NSX Global Policy API Guide

NSX 9.1.1

Overview
API Methods
API Types
API Type Schemas
API Errors
Deprecated Types and Methods

Overview

Introduction

This guide is for the NSX Global Manager API endpoint and is only relevant for environments using NSX Federation. For all other use cases please look at the at the NSX Manager API guide.

Like for the local manager of NSX, in case of Federation the global manager provides a programmatic API to automate management activities.

The Global Manager aims to manage centrally the configuration of multiple NSX deployments (also called Local Managers) as part of NSX Federation. In those environments both the Global Manager and the Local Managers API endpoints are available, but objects created and managed (CRUD) from the Global Manager should only be managed at this level.

The Global Manager follows the same data-structure than the NSX Local Manager. The API follows a resource-oriented Representational State Transfer (REST) architecture, using JSON object encoding. Clients interact with the API using RESTful web service calls over the HTTPS protocol.

Each API method is identified by a request method and URI. Method parameters are specified as key-value pairs appended to the URI. Unless otherwise noted, request and response bodies are encoded using JSON, and must conform to the JSON schema associated with each method. The content type of each request and reply is "application/json" unless otherwise specified. Each request that can be made is documented in the API Methods section. The associated request and response body schemas are documented in the API Schemas section.

If you provide URL-encoded UTF-8 characters in the URL of your API request, you must include the header "Content-Type:charset=UTF-8" in your request.

API Data Types and Allowed Ranges

The NSX API uses JSON to represent API request and response payloads, and uses JSONSchema to describe the schema of these payloads. The data types are:

string: a sequence of UTF-8 characters. If a particular string property has a maximum length, it is represented in the documentation with a maxLength property.

integer: a signed 64-bit value. Unless a minimum or maximum value is shown in the documentation, integer values may take on values in the range -9,223,372,036,854,775,808 to 9,223,372,036,854,775,807.

unsigned_integer: an unsigned 64-bit value. Unless a minimum or maximum value is shown in the documentation, integer values may take on values in the range 0 to 9,223,372,036,854,775,807.

int: a signed 32-bit value. Unless a minimum or maximum value is shown in the documentation, int values may take on values in the range -2,147,483,648 to 2,147,483,647.

number: a 64-bit floating point number. Unless a minimum or maximum value is shown in the documentation, number values may take on values in the range 4.9406564584124654 x 10^-324 to 1.7976931348623157 x 10³⁰⁸.

boolean: the values true or false. Do not use quotes when sending boolean values in payloads.

object: a nested JSON object.

array: an array of one of the above types.

Formats

Some API types have a required format, and payloads that do not conform to the required format will be rejected. If a property has a required format, it is listed in the "Notes" section in this API Guide. The following formats are used in NSX:

ipv4: Must be a valid Internet Protocol version 4 address, in dotted-quad notation. For example, "192.168.1.232".

ipv6: Must be a valid Internet Protocol version 6 address, as described in RFC 1924. For example, "2001:0db8:85a3:0000:0000:8a2e:0370:7334". Abbreviations are supported.

ip: Either an ipv4 or ipv6 address.

hostname: An internet hostname, as described in RFC 1123. For example, "example.com"

ipv4-cidr-block: An ipv4 Classless Inter-Domain Routing (CIDR) block, expressed as a base ipv4 address, a slash, and the number of bits in the subnet mask. For example, "10.1.0.1/24".

ipv6-cidr-block: An ipv6 Classless Inter-Domain Routing (CIDR) block, expressed as a base ipv6 address, a slash, and the number of bits in the subnet mask. For example, "2001:db8::/32".

ip-cidr-block: Either an ipv4-cidr-block or an ip-v6-cidr-block.

ipv4-address-range: A range of ipv4 addresses, expressed as a lower-bound ipv4 address, a dash, and an upper-bound ipv4 address. For example, "192.168.1.0-192.168.1.255"

ipv6-address-range: A range of ipv6 addresses, expressed as a lower-bound ipv6 address, a dash, and an upper-bound ipv6 address. For example, "fe80::0202:b3ff:fe1e:8329-fe80::0202:b3ff:fe1e:832a"

address-or-block-or-range: Either an ip address, an ip-cidr-block, an ipv4-address-range, or an ipv6-address-range.

port-or-range: A port number (an integer in the range 0 to 65535) or a range of port numbers, expressed as a lower and upper port number, separated by a dash. Examples: "80" or "997-1023".

hostname-or-ip: Either a hostname or an ip address.

hostname-or-ipv4: Either a hostname or an ipv4 address.

list-of-address-or-block-or-range: A comma-separated list address-or-block-or-range.

mac-address: A Media Access Control (MAC) address. MAC addresses are six hexadecimal numbers, separated by either colons ":" or dashes "-". Case is not significant. Examples: "20:f3:75:5e:47:f0" or "20-F3-75-5E-47-F0".

Request Failures

It is possible for any request to fail. Errors are reported using standard HTTP response codes. It should be assumed the following errors could be returned by any API method: 301 Moved Permanently, 307 Temporary Redirect, 400 Bad Request, 401 Unauthorized, 403 Forbidden, 429 Too Many Requests, 500 Internal Server Error, 503 Service Unavailable. Where other errors may be returned, the type of error is indicated in the API method description. All errors are documented in the API Errors section. API requests may fail due to concurrent updates, where an API request collides with another API request, and NSX cannot reconcile the two operations. In that case, the client must re-fetch the resource, apply the changes, and re-submit the operation.

Request Authentication

Most API calls require authentication. This API supports several different authentication schemes, which are documented in this section. Multiple authentication schemes may not be used concurrently.

HTTP Basic Authentication

To authenticate a request using HTTP Basic authentication, the caller's credentials are passed using the 'Authorization' header. The header content should consist of a base64-encoded string containing the username and password separated by a single colon (":") character, as specified in RFC 1945 section 11.1.

For example, to authenticate a request using the credentials of user admin with password admin, include the following header with the request:

Authorization: Basic YWRtaW46YWRtaW4=

The following cURL command will authenticate to the manager using basic authentication and will issue a GET request for the top-level global-infra object.

curl -k -u USERNAME:PASSWORD https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

where:
USERNAME is the user to authenticate as,
PASSWORD is the password to provide, and
GLOBAL_MANAGER is the IP address or host name of the NSX global manager

For example:

curl -k -u admin:secretPw99 https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

Note: the -k argument instructs cURL to skip verifying the manager's self-signed X.509 certificate. It is more secure to verify that the server's certificate is signed by a Certificate Authority (CA) that you trust. To do that, omit the -k argument and use the --cacert <ca-file> option, where <ca-file> is a PEM-formatted file containing the CA certificate to trust.

For example:

curl --cacert /home/me/certs/rootca.crt  -u admin:secretPw99 https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

Additional cURL examples below use the -k flag, but you can always substitute the --rootca <ca-file> argument for additional security.

In the above examples, USERNAME may be:

A local user name. For example, "admin".
A remote user name, of the form "user@domain", for example, "[email protected]". The domain must match a domain for a configured VIDM identity source or a configured LDAP identity source.

Note: in earlier versions of NSX, in order to authenticate to VIDM, it was required that you provide an authentication header of the form "Authorization: Remote base64-encoded-username-and-password". This is no longer required, but still functions for backward compatibility.

Session-Based Authentication

Session-based authentication is used by calling the /api/session/create authentication API to manage a session cookie. The session cookie returned in the result of a successful login must be provided in subsequent requests in order to associate those requests with the session.

Session state is local to the server responding to the API request. Idle sessions will automatically time-out, or can be terminated immediately using the POST /api/session/destroy API.

To obtain a session cookie, POST form data to the server using the application/x-ww-form-urlencoded media type, with fields "j_username" and "j_password" containing the username and password separated by an ampersand. Since an ampersand is a UNIX shell metacharacter, you may need to surround the argument with single quotes.

If the user is a remote user, append "@domain" to the username, for example, "[email protected]". The domain must match a domain for a configured VIDM identity source or a configured LDAP identity source.

The following cURL command will authenticate to the server, will deposit the session cookie in the file "cookies.txt", and will write all HTTP response headers to the file headers.txt. One of these headers is the X-XSRF-TOKEN header that you will need to provide in subsequent requests.

curl -k -c cookies.txt -D headers.txt -X POST     -d 'j_username=USERNAME&j_password=PASSWORD'     https://GLOBAL_MANAGER/api/session/create

For example:

curl -k -c cookies.txt -D headers.txt -X POST     -d 'j_username=admin&j_password=secretPw99'     https://GLOBAL_MANAGER/api/session/create

The manager will respond with the roles and permissions granted to the user, and cURL will deposit the session cookie into the file "cookies.txt".

In subsequent cURL requests, use the -b argument to specify the cookie file. You also need to pass the X-XSRF-TOKEN header that was saved to the headers.txt file, using cURL's -H option:

curl -k -b cookies.txt -H "`grep -i X-XSRF-TOKEN headers.txt | tr -d '\r\n'`"     https://GLOBAL_MANAGER/global-manager/api/v1/global-infra

When the session expires, the manager will respond with a 403 Forbidden HTTP response, at which point you must obtain a new session cookie and X-XSRF-TOKEN.

Session cookies can be destroyed by using the /api/session/destroy API:

curl -k -b cookies.txt -H "`grep -i X-XSRF-TOKEN headers.txt | tr -d '\r\n'`"     -X POST https://GLOBAL_MANAGER/api/session/destroy

Authentication using an X.509 certificate and a Principal Identity

NSX supports using an X.509 client certificate for authentication. The certificate is associated with a principal identity (a short name, similar to a username), and that principal identity can be bound to an NSX role. This is useful for automated processes or scripts that perform NSX API calls, and has the advantage that a user password does not need to be stored with the script.

For information on how to import a certificate and set up a principal identity, see the section "Add a Role Assignment or Principal Identity" in the NSX Administration Guide.

To use the client certificate to authenticate, your client must have access to the certificate and its associated private key. How to specify client authentication depends on the client you are using. For example, with curl, you use the --key argument to give the filename containing the private key and the --cert argument to give the filename containg the public certificate.

API Pagination

When responding to operations that return a ListResult type, NSX may limit the number of results returned. By default, the limit is 1000 results, but some APIs with large result payloads may return fewer results, even if a large number of results is requested by the client. Clients must be prepared to handle paginated results.

NSX indicates that it has returned fewer than the total number of results by including a "cursor" property in the response to the list operation. For example:

curl -k -u admin:SecretPw99 -H accept: application/json https://GLOBAL_MANAGER/global-manager/api/v1/infra/services

{
  "results" : [
    .... 1000 results omitted for clarity
  ],
  "result_count" : 1322,
  "sort_by" : "display_name",
  "sort_ascending" : true,
  "cursor" : "28de76e5-c7c2-4fa0-9a3e-0be891818d35"
}

The response indicates that there are a total of 1,322 results, but not all results are present in this response.

To get the next page of results, repeat the same list operation, but pass the returned cursor value. For example:

curl -k -u admin:SecretPw99 -H accept: application/json
    https://GLOBAL_MANAGER/global-manager/api/v1/infra/services?cursor=28de76e5-c7c2-4fa0-9a3e-0be891818d35

The response will return the next page of results. If there are more pages of results, the response will include a new cursor which can be used to get the next page of results. If this is the last page, then no cursor will be returned, as show below.

{
  "results" : [
    .... 322 results omitted for clarity
  ],
  "sort_by" : "display_name",
  "sort_ascending" : true,
}

The format of the "cursor" property is not meaningful to the client, and the client should not attempt to interpret the cursor's value. The format of the cursor may be different, depending on which API is called.

Example Requests and Responses

Example requests and responses are provided for most of the API calls below. Your actual response might differ from the example in the number of fields returned because optional empty fields are not returned when you make an API call.

Collection List Pagination

A call to the NSX API may return many thousands of results when the system is operating at scale. In such scenarios, the system performs pagination of response objects. All queries to the API must be capable of handling ListResults objects that contain partial results. Pagination in API works as follows:

The API will respond with a ListResult object that has at most page_size results. Note, that the client must always be ready to handle a paginated result, even if the client did not specify page_size.

The default page size is 1000. In case the result size exceeds the page size, the first page will be returned. You need to retrieve the remaining with cursor.

When doing an API call against the NSX-T API, there are a variety of objects which have limits on the number of returned items allowed. The limits themselves are different depending on the objects.

The way you can tell if pagination is being activated is by looking for an attribute called 'cursor'. For example, here is the end of a call for all firewall rule sections:

curl -k -s -X GET -u 'admin:*****' https://manager_ip/api/v1/firewall/sections

End of the results:

"section_type": "LAYER3",
"stateful": true,
"rule_count": 2,
"is_default": false,
"_create_user": "admin",
"_create_time": 1574438858340,
"_last_modified_user": ""****************",
"_last_modified_time": 1671726034024,
"_system_owned": false,
"_protection": "NOT_PROTECTED",
"_revision": 96
}
],
"result_count": 1448,
"sort_by": "position",
"cursor": "0036588a382d-c679-480a-ab95-67aa0022ae04RmlyZXdhbGxTZWN0aW9u"
}

So, looking at our result attributes we can see the overall result count is 1448 and we can tell pagination was activated, because we have a 'cursor' attribute. If you have a 'cursor' attribute returned in your overall results, pagination is activating and truncating those results. You need to retrieve the remaining with cursor.

You pass the cursor attribute in standard URL options with the value specified to the exact same call until you no longer have a cursor attribute returned, for example:

curl -k -s -X GET -u 'admin:*****' https://manager_ip/api/v1/firewall/sections?cursor=0036588a382d-c679-480a-ab95-67aa0022ae04RmlyZXdhbGxTZWN0aW9u

which will return the 2nd page of results.

Optimistic Concurrency Control and the _revision property

Overview

In order to prevent one client from overwriting another client's updates, NSX employs a technique called optimistic concurrency control.

All REST payloads contain a property named "_revision". This is an integer that is incremented each time an existing resource is updated. Clients must provide this property in PUT requests and it must match the current _revision or the update will be rejected. This guards against the following situation:

Client 1 reads resource A.

Client 2 reads resource A.

Client 1 replaces the display_name property of resource A and does a PUT to replace the resource.

Client 2 replaces is different property of resource A and attempts to perform a PUT operation.

Without optimistic concurrency control, Client 2's update would overwrite Client 1's update to the display_name property. Instead, Client 2 receives a 409 Conflict error. To recover, Client 2 must fetch the resource again, apply the change, and perform a PUT.

