c:cc:cc:cd, 01:00:0c:cd:cd:cd, 01:00:0c:cc:cc:c0, 01:00:0c:cc:cc:c1, 01:00:0c:cc:cc:c2, 01:00:0c:cc:cc:c3, 01:00:0c:cc:cc:c4, 01:00:0c:cc:cc:c5, 01:00:0c:cc:cc:c6, 01:00:0c:cc:cc:c7	array of MACAddress	Minimum items: 0 Maximum items: 32
bpdu_filter_enable	BPDU filtering status Indicates whether BPDU filter is enabled. BPDU filtering is enabled by default.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_client_block_enabled	Enable DHCP client block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_client_block_v6_enabled	Enable DHCP client block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_server_block_enabled	Enable DHCP server block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "True"
dhcp_server_block_v6_enabled	Enable DHCP server block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "True"
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
non_ip_traffic_block_enabled	Enable non IP traffic block A flag to block all traffic except IP/(G)ARP/BPDU.	boolean	Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
ra_guard_enabled	Enable Router Advertisement Guard Activate or deactivate Router Advertisement Guard.	boolean	Default: "False"
rate_limits	Rate limiting configuration Allows configuration of rate limits for broadcast and multicast traffic. Rate limiting is deactivated by default	TrafficRateLimits
rate_limits_enabled	Enable Rate Limits Activate or deactivate Rate Limits	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/segment-security-profiles/my-segment-security-profile { "resource_type": "SegmentSecurityProfile", "id": "MySegmentSecurityProfile", "display_name": "MySegmentSecurityProfile", "description": "MySegmentSecurityProfile", "bpdu_filter_enable": true, "bpdu_filter_allow":["01:80:c2:00:00:00", "01:80:c2:00:00:01"], "dhcp_server_block_enabled": true, "dhcp_client_block_enabled": true, "non_ip_traffic_block_enabled": true, "dhcp_server_block_v6_enabled": true, "dhcp_client_block_v6_enabled": true, "ra_guard_enabled": true } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

PUT segment security profile id

Create or replace a segment security profile
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

SegmentSecurityProfile+

SegmentSecurityProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
bpdu_filter_allow	Deactivate BPDU filtering on this allowlist Pre-defined list of allowed MAC addresses to be excluded from BPDU filtering. List of allowed MACs - 01:80:c2:00:00:00, 01:80:c2:00:00:01, 01:80:c2:00:00:02, 01:80:c2:00:00:03, 01:80:c2:00:00:04, 01:80:c2:00:00:05, 01:80:c2:00:00:06, 01:80:c2:00:00:07, 01:80:c2:00:00:08, 01:80:c2:00:00:09, 01:80:c2:00:00:0a, 01:80:c2:00:00:0b, 01:80:c2:00:00:0c, 01:80:c2:00:00:0d, 01:80:c2:00:00:0e, 01:80:c2:00:00:0f, 00:e0:2b:00:00:00, 00:e0:2b:00:00:04, 00:e0:2b:00:00:06, 01:00:0c:00:00:00, 01:00:0c:cc:cc:cc, 01:00:0c:cc:cc:cd, 01:00:0c:cd:cd:cd, 01:00:0c:cc:cc:c0, 01:00:0c:cc:cc:c1, 01:00:0c:cc:cc:c2, 01:00:0c:cc:cc:c3, 01:00:0c:cc:cc:c4, 01:00:0c:cc:cc:c5, 01:00:0c:cc:cc:c6, 01:00:0c:cc:cc:c7	array of MACAddress	Minimum items: 0 Maximum items: 32
bpdu_filter_enable	BPDU filtering status Indicates whether BPDU filter is enabled. BPDU filtering is enabled by default.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_client_block_enabled	Enable DHCP client block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_client_block_v6_enabled	Enable DHCP client block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_server_block_enabled	Enable DHCP server block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "True"
dhcp_server_block_v6_enabled	Enable DHCP server block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "True"
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
non_ip_traffic_block_enabled	Enable non IP traffic block A flag to block all traffic except IP/(G)ARP/BPDU.	boolean	Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
ra_guard_enabled	Enable Router Advertisement Guard Activate or deactivate Router Advertisement Guard.	boolean	Default: "False"
rate_limits	Rate limiting configuration Allows configuration of rate limits for broadcast and multicast traffic. Rate limiting is deactivated by default	TrafficRateLimits
rate_limits_enabled	Enable Rate Limits Activate or deactivate Rate Limits	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/segment-security-profiles/my-segment-security-profile { "resource_type": "SegmentSecurityProfile", "id": "MySegmentSecurityProfile", "display_name": "MySegmentSecurityProfile", "description": "MySegmentSecurityProfile", "bpdu_filter_enable": true, "bpdu_filter_allow":["01:80:c2:00:00:00", "01:80:c2:00:00:01"], "dhcp_server_block_enabled": true, "dhcp_client_block_enabled": true, "non_ip_traffic_block_enabled": true, "dhcp_server_block_v6_enabled": true, "dhcp_client_block_v6_enabled": true, "ra_guard_enabled": true } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfile+

SegmentSecurityProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
bpdu_filter_allow	Deactivate BPDU filtering on this allowlist Pre-defined list of allowed MAC addresses to be excluded from BPDU filtering. List of allowed MACs - 01:80:c2:00:00:00, 01:80:c2:00:00:01, 01:80:c2:00:00:02, 01:80:c2:00:00:03, 01:80:c2:00:00:04, 01:80:c2:00:00:05, 01:80:c2:00:00:06, 01:80:c2:00:00:07, 01:80:c2:00:00:08, 01:80:c2:00:00:09, 01:80:c2:00:00:0a, 01:80:c2:00:00:0b, 01:80:c2:00:00:0c, 01:80:c2:00:00:0d, 01:80:c2:00:00:0e, 01:80:c2:00:00:0f, 00:e0:2b:00:00:00, 00:e0:2b:00:00:04, 00:e0:2b:00:00:06, 01:00:0c:00:00:00, 01:00:0c:cc:cc:cc, 01:00:0c:cc:cc:cd, 01:00:0c:cd:cd:cd, 01:00:0c:cc:cc:c0, 01:00:0c:cc:cc:c1, 01:00:0c:cc:cc:c2, 01:00:0c:cc:cc:c3, 01:00:0c:cc:cc:c4, 01:00:0c:cc:cc:c5, 01:00:0c:cc:cc:c6, 01:00:0c:cc:cc:c7	array of MACAddress	Minimum items: 0 Maximum items: 32
bpdu_filter_enable	BPDU filtering status Indicates whether BPDU filter is enabled. BPDU filtering is enabled by default.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_client_block_enabled	Enable DHCP client block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_client_block_v6_enabled	Enable DHCP client block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_server_block_enabled	Enable DHCP server block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "True"
dhcp_server_block_v6_enabled	Enable DHCP server block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "True"
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
non_ip_traffic_block_enabled	Enable non IP traffic block A flag to block all traffic except IP/(G)ARP/BPDU.	boolean	Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
ra_guard_enabled	Enable Router Advertisement Guard Activate or deactivate Router Advertisement Guard.	boolean	Default: "False"
rate_limits	Rate limiting configuration Allows configuration of rate limits for broadcast and multicast traffic. Rate limiting is deactivated by default	TrafficRateLimits
rate_limits_enabled	Enable Rate Limits Activate or deactivate Rate Limits	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type":"SegmentSecurityProfile", "id":"MySegmentSecurityProfile", "display_name": "MySegmentSecurityProfile", "description": "MySegmentSecurityProfile", "path": "/infra/segment-security-profiles/my-segment-security-profile-id", "relative_path": "MySegmentSecurityProfile", "bpdu_filter_enable": "true", "bpdu_filter_allow":["01:80:c2:00:00:00", "01:80:c2:00:00:01"], "dhcp_server_block_enabled": Boolean, "dhcp_server_block_enabled": Boolean, "non_ip_traffic_block_enabled": Boolean, "dhcp_server_block_v6_enabled": "true" "dhcp_server_block_v6_enabled": "true" "ra_guard_enabled":"true" "_create_user": "admin", "_create_time": 1488995381918, "_last_modified_user": "admin", "_last_modified_time": 1488995381918, "_system_owned": false, "_revision": 0 } Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

DELETE segment security profile

API will delete segment security profile with the given id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/segment-security-profiles/my-segment-security-profile Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

GET Segment security profile id

API will return details of the segment security profile with given id. If the
profile does not exist, it will return 404.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segment-security-profiles/{segment-security-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segment-security-profiles/my-segment-security-profile-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentSecurityProfile+

SegmentSecurityProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
bpdu_filter_allow	Deactivate BPDU filtering on this allowlist Pre-defined list of allowed MAC addresses to be excluded from BPDU filtering. List of allowed MACs - 01:80:c2:00:00:00, 01:80:c2:00:00:01, 01:80:c2:00:00:02, 01:80:c2:00:00:03, 01:80:c2:00:00:04, 01:80:c2:00:00:05, 01:80:c2:00:00:06, 01:80:c2:00:00:07, 01:80:c2:00:00:08, 01:80:c2:00:00:09, 01:80:c2:00:00:0a, 01:80:c2:00:00:0b, 01:80:c2:00:00:0c, 01:80:c2:00:00:0d, 01:80:c2:00:00:0e, 01:80:c2:00:00:0f, 00:e0:2b:00:00:00, 00:e0:2b:00:00:04, 00:e0:2b:00:00:06, 01:00:0c:00:00:00, 01:00:0c:cc:cc:cc, 01:00:0c:cc:cc:cd, 01:00:0c:cd:cd:cd, 01:00:0c:cc:cc:c0, 01:00:0c:cc:cc:c1, 01:00:0c:cc:cc:c2, 01:00:0c:cc:cc:c3, 01:00:0c:cc:cc:c4, 01:00:0c:cc:cc:c5, 01:00:0c:cc:cc:c6, 01:00:0c:cc:cc:c7	array of MACAddress	Minimum items: 0 Maximum items: 32
bpdu_filter_enable	BPDU filtering status Indicates whether BPDU filter is enabled. BPDU filtering is enabled by default.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_client_block_enabled	Enable DHCP client block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_client_block_v6_enabled	Enable DHCP client block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "False"
dhcp_server_block_enabled	Enable DHCP server block Filters DHCP server and/or client traffic. DHCP server blocking is activated and client blocking is deactivated by default.	boolean	Default: "True"
dhcp_server_block_v6_enabled	Enable DHCP server block v6 Filters DHCP server and/or client IPv6 traffic. DHCP server blocking is enabled and client blocking is deactivated by default.	boolean	Default: "True"
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
non_ip_traffic_block_enabled	Enable non IP traffic block A flag to block all traffic except IP/(G)ARP/BPDU.	boolean	Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
ra_guard_enabled	Enable Router Advertisement Guard Activate or deactivate Router Advertisement Guard.	boolean	Default: "False"
rate_limits	Rate limiting configuration Allows configuration of rate limits for broadcast and multicast traffic. Rate limiting is deactivated by default	TrafficRateLimits
rate_limits_enabled	Enable Rate Limits Activate or deactivate Rate Limits	boolean	Default: "False"
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SegmentSecurityProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "bpdu_filter_enable": true, "bpdu_filter_allow": [ "01:80:c2:00:00:00", "01:80:c2:00:00:01" ], "dhcp_server_block_enabled": true, "dhcp_client_block_enabled": true, "non_ip_traffic_block_enabled": true, "dhcp_server_block_v6_enabled": true, "dhcp_client_block_v6_enabled": true, "ra_guard_enabled": true, "rate_limits_enabled": false, "resource_type": "SegmentSecurityProfile", "id": "my-segment-security-profile", "display_name": "MySegmentSecurityProfile", "description": "MySegmentSecurityProfile", "path": "/infra/segment-security-profiles/my-segment-security-profile", "relative_path": "my-segment-security-profile", "parent_path": "/infra/segment-security-profiles/my-segment-security-profile", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544566776526, "_last_modified_user": "admin", "_last_modified_time": 1544566776526, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segment Profiles: Spoofguard Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/spoofguard-profiles
DELETE /global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}
GET /global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}
PATCH /global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}
PUT /global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}

List SpoofGuard profiles

API will list all SpoofGuard profiles.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/spoofguard-profiles

Request Headers:

n/a

Query Parameters:

SpoofGuardProfileListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/spoofguard-profiles/ Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SpoofGuardProfileListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 2, "results": [ { "resource_type": "SpoofGuardProfile", "id": "default-spoofguard-profile", "display_name": "default-spoofguard-profile", "path": "/infra/spoofguard-profiles/default-spoofguard-profile", "parent_path": "/infra/spoofguard-profiles/default-spoofguard-profile", "relative_path": "default-spoofguard-profile", "marked_for_delete": false, "address_binding_allowlist": false, "_create_user": "system", "_create_time": 1539118620552, "_last_modified_user": "system", "_last_modified_time": 1539118620552, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "SpoofGuardProfile", "id": "spoofguardprofile_1", "display_name": "spoofguardprofile_1", "path": "/infra/spoofguard-profiles/spoofguardprofile_1", "parent_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "relative_path": "spoofguardprofile_1", "marked_for_delete": false, "address_binding_allowlist": false, "_create_user": "admin", "_create_time": 1539128784467, "_last_modified_user": "admin", "_last_modified_time": 1539128784467, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete SpoofGuard profile

API will delete SpoofGuard profile with the given id.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/spoofguard-profiles/spoofguardprofile_1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get SpoofGuard profile

API will return details of the SpoofGuard profile with given id. If the
profile does not exist, it will return 404.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/spoofguard-profiles/spoofguardprofile_1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SpoofGuardProfile+

SpoofGuardProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_binding_allowlist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This value cannot conflict with whitelist.	boolean	Required Default: "False"
address_binding_whitelist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This field is deprecated because it has offensive terminology. Please use address_binding_allowlist. This value cannot conflict with allow list.	boolean	Deprecated Required Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SpoofGuardProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SpoofGuardProfile", "id": "spoofguardprofile_1", "display_name": "spoofguardprofile_1", "path": "/infra/spoofguard-profiles/spoofguardprofile_1", "parent_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "relative_path": "spoofguardprofile_1", "marked_for_delete": false, "address_binding_allowlist": false, "_create_user": "admin", "_create_time": 1539128784467, "_last_modified_user": "admin", "_last_modified_time": 1539128784467, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or replace SpoofGuard profile

API will create or replace SpoofGuard profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

SpoofGuardProfile+

SpoofGuardProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_binding_allowlist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This value cannot conflict with whitelist.	boolean	Required Default: "False"
address_binding_whitelist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This field is deprecated because it has offensive terminology. Please use address_binding_allowlist. This value cannot conflict with allow list.	boolean	Deprecated Required Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SpoofGuardProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/spoofguard-profiles/spoofguardprofile_1 { "resource_type": "SpoofGuardProfile", "id": "spoofguardprofile_1", "display_name": "spoofguardprofile_1", "path": "/global-infra/spoofguard-profiles/spoofguardprofile_1", "parent_path": "/global-infra/spoofguard-profiles/spoofguardprofile_1", "relative_path": "spoofguardprofile_1", "address_binding_allowlist": true, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SpoofGuardProfile+

SpoofGuardProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_binding_allowlist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This value cannot conflict with whitelist.	boolean	Required Default: "False"
address_binding_whitelist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This field is deprecated because it has offensive terminology. Please use address_binding_allowlist. This value cannot conflict with allow list.	boolean	Deprecated Required Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SpoofGuardProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SpoofGuardProfile", "id": "spoofguardprofile_1", "display_name": "spoofguardprofile_1", "path": "/infra/spoofguard-profiles/spoofguardprofile_1", "parent_path": "/infra/spoofguard-profiles/spoofguardprofile_1", "relative_path": "spoofguardprofile_1", "marked_for_delete": false, "address_binding_allowlist": true, "_create_user": "admin", "_create_time": 1539128784467, "_last_modified_user": "admin", "_last_modified_time": 1539129032044, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Patch SpoofGuard profile

Create a new SpoofGuard profile if the SpoofGuard profile with the given id
does not exist. Otherwise, patch with the existing SpoofGuard profile.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/spoofguard-profiles/{spoofguard-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

SpoofGuardProfile+

SpoofGuardProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_binding_allowlist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This value cannot conflict with whitelist.	boolean	Required Default: "False"
address_binding_whitelist	Enable SpoofGuard If true, enable the SpoofGuard, which only allows VM sending traffic with the IPs in the allowlist. This field is deprecated because it has offensive terminology. Please use address_binding_allowlist. This value cannot conflict with allow list.	boolean	Deprecated Required Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value SpoofGuardProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/spoofguard-profiles/spoofguardprofile_1 { "display_name": "SpoofGuardProfile", "description": "SpoofGuardProfile", "address_binding_allowlist": true } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segments

Associated URIs:

GET /global-manager/api/v1/global-infra/segments
DELETE /global-manager/api/v1/global-infra/segments/{segment-id}
DELETE /global-manager/api/v1/global-infra/segments/{segment-id}?force=true
GET /global-manager/api/v1/global-infra/segments/{segment-id}
PATCH /global-manager/api/v1/global-infra/segments/{segment-id}
PATCH /global-manager/api/v1/global-infra/segments/{segment-id}?force=true
PUT /global-manager/api/v1/global-infra/segments/{segment-id}?force=true
PUT /global-manager/api/v1/global-infra/segments/{segment-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/effective-profiles

List all segments under infra

Paginated list of all segments under infra.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments

Request Headers:

n/a

Query Parameters:

SegmentListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Segment", "id": "web-tier", "display_name": "web-tier", "path": "/infra/segments/web-tier", "parent_path": "/infra/segments/web-tier", "relative_path": "web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "connectivity_path": "/infra/tier-1s/mgw", "_create_user": "admin", "_create_time": 1516668961954, "_last_modified_user": "admin", "_last_modified_time": 1516668961954, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read infra segment

Read infra segment
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Response: { "resource_type": "Segment", "id": "web-tier", "display_name": "web-tier", "path": "/infra/tier-1s/cgw/segments/web-tier", "parent_path": "/infra/tier-1s/cgw", "relative_path": "web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "connectivity_path": "/infra/tier-1s/mgw", "_create_user": "admin", "_create_time": 1516668961954, "_last_modified_user": "admin", "_last_modified_time": 1516668961954, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a segment

If segment with the segment-id is not already present, create a new segment.
If it already exists, update the segment with specified attributes.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier { "display_name":"web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "connectivity_path": "/global-infra/tier-1s/mgw" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete infra segment

Delete infra segment This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a infra segment

If segment with the segment-id is not already present, create a new segment.
If it already exists, replace the segment with this object.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier { "display_name":"web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "connectivity_path": "/global-infra/tier-1s/mgw", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List all effective profiles for infra segment

List all effective profiles for this segment on given enforcement point. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/effective-profiles

Request Headers:

n/a

Query Parameters:

EnforcementPointRequest+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/tier0-ls/effective-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EffectiveProfilesResponse+

Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a segment

If segment with the segment-id is not already present, create a new segment.
If it already exists, update the segment with specified attributes.

Force parameter is required when workload connectivity is indirectly impacted
with the current update.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}?force=true

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier>?force=true { "display_name":"web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "connectivity_path": "/global-infra/tier-1s/mgw" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a infra segment

If segment with the segment-id is not already present, create a new segment.
If it already exists, replace the segment with this object.

Force parameter is required when workload connectivity is indirectly impacted
with the current replacement.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
This API is available when using VMware Cloud (AWS, Dell-EMC, Outpost, Hyperscalers) or VMware NSX. Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}?force=true

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier?force=true { "display_name":"web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "connectivity_path": "/global-infra/tier-1s/mgw", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Force delete infra segment

Force delete bypasses validations during segment deletion. This may result in an inconsistent connectivity. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}?force=true

Request Headers:

n/a

Query Parameters:

SegmentDeleteRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-tier Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Segments (Fixed)

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}?force=true
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/effective-profiles
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp

Paginated list of all fixed segments (identified as /policy/api/v1/infra/tier-1s//segments/) under Tier-1 instance.

Paginated list of all fixed segments (identified as /policy/api/v1/infra/tier-1s//segments/) under Tier-1 instance.
This API call does not return flexible segments (identified as /policy/api/v1/infra/segments/) connected to the Tier-1.
To return all segments connected as a downlink to a Tier-1 one possibility is to use the search API with: https://{{nsx-mgr}}/policy/api/v1/search?query=resource_type:Segment%20AND%20connectivity_path:“/infra/tier-1s/
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PUT/PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments

Request Headers:

n/a

Query Parameters:

SegmentListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Segment", "id": "web-tier", "display_name": "web-tier", "path": "/infra/tier-1s/cgw/segments/web-tier", "parent_path": "/infra/tier-1s/cgw", "relative_path": "web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "_create_user": "admin", "_create_time": 1516668961954, "_last_modified_user": "admin", "_last_modified_time": 1516668961954, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete segment

Delete segment Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments/web-tier Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a segment

If segment with the segment-id is not already present, create a new segment.
If it already exists, replace the segment with this object.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PUT API payload, the path returned in the PUT/GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments/web-tier { "display_name":"web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Response: { "resource_type": "Segment", "id": "web-tier", "display_name": "web-tier", "path": "/infra/tier-1s/cgw/segments/web-tier", "parent_path": "/infra/tier-1s/cgw", "relative_path": "web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "_create_user": "admin", "_create_time": 1516668961954, "_last_modified_user": "admin", "_last_modified_time": 1516668961954, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a segment

If segment with the segment-id is not already present, create a new segment.
If it already exists, update the segment with specified attributes.
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the Alarm, GPRR, error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments/web-tier { "display_name":"web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read segment

Read segment
Note:
Extended Segment: Please note that old vpn path deprecated. If user specify old l2vpn path in the
"l2_extension" object in the PUT/PATCH API payload, the path returned in the GET response payload may include the new path
instead of the deprecated l2vpn path. Both old and new l2vpn path refer to same resource. there is no functional impact.
Also note that l2vpn path included in the error messages returned from validation may include the new VPN path
instead of the deprecated l2vpn path. Both new path and old vpn path refer to same resource.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments/web-tier Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Segment+

Segment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
address_bindings	Address bindings for the Segment Static address binding used for the Segment. This field is deprecated and will be removed in a future release. Please use address_bindings in SegmentPort to configure static bindings.	array of PortAddressBindingEntry	Deprecated Maximum items: 512
admin_state	Represents Desired state of the Segment Admin state represents desired state of segment. It does not reflect the state of other logical entities connected/attached to the segment.	string	Enum: UP, DOWN Default: "UP"
advanced_config	Advanced configuration for Segment Advanced configuration for Segment.	SegmentAdvancedConfig
bridge_profiles	Bridge Profile Configuration Multiple distinct L2 bridge profiles can be configured.	array of BridgeProfileConfig
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDhcpStaticBindingConfig ChildSegmentDiscoveryProfileBindingMap ChildSegmentPort ChildSegmentQoSProfileBindingMap ChildSegmentSecurityProfileBindingMap ChildStaticARPConfig
connectivity_path	Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0 Policy path to the connecting Tier-0 or Tier-1 or label of type Tier0. Valid only for segments created under Infra. This field can only be used for overlay segments. VLAN backed segments cannot have connectivity path set.	string
description	Description of this resource	string	Maximum length: 1024 Sortable
dhcp_config_path	Policy path to DHCP configuration Policy path to DHCP server or relay configuration to use for all IPv4 & IPv6 subnets configured on this segment.	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
domain_name	DNS domain name	string
evpn_segment	Evpn Segment Flag. Flag to indicate if the Segment is a Child-Segment of type EVPN.	boolean	Readonly
evpn_tenant_config_path	Policy path to the EvpnTenantConfig Policy path to the EvpnTenantConfig resource. Supported only for Route-Server Evpn Mode. Supported only for Overlay Segments. This will be populated for both Parent and Child segments participating in Evpn Route-Server Mode.	string
extra_configs	Extra configs on Segment This property could be used for vendor specific configuration in key value string pairs, the setting in extra_configs will be automatically inheritted by segment ports in the Segment.	array of SegmentExtraConfig
federation_config	Federation releated config Additional config for federation.	FederationConnectivityConfig	Readonly
id	Unique identifier of this resource	string	Sortable
l2_extension	Configuration for extending Segment through L2 VPN	L2Extension
ls_id	Pre-created logical switch id for Segment This property is deprecated. The property will continue to work as expected for existing segments. The segments that are newly created with ls_id will be ignored. Sepcify pre-creted logical switch id for Segment.	string	Deprecated
mac_pool_id	Allocation mac pool associated with the Segment Mac pool id that associated with a Segment.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata_proxy_paths	Metadata Proxy Configuration Paths Policy path to metadata proxy configuration. Multiple distinct MD proxies can be configured.	array of string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overlay_id	Overlay connectivity ID for this Segment Used for overlay connectivity of segments. The overlay_id should be allocated from the pool as definied by enforcement-point. If not provided, it is auto-allocated from the default pool on the enforcement-point.	int	Minimum: 0 Maximum: 2147483647
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
replication_mode	Replication mode of the Segment If this field is not set for overlay segment, then the default of MTEP will be used.	string	Enum: MTEP, SOURCE Default: "MTEP"
resource_type	Must be set to the value Segment	string
subnets	Subnet configuration. Max 1 subnet	array of SegmentSubnet
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to the transport zone. Supported for VLAN backed segments as well as Overlay Segments. - This field is required for VLAN backed Segments. - For overlay Segments, it is auto assigned if only one transport zone exists in the enforcement point. Default transport zone is auto assigned for overlay segments if none specified.	string
type	Segment type Segment type based on configuration.	string	Readonly Enum: ROUTED, EXTENDED, ROUTED_AND_EXTENDED, DISCONNECTED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vlan_ids	VLAN ids for VLAN backed Segment VLAN ids for a VLAN backed Segment. Can be a VLAN id or a range of VLAN ids specified with '-' in between.	array of string

Example Response: { "resource_type": "Segment", "id": "web-tier", "display_name": "web-tier", "path": "/infra/tier-1s/cgw/segments/web-tier", "parent_path": "/infra/tier-1s/cgw", "relative_path": "web-tier", "subnets": [ { "gateway_address": "40.1.1.1/16", "dhcp_ranges": [ "40.1.2.0/24" ] } ], "_create_user": "admin", "_create_time": 1516668961954, "_last_modified_user": "admin", "_last_modified_time": 1516668961954, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

List all effective profiles for segment

List all effective profiles for this segment on given enforcement point. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/effective-profiles

Request Headers:

n/a

Query Parameters:

EnforcementPointRequest+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/tier1-ls/effective-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EffectiveProfilesResponse+

Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete static ARP config

Delete static ARP config Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/production_t1/segments/production-t1-seg/static-arp Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a static ARP config

Create static ARP config with Tier-1 and segment IDs provided if it doesn't exist,
update with provided config if it's already created.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

StaticARPConfig+

StaticARPConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_address	IP Address	IPAddress	Required
mac_address	MAC Address	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value StaticARPConfig	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/production_t1/segments/production-t1-seg/static-arp { "ip_address":"1.1.1.1", "mac_address":"aa:bb:cc:44:55:66" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