Exceptions for /policy APIs

APIs whose URI begins with /policy have slightly different behavior. For those APIs, the _revision property must not be set when PUT is used to create a new resource. Once the resource is created, however, the _revision property must be provided with PUT operations.

PATCH and _revision for /policy APIs

APIs whose URI begins with /policy support the PATCH operation. Those APIs do not require that the _revision property be provided. A client can, however, request that the _revision property be checked when it is performing a PATCH in the /infra path. To do this, the client should pass the query parameter enforce_revision_check, e.g. PATCH /infra?enforce_revision_check=true.

Partial PATCH

Partial patching of objects is a feature supported by NSX that allows patching a subset of properties of any object. This behavior needs to be explicitly activated. When partial patching is disabled (default behavior), the entire payload of object is expected to be provided in both PUT and PATCH operations for the /policy APIs.

In order to perform partial patching of existing objects using PATCH operation, partial patching should be activated using either one of the following approach:

System-wide partial patch configuration
Partial patch can be activated/deactivated in the system by using the Partial Patch Config api (i.e. PATCH /policy/api/v1/system-config/nsx-partial-patch-config) with sample request payload.

{ "enable_partial_patch": "true" }
Default is 'false'.
Note: If the API request header has 'nsx-enable-partial-patch' parameter, then the header takes precedence over this system-wide configuration.
Header parameter (request level configuration)
Partial patch can also be activated/deactivated using API request header parameter. This will override the system-wide configuration for a particular request.
To activate partial patch, use 'nsx-enable-partial-patch=true'
To deactivate partial patch, use 'nsx-enable-partial-patch=false'
If this parameter is not passed in header, the system level configuration will be considered for Partial Patch operation. This header parameter will be considered only for PATCH requests. For other requests (e.g. PUT, POST etc.), this header parameter will be ignored.

Some important considerations/notes on Partial Patch:

Array properties will be replaced entirely in partial patch.
If PATCH api is executed on a non-existing object, a new object will be created after performing all applicable validations.
There are cases where properties of an object are inter-dependent on each other e.g. username and password, IP address and thumbprint etc. In such cases, the partial patch request expects all such inter-dependent fields to be provided (either all or none).
Partial patch is not supported for 'Infra' object.
Certain types like Labels, Security Policies (for the 'rules' attribute) and Services have special handling for certain attributes in PATCH request. This behavior will not be overridden by Partial Patch.
For instance, specifying rules on Security policies as a part of the PATCH invocation merges the specified rules with the existing rules. For full replacement of rules, PUT operation needs to be performed on the Security Policy.
Partial patch will not work for properties accepting polymorphic types if the specified value has a type that is different from that of the existing value.

PUT Operations

NSX conforms to REST and HTTP standards regarding the operation of PUT operations. A PUT is always a full replace of a resource, and if any properties are omitted from the payload, those properties will be reset to default values. It is suggested that API clients retrieve the existing resource, apply any desired changes to the copy of the resource, and PUT the entire modified resource.

API Rate Limiting

The NSX API service has three settings that control the rate of incoming API requests:

1) A per-client rate limit, in requests per second. If a client makes more requests than this limit in one second, the API server will refuse to service the API request and will return an HTTP 429 Too Many Requests Error. By default, this limit is 100 requests per second.

2) A per-client concurrency limit. This is the maximum number of outstanding requests that a client can have. For example, a client can open multiple connections to NSX and submit operations on each connection. When this limit is exceeded, the server returns a 503 Server Unavailable error to the client. By default, this limit is 40 concurrent requests.

3) An overall maximum number of concurrent requests. This is the maximum number of API requests that can be in process on the server. If the server is at this limit, additional requests will be refused and the HTTP error 503 Service Unavailable will be returned to the client. By default, this limit is 199 concurrent requests.

The first two limits exist to provide some level of fairness across multiple clients of NSX, and are intended to prevent one greedy client from preventing other clients from making API requests.

The last limit is the server's way of protecting itself against an unintentional (or intentional) denial of service attack.

Each manager enforces the rate limit independently of the other managers. For example, in a 3-node cluster, each manager has a maximum concurrency of 199 requests, but across the cluster there may be a maximum of 199 * 3 = 597 concurrent requests.

While it is possible to configure these rate limits using the /api/v1/node/services/http API, it is not recommended. Instead, you should design your API client to gracefully deal with situations where limits are exceeded.

Designing API client code to work gracefully with rate limits

One approach is to build in throttling into the client code so that it never sends more than 100 requests in a given second and that it never has more than 40 concurrent requests in flight.

However, there isn't any way to ensure that the overall concurrency limits are never hit. That is because there may be other clients calling APIs, driving up the load on the server. API clients need to check for the HTTP error 503 Service Unavailable. In the event a 503 error is received, the simplest strategy is to insert a delay, possibly with an exponential backoff in the event that server load is high.

There are open-source libraries than can help you implement this retry/backoff behavior, such as Google's Retry helper in its Python google-api-core library. For an example of using this library with the NSX APIs, see https://github.com/vmware-samples/nsx-t/blob/master/python/basics/rate-limits.py

OpenAPI Specification of NSX APIs

You can download OpenAPI specifications for the NSX Global Policy API at the following URLs:

NSX Global Policy API:

GET https://<global-manager>/global-manager/api/v1/spec/openapi/nsx_global_policy_api.yaml
GET https://<global-manager>/global-manager/api/v1/spec/openapi/nsx_global_policy_api.json

API Methods

Toggle all tables +

Certificates

Certificates: Ca Bundles

Associated URIs:

GET /global-manager/api/v1/global-infra/cabundles
DELETE /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
GET /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
PATCH /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
POST /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
PUT /global-manager/api/v1/global-infra/cabundles/{cabundle-id}
GET /global-manager/api/v1/global-infra/cabundles/{cabundle-id}/pem-file
GET /global-manager/api/v1/global-infra/certificates
DELETE /global-manager/api/v1/global-infra/certificates/{certificate-id}
GET /global-manager/api/v1/global-infra/certificates/{certificate-id}
PATCH /global-manager/api/v1/global-infra/certificates/{certificate-id}
PUT /global-manager/api/v1/global-infra/certificates/{certificate-id}

Returns information about all the CA bundles

Returns information about all the bundles of trusted CA certificates.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cabundles

Request Headers:

n/a

Query Parameters:

ListCertParameter+

ListCertParameter (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
details	whether to expand the pem data and show all its details	boolean	Default: "False"
fmt		CertificateFormatParameter
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
node_id	Node ID of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular node ID.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
type	Type of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular usage. Passing cluster_certificate will return the certificate used for the cluster wide API service.	string	Enum: cluster_api_certificate, api_certificate

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundleListResult+

Example Response: { "result_count": 2, "results": [ { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" }, { "_create_time": 1611941474997, "_create_user": "unknown", "_last_modified_time": 1611941474997, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": true, "display_name": "default_trusted_public_ca_bundle", "earliest_not_after": 1616006013000, "id": "default_trusted_public_ca_bundle", "marked_for_delete": false, "not_after_list": [2289338164000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/default_trusted_public_ca_bundle", "relative_path": "default_trusted_public_ca_bundle", "resource_type": "CaBundle", "unique_id": "293185d4-07e5-4a5e-b7b8-bd3a86fa270e"}], } ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Adds or replaces a CA bundle

Adds or replaces a new bundle of trusted CA certificates.
The bundle must be a concatenation of one or more
PEM-encoded certificates.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id { "pem_encoded": "-----BEGIN CERTIFICATE-----\n[...]\n-----END CERTIFICATE-----", } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Adds or updates a CA bundle

Adds or updates a new bundle of trusted CA certificates.
The bundle must be a concatenation of one or more
PEM-encoded certificates. The PEM-encoded bundle is replaced
with the one provided in the request.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id { "pem_encoded": "-----BEGIN CERTIFICATE-----\n[...]\n-----END CERTIFICATE-----", } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 1, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Adds or replaces a CA bundle

Adds or replaces a new bundle of trusted CA certificates.
The multipart-uploaded file must be a concatenation of one or more
PEM-encoded certificates.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

UploadFileRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Content-Type: multipart/form-data; boundary=243332e4709e58a3bd679ef3c7b1259a --243332e4709e58a3bd679ef3c7b1259a Content-Disposition: form-data; name="file"; filename="example-cabundle.pem" -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- [...] --243332e4709e58a3bd679ef3c7b1259a-- Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Deletes CA bundle

Deletes the specified bundle of trusted CA certificates.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Returns information about a CA bundle

Returns information about the specified bundle of trusted CA
certificates.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CaBundle+

CaBundle (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
certificates	X509Certificates in the bundle	array of X509Certificate	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
earliest_not_after	The earliest time in epoch milliseconds at which a certificate becomes invalid.	EpochMsTimestamp	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
not_after_list	Times for each certificate in the bundle at which the certificate becomes invalid.	array of EpochMsTimestamp	Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM-encoded CA bundle certificates.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value CaBundle	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "_create_time": 0, "_create_user": "unknown", "_last_modified_time": 0, "_last_modified_user": "unknown", "_protection": "NOT_PROTECTED", "_revision": 0, "_system_owned": false, "certificates": [ { "is_ca": true, "is_valid": true, "issuer": "CN=test.local,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU", "issuer_cn": "test.local", "not_after": 1688688782000, "not_before": 1602202382000, "public_key_algo": "RSA", "public_key_length": 2048, "rsa_public_key_exponent": "10001", "rsa_public_key_modulus": "00 cf ...", "serial_number": "abffbac5ca0a1934357be127156f6615cc14400", "signature": "1e 81 ...", "signature_algorithm": "SHA256WITHRSA", "subject": "CN=test.local,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU", "subject_cn": "test.local", "version": "3", }, ... ], "display_name": "example-cabundle-id", "earliest_not_after": 1688688782000, "id": "example-cabundle-id", "marked_for_delete": false, "not_after_list": [1688688782000, ...], "overridden": false, "parent_path": "/infra", "path": "/infra/cabundles/example-cabundle-id", "relative_path": "example-cabundle-id", "resource_type": "CaBundle", "unique_id": "b829537a-fcdb-4349-b5e1-53fb40f69a8c" } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Downloads a CA bundle

Downloads the specified PEM-encoded bundle of trusted CA certificates.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cabundles/{cabundle-id}/pem-file

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cabundles/example-cabundle-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/plain;charset=UTF-8

Response Body:

string

Example Response: -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- [...] Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Return All the User-Facing Components' Certificates

Returns all certificate information viewable by the user, including each
certificate's id; pem_encoded data; and history of the
certificate (who created or modified it and when). For additional
information, include the ?details=true modifier at the end of the request
URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/certificates

Request Headers:

n/a

Query Parameters:

ListCertParameter+

ListCertParameter (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
details	whether to expand the pem data and show all its details	boolean	Default: "False"
fmt		CertificateFormatParameter
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
node_id	Node ID of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular node ID.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
type	Type of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular usage. Passing cluster_certificate will return the certificate used for the cluster wide API service.	string	Enum: cluster_api_certificate, api_certificate

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/certificates Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCertificateList+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 2, "results": [ { "resource_type": "TlsCertificate", "id": "caCert", "display_name": "caCert", "path": "/infra/certificates/caCert", "parent_path": "/infra", "relative_path": "caCert", "details": [ ... ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": false, "tls_certificate_type": "CERTIFICATE_CA", "_create_user": "admin", "_create_time": 1516329725649, "_last_modified_user": "admin", "_last_modified_time": 1516329725649, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "TlsCertificate", "id": "selfSignedCert", "display_name": "selfSignedCert", "path": "/infra/certificates/selfSignedCert", "parent_path": "/infra", "relative_path": "selfSignedCert", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "realization_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Add a New Certificate

Adds a new private-public certificate and, optionally, a private key that
can be applied to one of the user-facing components (appliance management
or edge). The certificate and the key should be stored in PEM format. If
no private key is provided, the certificate is used as a client
certificate in the trust store.
A private key can be uploaded for a CA certificate only if the "purpose"
parameter is set to "signing-ca".
A certificate chain will not be expanded
into separate certificate instances for reference, but would be pushed to
the enforcement point as a single certificate. This PUT method does
not modify an existing certificate.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsTrustData+

TlsTrustData (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key_algo	Key algorithm contained in this certificate.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
passphrase	Password for private key encryption.	secure_string
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
private_key	private key data	secure_string
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsTrustData	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/certificates/selfSignedCert { "_revision":"0", "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "private_key": "-----BEGIN RSA PRIVATE KEY----------END RSA PRIVATE KEY-----\n", "passphrase": "1234" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
category	Category Category of certificate. This certificate is used to connect to services only.	string	Readonly Enum: SERVICE_CERTIFICATE
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "selfSignedCert", "display_name": "selfSignedCert", "path": "/infra/certificates/selfSignedCert", "parent_path": "/infra", "relative_path": "selfSignedCert", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "realization_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Add a New Certificate

Adds a new private-public certificate and, optionally, a private key that
can be applied to one of the user-facing components (appliance management
or edge). The certificate and the key should be stored in PEM format. If
no private key is provided, the certificate is used as a client
certificate in the trust store.
A private key can be uploaded for a CA certificate only if the "purpose"
parameter is set to "signing-ca".
A certificate chain will not be expanded
into separate certificate instances for reference, but would be pushed to
the enforcement point as a single certificate. This patch method does
not modify an existing certificate.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsTrustData+

TlsTrustData (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key_algo	Key algorithm contained in this certificate.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
passphrase	Password for private key encryption.	secure_string
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
private_key	private key data	secure_string
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsTrustData	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/certificates/certificate-1 { "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "private_key": "-----BEGIN RSA PRIVATE KEY----------END RSA PRIVATE KEY-----\n", "passphrase": "1234" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Show Certificate Data for the Given Certificate ID

Returns information for the specified certificate ID, including the
certificate's id; pem_encoded data; and history of the
certificate (who created or modified it and when). For additional
information, include the ?details=true modifier at the end of the request
URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

GetCertParameter+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/certificates/selfSignedCertificate Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
category	Category Category of certificate. This certificate is used to connect to services only.	string	Readonly Enum: SERVICE_CERTIFICATE
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "selfSignedCert", "display_name": "selfSignedCert", "path": "/infra/certificates/selfSignedCert", "parent_path": "/infra", "relative_path": "selfSignedCert", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "realization_id": "e523b4c0-c3c5-4656-80a1-36dd0fab38cb", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Certificate for the Given Certificate ID

Removes the specified certificate. The private key associated with the
certificate is also deleted.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/certificates/{certificate-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/certificates/signedDigitalCert Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Certificates: Crls

Associated URIs:

GET /global-manager/api/v1/global-infra/crls
DELETE /global-manager/api/v1/global-infra/crls/{crl-id}
GET /global-manager/api/v1/global-infra/crls/{crl-id}
PATCH /global-manager/api/v1/global-infra/crls/{crl-id}
POST /global-manager/api/v1/global-infra/crls/{crl-id}?action=import
POST /global-manager/api/v1/global-infra/crls/{crl-id}?action=upload
PUT /global-manager/api/v1/global-infra/crls/{crl-id}

Return All Added CRLs

Returns information about all CRLs. For additional information, include the
?details=true modifier at the end of the request URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/crls

Request Headers:

n/a

Query Parameters:

ListCertParameter+

ListCertParameter (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
details	whether to expand the pem data and show all its details	boolean	Default: "False"
fmt		CertificateFormatParameter
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
node_id	Node ID of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular node ID.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
type	Type of certificate to return Provide this parameter to limit the list of returned certificates to those matching a particular usage. Passing cluster_certificate will return the certificate used for the cluster wide API service.	string	Enum: cluster_api_certificate, api_certificate

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/crls?details=true Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrlListResult+

Example Response: { "result_count": 1, "results": [ { "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "details": { "next_update": "945220365000", "issuer": "1.2.840.113549.1.9.1=#161d726f6f744069676c6f6f2e6974732e756e696d656c622e6564752e6175,CN=igloo Certificate Authority,OU=Certificates Administration,O=igloo CA,L=Melbourne,ST=Victoria,C=AU", "version": "1" }, "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1, "_last_modified_user": "admin", "_last_modified_time": 1413387436438, "_create_time": 1413386249116, "_create_user": "admin" }, { "crl_type": "OneCRL", "one_crl": "{\"data\":[ <...> ]}", "details_revoked_by_issuer_and_serial_number": [ <...> ], "details_revoked_by_subject_and_public_key_hash": [ <...> ], "resource_type": "TlsCrl", "id": "default_public_crl", "display_name": "default_public_crl", "path": "/infra/crls/default_public_crl", "relative_path": "default_public_crl", "parent_path": "/infra", "unique_id": "91503436-5215-4d13-93e0-094c7473e30d", "realization_id": "91503436-5215-4d13-93e0-094c7473e30d", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_user": "system", "_create_time": 1630097138768, "_last_modified_user": "admin", "_last_modified_time": 1630107914252, "_protection": "NOT_PROTECTED", "_revision": 1 }, ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or patch a Certificate Revocation List

Create or patch a Certificate Revocation List for the given id. The CRL is used to
verify the client certificate status against the revocation lists published by the CA.
For this reason, the administrator needs to add the CRL in certificate repository as well.
The CRL must contain PEM data for a single CRL.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCertsb { "display_name": "Revoked Certificates", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "crl_type": "X509" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 Ok Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or fully replace a Certificate Revocation List

Create or replace a Certificate Revocation List for the given id. The CRL is used to
verify the client certificate status against the revocation lists published by the CA.
For this reason, the administrator needs to add the CRL in certificate repository as well.
The CRL must contain PEM data for a single CRL. Revision is required.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCerts { "display_name": "Revoked Certificates", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "_revision": 1, "crl_type": "X509" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "details": { "next_update": "945220365000", "issuer": "1.2.840.113549.1.9.1=#161d726f6f744069676c6f6f2e6974732e756e696d656c622e6564752e6175,CN=igloo Certificate Authority,OU=Certificates Administration,O=igloo CA,L=Melbourne,ST=Victoria,C=AU", "version": "1" }, "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1, "_last_modified_time": 1413386249116, "_create_time": 1413386249116, "_create_user": "admin", "_last_modified_user": "admin" } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete a CRL

Deletes an existing CRL. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCerts Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Show CRL Data for the Given CRL id.

Returns information about the specified CRL. For additional information,
include the ?details=true modifier at the end of the request URI.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}

Request Headers:

n/a

Query Parameters:

GetCertParameter+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/crls/revokedCerts?details=true Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "details": { "next_update": "945220365000", "issuer": "1.2.840.113549.1.9.1=#161d726f6f744069676c6f6f2e6974732e756e696d656c622e6564752e6175,CN=igloo Certificate Authority,OU=Certificates Administration,O=igloo CA,L=Melbourne,ST=Victoria,C=AU", "version": "1" }, "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1, "_last_modified_user": "admin", "_last_modified_time": 1413387436438, "_create_time": 1413386249116, "_create_user": "admin" } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create a new Certificate Revocation List

Adds a new certificate revocation list (CRLs). The CRL is used to verify the client
certificate status against the revocation lists published by the CA. For this reason,
the administrator needs to add the CRL in certificate repository as well.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
An X.509 CRL can contain a single CRL or multiple CRLs depending on the PEM data.
- Single CRL: a single CRL is created with the given id.
- Composite CRL: multiple CRLs are generated. Each of the CRL is created with an id
generated based on the given id. First CRL is created with crl-id, second with crl-id-1,
third with crl-id-2, etc.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}?action=import

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCrlListResult+

Example Response: { "results": [{ "resource_type": "TlsCrl", "display_name": "revoked certificates", "path": "/infra/crls/revokedCerts", "parent_path": "/infra", "relative_path": "revokedCerts", "pem_encoded": "-----BEGIN X509 CRL----------END X509 CRL-----\n", "crl_type": "X509", "unique_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "realization_id": "511cf9cd-448b-4fa5-9bdf-a24a9dcba853", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0, "_last_modified_user": "admin", "_last_modified_time": 1413387436438, "_create_time": 1413386249116, "_create_user": "admin" }] } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Upload a new or updated Certificate Revocation List

Adds or replaces a certificate revocation list (CRLs). The CRL is used to verify the client
certificate status against the revocation lists published by the CA. For this reason,
the administrator needs to add the CRL in certificate repository as well.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the upload content.
An X.509 CRL can contain a single CRL or multiple CRLs depending on the PEM data.
- Single CRL: a single CRL is created with the given id.
- Composite CRL: multiple CRLs are generated. Each of the CRL is created with an id
generated based on the given id. First CRL is created with crl-id, second with crl-id-1,
third with crl-id-2, etc.
Differently from action=import, this method allows multi-part upload of the CRL(s).
The TlsCrl resource returned in the body of the response will have an empty pem_encoded
field, as it may be large. Use a GET request to retrieve the PEM-encoded CRL.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/crls/{crl-id}?action=upload

Request Headers:

n/a

Query Parameters:

UploadTlsCrlRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/crls/revokedCerts?action=import Content-Type: multipart/form-data; boundary=2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f --2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f Content-Disposition: form-data; name="file"; filename="mycrl.pem" -----BEGIN X509 CRL----- -----END X509 CRL----- Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCrl+

TlsCrl (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
crl_type	Type of CRL The type of the CRL. It can be "OneCRL" or "X509" (default).	string	Enum: OneCRL, X509 Default: "X509"
description	Description of this resource	string	Maximum length: 1024 Sortable
details	Details of the X509Crl object Details of the X509Crl object.	X509Crl	Readonly
details_revoked_by_issuer_and_serial_number	Certificates revoked by issuer and serial number	array of IssuerSerialNumber	Readonly
details_revoked_by_subject_and_public_key_hash	Certificates revoked by subject and public key hash	array of SubjectPublicKeyHash	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
one_crl	JSON-encoded OneCRL-like object	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	Pem encoded crl data Pem encoded crl data.	string
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCrl	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Certificates: Csrs

Associated URIs:

GET /global-manager/api/v1/global-infra/csrs
POST /global-manager/api/v1/global-infra/csrs?action=self_sign
DELETE /global-manager/api/v1/global-infra/csrs/{csr-id}
GET /global-manager/api/v1/global-infra/csrs/{csr-id}
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=create
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=import
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=upload
POST /global-manager/api/v1/global-infra/csrs/{csr-id}?action=self_sign
GET /global-manager/api/v1/global-infra/csrs/{csr-id}/pem-file

Return All the Generated CSRs

Returns information about all of the CSRs that have been created. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/csrs

Request Headers:

n/a

Query Parameters:

ListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/csrs Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCsrListResult+

Example Response: { "result_count": 1, "results": [ { "resource_type": "Csr", "id": "example-csr-id", "display_name": "example-csr-id", "path": "/infra/csrs/example-csr-id", "parent_path": "/infra/csrs/example-csr-id", "relative_path": "example-csr-id", "pem_encoded": "-----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST-----\n", "key_size": 2048, "subject": { "attributes": [ { "value": "Jane", "key": "CN" }, { "value": "VMware", "key": "O" }, { "value": "NSBU", "key": "OU" }, { "value": "US", "key": "C" }, { "value": "CA", "key": "ST" }, { "value": "PA", "key": "L" } ] }, "algorithm": "RSA", "is_ca": false, "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Show CSR Data for the Given CSR ID

Returns information about the specified CSR. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsCsr+

TlsCsr (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA, EC Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
extensions	X509 extensions to add X509 v3 extensions to be added to a CSR.	CsrExtensions	Readonly
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCsr	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Csr", "id": "example-csr-id", "display_name": "example-csr-id", "path": "/infra/csrs/example-csr-id", "parent_path": "/infra/csrs/example-csr-id", "relative_path": "example-csr-id", "pem_encoded": "-----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST-----\n", "key_size": 2048, "subject": { "attributes": [ { "value": "Jane", "key": "CN" }, { "value": "VMware", "key": "O" }, { "value": "NSBU", "key": "OU" }, { "value": "US", "key": "C" }, { "value": "CA", "key": "ST" }, { "value": "PA", "key": "L" } ] }, "algorithm": "RSA", "is_ca": false, "extensions": { "subject_alt_names": { "dns_names": [ "www.vmware.com", "*.vmware.com" ] } }, "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete a CSR

Removes a specified CSR. If a CSR is not used for verification, you can
delete it. Note that the CSR import and upload POST actions automatically
delete the associated CSR.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get CSR PEM File for the Given CSR ID

Downloads the CSR PEM file for a specified CSR. Clients must include an Accept: text/plain request header. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}/pem-file

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id/pem-file Accept: text/plain Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: text/plain;charset=UTF-8

Response Body:

string

Example Response: -----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST----- Required Permissions: read Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Generate a New Certificate Signing Request

Creates a new certificate signing request (CSR). A CSR is encrypted text that
contains information about your organization (organization name, country,
and so on) and your Web server's public key, which is a public certificate
the is generated on the server that can be used to forward this request to a
certificate authority (CA). A private key is also usually created at the
same time as the CSR.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=create

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCsr+

TlsCsr (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA, EC Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
extensions	X509 extensions to add X509 v3 extensions to be added to a CSR.	CsrExtensions	Readonly
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCsr	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=create { "subject": { "attributes": [ {"key":"CN","value":"Jane"}, {"key":"O","value":"VMware"}, {"key":"OU","value":"NSBU"}, {"key":"C","value":"US"}, {"key":"ST","value":"CA"}, {"key":"L","value":"PA"} ] }, "key_size": "2048", "algorithm": "RSA", "is_ca": false } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCsr+

TlsCsr (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA, EC Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
extensions	X509 extensions to add X509 v3 extensions to be added to a CSR.	CsrExtensions	Readonly
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCsr	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCsr", "id": "example-csr-id", "display_name": "example-csr-id", "path": "/infra/csrs/example-csr-id", "parent_path": "/infra/csrs", "relative_path": "example-csr-id", "pem_encoded": "-----BEGIN CERTIFICATE REQUEST----------END CERTIFICATE REQUEST-----\n", "key_size": 2048, "subject": { "attributes": [ { "value": "Jane", "key": "CN" }, { "value": "VMware", "key": "O" }, { "value": "NSBU", "key": "OU" }, { "value": "US", "key": "C" }, { "value": "CA", "key": "ST" }, { "value": "PA", "key": "L" } ] }, "algorithm": "RSA", "is_ca": false, "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Import a Certificate Associated with an Approved CSR

Imports a certificate authority (CA)-signed certificate for a CSR. This
action links the certificate to the private key created by the CSR. The
pem_encoded string in the request body is the signed certificate provided by
your CA in response to the CSR that you provide to them. The import POST
action automatically deletes the associated CSR.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=import

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsTrustData+

TlsTrustData (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key_algo	Key algorithm contained in this certificate.	string
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
passphrase	Password for private key encryption.	secure_string
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
private_key	private key data	secure_string
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsTrustData	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=import { "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n" } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
category	Category Category of certificate. This certificate is used to connect to services only.	string	Readonly Enum: SERVICE_CERTIFICATE
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "display_name": "example-csr-id", "path": "/infra/certificates/669f4e8f-061e-4c73-8cfb-1044181eb365", "parent_path": "/infra", "relative_path": "example-csr-id", "details": [ { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "Jane", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "realization_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "marked_for_delete": false, "overridden": false, "has_private_key": true, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Self-Sign the CSR

Self-signs the previously generated CSR. This action is similar to the
import certificate action, but instead of using a public certificate signed
by a CA, the self_sign POST action uses a certificate that is signed with
NSX's own private key. The maximum validity limit for non-CA certificates
is 825 days, except that values of 3,650 and 36,500 days are allowed.
No limit is set for CA certificates.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=self_sign

Request Headers:

n/a

Query Parameters:

SelfSignedActionParameter+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=self_sign&days_valid=365 Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
category	Category Category of certificate. This certificate is used to connect to services only.	string	Readonly Enum: SERVICE_CERTIFICATE
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "display_name": "example-csr-id", "path": "/infra/certificates/669f4e8f-061e-4c73-8cfb-1044181eb365", "parent_path": "/infra", "relative_path": "669f4e8f-061e-4c73-8cfb-1044181eb365", "details": [ { "issuer_cn": "Jane", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "is_ca": false, "subject_cn": "Jane", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "realization_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Upload the Certificate PEM File Signed by the CA Associated with a CSR

Uploads the certificate authority (CA)-signed certificate. After you send
the certificate request to the CA of your choice, and the CA sends back the
signed certificate, you can use the upload POST action to upload the signed
certificate. The upload action is similar to the import action, but the
upload action allows you to directly upload the PEM-encoded file (signed
certificate) provided by the CA. Like the import POST action, the upload
POST action automatically deletes the associated CSR.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs/{csr-id}?action=upload

Request Headers:

n/a

Query Parameters:

UploadFileRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs/example-csr-id?action=upload Content-Type: multipart/form-data; boundary=2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f --2a8ae6ad-f4ad-4d9a-a92c-6d217011fe0f Content-Disposition: form-data; name="file"; filename="mycert.pem" -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
category	Category Category of certificate. This certificate is used to connect to services only.	string	Readonly Enum: SERVICE_CERTIFICATE
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Generate a new self-signed certificate