StaticARPConfig+

StaticARPConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_address	IP Address	IPAddress	Required
mac_address	MAC Address	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value StaticARPConfig	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "ip_address": "1.1.1.1", "mac_address": "aa:bb:cc:44:55:66", "resource_type": "StaticARPConfig", "id": "static-arp", "display_name": "static-arp", "path": "/infra/tier-1s/production_t1/segments/production-t1-seg/static-arp", "relative_path": "static-arp", "parent_path": "/infra/tier-1s/production_t1", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544640364065, "_last_modified_user": "admin", "_last_modified_time": 1544640364065, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: execute Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a static ARP config

Create static ARP config with Tier-1 and segment IDs provided if it doesn't exist,
update with provided config if it's already created.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

StaticARPConfig+

StaticARPConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_address	IP Address	IPAddress	Required
mac_address	MAC Address	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value StaticARPConfig	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/production_t1/segments/production-t1-seg/static-arp { "ip_address":"1.1.1.1", "mac_address":"aa:bb:cc:44:55:66" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: execute Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read static ARP config

Read static ARP config Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/static-arp

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/production_t1/segments/production-t1-seg/static-arp Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

StaticARPConfig+

StaticARPConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_address	IP Address	IPAddress	Required
mac_address	MAC Address	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value StaticARPConfig	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Force delete segment

Force delete bypasses validations during segment deletion. This may result in an inconsistent connectivity.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}?force=true

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/cgw/segments/web-tier?force=true Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: State

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segments-id}/state
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/state
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/state

Get infra segment state information

Get infra segment state information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segments-id}/state

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/state?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentConfigurationState+

SegmentConfigurationState (schema)

Name	Description	Type	Notes
details	Array of configuration state of various sub systems	array of ConfigurationStateElement	Readonly
failure_code	Error code	integer	Readonly
failure_message	Error message in case of failure	string	Readonly
segment_path	Segment path	string	Readonly
state	Overall state of desired configuration Gives details of state of desired configuration. Additional enums with more details on progress/success/error states are sent for edge node. The success states are NODE_READY and TRANSPORT_NODE_READY, pending states are {VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, REGISTRATION_PENDING} and other values indicate failures. "in_sync" state indicates that the desired configuration has been received by the host to which it applies, but is not yet in effect. When the configuration is actually in effect, the state will change to "success". Please note, failed state is deprecated.	string	Required Readonly Enum: pending, in_progress, success, failed, partial_success, orphaned, unknown, error, in_sync, NOT_AVAILABLE, VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, VM_DEPLOYMENT_FAILED, VM_POWER_ON_IN_PROGRESS, VM_POWER_ON_FAILED, REGISTRATION_PENDING, NODE_NOT_READY, NODE_READY, VM_POWER_OFF_IN_PROGRESS, VM_POWER_OFF_FAILED, VM_UNDEPLOY_IN_PROGRESS, VM_UNDEPLOY_FAILED, VM_UNDEPLOY_SUCCESSFUL, EDGE_CONFIG_ERROR, VM_DEPLOYMENT_RESTARTED, REGISTRATION_FAILED, TRANSPORT_NODE_SYNC_PENDING, TRANSPORT_NODE_CONFIGURATION_MISSING, EDGE_HARDWARE_NOT_SUPPORTED, MULTIPLE_OVERLAY_TZS_NOT_SUPPORTED, TN_OVERLAY_TZ_IN_USE_BY_EDGE_CLUSTER, TZ_ENDPOINTS_NOT_SPECIFIED, NO_PNIC_PREPARED_IN_EDGE, APPLIANCE_INTERNAL_ERROR, VTEP_DHCP_NOT_SUPPORTED, UNSUPPORTED_HOST_SWITCH_PROFILE, UPLINK_HOST_SWITCH_PROFILE_NOT_SPECIFIED, HOSTSWITCH_PROFILE_NOT_FOUND, LLDP_SEND_ENABLED_NOT_SUPPORTED, UNSUPPORTED_NAMED_TEAMING_POLICY, LBSRCID_NOT_SUPPORTED_FOR_EDGE_VM, LACP_NOT_SUPPORTED_FOR_EDGE_VM, STANDBY_UPLINKS_NOT_SUPPORTED_FOR_EDGE_VM, MULTIPLE_ACTIVE_UPLINKS_NOT_SUPPORTED_FOR_EDGE, UNSUPPORTED_LACP_LB_ALGO_FOR_NODE, EDGE_NODE_VERSION_NOT_SUPPORTED, NO_PNIC_SPECIFIED_IN_TN, INVALID_PNIC_DEVICE_NAME, TRANSPORT_NODE_READY, VM_NETWORK_EDIT_PENDING, UNSUPPORTED_DEFAULT_TEAMING_POLICY, MPA_DISCONNECTED, VM_RENAME_PENDING, VM_CONFIG_EDIT_PENDING, VM_NETWORK_EDIT_FAILED, VM_RENAME_FAILED, VM_CONFIG_EDIT_FAILED, VM_CONFIG_DISCREPANCY, VM_NODE_REFRESH_FAILED, VM_PLACEMENT_REFRESH_FAILED, REGISTRATION_TIMEDOUT, REPLACE_FAILED, UPLINK_FROM_TEAMING_POLICY_NOT_MAPPED, LOGICAL_SWITCH_NAMED_TEAMING_HAS_NO_PNIC_BACKING, DELETE_VM_IN_REDEPLOY_FAILED, DEPLOY_VM_IN_REDEPLOY_FAILED, INSUFFICIENT_RESOURCES_IN_EDGE_NODE_FOR_SERVICE, VM_RESOURCE_RESERVATION_FAILED, DUPLICATE_PNICS_IN_TEAMINGS_WITH_MULTIPLE_UPLINKS_AND_FAILOVER_ORDER, DUPLICATE_VLANS_SHARING_SAME_PNICMULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, EDGE_NODE_SETTINGS_MISMATCH_RESOLVE, EDGE_VM_VSPHERE_SETTINGS_MISMATCH_RESOLVE, EDGE_NODE_SETTINGS_AND_VSPHERE_SETTINGS_ARE_CHANGED_RESOLVE, EDGE_VSPHERE_LOCATION_MISMATCH_RESOLVE, COMPUTE_MANAGER_NOT_FOUND, DELETE_IN_PROGRESS, ADVANCED_CONFIG_EDIT_FAILED, UPT_MODE_REALIZATION_POLL_TIMED_OUT, DATAPATH_CONFIGURATION_EDIT_FAILED, MAINTENANCE_MODE_ENABLED, ERROR_IN_ENABLE_MAINTENANCE_MODE, ERROR_IN_DISABLE_MAINTENANCE_MODE, CONFIGURE_UPT_ON_VM_FAILED, VM_VERSION_IS_UPT_INCOMPATIBLE, DELETE_FAILED_FOR_DIFFERENT_MOREF_ID, DELETE_FAILED_ON_VM_NOT_FOUND, DELETE_FAILED_FOR_NON_LCM_EDGE, ADVANCED_CONFIG_EDIT_PENDING, DUPLICATE_VLANS_SHARING_SAME_PNIC, MULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, REDEPLOY_ACTIVITY_FAILED, REDEPLOY_ACTIVITY_IN_PROGRESS, REDEPLOY_ACTIVITY_SCHEDULED, REDEPLOY_ACTIVITY_SUCCESSFUL, REPLACE_ACTIVITY_FAILED, REPLACE_ACTIVITY_IN_PROGRESS, REPLACE_ACTIVITY_SCHEDULED, REPLACE_ACTIVITY_SUCCESSFUL, REPLACED_RPC_CLIENT_OF_TN, RETRYING_REPLACE, UNABLE_TO_DELETE_EDGE_NODE_VM_INTERNAL_ERROR, VM_REDEPLOY_FAILED, VM_RESOURCE_RESERVATION_EDIT_PENDING, REDEPLOYED_VM_REGISTRATION_PENDING

Example Response: { "logical_switch_id": "211fe0fb-ae0c-4e16-9560-4b7647adefd8", "state": "success", "details": [] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment state information

Get tier1 segment state information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/state

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/it_t1/segments/it-t1-seg/state?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentConfigurationState+

SegmentConfigurationState (schema)