Creates a new self-signed certificate. A private key is also created at the
same time. This is convenience call that will generate a CSR and then self-sign it.
The maximum validity limit for non-CA certificates is 825 days, except that values
of 3,650 and 36,500 days are allowed. No limit is set for CA certificates.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/csrs?action=self_sign

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TlsCsrWithDaysValid+

TlsCsrWithDaysValid (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
algorithm	Cryptographic algorithm (asymmetric) used by the public key for data encryption.	string	Enum: RSA, EC Default: "RSA"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
days_valid	Number of days the certificate will be valid, default 825 days	integer	Default: "825"
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
extensions	X509 extensions to add X509 v3 extensions to be added to a CSR.	CsrExtensions	Readonly
id	Unique identifier of this resource	string	Sortable
is_ca	Whether the CSR is for a CA certificate.	boolean	Default: "False"
key_size	Size measured in bits of the public key used in a cryptographic algorithm.	integer	Default: "4096"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	PEM encoded certificate data.	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCsrWithDaysValid	string
subject	The certificate owner's information. (CN, O, OU, C, ST, L)	Principal	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/csrs?action=self_sign { "subject": { "attributes": [ {"key":"CN","value":"Jane"}, {"key":"O","value":"VMware"}, {"key":"OU","value":"NSBU"}, {"key":"C","value":"US"}, {"key":"ST","value":"CA"}, {"key":"L","value":"PA"} ] }, "key_size": "2048", "algorithm": "RSA", "days_valid": 365, } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

TlsCertificate+

TlsCertificate (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
category	Category Category of certificate. This certificate is used to connect to services only.	string	Readonly Enum: SERVICE_CERTIFICATE
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
details	list of X509Certificates.	array of X509Certificate	Readonly
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
has_private_key	whether we have the private key for this certificate.	boolean	Required Readonly Default: "False"
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
pem_encoded	pem encoded certificate data.	string	Required
purpose	Purpose of this certificate. Can be empty or set to "signing-ca".	string	Readonly Enum: signing-ca
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TlsCertificate	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
tls_certificate_type	Classification of the TlsCertificate helps differentiate how a TlsCertificate could be used for various components either as a client trust certificate; CERTIFICATE_CA, or as a server identity certificate; CERTIFICATE_SIGNED,or CERTIFICATE_SELF_SIGNED.	string	Readonly Enum: CERTIFICATE_CA, CERTIFICATE_SIGNED, CERTIFICATE_SELF_SIGNED
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "TlsCertificate", "id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "display_name": "example-csr-id", "path": "/infra/certificates/669f4e8f-061e-4c73-8cfb-1044181eb365", "parent_path": "/infra", "relative_path": "669f4e8f-061e-4c73-8cfb-1044181eb365", "details": [ { "issuer_cn": "Jane", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "CN=Jane,O=VMware,OU=NSBU,ST=CA,C=US,PA=L", "is_ca": false, "subject_cn": "Jane", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" } ], "pem_encoded": "-----BEGIN CERTIFICATE----------END CERTIFICATE-----\n", "has_private_key": true, "tls_certificate_type": "CERTIFICATE_SELF_SIGNED", "unique_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "realization_id": "669f4e8f-061e-4c73-8cfb-1044181eb365", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1516338671237, "_last_modified_user": "admin", "_last_modified_time": 1516338671237, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_certificate Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Enforcement Points

Enforcement Points: Edge Clusters

Associated URIs:

GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points
POST /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}?action=full-sync
DELETE /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
PATCH /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
POST /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}?action=reload
PUT /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}

List enforcementpoints under Site

Paginated list of all enforcementpoints under Site.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points

Request Headers:

n/a

Query Parameters:

EnforcementPointListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPointListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Full sync EnforcementPoint from Site

Full sync EnforcementPoint from Site Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcement-point-id}?action=full-sync

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/external-ep?action=full-sync Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create/update a new Enforcement Point under Site

If the passed Enforcement Point does not already exist, create a new Enforcement Point.
If it already exists, replace it.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep { "connection_info": { "enforcement_point_address":"10.192.201.163", "resource_type":"NSXTConnectionInfo", "username":"admin", "password":"Admin!23Admin", "thumbprint":"f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Response: { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a new Enforcement Point under Site

If the passed Enforcement Point does not already exist, create a new Enforcement Point.
If it already exists, patch it.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep { "connection_info": { "enforcement_point_address":"10.192.201.163", "resource_type":"NSXTConnectionInfo", "username":"admin", "password":"Admin!23Admin", "thumbprint":"f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" } } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read an Enforcement Point under Infra/Site

Read an Enforcement Point under Infra/Site
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Response: { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete EnforcementPoint from Site

Delete EnforcementPoint from Site Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List Edge Clusters under an Enforcement Point

Paginated list of all Edge Clusters under an Enforcement Point
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters

Request Headers:

n/a

Query Parameters:

PolicyEdgeClusterListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep/edge-clusters Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "PolicyEdgeCluster", "id": "ec", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "parent_path": "/infra/sites/default/enforcement-points/nsxt-ep", "relative_path": "ec", "policy_edge_nodes": [ { "id": "my-policy-edge-node-id", "edge_transport_node_path": "/infra/sites/default/enforcement-points/default/edge-transport-nodes/my-policy-edge-tn-id", "member_index": 0 }, { "id": "my-policy-edge-node-id-1", "edge_transport_node_path": "/infra/sites/default/enforcement-points/default/edge-transport-nodes/my-policy-edge-tn-id-1", "member_index": 1 } ] "nsx_id": "8ce97b79-e2da-4d73-bc3b-4723ccab0600", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read an Edge Cluster under an Enforcement Point

Read an Edge Cluster under an Enforcement Point
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeCluster+

PolicyEdgeCluster (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
allocation_rules	Allocation rules for auto placement Set of allocation rules to auto-allocate nodes for Tier0/Tier1 Gateways, and DHCP on edge cluster members.	array of AllocationRule
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeNode
core_allocation_profile	Core allocation profile to be set on cluster members The Core Allocation Profile attribute defines the core allocation for edge transport nodes within a cluster, and any new or redeployed edge will utilize this profile. It can be updated to another supported profile, which subsequently updates the core profile on all edges in the cluster. Note that a manual reboot is required for the new profile to be applied to the edge appliance. To verify the current profile applied to cluster members, use the Edge Cluster State API. https://<nsx-mgr>/policy/api/v1/infra/sites/default/enforcement-points/<enforcementpoint-id>/edge-clusters/cluster/<edge-cluster-id>/state	CoreAllocationProfile
deployment_type	Edge cluster deployment type This field is a readonly field which shows the deployment_type of members. It returns UNKNOWN if there are no members, and returns VIRTUAL_MACHINE\| PHYSICAL_MACHINE if all edge members are VIRTUAL_MACHINE\|PHYSICAL_MACHINE.	EdgeDeploymentType	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_cluster_profile	Path of edge cluster high availability profile. This field is optional and if not provided, default profile path will be considered.	string
id	Unique identifier of this resource	string	Sortable
inter_site_forwarding_enabled	Inter site forwarding is enabled if true Flag indicates that edge cluster has inter-site forwarding enabled and remote tunnel points is configured for all the members. This is required to deploy stretch gateways.	boolean	Readonly
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
member_node_type	Node type of the cluster members This field contains the info of type of transport nodes. Edge cluster is homogenous collection of transport nodes. Hence all transport nodes of the cluster must be of same type.	EdgeClusterNodeType	Readonly
nsx_id	Edge Cluster UUID on NSX-T Enforcement Point This field is deprecated.Refer policy edge cluster unique_id to get the policy edge cluster uuid.	string	Deprecated Readonly
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
password_managed_by_vcf	VCF managed password flag Setting to true enables VCF password management for all edge nodes in the cluster.	boolean	Default: "False"
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_edge_nodes	Policy Edge Cluster Member This field contains the list of edge cluster members. Using this field, multiple members can be add and remove.	array of PolicyEdgeClusterMember
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyEdgeCluster	string
rtep_ips	Remote tunnel endpoint IP addresses. This field is deprecated, Refer the /infra/sites//enforcement-points//edge-transport-nodes//state API for rtep ips.	array of IPAddress	Deprecated Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyEdgeCluster", "id": "ec", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "path": "/infra/sites/default/enforcement-points/nsxt-ep/edge-clusters/ec", "parent_path": "/infra/sites/default/enforcement-points/nsxt-ep", "policy_edge_nodes": [ { "id": "my-policy-edge-node-id", "edge_transport_node_path": "/infra/sites/default/enforcement-points/default/edge-transport-nodes/my-policy-edge-tn-id", "member_index": 0 }, { "id": "my-policy-edge-node-id-1", "edge_transport_node_path": "/infra/sites/default/enforcement-points/default/edge-transport-nodes/my-policy-edge-tn-id-1", "member_index": 1 } ] "relative_path": "ec", "nsx_id": "8ce97b79-e2da-4d73-bc3b-4723ccab0600", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Reload an Enforcement Point under Site

Reload an Enforcement Point under Site. This will read and update
fabric configs from enforcement point.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}?action=reload

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/nsxt-ep?action=reload Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

EnforcementPoint+

EnforcementPoint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
auto_enforce	Auto Enforce Flag Auto enforce flag suggests whether the policy objects shall be automatically enforced on this enforcement point or not. When this flag is set to true, all policy objects will be automatically enforced on this enforcement point. If this flag is set to false, user shall rely on the usual means of realization, i.e., deployment maps.	boolean	Default: "True"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildPolicyEdgeCluster ChildPolicyTransportZone
connection_info	Enforcement Point Connection Info Connection Info of the Enforcement Point.	EnforcementPointConnectionInfo (Abstract type: pass one of the following concrete types) AviConnectionInfo CvxConnectionInfo NSXTConnectionInfo NSXVConnectionInfo	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EnforcementPoint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
version	Enforcement point Version Version of the Enforcement point.	string	Readonly

Example Response: { "resource_type": "EnforcementPoint", "id": "nsxt-ep", "display_name": "/infra/sites/default/enforcement-points/nsxt-ep", "path": "/infra/sites/default/enforcement-points/nsxt-ep", "parent_path": "/infra/sites/default", "relative_path": "nsxt-ep", "connection_info": { "resource_type": "NSXTConnectionInfo", "enforcement_point_address": "10.192.201.163", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262753660, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation

Federation: Edge Transport Node (Remote Tep)

Associated URIs:

GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/neighbors
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/neighbors/{neighbor-id}/advertised-routes
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/neighbors/{neighbor-id}/routes
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/summary
GET /global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/tunnels/statistics

Paginated list of BGP Neighbors on edge transport node

Paginated list of paginated BGP neighbors on the edge transport node.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/neighbors

Request Headers:

n/a

Query Parameters:

ListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/default/enforcement-points/default/edge-clusters/fa0f2e56-a09c-42f6-9417-adcce68416a4/edge-nodes/0/remote-tep-connectivity/bgp/neighbors Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeNodeBgpNeighborsListResult+

Example Response: { "results": [ { "enabled": true, "neighbor_address": "172.20.10.20", "source_address": "172.20.10.10", "source_addresses": [ "172.20.10.10" ], "maximum_hop_limit": 0, "enable_bfd": false, "remote_as": 65000, "remote_as_num": "65000", "hold_down_timer": 15, "keep_alive_timer": 5, "address_families": [ { "type": "IPV6_UNICAST", "enabled": true, "in_filter_routemap_id": "90318bdc-d9a6-426e-98fc-53e3ea1b68a9", "out_filter_routemap_id": "f1490a33-34cc-4a96-a60a-1da4289f5394" } ], "allow_as_in": false, "graceful_restart_mode": "INVALID", "resource_type": "BgpNeighbor", "id": "504684af-8b62-44c9-8333-39884203b386", "_protection": "NOT_PROTECTED", "_create_time": 1734502487340, "_create_user": "system", "_last_modified_time": 1734502487340, "_last_modified_user": "system", "_revision": 0 }, { "enabled": true, "neighbor_address": "172.20.10.21", "source_address": "172.20.10.10", "source_addresses": [ "172.20.10.10" ], "maximum_hop_limit": 0, "enable_bfd": false, "remote_as": 65000, "remote_as_num": "65000", "hold_down_timer": 15, "keep_alive_timer": 5, "address_families": [ { "type": "IPV6_UNICAST", "enabled": true, "in_filter_routemap_id": "90318bdc-d9a6-426e-98fc-53e3ea1b68a9", "out_filter_routemap_id": "f1490a33-34cc-4a96-a60a-1da4289f5394" } ], "allow_as_in": false, "graceful_restart_mode": "INVALID", "resource_type": "BgpNeighbor", "id": "6f6178a5-5766-4765-b0a0-dbd7bcefa4e9", "_protection": "NOT_PROTECTED", "_create_time": 1734502487342, "_create_user": "system", "_last_modified_time": 1734502487342, "_last_modified_user": "system", "_revision": 0 } ], "result_count": 2 } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get BGP neighbor advertised routes on edge transport node.

Returns routes advertised by BGP neighbor from the given edge transport node. It always returns realtime response.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/neighbors/{neighbor-id}/advertised-routes

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1//global-infra/sites/default/enforcement-points/default/edge-clusters/fa0f2e56-a09c-42f6-9417-adcce68416a4/edge-nodes/0/remote-tep-connectivity/bgp/neighbors/504684af-8b62-44c9-8333-39884203b386/advertised-routes Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeNodeBgpNeighborAdvertisedRoutes+

Example Response: { "neighbor_id": "504684af-8b62-44c9-8333-39884203b386", "neighbor_address": "172.20.10.20", "per_transport_node_routes": [ { "source_address": "172.20.10.10", "routes": [ { "network": "fc00::3:fcf9:23:fcf9/128", "next_hop": "::", "local_pref": 100, "weight": 32768, "med": 0, "as_path": "" }, { "network": "fc00::3:98f9:23:98f9/128", "next_hop": "::", "local_pref": 100, "weight": 32768, "med": 0, "as_path": "" }, { "network": "fc00::3:c0f9:23:c0f9/128", "next_hop": "::", "local_pref": 100, "weight": 32768, "med": 0, "as_path": "" } ] } ] } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get BGP neighbor learned routes on edge transport node.

Returns routes learned by BGP neighbor from the given edge transport node. It always returns realtime response.
Request:

Method:

GET

URI Path(s):

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeNodeBgpNeighborRouteDetailList+

Example Response: { "neighbor_id": "504684af-8b62-44c9-8333-39884203b386", "neighbor_address": "172.20.10.20", "per_transport_node_routes": [ { "source_address": "172.20.10.10", "routes": [ { "network": "fc00::3:fcf9:43:fcf9/128", "next_hop": "fe80::1:ac14:a14", "local_pref": 100, "weight": 32768, "med": 0, "as_path": "" }, { "network": "fc00::3:98f9:43:98f9/128", "next_hop": "fe80::1:ac14:a14", "local_pref": 100, "weight": 32768, "med": 0, "as_path": "" }, { "network": "fc00::3:c0f9:43:c0f9/128", "next_hop": "fe80::1:ac14:a14", "local_pref": 100, "weight": 32768, "med": 0, "as_path": "" } ] } ] } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Remote TEP BGP summary of policy edge transport node.

Get Remote TEP BGP summary of policy edge transport node.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/enforcement-points/{enforcementpoint-id}/edge-clusters/{edge-cluster-id}/edge-nodes/{policy-edge-node-id}/remote-tep-connectivity/bgp/summary

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterMemberInterSiteBgpSummary+

Example Response: { "policy_edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/fa0f2e56-a09c-42f6-9417-adcce68416a4/edge-nodes/0", "neighbor_status": [ { "source_address": "172.20.10.10", "local_port": 179, "neighbor_address": "172.20.10.20", "remote_port": 34703, "remote_as_number": "65000", "connection_state": "ESTABLISHED", "messages_received": 145809, "messages_sent": 145797, "time_since_established": 205949, "total_in_prefix_count": 3, "total_out_prefix_count": 3, "address_families": [ { "type": "IPV6_UNICAST", "in_prefix_count": 3, "out_prefix_count": 3 } ], "connection_drop_count": 6, "established_connection_count": 7, "hold_time": 15, "keep_alive_interval": 5, "graceful_restart_mode": "HELPER_ONLY", "announced_capabilities": [ "addPath IPv6 Unicast Rx", "IPv6 Unicast", "hostName advHostName", "routeRefresh", "4byteAs" ], "negotiated_capability": [ "addPath IPv6 Unicast Rx", "IPv6 Unicast", "hostName rcvHostName", "routeRefresh", "4byteAs" ], "neighbor_router_id": "172.20.10.20", "remote_site_path": "/global-infra/sites/Paris" }, { "source_address": "172.20.10.10", "local_port": 179, "neighbor_address": "172.20.10.21", "remote_port": 44337, "remote_as_number": "65000", "connection_state": "ESTABLISHED", "messages_received": 145778, "messages_sent": 145782, "time_since_established": 200713, "total_in_prefix_count": 3, "total_out_prefix_count": 3, "address_families": [ { "type": "IPV6_UNICAST", "in_prefix_count": 3, "out_prefix_count": 3 } ], "connection_drop_count": 12, "established_connection_count": 13, "hold_time": 15, "keep_alive_interval": 5, "graceful_restart_mode": "HELPER_ONLY", "announced_capabilities": [ "addPath IPv6 Unicast Rx", "IPv6 Unicast", "hostName advHostName", "routeRefresh", "4byteAs" ], "negotiated_capability": [ "addPath IPv6 Unicast Rx", "IPv6 Unicast", "hostName rcvHostName", "routeRefresh", "4byteAs" ], "neighbor_router_id": "172.20.10.21", "remote_site_path": "/global-infra/sites/Paris" } ], "last_update_timestamp": 1735231591677 } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get cross-site tunnel statistics of policy edge transport node.

Returns RTEP to RTEP tunnel port statistics of the given edge node. It always returns realtime response.
Request:

Method:

GET

URI Path(s):

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeNodeRemoteTepStatistics+

Example Response: { "stats_per_site": [ { "remote_site_path": "/global-infra/sites/Paris", "stats_per_tunnel": [ { "tunnel_source_address": "172.20.10.10", "tunnel_destination_address": "172.20.10.20", "rx": { "total_bytes": 30728445, "total_packets": 405923, "dropped_packets": 17, "blocked_packets": 0 }, "tx": { "total_bytes": 48996399, "total_packets": 409618, "dropped_packets": 0, "blocked_packets": 0 } }, { "tunnel_source_address": "172.20.10.10", "tunnel_destination_address": "172.20.10.21", "rx": { "total_bytes": 30361253, "total_packets": 401876, "dropped_packets": 23, "blocked_packets": 0 }, "tx": { "total_bytes": 48280988, "total_packets": 404029, "dropped_packets": 0, "blocked_packets": 0 } } ], "rx": { "total_bytes": 61089698, "total_packets": 807799, "dropped_packets": 40, "blocked_packets": 0 }, "tx": { "total_bytes": 97277387, "total_packets": 813647, "dropped_packets": 0, "blocked_packets": 0 } } ], "last_update_timestamp": 1735233402279 } Required Permissions: read Feature: policy_ep_edge Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Federation Configuration

Associated URIs:

GET /global-manager/api/v1/global-infra/federation-config
GET /global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data
PATCH /global-manager/api/v1/global-infra/global-manager-config
PUT /global-manager/api/v1/global-infra/global-manager-config
GET /global-manager/api/v1/global-infra/overridden-resources

Read federation config

Read a federation config from Global Manager. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/federation-config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/federation-config GET https://<global-mgr>/global-manager/api/v1/global-infra/federation-config Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationConfig+

Example Response: { "site_config" : [ { "site_id": "59ee0369-3d2b-4b2a-9221-594344f6ca4c", "rtep_ips": [ "10.192.201.163", "10.192.201.164" ], "site_index": 1, "site_path": "/global-infra/sites/paris" } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or fully replace Global Manager Config

Create or fully replace a Global Manager Config.
Revision is optional for creation and required for update.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/global-manager-config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/global-manager-config { "rtep_config" : { "ibgp_password": "secureme" }, "_revision": 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManagerConfig", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or patch Global Manager Config

Create or patch a Global Manager Config
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/global-manager-config

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/global-manager-config { "rtep_config" : { "ibgp_password": "secureme" } } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read Global Manager config along with sensitive data

Read a Global Manager config along with sensitive data.
For example - rtep_config.ibgp_password
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<pglobal-mgr>/global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data GET https://<policy-mgr>/global-manager/api/v1/global-infra/global-manager-config?action=show-sensitive-data Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManagerConfig+

GlobalManagerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManagerConfig	string
rtep_config	Global Manager federation RTEP configuration Global Manager federation RTEP configuration. This configuration is distributed to all Sites participating in federation.	GmRtepConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManagerConfig", "rtep_config" : { "ibgp_password": "secureme" }, "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List overridden resources

List overridden resources Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/overridden-resources

Request Headers:

n/a

Query Parameters:

OverrideListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/overridden-resources Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

OverriddenResourceListResult+

Example Response: { "results": [ { "intent_path": "/global-infra/spoofguard-profiles/spoofguard_disabled", "site_path": "/global-infra/sites/Paris", "resource_type": "OverriddenResource", "id": "SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "display_name": "/global-infra/overriden-objects/SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "path": "/global-infra/overriden-objects/SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "relative_path": "SPOOFGUARD_PROFILE-spoofguard_disabled-Paris", "parent_path": "/global-infra", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "system", "_create_time": 1580359905533, "_last_modified_user": "system", "_last_modified_time": 1580359905533, "_revision": 0 } ], "result_count": 1 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Full Synchronization

Associated URIs:

GET /global-manager/api/v1/global-infra/full-sync-states
GET /global-manager/api/v1/global-infra/full-sync-states/{full-sync-id}

List full sync states

List full sync state. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/full-sync-states

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/full-sync-states Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FullSyncStateListResult+

Example Response: { "result_count" : 1, "results" : [ "resource_type": "FullSyncState", "id": "1234", "full_sync_id": "1234", "last_completed_stage": "PROCESSED_DELTAS", "path": "/infra/fullsync-states/1234", "parent_path": "/infra", "relative_path": "1234", "_create_user": "SYSTEM", "_create_time": 1517262573524, "_last_modified_user": "SYSTEM", "_last_modified_time": 1517262573524, "_system_owned": true, "_revision": 2 ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get full sync state

Get full sync state. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/full-sync-states/{full-sync-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/full-sync-states/1234 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FullSyncState+

FullSyncState (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
errors	Errors occurred during full sync Errors occurred during full sync.	array of string	Readonly
full_sync_id	Full sync id Full sync id generated by Async Replicator (AR) service.	string	Readonly
id	Unique identifier of this resource	string	Sortable
last_completed_stage	Full sync stage that is last completed for this request. The current stage of full sync completion for ongoing sync. When Local Manager (LM) receives full sync data from AR, LM starts with workflow to prserve the state and restore the full sync from where it has left off in case of change of leadership of the service to different NSX node or LM is restarted. LM starts the full sync workflow with state INITIAL capturing the AR full sync id and data location details. The stage/state transition follows the order given below INITIAL - Full sync started PROCESSED_FULLSYNC_DATA - Compelted processing the full state data provided by AR PRCESSED_DELTAS - Completed processing pending delta changes provided by AR. DELETED_STALE_ENTITIES - Completed deletion of all global entities on LM that are not in GM anymore COMPLETED - Full sync handling is completed on LM ERROR - Full sync failed with errors on LM, in which case AR will re-attempt full sync later point in time for the LM ABORTED - Indicates that the full sync cancelled as per user request	string	Readonly Enum: INITIAL, PAUSE_DCNS, DELETED_STALE_ENTITIES, PROCESSED_FULLSYNC_DATA, PROCESSED_DELTAS, UNPAUSE_DCNS, COMPLETED, ERROR, ABORTED
last_upate_time	Deprecated, refer to last_update_time for the last update time stamp.	EpochMsTimestamp	Deprecated Readonly Sortable
last_update_time	Timestamp of last update, could be progress or success or error.	EpochMsTimestamp	Readonly Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value FullSyncState	string
start_time	Timestamp of Full Sync start.	EpochMsTimestamp	Readonly Sortable
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "FullSyncState", "id": "1234", "full_sync_id": "1234", "last_completed_stage": "PROCESSED_DELTAS", "path": "/infra/fullsync-states/1234", "parent_path": "/infra", "relative_path": "1234", "_create_user": "SYSTEM", "_create_time": 1517262573524, "_last_modified_user": "SYSTEM", "_last_modified_time": 1517262573524, "_system_owned": true, "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Global Managers

Associated URIs:

GET /global-manager/api/v1/gm-operational-state
GET /global-manager/api/v1/global-infra/global-managers
DELETE /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
GET /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
PATCH /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
PUT /global-manager/api/v1/global-infra/global-managers/{global-manager-id}
GET /global-manager/api/v1/global-infra/site-cleanup-pending
GET /global-manager/api/v1/global-infra/upgrade-summary

Get Global Managed operational state

Global Manager operation state includes the current status, switchover status
of global manager nodes if any, errors if any and consolidated status of the
operation.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/gm-operational-state

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/gm-operational-state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GmOperationalState+

Example Response: { "status": "SWITCHING_TO_ACTIVE", "start_time": 2374925435, "end_time": 32342234, "consolidated_progress": "IN_PROGRESS", "nodes" :[ { "node-id": "23fae-332d-34243d-2342aa", "status": "COMPLETED", "start_time": 2374925435, "end_time": 32342234, }, { "node-id": "55fae-332d-34243d-2342fr", "status": "IN_PROGRESS", "start_time": 2374925435, "end_time": 32342234, } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List Global Managers

List Global Managers under Infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/global-managers

Request Headers:

n/a

Query Parameters:

GlobalManagerListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManagerListResult+

Example Response: { "result_count" : 2, "results" : [ { "resource_type": "GlobalManager", "id": "london", "gm_id": "aad93dd9-ea71-41d7-be0d-1b1fca616660", "display_name": "London GM", "path": "/infra/global-managers/london", "parent_path": "/infra/global-managers/london", "relative_path": "london", "mode": "ACTIVE", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 }, { "resource_type": "GlobalManager", "id": "Paris", "gm_id": "dfd93dd9-ea71-41d7-be0d-1b1fca616660", "display_name": "Paris GM", "path": "/infra/global-managers/Paris", "parent_path": "/infra/global-managers/Paris", "relative_path": "Paris", "mode": "STANDBY", "connection_info": [{ "fqdn": "10.190.201.163" }], "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 1 } ] } Required Permissions: read Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or fully replace a Global Manager under infra

Create or fully replace Global Manager under Infra.
Revision is optional for creation and required for update.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

GlobalManagerSwitchOverRequestParameter+

Request Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/Paris { "display_name": "Paris GM", "mode": "ACTIVE", "_revision" : 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManager", "id": "Paris", "display_name": "Paris GM", "path": "/infra/global-managers/Paris", "parent_path": "/infra/global-managers/Paris", "relative_path": "Paris", "mode": "ACTIVE", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or patch a Global Manager

Create or patch a Global Manager under Infra.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

GlobalManagerSwitchOverRequestParameter+

Request Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/Paris { "display_name": "Paris GM", "mode": "ACTIVE" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read a Global Manager

Retrieve information about a particular configured global manager.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/london Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GlobalManager+

GlobalManager (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
connection_info	Connection information To create a standby GM, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the GM has been successfully onboarded, the connection_info is discarded and authentication to the standby GM occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_id	Global manager federation UUID Internally generated UUID to the federation of Global Manager.	string	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
mode	Mode of the global manager There can be at most one ACTIVE global manager and one STANDBY global manager. In order to add a STANDBY manager, there must be an ACTIVE manager defined.	string	Required Enum: ACTIVE, STANDBY
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value GlobalManager	string
site_id	UUID of the site where Global manager is running UUID of the site where Global manager is running. This is the Site Manager generated UUID for every NSX deployment.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "GlobalManager", "id": "london", "gm_id": "dfd93dd9-ea71-41d7-be0d-1b1fca616660", "display_name": "London GM", "path": "/infra/global-managers/london", "parent_path": "/infra/global-managers/london", "relative_path": "london", "mode": "ACTIVE", "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete a Global Manager under Infra

Delete a particular global manager under Infra.
Global Manager id 'self' is reserved and can be used for referring to local
logged in Global Manager.
Example - /infra/global-managers/self
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/global-managers/{global-manager-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/global-managers/london Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: standby_site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List resources pending to be cleaned from set of sites.