Name	Description	Type	Notes
details	Array of configuration state of various sub systems	array of ConfigurationStateElement	Readonly
failure_code	Error code	integer	Readonly
failure_message	Error message in case of failure	string	Readonly
segment_path	Segment path	string	Readonly
state	Overall state of desired configuration Gives details of state of desired configuration. Additional enums with more details on progress/success/error states are sent for edge node. The success states are NODE_READY and TRANSPORT_NODE_READY, pending states are {VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, REGISTRATION_PENDING} and other values indicate failures. "in_sync" state indicates that the desired configuration has been received by the host to which it applies, but is not yet in effect. When the configuration is actually in effect, the state will change to "success". Please note, failed state is deprecated.	string	Required Readonly Enum: pending, in_progress, success, failed, partial_success, orphaned, unknown, error, in_sync, NOT_AVAILABLE, VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, VM_DEPLOYMENT_FAILED, VM_POWER_ON_IN_PROGRESS, VM_POWER_ON_FAILED, REGISTRATION_PENDING, NODE_NOT_READY, NODE_READY, VM_POWER_OFF_IN_PROGRESS, VM_POWER_OFF_FAILED, VM_UNDEPLOY_IN_PROGRESS, VM_UNDEPLOY_FAILED, VM_UNDEPLOY_SUCCESSFUL, EDGE_CONFIG_ERROR, VM_DEPLOYMENT_RESTARTED, REGISTRATION_FAILED, TRANSPORT_NODE_SYNC_PENDING, TRANSPORT_NODE_CONFIGURATION_MISSING, EDGE_HARDWARE_NOT_SUPPORTED, MULTIPLE_OVERLAY_TZS_NOT_SUPPORTED, TN_OVERLAY_TZ_IN_USE_BY_EDGE_CLUSTER, TZ_ENDPOINTS_NOT_SPECIFIED, NO_PNIC_PREPARED_IN_EDGE, APPLIANCE_INTERNAL_ERROR, VTEP_DHCP_NOT_SUPPORTED, UNSUPPORTED_HOST_SWITCH_PROFILE, UPLINK_HOST_SWITCH_PROFILE_NOT_SPECIFIED, HOSTSWITCH_PROFILE_NOT_FOUND, LLDP_SEND_ENABLED_NOT_SUPPORTED, UNSUPPORTED_NAMED_TEAMING_POLICY, LBSRCID_NOT_SUPPORTED_FOR_EDGE_VM, LACP_NOT_SUPPORTED_FOR_EDGE_VM, STANDBY_UPLINKS_NOT_SUPPORTED_FOR_EDGE_VM, MULTIPLE_ACTIVE_UPLINKS_NOT_SUPPORTED_FOR_EDGE, UNSUPPORTED_LACP_LB_ALGO_FOR_NODE, EDGE_NODE_VERSION_NOT_SUPPORTED, NO_PNIC_SPECIFIED_IN_TN, INVALID_PNIC_DEVICE_NAME, TRANSPORT_NODE_READY, VM_NETWORK_EDIT_PENDING, UNSUPPORTED_DEFAULT_TEAMING_POLICY, MPA_DISCONNECTED, VM_RENAME_PENDING, VM_CONFIG_EDIT_PENDING, VM_NETWORK_EDIT_FAILED, VM_RENAME_FAILED, VM_CONFIG_EDIT_FAILED, VM_CONFIG_DISCREPANCY, VM_NODE_REFRESH_FAILED, VM_PLACEMENT_REFRESH_FAILED, REGISTRATION_TIMEDOUT, REPLACE_FAILED, UPLINK_FROM_TEAMING_POLICY_NOT_MAPPED, LOGICAL_SWITCH_NAMED_TEAMING_HAS_NO_PNIC_BACKING, DELETE_VM_IN_REDEPLOY_FAILED, DEPLOY_VM_IN_REDEPLOY_FAILED, INSUFFICIENT_RESOURCES_IN_EDGE_NODE_FOR_SERVICE, VM_RESOURCE_RESERVATION_FAILED, DUPLICATE_PNICS_IN_TEAMINGS_WITH_MULTIPLE_UPLINKS_AND_FAILOVER_ORDER, DUPLICATE_VLANS_SHARING_SAME_PNICMULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, EDGE_NODE_SETTINGS_MISMATCH_RESOLVE, EDGE_VM_VSPHERE_SETTINGS_MISMATCH_RESOLVE, EDGE_NODE_SETTINGS_AND_VSPHERE_SETTINGS_ARE_CHANGED_RESOLVE, EDGE_VSPHERE_LOCATION_MISMATCH_RESOLVE, COMPUTE_MANAGER_NOT_FOUND, DELETE_IN_PROGRESS, ADVANCED_CONFIG_EDIT_FAILED, UPT_MODE_REALIZATION_POLL_TIMED_OUT, DATAPATH_CONFIGURATION_EDIT_FAILED, MAINTENANCE_MODE_ENABLED, ERROR_IN_ENABLE_MAINTENANCE_MODE, ERROR_IN_DISABLE_MAINTENANCE_MODE, CONFIGURE_UPT_ON_VM_FAILED, VM_VERSION_IS_UPT_INCOMPATIBLE, DELETE_FAILED_FOR_DIFFERENT_MOREF_ID, DELETE_FAILED_ON_VM_NOT_FOUND, DELETE_FAILED_FOR_NON_LCM_EDGE, ADVANCED_CONFIG_EDIT_PENDING, DUPLICATE_VLANS_SHARING_SAME_PNIC, MULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, REDEPLOY_ACTIVITY_FAILED, REDEPLOY_ACTIVITY_IN_PROGRESS, REDEPLOY_ACTIVITY_SCHEDULED, REDEPLOY_ACTIVITY_SUCCESSFUL, REPLACE_ACTIVITY_FAILED, REPLACE_ACTIVITY_IN_PROGRESS, REPLACE_ACTIVITY_SCHEDULED, REPLACE_ACTIVITY_SUCCESSFUL, REPLACED_RPC_CLIENT_OF_TN, RETRYING_REPLACE, UNABLE_TO_DELETE_EDGE_NODE_VM_INTERNAL_ERROR, VM_REDEPLOY_FAILED, VM_RESOURCE_RESERVATION_EDIT_PENDING, REDEPLOYED_VM_REGISTRATION_PENDING

Example Response: { "logical_switch_id": "211fe0fb-ae0c-4e16-9560-4b7647adefd8", "state": "success", "details": [] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segments by configuration state

Returns all tier-1 segments with configuration state on the enforcement
point specified in the request
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/state

Request Headers:

n/a

Query Parameters:

SegmentStateRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/TLR1_LR/segments/state?configuration_state=success&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentConfigurationStateListResult+

Example Response: { "results": [ { "segment_path": "/infra/tier-1s/TLR1_LR/segments/TIER1_DOWNLINK_SWITCH", "state": "success", "details": [] } ], "result_count": 1 } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Statistics

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segments-id}/ports/{port-id}/statistics
GET /global-manager/api/v1/global-infra/segments/{segments-id}/statistics
GET /global-manager/api/v1/global-infra/segments/state
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/ports/{port-id}/statistics
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/statistics

Get infra segment port statistics information

Get infra segment port statistics information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segments-id}/ports/{port-id}/statistics

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls-2/ports/ls2-p1/statistics?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortStatistics+

Example Response: { "rx_packets": { "total": 0 }, "rx_bytes": { "total": 0 }, "tx_packets": { "total": 0 }, "tx_bytes": { "total": 0 }, "logical_port_id": "706aecff-7741-4856-bc9b-d96fbcf474b8" } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segment statistics information

Get infra segment statistics information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segments-id}/statistics

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/statistics?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentStatistics+

SegmentStatistics (schema)

Name	Description	Type	Notes
dropped_by_firewall_packets		DfwDropCounters	Readonly
dropped_by_security_packets		PacketsDroppedBySecurity	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
logical_switch_id	The id of the logical Switch	string	Required Readonly
mac_learning		MacLearningCounters	Readonly
nsxt_swsec	Switch Security provides stateless L2 and L3 security by checking, traffic to the logical switch and dropping unauthorized packets sent, from VMs	SwsecCounters	Readonly
nsxt_vdl2	Overlay Layer-2 module responsible for workload connectivity	Vdl2Counters	Readonly
nsxt_vdrb	Virtual Distributed Routing (VDR) routes packets on every ESX	VdrbCounters	Readonly
rx_bytes		DataCounter	Readonly
rx_packets		DataCounter	Readonly
tx_bytes		DataCounter	Readonly
tx_packets		DataCounter	Readonly

Example Response: { "rx_packets": { "dropped": 0, "total": 13 }, "rx_bytes": { "total": 642 }, "tx_packets": { "dropped": 0, "total": 0 }, "tx_bytes": { "total": 0 }, "logical_switch_id": "8ff845d2-06a4-47d5-adb2-dd386053e88d", "last_update_timestamp": 1548964270603 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get infra segments by configuration state

Returns all infra segments with configuration state on the enforcement
point specified in the request
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/state

Request Headers:

n/a

Query Parameters:

SegmentStateRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/state?configuration_state=success&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentConfigurationStateListResult+

Example Response: { "results": [ { "segment_path": "/infra/segments/test-infra-seg", "state": "success", "details": [] }, { "segment_path": "/infra/segments/md-proxy-seg1", "state": "success", "details": [] }, { "segment_path": "/infra/segments/test-t0-dl", "state": "success", "details": [] }, { "segment_path": "/infra/segments/t0-ext-seg", "state": "success", "details": [] }, { "segment_path": "/infra/segments/TIER0_DOWN_LINK_SWITCH", "state": "success", "details": [] } ], "result_count": 5 } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segment port statistics information

Get tier-1 segment port statistics information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/ports/{port-id}/statistics

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1//global-infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:cf3a0716-3ba0-4327-a8e5-b1e76269108f/statistics?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortStatistics+