Paginated list of resources pending to be cleaned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/site-cleanup-pending

Request Headers:

n/a

Query Parameters:

SiteCleanupPendingListRequestParameters+

Request Body:

n/a

Example Request: GET https://<global-manager>/global-manager/api/v1/global-infra/site-cleanup-pending?intent_path=/global-infra/tier-1s/t1&intent_path=/global-infra/tier-1s/t2 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteCleanupPendingListResult+

Example Response: { "results":[ { "resource_path":"/global-infra/tier-1s/t1", "mark_for_delete":true, "pending_sites":[ { "site_id":"0692bb40-f47f-4b16-b09d-b8493e2c37ee", "site_path":"/global-infra/sites/LM-London" }, { "site_id":"1225c8b2-10a3-4b43-b1a0-b11d3b3e0656", "site_path":"/global-infra/sites/LM-Paris" } ] }, { "resource_path":"/global-infra/tier-1s/t1/segments/segment1", "mark_for_delete":true, "pending_sites":[ { "site_id":"0692bb40-f47f-4b16-b09d-b8493e2c37ee", "site_path":"/global-infra/sites/LM-London" }, { "site_id":"1225c8b2-10a3-4b43-b1a0-b11d3b3e0656", "site_path":"/global-infra/sites/LM-Paris" } ] }, { "resource_path":"/global-infra/tier-1s/t2", "mark_for_delete":false, "pending_sites":[ { "site_id":"0692bb40-f47f-4b16-b09d-b8493e2c37ee", "site_path":"/global-infra/sites/LM-London" } ] } ], "result_count":3, "sort_by":"resource_path", "sort_ascending":true } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Upgrade summary

API will return high level summary of Upgrade across various sites.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/upgrade-summary

Request Headers:

n/a

Query Parameters:

FederationUpgradeSummaryListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/upgrade-summary Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationUpgradeSummaryListResult+

Example Response: { "result_count" : 1, "results" : [ { "id": "30f127c3-aab3-42ec-81f8-223b46184695", "name": "Paris Site", "gpm_name": "Paris GM", "site_type": "ACTIVE_SITE", "overall_upgrade_status": "IN_PROGRESS", "current_version": "3.0.0.2.0.68976345", "target_version": "3.1.0.0.0.76898768", "last_upgrade_timestamp": "3425325235235325", "site_ip": "10.2.35.6", "component_status": [ { "component_type": "EDGE", "component_status": "SUCCESS", "progress_percent": "100", "current_version_node_summary": [ { "2.3.4.5.6", "node_count": "2" } ], "target_version": "3.4.5.6.7" }, { "component_type": "HOST", "component_status": "SUCCESS", "progress_percent": "100", "current_version_node_summary": [ { "version": "2.3.4.5.6", "node_count": "3" }, { "version":"2.3.4,5,5", "node_count": "1" } ], "target_version": "3.4.5.6.7" }, { "component_type": "MP", "component_status": "SUCCESS", "progress_percent": "100", "current_version_node_summary": [ { "2.3.4.5.6", "node_count": "3" } ], "target_version": "3.4.5.6.7" } ] } ] } Required Permissions: read Feature: utilities_upgrade Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Inter-Sites (Legacy Management Plane)

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/site-span-info
GET /global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/statistics
GET /global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/status (Deprecated)
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/bgp-summary (Deprecated)
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/status (Deprecated)
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/locale-services/{locale-services-id}/inter-site-forwarder/status
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/site-span-info
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/statistics
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/status (Deprecated)

Get infra segment cross site forwarder placement and HA status

Get infra segment cross site forwarder placement and HA statuss.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/site-span-info

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
bgp_neighbor_type	Bgp neighbor type Bgp neighbor type that can be used as filter for T0 bgp neighbor status filter.	string	Enum: INTER_SR, USER
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType	Experimental
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Experimental Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string	Experimental

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/inter-site-forwarder/site-span-info?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentL2ForwarderSiteSpanInfo+

Example Response: { "segment_path": "/global-infra/segments/tier0-ls", "remote_macs_per_site": [ { "rtep_group_id": 2001, "remote_site": { "target_id": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true }, "remote_mac_addresses": [ "02:00:17:00:12:D3", "02:00:17:00:13:13" ], "remote_active_ips": [ "10.10.10.1" ], "remote_standby_ips": [ "20.20.20.1" ] } ], "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get infra segment cross site traffic statistics

Get infra segment cross site traffic statistics.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/statistics

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
bgp_neighbor_type	Bgp neighbor type Bgp neighbor type that can be used as filter for T0 bgp neighbor status filter.	string	Enum: INTER_SR, USER
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType	Experimental
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Experimental Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string	Experimental

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/inter-site-forwarder/stats?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentCrossSiteTrafficStats+

Example Response: { "segment_path": "/global-infra/segments/tier0-ls", "rx": { "total_bytes": 56646, "total_packets": 342, "dropped_packets": 103 }, "tx": { "total_bytes": 1125548, "total_packets": 2235, "dropped_packets": 0 }, "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get infra segment cross site traffic statistics (Deprecated)

Get infra segment cross site traffic statistics.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/inter-site-forwarder/status

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
bgp_neighbor_type	Bgp neighbor type Bgp neighbor type that can be used as filter for T0 bgp neighbor status filter.	string	Enum: INTER_SR, USER
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType	Experimental
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Experimental Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string	Experimental

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/tier0-ls/inter-site-forwarder/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentCrossSiteTrafficStats+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get RTEP span and mac address-table (Deprecated)

Get RTEP span and mac address-table.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/bgp-summary

Request Headers:

n/a

Query Parameters:

ListByOptionalTransportNodeParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/tier0/locale-services/tier0localeservices/inter-site/bgp-summary Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterInterSiteBgpSummary+

PolicyEdgeClusterInterSiteBgpSummary (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
edge_cluster_path	Edge node path Edge cluster path whose status is being reported.	string	Required Readonly
edge_nodes	Individual edge nodes status Status of all edge nodes within cluster.	array of PolicyEdgeNodeInterSiteBgpSummary	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "edge_cluster_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/875381be-a4c5-4173-8aa7-ab71695a8129", "edge_nodes": [ { "edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/875381be-a4c5-4173-8aa7-ab71695a8129", "neighbor_status": [ { "source_address": "10.1.1.1", "neighbor_address": "10.1.2.1", "remote_as_number": "1", "remote_port": 179, "local_port": 179, "connection_state": "ESTABLISHED", "time_since_established": 45628, "messages_received": 12, "messages_sent": 10, "connection_drop_count": 0, "established_connection_count": 1, "hold_time": 180, "keep_alive_interval": 30, "graceful_restart": true, "graceful_restart_mode": "HELPER_ONLY", "total_in_prefix_count": 2, "total_out_prefix_count": 1, "address_families": [ { "type": "IPV4_UNICAST", "in_prefix_count": 2, "out_prefix_count": 1 } ], "remote_site": { "target_id": "cfaec4c7-45c2-439b-b7c6-2c3aeabd9976", "target_display_name": "PA Site", "is_valid": true } } ], "last_update_timestamp": 1457117071089 }, { "source_address": "10.1.1.1", "neighbor_address": "10.1.2.1", "remote_as_number": "1", "remote_port": 179, "local_port": 179, "connection_state": "ESTABLISHED", "time_since_established": 45628, "messages_received": 12, "messages_sent": 10, "connection_drop_count": 0, "established_connection_count": 1, "hold_time": 180, "keep_alive_interval": 30, "graceful_restart": true, "graceful_restart_mode": "HELPER_ONLY", "total_in_prefix_count": 2, "total_out_prefix_count": 1, "address_families": [ { "type": "IPV4_UNICAST", "in_prefix_count": 2, "out_prefix_count": 1 } ], "remote_site": { "target_id": "cfaec4c7-45c2-439b-b7c6-2c3aeabd9976", "target_display_name": "PA Site", "is_valid": true } } ], "last_update_timestamp": 1457117071089 } ], } Required Permissions: read Feature: policy_connectivity Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get RTEP mesh connectivity status (Deprecated)

Get RTEP mesh connectivity status.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/locale-services/{locale-services-id}/inter-site/status

Request Headers:

n/a

Query Parameters:

ListByOptionalTransportNodeParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-0s/tier0/locale-services/tier0localeservices/inter-site/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyEdgeClusterInterSiteStatus+

Example Response: { "gateway_path": "/global-infra/tier-0s/tier0", "edge_cluster_path": "/global-infra/sites/default/enforcement-points/default/edge-clusters/875381be-a4c5-4173-8aa7-ab71695a8129", "edge_cluster_name": "Federation edge cluster", "member_status": [ { "edge_node": { "edge_node_path": "/global-infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "Edge node 1", "is_valid": true }, "total_bgp_sessions": 2, "established_bgp_sessions": 2, "neighbor_status": [ { "source_address": "192.100.20.10", "neighbor_address": "192.200.20.10", "connection_state": "ESTABLISHED", "remote_site": { "target_edge_node": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true } }, { "source_address": "192.300.20.10", "neighbor_address": "192.400.20.10", "connection_state": "ESTABLISHED", "remote_site": { "target_id": "235c52a2-c960-4005-4512-451dc54fa542", "target_display_name": "PA Site", "is_valid": true } } ] "status": "UP" }, { "edge_node": { "edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/77eead22-3bb9-4586-8de3-9412941f9116", "target_display_name": "Edge node 2", "is_valid": true }, "total_bgp_sessions": 1, "established_bgp_sessions": 0, "neighbor_status": [ { "source_address": "192.100.20.10", "neighbor_address": "192.200.20.10", "connection_state": "IDLE", "remote_site": { "target_edge_node": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true } } ] "status": "DOWN" } ], "overall_status": "DEGRADED", "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_connectivity Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get inter-site L2 forwarder status for Tier1 gateway

Get inter-site L2 forwarder status for Tier1 gateway.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/locale-services/{locale-services-id}/inter-site-forwarder/status

Request Headers:

n/a

Query Parameters:

ListByOptionalTransportNodeParameters+

Request Body:

n/a

Example Request: GET https://policy-mgr/global-manager/api/v1/global-infra/tier-1s/tier1/locale-services/tier1localeservices/inter-site-forwarder/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GatewayL2ForwarderSiteSpanInfo+

Example Response: { } Required Permissions: read Feature: policy_connectivity Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get segment cross site forwarder placement and HA status

Get segment cross site forwarder placement and HA statuss.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/site-span-info

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
bgp_neighbor_type	Bgp neighbor type Bgp neighbor type that can be used as filter for T0 bgp neighbor status filter.	string	Enum: INTER_SR, USER
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType	Experimental
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Experimental Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string	Experimental

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/segments/tier1-ls/inter-site-forwarder/site-span-info?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentL2ForwarderSiteSpanInfo+

Example Response: { "segment_path": "/global-infra/tier-1s/tier1/segments/tier1-ls", "remote_macs_per_site": [ { "rtep_group_id": 2001, "remote_site": { "target_id": "258c50b4-c960-4005-9023-f7946e302162", "target_display_name": "India Site", "is_valid": true }, "remote_mac_addresses": [ "02:00:17:00:12:D3", "02:00:17:00:13:13" ], "remote_active_ips": [ "10.10.10.1" ], "remote_standby_ips": [ "20.20.20.1" ] } ], "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get segment cross site traffic statistics

Get segment cross site traffic statistics.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/statistics

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
bgp_neighbor_type	Bgp neighbor type Bgp neighbor type that can be used as filter for T0 bgp neighbor status filter.	string	Enum: INTER_SR, USER
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType	Experimental
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Experimental Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string	Experimental

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/segments/tier1-ls/inter-site-forwarder/stats?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentCrossSiteTrafficStats+

Example Response: { "segment_path": "/global-infra/tier-1s/tier1/segments/tier1-ls", "rx": { "total_bytes": 56646, "total_packets": 342, "dropped_packets": 103 }, "tx": { "total_bytes": 1125548, "total_packets": 2235, "dropped_packets": 0 }, "last_update_timestamp": 1457117071089 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get segment cross site traffic statistics (Deprecated)

Get segment cross site traffic statistics.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/inter-site-forwarder/status

Request Headers:

n/a

Query Parameters:

L2L3RuntimeRequestParameters+

L2L3RuntimeRequestParameters (schema)

Name	Description	Type	Notes
bgp_neighbor_type	Bgp neighbor type Bgp neighbor type that can be used as filter for T0 bgp neighbor status filter.	string	Enum: INTER_SR, USER
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
edge_path	Policy path of edge node Policy path of edge node. Edge should be member of enforcement point.	string
enforcement_point_path	String Path of the enforcement point Enforcement point path.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source of statistics data The data source can be either realtime or cached. If not provided, cached data is returned.	DataSourceType	Experimental
stats_type	Segment statistics type This indicates the type of statistics being requested. We support statistics from the data plane.	string	Experimental Enum: DATAPATH_STATS
transport_node_id	Transport Node Id Identifer of the transport node. This is a UUID.	string	Experimental

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/segments/tier1-ls/inter-site-forwarder/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SegmentCrossSiteTrafficStats+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Observability

Associated URIs:

GET /global-manager/api/v1/observability/flow-details

Get monitoring info

Provides federation monitoring information, which includes all
config flows originating from the site where API is invoked.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/observability/flow-details

Request Headers:

n/a

Query Parameters:

SiteRequestParameter+

Request Body:

n/a

Example Request: GET https://<global-manager>/global-manager/api/v1/observability/flow-details GET https://<local-manager>/global-manager/api/v1/observability/flow-details Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