Example Response: { "rx_packets": { "multicast_broadcast": 6648, "dropped": 793, "total": 8546 }, "rx_bytes": { "multicast_broadcast": 565080, "dropped": 0, "total": 898998 }, "tx_packets": { "multicast_broadcast": 6648, "dropped": 0, "total": 8546 }, "tx_bytes": { "multicast_broadcast": 498600, "dropped": 0, "total": 880098 }, "dropped_by_security_packets": { "spoof_guard_dropped": [ { "packet_type": "IPV4", "counter": 0 }, { "packet_type": "IPV6", "counter": 0 }, { "packet_type": "ARP", "counter": 0 }, { "packet_type": "ND", "counter": 0 }, { "packet_type": "NON_IP", "counter": 0 } ], "bpdu_filter_dropped": 0, "dhcp_server_dropped_ipv4": 0, "dhcp_server_dropped_ipv6": 0, "dhcp_client_dropped_ipv4": 0, "dhcp_client_dropped_ipv6": 0 }, "mac_learning": { "mac_not_learned_packets_allowed": 0, "mac_not_learned_packets_dropped": 0, "macs_learned": 0 }, "logical_port_id": "cf3a0716-3ba0-4327-a8e5-b1e76269108f", "last_update_timestamp": 1548964938985 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment statistics information

Get tier1 segment statistics information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/statistics

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/it_t1/segments/it-t1-seg/statistics?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentStatistics+

SegmentStatistics (schema)

Name	Description	Type	Notes
dropped_by_firewall_packets		DfwDropCounters	Readonly
dropped_by_security_packets		PacketsDroppedBySecurity	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
logical_switch_id	The id of the logical Switch	string	Required Readonly
mac_learning		MacLearningCounters	Readonly
nsxt_swsec	Switch Security provides stateless L2 and L3 security by checking, traffic to the logical switch and dropping unauthorized packets sent, from VMs	SwsecCounters	Readonly
nsxt_vdl2	Overlay Layer-2 module responsible for workload connectivity	Vdl2Counters	Readonly
nsxt_vdrb	Virtual Distributed Routing (VDR) routes packets on every ESX	VdrbCounters	Readonly
rx_bytes		DataCounter	Readonly
rx_packets		DataCounter	Readonly
tx_bytes		DataCounter	Readonly
tx_packets		DataCounter	Readonly

Example Response: { "rx_packets": { "multicast_broadcast": 19914, "dropped": 2358, "total": 28909 }, "rx_bytes": { "multicast_broadcast": 1692690, "dropped": 0, "total": 3692670 }, "tx_packets": { "multicast_broadcast": 19914, "dropped": 0, "total": 28968 }, "tx_bytes": { "multicast_broadcast": 1493550, "dropped": 0, "total": 2853978 }, "dropped_by_security_packets": { "spoof_guard_dropped": [ { "packet_type": "IPV4", "counter": 0 }, { "packet_type": "IPV6", "counter": 0 }, { "packet_type": "ARP", "counter": 0 }, { "packet_type": "ND", "counter": 0 }, { "packet_type": "NON_IP", "counter": 0 } ], "bpdu_filter_dropped": 0, "dhcp_server_dropped_ipv4": 0, "dhcp_server_dropped_ipv6": 0, "dhcp_client_dropped_ipv4": 0, "dhcp_client_dropped_ipv6": 0 }, "mac_learning": { "mac_not_learned_packets_allowed": 0, "mac_not_learned_packets_dropped": 0, "macs_learned": 0 }, "logical_switch_id": "3df039b1-d031-4733-987f-fcf8a4ed3e5b", "last_update_timestamp": 1548964636611 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: Status

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segments-id}/ports/{port-id}/status
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/ports/{port-id}/status

Get infra segment port status information

Get infra segment port status information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segments-id}/ports/{port-id}/status

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls-2/ports/ls2-p1/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortStatus+

Example Response: { "logical_port_id": "04efc498-b872-40fc-83f8-ebf9317a2766", "last_update_timestamp": 1453764613211, "status": "UP" } Required Permissions: read Feature: policy_connectivity Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get segment port status information

Get tier1 segment port status information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segments-id}/ports/{port-id}/status

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1//global-infra/tier-1s/it_t1/segments/it-t1-seg/ports/default:cf3a0716-3ba0-4327-a8e5-b1e76269108f/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentPortStatus+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Segments: TEP Table

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/tep-table
GET /global-manager/api/v1/global-infra/segments/{segment-id}/tep-table?format=csv
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/tep-table?format=csv
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/tep-table

Get infra segment TEP table

Returns TEP table for a segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/tep-table

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER1_DOWNLINK_SWITCH/tep-table?source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyTepListResult+

PolicyTepListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of PolicyTepTableEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
transport_node_id	Transport node identifier	string	Readonly

Example Response: { "last_update_timestamp": 1591745956155, "results": [ { "tep_label": 55298, "tep_ip": "100.100.100.3", "tep_mac_address": "00:50:56:6a:af:ce" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segment TEP table in CSV

Returns TEP table for a segment in CSV
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/tep-table?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/test-infra-seg/tep-table?format=csv&source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

PolicyTepCsvListResult+

Example Response: tep_label,tep_ip,tep_mac_address,segment_id 55298,100.100.100.3,00:50:56:6a:af:ce, Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segment TEP table

Returns TEP table for a segment
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/tep-table

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/TLR1_LR/segments/TIER1_DOWNLINK_SWITCH/tep-table?source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyTepListResult+

PolicyTepListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of PolicyTepTableEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
transport_node_id	Transport node identifier	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-1 segment TEP table in CSV

Returns TEP table for a segment in CSV
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/tep-table?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/tier-1s/pepsi/segments/test-infra-seg/tep-table?format=csv&source=realtime Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

PolicyTepCsvListResult+

Example Response: tep_label,tep_ip,tep_mac_address,segment_id 55298,100.100.100.3,00:50:56:6a:af:ce, Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Tier-0 Gateways

Policy: Networking: Connectivity: Tier-0 Gateways: ARP Proxies

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/arp-proxies
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/arp-proxies?format=csv
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/arp-proxies (Deprecated)

Get Tier-0 Address Resolution Protocol Proxies

Returns ARP proxy table for a tier-0
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/arp-proxies

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/pepsi/arp-proxies Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyArpProxyTableListResult+

Example Response: TODO smanikarnike Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-0 Address Resolution Protocol Proxies in CSV format

Returns ARP proxy table for a tier-0 in CSV format
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/arp-proxies?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/pepsi/arp-proxies?format=csv Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

PolicyArpProxyTableCsvListResult+

Example Response: TODO : smanikarnike Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-0 Address Resolution Protocol Proxies (Deprecated)

Returns ARP proxy table for a tier-0
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/arp-proxies

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/pepsi/locale-services/1-policyconnectivity-1340/arp-proxies Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyArpProxyTableListResult+

Example Response: { "results": [ { "interface_arp_proxy" : [ { "service_id" : "22", "arp_proxy_ip" : "10.22.2.42" }, { "service_id" : "0", "arp_proxy_ip" : "10.22.12.100" } ] } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Tier-0 Gateways: Interface Groups

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups
DELETE /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}
PATCH /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}
PUT /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}

List Tier-0 Interface groups

Paginated list of all Tier-0 Interface groups under locale service.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups

Request Headers:

n/a

Query Parameters:

Tier0InterfaceGroupListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/ls1/interface-groups Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Tier0InterfaceGroupListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Tier0InterfaceGroup", "id": "group1", "display_name": "group1", "path": "/infra/tier-0s/t0/locale-services/ls1/interface-groups/group1", "parent_path": "/infra/tier-0s/t0/locale-services/ls1", "relative_path": "group1", "members": [ { "interface_path": "/infra/tier-0s/t0/locale-services/interfaces/ls1/intf1" }, { "interface_path": "/infra/tier-0s/t0/locale-services/interfaces/ls1/intf2" } ], "source_nat_ip_pool": [ "pool1", "pool2" ], "_create_user": "admin", "_create_time": 1516751318020, "_last_modified_user": "admin", "_last_modified_time": 1516751318020, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Delete Tier-0 Interface group

Delete Tier-0 Interface group Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/ls1/interface-groups/group1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Read Tier-0 Interface group

Read Tier-0 Interface group Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/ls1/interface-groups/group1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Tier0InterfaceGroup+

Tier0InterfaceGroup (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
members	Tier0/Tier1 interface memeber list List of interface reference. Interface must belong to same location.	array of GatewayInterfaceReference
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Tier0InterfaceGroup	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Tier0InterfaceGroup", "id": "group1", "display_name": "group1", "path": "/infra/tier-0s/t0/locale-services/ls1/interface-groups/group1", "parent_path": "/infra/tier-0s/t0/locale-services/ls1", "relative_path": "group1", "members": [ { "interface_path": "/infra/tier-0s/t0/locale-services/interfaces/ls1/intf1" }, { "interface_path": "/infra/tier-0s/t0/locale-services/interfaces/ls1/intf2" } ], "source_nat_ip_pool": [ "pool1", "pool2" ], "_create_user": "admin", "_create_time": 1516751318020, "_last_modified_user": "admin", "_last_modified_time": 1516751318020, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Create or update a Tier-0 Interface group.