MonitoringInfo+

Example Response: On Global Manager { "monitoring_info": [{ "id": "rrrrrr-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_TO_LM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm2lm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "gm2lm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "36021bd5-9ebc-46e0-9d7a-5a4fa8bb3802", "to_site_path": "/global-infra/sites/Newyork", "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "from_site_path": "/global-infra/global-managers/LondonGM", "latency_millis": 123, "latency_measured_ts": 1590336614947, "last_full_sync": { "status": "COMPLETED", "id": "f6fda71a-d5f2-4000-8677-deaafd80641e", "reason_code": "10010", "reason": "Site onboarded", "stage": "COMPLETED", "data_streaming_from_source_progress": "Sending resources of type COMMUNICATION_MAP", "data_streaming_from_source_start_time": 1590335604947, "data_streaming_from_source_end_time": 1590336604947, "receiver_state": "COMPLETED", "receiver_start_time": 1590336614947, "receiver_end_time": 1590336714947, "start_time": 1590335604947, "end_time": 1590435604947, "errors": {}, "warnings": {} } } }, { "id": "asarrr-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_TO_LM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm2lm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "gm2lm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "to_site_path": "/global-infra/sites/Paris", "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "from_site_path": "/global-infra/global-managers/LondonGM", "latency_millis": 123, "latency_measured_ts": 1590336614947, "last_full_sync": { "status": "COMPLETED", "id": "f6fda71a-d5f2-4000-8677-deaafd80641e", "reason_code": "10010", "reason": "Site onboarded", "stage": "COMPLETED", "data_streaming_from_source_progress": "Sending resources of type COMMUNICATION_MAP", "data_streaming_from_source_start_time": 1590335604947, "data_streaming_from_source_end_time": 1590336604947, "receiver_state": "COMPLETED", "receiver_start_time": 1590336614947, "receiver_end_time": 1590336714947, "start_time": 1590335604947, "end_time": 1590435604947, "errors": {}, "warnings": {} } } }, { "id": "rrbbr-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_GM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "lm2gm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "lm2gm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "to_site_path": "/global-infra/global-managers/LondonGM", "from_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "from_site_path": "/global-infra/sites/Paris", "latency_millis": 125 } }, { "id": "ca00-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_GM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "lm2gm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "lm2gm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "to_site_path": "/global-infra/global-managers/NewyorkGM", "from_site_id": "BB021bd5-9ebc-46e0-9d7a-5a4fa8bb3155", "from_site_path": "/global-infra/sites/Newyork", "latency_millis": 120 "latency_measured_ts": 1590336614947, } }, { "id": "cab10-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_WORK_QUEUE", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm-work-queue", "namespace": "gm" } ] }, { "id": "dea0-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_DELETE_QUEUE", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm-delete-queue-1", "namespace": "gm" } ] } ] } On Local Manager { "monitoring_info": [ { "id": "we11-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"GM_TO_LM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "gm2lm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "gm2lm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "to_site_path": "/global-infra/sites/Paris", "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "from_site_path": "/global-infra/global-managers/LondonGM", "latency_millis": 123, "latency_measured_ts": 1590336614947, "last_full_sync": { "status": "COMPLETED", "id": "f6fda71a-d5f2-4000-8677-deaafd80641e", "reason_code": "10010", "reason": "Site onboarded", "stage": "COMPLETED", "data_streaming_from_source_progress": "Sending resources of type COMMUNICATION_MAP", "data_streaming_from_source_start_time": 1590335604947, "data_streaming_from_source_end_time": 1590336604947, "receiver_state": "COMPLETED", "receiver_start_time": 1590336614947, "receiver_end_time": 1590336714947, "start_time": 1590335604947, "end_time": 1590435604947, "errors": {}, "warnings": {} } } }, { "id": "fg12-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_GM", "queue_info": [ { "max_size": 1000, "current_size": 100, "name": "lm2gm.transmitter.delta", "namespace": "ar-queues" }, { "max_size": 1000, "current_size": 200, "name": "lm2gm.receiver.delta", "namespace": "ar-queues" }, ], "cross_site_flow_info": { "status": "GOOD", "to_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "to_site_path": "/global-infra/global-managers/LondonGM", "from_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", "from_site_path": "/global-infra/sites/Paris", "latency_millis": 125, "latency_measured_ts": 1590336614947, } }, { "id": "ff10-9ebc-46e0-9d7a-5a4fa8bb3802", "flow_type":"LM_TO_LM", "cross_site_flow_info": { "status": "GOOD", "to_site_id": "aa021bd5-9ebc-46e0-9d7a-5a4fa8bb3111", // To NewYork (LM doesn't have site paths) "from_site_id": "ececa019-3601-47dc-b92e-f21f52b34f6f", "latency_millis": 123, "latency_measured_ts": 1590336614947, } } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Onboarding

Associated URIs:

POST /global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=start_onboarding
POST /global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=check_conflict
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/feature-summary
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/invalid-config-details
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences
PUT /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences
GET /global-manager/api/v1/global-infra/sites/{site-id}/onboarding/status

Fetch conflicting entities summary for a Site

Get consolidated list of conflicting entities summary for each supported
feature for a site with an example.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/feature-summary

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET /global-infra/site/site-1/onboarding/feature-summary Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConflictingEntityListResponse+

Example Response: { "infra_descendants": [ { "feature": { "name": "NETWORK" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "LOCATION" }, "conflict_count": 0, "total_count": 2 }, { "feature": { "name": "DNS" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "DHCP" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "NETWORK_PROFILE" }, "conflict_count": 0, "total_count": 8 }, { "feature": { "name": "CONTEXT_PROFILE" }, "conflict_count": 0, "total_count": 126 }, { "feature": { "name": "SERVICE" }, "conflict_count": 0, "total_count": 2460 }, { "feature": { "name": "TIER1" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "TIER0" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "SECURITY_PROFILE" }, "conflict_count": 0, "total_count": 0 } ], "feature_descendants": [ { "feature": { "name": "UNKNOWN" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "IDS" }, "conflict_count": 0, "total_count": 2 }, { "feature": { "name": "SECURITY_POLICY" }, "conflict_count": 0, "total_count": 230 }, { "feature": { "name": "GATEWAY_PROFILE" }, "conflict_count": 0, "total_count": 4 }, { "feature": { "name": "GATEWAY_PROPERTY" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "IGNORE" }, "conflict_count": 0, "total_count": 2 }, { "feature": { "name": "NAT" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "GROUP" }, "conflict_count": 0, "total_count": 20 }, { "feature": { "name": "IP_ADDRESS_POOL" }, "conflict_count": 0, "total_count": 0 }, { "feature": { "name": "LB" }, "conflict_count": 0, "total_count": 17 }, { "feature": { "name": "VPN" }, "conflict_count": 0, "total_count": 29 } ], "feature_summary" : { "total_conflict_count": 0, "total_count" : 304 } "example": { "name": "service_14", "resource_type": "SERVICE", "path": "/infra/services/service_14" }, "feature_compatibility_data" : [ { "feature": { "name": "SECURITY_POLICY" }, "status" : "INCOMPATIBLE", "details" : [ { "status_code" : 40031, "status_message" : "Incompatible Security Policy order found on..." "attributes" : [ { "name" : "SP_SEQ_INCOMP_CNT", "value" : "12", "value_type" : "INTEGER" } ] } ] } ] } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Fetch feature entities summary details for a Site

Get feature summary details with invalid configuration for a feature.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/invalid-config-details

Request Headers:

n/a

Query Parameters:

FeatureSummaryRequestParameters+

Request Body:

n/a

Example Request: GET /global-infra/site/site-1/onboarding/invalid-config-details?feature=LB Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationInvalidConfigurationDetailsResponse+

Example Response: { "feature": { "name": "LB" }, "invalid_config_summary": [ { "category": "LB_POOL_GROUP_USE_COUNT", "resource_summary_details": [ { "resource_type": "Group", "resource_list": [ { "name": "group-8", "value": "/infra/domains/domain/groups/group-8", "value_type": "STRING" }, { "name": "group-2", "value": "/infra/domains/domain/groups/group-2", "value_type": "STRING" }, { "name": "group-1", "value": "/infra/domains/domain/groups/group-1", "value_type": "STRING" } ], "resource_count": 3 } ], "resource_count": 3 }, { "category": "LB_POOL_SHARED_SECTION_USE_COUNT", "resource_summary_details": [ { "resource_type": "CommunicationMap", "resource_list": [ { "name": "sec-11", "value": "/infra/domains/default/security-policies/sec-11", "value_type": "STRING" }, { "name": "sec-12", "value": "/infra/domains/default/security-policies/sec-12", "value_type": "STRING" }, { "name": "sec-5", "value": "/infra/domains/default/security-policies/sec-5", "value_type": "STRING" }, { "name": "sec-14", "value": "/infra/domains/default/security-policies/sec-14", "value_type": "STRING" }, { "name": "sec-1", "value": "/infra/domains/default/security-policies/sec-1", "value_type": "STRING" } ], "resource_count": 5 } ], "resource_count": 5 } ], "total_count": 8 } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Update Onboarding Preferences

Update user onboarding preferences to allow or reject site onboarding on
global manager.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SiteOnboardingPreference+

SiteOnboardingPreference (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ignore_import	Ignore Import Preference Represents user's decision to ignore onboarding option for a site. User will not be shown onboarding message or will failing onboarding when ignore status is set to 'true'.	boolean	Required Readonly
resource_type	Must be set to the value SiteOnboardingPreference	string
site_id	Site Identifier Unique site identifier.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30

Example Request: PUT /global-infra/sites/site-1/onboarding/user-preferences { "site_id": "site-1", "ignore_import": true, "resource_type": "SiteOnboardingPreference", "id": "site-1", "display_name": "site-1", "_create_user": "admin", "_create_time": 1581541290117, "_last_modified_user": "admin", "_last_modified_time": 1581541290117, "_system_owned": false, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteOnboardingPreference+

SiteOnboardingPreference (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ignore_import	Ignore Import Preference Represents user's decision to ignore onboarding option for a site. User will not be shown onboarding message or will failing onboarding when ignore status is set to 'true'.	boolean	Required Readonly
resource_type	Must be set to the value SiteOnboardingPreference	string
site_id	Site Identifier Unique site identifier.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30

Example Response: { "site_id": "site-1", "ignore_import": true, "resource_type": "SiteOnboardingPreference", "id": "site-1", "display_name": "site-1", "_create_user": "admin", "_create_time": 1581541290117, "_last_modified_user": "admin", "_last_modified_time": 1581541290117, "_system_owned": false, "_revision": 1 } Required Permissions: crud Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Onboarding Preferences

Get user onboarding preferences for a site on global manager.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/preferences

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET /global-infra/sites/site-1/onboarding/user-preferences Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteOnboardingPreference+

SiteOnboardingPreference (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ignore_import	Ignore Import Preference Represents user's decision to ignore onboarding option for a site. User will not be shown onboarding message or will failing onboarding when ignore status is set to 'true'.	boolean	Required Readonly
resource_type	Must be set to the value SiteOnboardingPreference	string
site_id	Site Identifier Unique site identifier.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30

Example Response: { "site_id": "site-1", "ignore_import": false, "resource_type": "SiteOnboardingPreference", "id": "site-1", "display_name": "site-1", "_create_user": "admin", "_create_time": 1581541290117, "_last_modified_user": "admin", "_last_modified_time": 1581541290117, "_system_owned": false, "_revision": 0 } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Onboarding status

Get onboarding status for a site. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding/status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET /global-infra/sites/site-1/onboarding/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConfigOnboardingStatus+

Example Response: { "site_id": "site-1", "status": "IN_PROGRESS", "details": { "import_progress": { "feature": { "name": "SERVICE" }, "stage": "LM_MIGRATION", "current_step": 1, "total_steps": 5 }, "site_backup_reference": "2020-01-28-Site-1-backup" }, "timestamp": 1581550365276 } Required Permissions: read Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Check Onboarding configuration conflicts

Verifies and reports conflicting onboarding feature for a site. The
response will contain first conflicting feature for the site configuration
compared to corresponding global manager configuration.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=check_conflict

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ConfigOnboardingConflictRequest+

Example Request: POST /global-infra/sites/site-1/onboarding??action=check_conflict { "site_id" : "site-1", "suffix": "site-1-suffix" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConfigOnboardingConflictStatus+

Example Response: { "site_id": "site-1", "status": "CONFLICT_DETECTED", "details": { "resource_type" : "Tier0", "name": "routing-gateway", "path": "/infra/tier0s/routing-gateway" } } Required Permissions: crud Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Start or Check on-boarding for a Site

Initiate config on-boarding of a Site. The entire on-boarding is async
workflow controlled by API.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/onboarding?action=start_onboarding

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ConfigOnboardingRequest+

Example Request: POST /global-infra/sites/site-1/onboarding?action=start_config_onboarding { "site_id" : "site-1", "suffix": "site-1-suffix", "site_backup_reference" : "2020-01-28-Site-1-backup" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConfigOnboardingStatus+

Example Response: { "site_id": "site-1", "status": "IN_PROGRESS", "supported_features": [], "details": { "import_progress": {}, "site_backup_reference": "2020-01-28-Site-1-backup" }, "timestamp": 1580609440765 } Required Permissions: crud Feature: federated_site_onboarding Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Sites

Associated URIs:

POST /global-manager/api/v1/global-infra/onboarding-check-compatibility
GET /global-manager/api/v1/global-infra/sites
DELETE /global-manager/api/v1/global-infra/sites/{site-id}
GET /global-manager/api/v1/global-infra/sites/{site-id}
PATCH /global-manager/api/v1/global-infra/sites/{site-id}
PUT /global-manager/api/v1/global-infra/sites/{site-id}
GET /global-manager/api/v1/global-infra/sites/listener_certificate
GET /global-manager/api/v1/global-infra/span
GET /api/v1/sites
GET /api/v1/sites?version=3.0.2
GET /api/v1/sites?version=3.1.0
GET /api/v1/sites?version=latest
GET /api/v1/sites/compatibility
GET /api/v1/sites/compatibility/remote
GET /api/v1/sites/self
GET /api/v1/sites/status
GET /api/v1/sites/switchover-status

Create or fully replace a Site under infra

Create or fully replace a Site under Infra.
Revision is optional for creation and required for update.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/onboarding-check-compatibility

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SiteNodeConnectionInfo+

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/onboarding-check-compatibility { "fqdn": "10.192.201.163", "username": "admin", "password": "Admin!23Admin", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

CompatibilityCheckResult+

Example Response: { "rtt": 125, "rtt_exceeded": false, "nsx_version": "3.0.0", "version_compatible" : true } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List Sites

List Sites under Infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites

Request Headers:

n/a

Query Parameters:

SiteListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteListResult+

Example Response: { "result_count" : 3, "results" : [ { "resource_type": "Site", "id": "casablanca", "display_name": "Casablanca, Morocco Site", "description" : "Site managing call center workloads in North Africa", "path": "/infra/sites/casablanca", "parent_path": "/infra/sites/casablanca", "relative_path": "casablanca", "site_connection_info": [{ "fqdn": "10.192.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 }, { "resource_type": "Site", "id": "tokyo", "display_name": "Tokyo, Japan Site", "description" : "Active Site managing production workloads in East Asia", "path": "/infra/sites/tokyo", "parent_path": "/infra/sites/tokyo", "relative_path": "tokyo", "site_connection_info": [{ "fqdn": "10.199.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 }, { "resource_type": "Site", "id": "paris", "display_name": "Paris, France Site", "description" : "StandBy Site managing business workloads in Central Europe", "path": "/infra/sites/paris", "parent_path": "/infra/sites/paris", "relative_path": "paris", "site_connection_info": [{ "fqdn": "10.190.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or fully replace a Site under infra