If an Interface group with the label-id is not already present, create a new
Interface group. If it already exists, update the Interface group for specified attributes.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Tier0InterfaceGroup+

Tier0InterfaceGroup (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
members	Tier0/Tier1 interface memeber list List of interface reference. Interface must belong to same location.	array of GatewayInterfaceReference
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Tier0InterfaceGroup	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/ls1/interface-groups/group1 { "members": [ { "interface_path": "/global-infra/tier-0s/t0/locale-services/ls1/interfaces/intf1" }, { "interface_path": "/global-infra/tier-0s/t0/locale-services/ls1/interfaces/intf2" } ], "source_nat_ip_pool": [ "pool1", "pool2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Update a Tier-0 Interface group.

Update the Interface group for specified attributes.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interface-groups/{label-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Tier0InterfaceGroup+

Tier0InterfaceGroup (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
members	Tier0/Tier1 interface memeber list List of interface reference. Interface must belong to same location.	array of GatewayInterfaceReference
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Tier0InterfaceGroup	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/ls1/interface-groups/group1 { "members": [ { "interface_path": "/global-infra/tier-0s/t0/locale-services/interfaces/ls1/intf1" }, { "interface_path": "/global-infra/tier-0s/t0/locale-services/interfaces/ls1/intf2" } ], "source_nat_ip_pool": [ "pool1", "pool2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Tier0InterfaceGroup+

Tier0InterfaceGroup (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object gets deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
members	Tier0/Tier1 interface memeber list List of interface reference. Interface must belong to same location.	array of GatewayInterfaceReference
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object. This is used in NSX+.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object. This is used in NSX+.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This is the path of the object on the local managers when queried on the NSX+ service, and path of the object on NSX+ service when queried from the local managers.	string	Readonly
resource_type	Must be set to the value Tier0InterfaceGroup	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Tier-0 Gateways: Interfaces

Policy: Networking: Connectivity: Tier-0 Gateways: Interfaces: ARP Proxies

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-proxy
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-proxy?format=csv

Get Tier-0 Interface Address Resolution Protocol Proxies

Returns ARP proxy table for a tier-0 interface. Interfaces can be of types
- EXTERNAL and SERVICE. Interfaces of type LOOBACK and downlink are not
supported.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-proxy

Request Headers:

n/a

Query Parameters:

PolicyListL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/pepsi/locale-services/1-policyconnectivity-1340/interfaces/my-if/arp-proxy Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyArpProxyTableListResult+

Example Response: { "results": [ { "interface_arp_proxy" : [ { "service_id" : "0", "arp_proxy_ip" : "10.22.12.100" } ] } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get Tier-0 Interface Address Resolution Protocol Proxies in CSV format

Returns ARP proxy table for a tier-0 interface in CSV format. Interfaces can be of types
- EXTERNAL and SERVICE. Interfaces of type LOOBACK and downlink are not
supported.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-proxy?format=csv

Request Headers:

n/a

Query Parameters:

PolicyL2TablesParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/pepsi/locale-services/1-policyconnectivity-1340/interfaces/my-if/arp-proxy?format=csv Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

PolicyArpProxyTableCsvListResult+

Example Response: TODO smanikarnike Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Tier-0 Gateways: Interfaces: ARP Table

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/arp-table
GET /global-manager/api/v1/global-infra/segments/{segment-id}/arp-table?format=csv
GET /global-manager/api/v1/global-infra/segments/{segment-id}/gateway-interface-arp-table (Deprecated)
GET /global-manager/api/v1/global-infra/segments/{segment-id}/gateway-interface-arp-table?format=csv (Deprecated)
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-table
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-table?format=csv
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/tier-1-interface/arp-table?format=csv
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/tier-1-interface/arp-table

Get ARP table from segment interface (downlink)

Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) for the
interface (downlink) attaching segment to tier-0/tier-1 gateway, on a edge
node specified in edge_path parameter.
The edge_path parameter is mandatory.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/arp-table

Request Headers:

n/a

Query Parameters:

ArpTableRequestParameters+

ArpTableRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge node must be member of enforcement point. Edge path is required when interface specified is either service or loopback interface.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point. When not specified, routes from all enforcement-points are returned. This property is required for retrieving routes in CSV format.	string
host_transport_node_path	Policy path of host transport node Policy path of host transport node. In case of API used from Global Manager, use the HostTransportNode path from Local Manager.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-app-seg/arp-table?enforcement_point_path=/global-infra/sites/default/enforcement-points/default&edge_path=/global-infra/sites/default/enforcement-points/default/edge-clusters/57d2c653-4d63-48d8-b188-40b4e45a9bc8/edge-nodes/2ed9af04-21c9-11e9-be65-000c2902dff7 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceArpTable+

InterfaceArpTable (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
edge_path	Policy path of edge node Policy path of edge node.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point.	string
interface_path	The ID of the logical router port	string	Required
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of InterfaceArpEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "sort_ascending": true, "sort_by": "displayName", "result_count": 3, "interface_path": "/infra/realized-state/enforcement-points/default/logical-ports/infra-web-app-seg-dlrp", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "edge_path": "/infra/sites/default/enforcement-points/default/edge-clusters/57d2c653-4d63-48d8-b188-40b4e45a9bc8/edge-nodes/2ed9af04-21c9-11e9-be65-000c2902dff7", example_response: | "results": [ { "mac_address": "00:50:56:8e:b4:21", "ip": "172.16.10.21" }, { "mac_address": "02:50:56:56:44:52", "ip": "172.16.10.1" }, { "mac_address": "00:50:56:8e:91:12", "ip": "172.16.10.11" } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get ARP table from segment interface (downlink) in CSV format

Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format for the
interface (downlink) attaching segment to tier-0/tier-1 gateway, on a edge
node specified in edge_path parameter.
The edge_path parameter is mandatory.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/arp-table?format=csv

Request Headers:

n/a

Query Parameters:

ArpTableRequestParameters+

ArpTableRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge node must be member of enforcement point. Edge path is required when interface specified is either service or loopback interface.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point. When not specified, routes from all enforcement-points are returned. This property is required for retrieving routes in CSV format.	string
host_transport_node_path	Policy path of host transport node Policy path of host transport node. In case of API used from Global Manager, use the HostTransportNode path from Local Manager.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web-app-seg/arp-table?format=csv&enforcement_point_path=/global-infra/sites/default/enforcement-points/default&edge_path=/global-infra/sites/default/enforcement-points/default/edge-clusters/57d2c653-4d63-48d8-b188-40b4e45a9bc8/edge-nodes/2ed9af04-21c9-11e9-be65-000c2902dff7 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

InterfaceArpTableInCsvFormat+

Example Response: mac_address,ip 02:50:56:56:44:52,172.16.20.1 Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get ARP table for downlink router port on tier-0 router (Deprecated)

Get ARP table for downlink router port on tier-0 router. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/gateway-interface-arp-table

Request Headers:

n/a

Query Parameters:

ArpTableRequestParameters+

ArpTableRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge node must be member of enforcement point. Edge path is required when interface specified is either service or loopback interface.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point. When not specified, routes from all enforcement-points are returned. This property is required for retrieving routes in CSV format.	string
host_transport_node_path	Policy path of host transport node Policy path of host transport node. In case of API used from Global Manager, use the HostTransportNode path from Local Manager.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER0_DOWNLINK_SWITCH/gateway-interface-arp-table?edge_path=/global-infra/sites/default/enforcement-points/default/edge-clusters/7f7d37a7-b78e-4378-949d-09190cbfef7d/edge-nodes/a831390e-a7c8-11ea-9102-020063e79023 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceArpTable+

InterfaceArpTable (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
edge_path	Policy path of edge node Policy path of edge node.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point.	string
interface_path	The ID of the logical router port	string	Required
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of InterfaceArpEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "interface_path": "/infra/realized-state/enforcement-points/default/logical-ports/TLR0_LR-TIER0_DOWNLINK_SWITCH-dlrp", "last_update_timestamp": 1591854345080, "results": [ { "mac_address": "00:0c:29:ad:24:e4", "ip": "192.168.100.163" }, { "mac_address": "00:00:00:00:00:00", "ip": "192.168.100.161" }, { "mac_address": "00:00:00:00:00:00", "ip": "192.168.100.160" } ], "result_count": 3, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get ARP table for downlink router port on tier-0 router in CSV (Deprecated)

Get ARP table for downlink router port on tier-0 router in CSV. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/gateway-interface-arp-table?format=csv

Request Headers:

n/a

Query Parameters:

ArpTableRequestParameters+

ArpTableRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge node must be member of enforcement point. Edge path is required when interface specified is either service or loopback interface.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point. When not specified, routes from all enforcement-points are returned. This property is required for retrieving routes in CSV format.	string
host_transport_node_path	Policy path of host transport node Policy path of host transport node. In case of API used from Global Manager, use the HostTransportNode path from Local Manager.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER0_DOWNLINK_SWITCH/gateway-interface-arp-table?format=csv&edge_path=/global-infra/sites/default/enforcement-points/default/edge-clusters/7f7d37a7-b78e-4378-949d-09190cbfef7d/edge-nodes/a831390e-a7c8-11ea-9102-020063e79023 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

InterfaceArpTableInCsvFormat+

Example Response: mac_address,ip 00:0c:29:ad:24:e4,192.168.100.163 00:00:00:00:00:00,192.168.100.161 00:00:00:00:00:00,192.168.100.160 Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get ARP table from tier-0 interface

Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) for the
tier-0 interface, on a edge node if a query parameter
"edge_path=<policy-edge-path>" is given. The edge_path
parameter is mandatory if the interface type is not EXTERNAL.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-table

Request Headers:

n/a

Query Parameters:

ArpTableRequestParameters+

ArpTableRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge node must be member of enforcement point. Edge path is required when interface specified is either service or loopback interface.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point. When not specified, routes from all enforcement-points are returned. This property is required for retrieving routes in CSV format.	string
host_transport_node_path	Policy path of host transport node Policy path of host transport node. In case of API used from Global Manager, use the HostTransportNode path from Local Manager.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/default/interfaces/to_internet/arp-table?enforcement_point_path=/global-infra/sites/default/enforcement-points/default&edge_path=/global-infra/sites/default/enforcement-points/default/edge-clusters/57d2c653-4d63-48d8-b188-40b4e45a9bc8/edge-nodes/2ed9af04-21c9-11e9-be65-000c2902dff7 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceArpTable+

InterfaceArpTable (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
edge_path	Policy path of edge node Policy path of edge node.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point.	string
interface_path	The ID of the logical router port	string	Required
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of InterfaceArpEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "sort_ascending": true, "sort_by": "displayName", "result_count": 3, "interface_path": "/infra/tier-0s/t0/locale-services/default/interfaces/to_internet", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "edge_path": "/infra/sites/default/enforcement-points/default/edge-clusters/57d2c653-4d63-48d8-b188-40b4e45a9bc8/edge-nodes/2ed9af04-21c9-11e9-be65-000c2902dff7", example_response: | "results": [ { "mac_address": "00:50:56:8e:b4:21", "ip": "172.16.10.21" }, { "mac_address": "02:50:56:56:44:52", "ip": "172.16.10.1" }, { "mac_address": "00:50:56:8e:91:12", "ip": "172.16.10.11" } ] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get ARP table from tier-0 interface in CSV format

Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format
for the tier-0 interface, on a edge node if a query parameter
"edge_path=<policy-edge-path>" is given. The edge_path
parameter is mandatory if the interface type is not EXTERNAL.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/arp-table?format=csv

Request Headers:

n/a

Query Parameters:

ArpTableRequestParameters+

ArpTableRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge node must be member of enforcement point. Edge path is required when interface specified is either service or loopback interface.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point. When not specified, routes from all enforcement-points are returned. This property is required for retrieving routes in CSV format.	string
host_transport_node_path	Policy path of host transport node Policy path of host transport node. In case of API used from Global Manager, use the HostTransportNode path from Local Manager.	string
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/t0/locale-services/default/interfaces/to_internet/arp-table?format=csv&enforcement_point_path=/global-infra/sites/default/enforcement-points/default&edge_path=/global-infra/sites/default/enforcement-points/default/edge-clusters/57d2c653-4d63-48d8-b188-40b4e45a9bc8/edge-nodes/2ed9af04-21c9-11e9-be65-000c2902dff7 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

InterfaceArpTableInCsvFormat+

Example Response: mac_address,ip 02:50:56:56:44:52,172.16.20.1 Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get tier-0 router link arp information

Get tier-0 interface arp information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/tier-1-interface/arp-table

Request Headers:

n/a

Query Parameters:

RouterLinkRuntimeRequestParameters+

RouterLinkRuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point. It is mandantory for router link interface statistics and ARP-table APIs.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
tier1_path	Policy path of tier1 Policy path of tier1.	string	Required

Request Body:

n/a

Example Request: GET Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceArpTable+

InterfaceArpTable (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
edge_path	Policy path of edge node Policy path of edge node.	string
enforcement_point_path	Enforcement point path String Path of the enforcement point.	string
interface_path	The ID of the logical router port	string	Required
last_update_timestamp	Timestamp when the data was last updated; unset if data source has never updated the data.	EpochMsTimestamp	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results		array of InterfaceArpEntry
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { } Required Permissions: read Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get ARP table from tier-0 router link interface in CSV format

Returns ARP table (IPv4) or Neighbor Discovery table (IPv6) in CSV format
for the tier-0 router link interface, on a edge node. The edge_path
parameter is mandatory if the interface type is not EXTERNAL.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/tier-1-interface/arp-table?format=csv

Request Headers:

n/a

Query Parameters:

RouterLinkRuntimeRequestParameters+

RouterLinkRuntimeRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point. It is mandantory for router link interface statistics and ARP-table APIs.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending		boolean
sort_by	Field by which records are sorted	string
tier1_path	Policy path of tier1 Policy path of tier1.	string	Required

Request Body:

n/a

Example Request: GET Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/csv

Response Body:

InterfaceArpTableInCsvFormat+

Example Response: { } Required Permissions: read Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Tier-0 Gateways: Interfaces: DAD State

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/gateway-interface-dad-state
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/dad-state
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/dad-state

Get DAD state for downlink router port on tier-0 router

Segment ID is the ID of the segment that is connected to the the tier-0
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/gateway-interface-dad-state

Request Headers:

n/a

Query Parameters:

PolicyRuntimeRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/segments/TIER0_DOWNLINK_SWITCH/gateway-interface-dad-state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceDADState+

Example Response: { "interface_path": "/infra/segments/TIER0_DOWNLINK_SWITCH", "dad_statuses": [] } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get DAD status by interface

Get tier-0 interface DAD state information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/dad-state

Request Headers:

n/a

Query Parameters:

PolicyRuntimeOnEpRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1//global-infra/tier-0s/pepsi/locale-services/default/interfaces/to_internet/dad-state?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceDADState+

Example Response: { "interface_path": "/infra/tier-0s/pepsi/locale-services/default/interfaces/to_internet", "dad_statuses": [ { "ip_address": "2001::1", "status": "ASSIGNED", "edge_paths": [ "/infra/sites/default/enforcement-point/nsx/edge-clusters/95196903-6b8a-4276-a7c4-387263e834fd/edge-nodes/940f1f4b-0317-45d4-84e2-b8c2394e7405" ] } ] } Required Permissions: read Feature: policy_t0 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Get DAD status by interface

Get tier-1 interface DAD state information.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/locale-services/{locale-service-id}/interfaces/{interface-id}/dad-state

Request Headers:

n/a

Query Parameters:

PolicyRuntimeOnEpRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/pepsi/locale-services/default/interfaces/to_internet/dad-state?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

InterfaceDADState+

Example Response: { "interface_path": "/infra/tier-1s/pepsi/locale-services/default/interfaces/to_internet", "dad_statuses": [ { "ip_address": "2001::1", "status": "ASSIGNED", "edge_paths": [ "/infra/sites/default/enforcement-point/nsx/edge-clusters/95196903-6b8a-4276-a7c4-387263e834fd/edge-nodes/940f1f4b-0317-45d4-84e2-b8c2394e7405" ] } ] } Required Permissions: read Feature: policy_t1 Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428
429
500 Internal Server Error
503 Service Unavailable

Policy: Networking: Connectivity: Tier-0 Gateways: Interfaces: Interfaces

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces
DELETE /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}
PATCH /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}
PUT /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces/{interface-id}
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/service-interfaces
DELETE /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/service-interfaces/{interface-id}
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/service-interfaces/{interface-id}
PATCH /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/service-interfaces/{interface-id}
PUT /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/service-interfaces/{interface-id}

List Tier-0 Interfaces

Paginated list of all Tier-0 Interfaces
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-service-id}/interfaces

Request Headers:

n/a

Query Parameters:

Tier0InterfaceListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_prv/locale-services/default/interfaces Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Tier0InterfaceListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Tier0Interface", "id": "to_internet", "display_name": "to_internet", "path": "/infra/tier-0s/vmc_prv/locale-services/default/interfaces/to_internet", "parent_path": "/infra/tier-0s/vmc_prv/locale-services/default", "relative_path": "to_internet", "segment_path": "/infra/segments/sg-uplink", "subnets": [ { "ip_addresses": [ "35.1.1.1" ], "prefix_len": 24 } ], "edge_path": "/infra/sites/default/enforcement-points/nsx/edge-clusters/05e58fcb-8575-4b20-9c49-3f09a0d70572/edge-nodes/0", "type": "EXTERNAL" "_create_user": "admin", "_create_time": 1516751318020, "_last_modified_user": "admin", "_last_modified_time": 1516751318020, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_t0 Additional Errors:

301 Moved

NSX Global Policy API Guide

Table of Contents

Introduction

API Policy: Changes, Deprecations and Removals

API Data Types and Allowed Ranges

Formats

Request Failures

Request Authentication

HTTP Basic Authentication

Session-Based Authentication

Authentication using an X.509 certificate and a Principal Identity

Example Requests and Responses

Optimistic Concurrency Control and the _revision property

Overview

Exceptions for /policy APIs

PATCH and _revision for /policy APIs

API Rate Limiting

Designing API client code to work gracefully with rate limits

OpenAPI Specification of NSX APIs