Create or fully replace a Site under Infra.
Revision is optional for creation and required for update.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint ChildSiteSecuritySetting
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/Paris { "site_connection_info": [{ "fqdn": "10.192.201.163", "username": "admin", "password": "Admin!23Admin", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_rtep_misconfigured": true "display_name": "Paris, EU Site", "description" : "Site managing call center workloads in western Europe", "_revision" : 1 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint ChildSiteSecuritySetting
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Site", "id": "Paris", "display_name": "Paris, EU Site", "description" : "Site managing call center workloads in western Europe", "path": "/infra/sites/Paris", "parent_path": "/infra/sites/Paris", "relative_path": "Paris", "site_connection_info": [{ "fqdn": "10.192.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_rtep_misconfigured": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or patch Site

Create or patch Site under Infra.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint ChildSiteSecuritySetting
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/Paris { "site_connection_info": [{ "fqdn": "10.192.201.163", "username": "admin", "password": "Admin!23Admin", "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_rtep_misconfigured": true "display_name": "Paris, EU Site", "description" : "Site managing call center workloads in western Europe", } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete a site

Delete a site under Infra.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

SiteActionParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/sites/Paris Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read a site

Read a site under Infra.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/casablanca Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Site+

Site (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildEnforcementPoint ChildSiteSecuritySetting
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
fail_if_rtep_misconfigured	Fail onboarding if RTEPs misconfigured Both the local site and the remote site must have edge clusters correctly configured and remote tunnel endpoint (RTEP) interfaces must be defined, or onboarding will fail.	boolean	Default: "True"
fail_if_rtt_exceeded	Fail onboarding if maximum RTT exceeded Fail onboarding if maximum RTT exceeded.	boolean	Default: "True"
federation_config	Federation releated config System managed federation config.	GmFederationSiteConfig	Readonly
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
maximum_rtt	Maximum acceptable packet round trip time (RTT) If provided and fail_if_rtt_exceeded is true, onboarding of the site will fail if measured RTT is greater than this value.	integer	Minimum: 0 Maximum: 1000 Default: "250"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Site	string
site_connection_info	Connection information To onboard a site, the connection information (username, password, and API thumbprint) for at least one NSX manager node in the remote site must be provided. Once the site has been successfully onboarded, the site_connection_info is discarded and authentication to the remote site occurs using an X.509 client certificate.	array of SiteNodeConnectionInfo	Maximum items: 3
site_number	12-bit system generated site number	integer	Readonly
site_type	Persistent Site Type The site_type property identifies type of current site.	string	Enum: ONPREM_LM, SDDC_LM
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Site", "id": "casablanca", "display_name": "Casablanca, Morocco Site", "description" : "Site managing call center workloads in North Africa", "path": "/infra/sites/casablanca", "parent_path": "/infra/sites/casablanca", "relative_path": "casablanca", "site_connection_info": [{ "fqdn": "10.192.201.163" }], "maximum_rtt": 250, "fail_if_rtt_exceeded": true, "fail_if_mismatch_rteps": true "_create_user": "admin", "_create_time": 1517262573524, "_last_modified_user": "admin", "_last_modified_time": 1517262573524, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Returns the certificate of the listener

Connects to the given IP and port, and, if an SSL listener is present, returns
the certificate of the listener.
Intent of this API is "Do you trust this certificate?".
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/listener_certificate

Request Headers:

n/a

Query Parameters:

TlsListenerEndpointAddressRequestParameters+

Request Body:

n/a

Example Request: POST https://<policy-mgr>/global-policy/api/v1/global-infra/sites/listener_certificate?address=10.22.122.7&port=443 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TlsListenerCertificate+

Example Response: { "result": "SUCCESS", "certificate": { "issuer_cn": "vSM Test Certificate", "public_key_length": 1024, "signature": "4e cf ff 36 ac a1", "not_before": 1323772715000, "subject": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "serial_number": "ca55f5e21a0b2dd2", "public_key_algo": "RSA", "version": "1", "issuer": "1.2.840.113549.1.9.1=#16076140622e636f6d,CN=vSM Test Certificate,OU=vShield,O=VMware,L=Pune,ST=Maharashtra,C=IN", "is_ca": false, "subject_cn": "vSM Test Certificate", "not_after": 1355308715000, "is_valid": false, "rsa_public_key_exponent": "10001", "signature_algorithm": "SHA1WITHRSA", "rsa_public_key_modulus": "00 b7 8f 79 e4" }, "thumbprint": "f53d7052535613b3032a41d555631228cb4d0d8b584a8225b94fbf0ba83eb9a4" } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get span for an entity with specified path

Get span for an entity with specified path. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/span

Request Headers:

n/a

Query Parameters:

IntentPathRequestParameter+

Request Body:

n/a

Example Request: GET https://<global-manager>/global-manager/api/v1/global-infra/span?intent_path=/global-infra/tier-0s/t0 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Span+

Span (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Span	string
sites	List of SpanSiteInfos List of SpanSiteInfos representing the strech of the entity.	array of SpanSiteInfo	Readonly
span_leader	Policy resource type of span leader Represents Policy resource type streached entity's span leader.	string	Readonly
span_resource	Policy resource path Represents Policy resource path of streached entity.	string	Readonly
span_resource_type	Policy resource type Policy resource type of the streached entity.	string	Readonly
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "SPAN", "span_resource_type": "PROVIDER", "span_resource": "/global-infra/tier-0s/t0", "span_leader": "/global-infra/tier-0s/t0", "site_ids": [ "51a1294a-b1d5-40a9-a382-2b1aeb62c41a", "3d497d3f-2f9a-4983-9db0-d1f5f7cbc3d0" ], "marked_for_delete": false, "overridden": false } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the site configuration

Request:

Method:

GET

URI Path(s):

/api/v1/sites

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/sites Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationConfiguration+

Example Response: { "sites": [ { "id": "c69dd550-841d-4064-bc92-476e977ad04d", "name": "name1", "active_gm": "true", "aph_list": [ { "address": "10.11.12.13", "port": "8000", "certificate": "-----BEGIN CERTIFICATE-----\nMIIC1TCCAb2gAwIBAgIEX135sjANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9j\nbHVzdGVyLW1hbmFnZXIwIBcNMTgwODAzMTgyNTI1WhgPMjExODA3MTAxODI1MjVa\nMBoxGDAWBgNVBAMTD2NsdXN0ZXItbWFuYWdlcjCCASIwDQYJKoZIhvcNAQEBBQAD\nggEPADCCAQoCggEBALKz/i+SQzpB7dkaF6tGTm1oP4esjEtd5Pv9beE01qpZv+CA\npAB/BosbDLFvBSwlEwqFZNbNSPlgyfbHCCe28IibWWrkVtIIH/9XVTdsH+iJEG3N\nDXgcn3Qj+PBbYK9K+imF2fQdypeYokMova3YQnBadfTKZgJSc5gt0fKPehLceeHE\nIZz07tfDRMzZg4kYFBURU1u/V17coPD7y/Ja0kGJSBSjN6t/eFqI1PvVLw9niddz\n+yjsRqnvdGnQFoB43LewnbpYxn69qOd9Knu81MP2HR4G2jhVevf/qkG8mS3fS8gu\nFGm2JwtncnWsxGFdb2c/KTMxH0iQEcBCjbph6T0CAwEAAaMhMB8wHQYDVR0OBBYE\nFHhBeWEQrmNTv4otlztUkfVLCzwkMA0GCSqGSIb3DQEBCwUAA4IBAQBAu/jFw3QY\n5eWm3lOBJe67MXXOFVbCLRgcMlXzXoNWStI/3ncH1ZUDH0pz0pcOmyWoWUZ0OSjr\nLz+XMZN6MFgHx2w7RvLXYewFzowVaNu7l/V375Vhv18KpnJ6EjemVQRMZmJQFwda\nMrLU5dSuWVJYoTR6yVneSPasxHMCorTc+K3msVbP/1nh/wSls5Zj8L7jszLOqMpz\nUQL8eYN2r+A/sWFW5Ge6qGTOuOVpUS24isBwRqcyYLD7iJsIzpdebanuTNlXeJJQ\n49yPXri4nzQ4mNsiVCNFGGZyUmBzEpvcx3Lzol790Azk8SHkiGaOQJRKVr8CPszv\nZ12pIgNkADz8\n-----END CERTIFICATE-----\n" } ], } ], "epoch": 1, "version": 1 } Required Permissions: read Feature: cluster_management Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the compatibility list of the site

Returns the version of this site and list of compatible versions
Request:

Method:

GET

URI Path(s):

/api/v1/sites/compatibility

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/sites/compatibility Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteCompatibilityInfo+

Example Response: { "site_version": "3.1.0", "compatibility_list": ["3.0.1", "3.1.0"] } Required Permissions: read Feature: cluster_management Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Check whether the remote site version is compatible to this site

Returns the version of this site and list of compatible versions for both local and remote site,
also a boolean indicating whether the two are compatible, this value is true if one of the site
version is in the compatibility list of the other site
Request:

Method:

GET

URI Path(s):

/api/v1/sites/compatibility/remote

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

RemoteSiteCredential+

Example Request: GET https://<nsx-mgr>/api/v1/sites/compatibility/remote { "address": "10.100.200.10:7441", "username": "admin", "password": "password", "thumbprint": "f656452785a13d8e1431984a0a5137f1e27cdfa43e1cb08f46051a66733ca1b8" } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

RemoteSiteCompatibilityInfo+

Example Response: { "local": { "site_version": "3.1.0", "compatibility_list": ["3.0.1", "3.1.0"] } "remote": { "site_version": "3.1.1", "compatibility_list": ["3.1.0", "3.1.1"] } "is_compatible": true } Required Permissions: crud Feature: cluster_management Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the local site configuration

Request:

Method:

GET

URI Path(s):

/api/v1/sites/self

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/sites/self Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

LocalSiteConfiguration+

Example Response: { "federation_id": "12345", "epoch": 12, "site": { "id": "c69dd550-841d-4064-bc92-476e977ad04d", "name": "name1", "active_gm": "true", "aph_list": [ { "address": "10.11.12.13", "port": "8000", "certificate": "-----BEGIN CERTIFICATE-----\nMIIC1TCCAb2gAwIBAgIEX135sjANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw9j\nbHVzdGVyLW1hbmFnZXIwIBcNMTgwODAzMTgyNTI1WhgPMjExODA3MTAxODI1MjVa\nMBoxGDAWBgNVBAMTD2NsdXN0ZXItbWFuYWdlcjCCASIwDQYJKoZIhvcNAQEBBQAD\nggEPADCCAQoCggEBALKz/i+SQzpB7dkaF6tGTm1oP4esjEtd5Pv9beE01qpZv+CA\npAB/BosbDLFvBSwlEwqFZNbNSPlgyfbHCCe28IibWWrkVtIIH/9XVTdsH+iJEG3N\nDXgcn3Qj+PBbYK9K+imF2fQdypeYokMova3YQnBadfTKZgJSc5gt0fKPehLceeHE\nIZz07tfDRMzZg4kYFBURU1u/V17coPD7y/Ja0kGJSBSjN6t/eFqI1PvVLw9niddz\n+yjsRqnvdGnQFoB43LewnbpYxn69qOd9Knu81MP2HR4G2jhVevf/qkG8mS3fS8gu\nFGm2JwtncnWsxGFdb2c/KTMxH0iQEcBCjbph6T0CAwEAAaMhMB8wHQYDVR0OBBYE\nFHhBeWEQrmNTv4otlztUkfVLCzwkMA0GCSqGSIb3DQEBCwUAA4IBAQBAu/jFw3QY\n5eWm3lOBJe67MXXOFVbCLRgcMlXzXoNWStI/3ncH1ZUDH0pz0pcOmyWoWUZ0OSjr\nLz+XMZN6MFgHx2w7RvLXYewFzowVaNu7l/V375Vhv18KpnJ6EjemVQRMZmJQFwda\nMrLU5dSuWVJYoTR6yVneSPasxHMCorTc+K3msVbP/1nh/wSls5Zj8L7jszLOqMpz\nUQL8eYN2r+A/sWFW5Ge6qGTOuOVpUS24isBwRqcyYLD7iJsIzpdebanuTNlXeJJQ\n49yPXri4nzQ4mNsiVCNFGGZyUmBzEpvcx3Lzol790Azk8SHkiGaOQJRKVr8CPszv\nZ12pIgNkADz8\n-----END CERTIFICATE-----\n" } ] } } Required Permissions: read Feature: cluster_management Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get overall status of the federation, including stub status

Request:

Method:

GET

URI Path(s):

/api/v1/sites/status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/sites/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationStatus+

Example Response: { "remote_connections": [ { "site_name": "site name", "stubs": { "address": "10.160.223.31", "connection_up": true } } ], "active_standby_sync_statuses": [ { "standby_site": "London", "is_data_consistent": true, "description": "status description", "status": "ONGOING", "percentage_completed": 70, "remaining_entries_to_send": 5, "sync_type": "DELTA_SYNC", "full_sync_status": { "sync_id": "9d33ec11-3c7a-46bc-80f9-88adc21c8289", "status": "COMPLETE", "sync_type": "STANDARD", "completed_at": "1600913640000", "snapshot_version": "781" } } ] } Required Permissions: read Feature: cluster_management Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the switchover status

Request:

Method:

GET

URI Path(s):

/api/v1/sites/switchover-status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/sites/switchover-status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SwitchoverStatus+

Example Response: { "overall_status": "ERROR", "note": "", "current_step": { "name": "precheck", "description": "precheck", "parts": [ { "name": "precheck", "description": "precheck", "status": "ERROR", "percentage": 0, "error": "Some problem have occured" } ] }, "current_step_number", 1, "number_of_stemps", 6 } Required Permissions: read Feature: cluster_management Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the site configuration, some attributes won't be shown based on version

Request:

Method:

GET

URI Path(s):

/api/v1/sites?version=3.0.2

/api/v1/sites?version=3.1.0

/api/v1/sites?version=latest

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/sites?version=latest Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

FederationConfiguration+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Federation: Sites (Security Settings)

Associated URIs:

DELETE /global-manager/api/v1/global-infra/sites/{site-id}/security-setting
GET /global-manager/api/v1/global-infra/sites/{site-id}/security-setting
PATCH /global-manager/api/v1/global-infra/sites/{site-id}/security-setting
PUT /global-manager/api/v1/global-infra/sites/{site-id}/security-setting

This routine will get site security setting

This routine will get site security setting
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/security-setting

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/sites/London/security-setting { "air_gapped": true, "resource_type": "SiteSecuritySetting", "id": "security-setting", "display_name": "security-setting", "path": "/global-infra/sites/LM/security-setting", "relative_path": "security-setting", "parent_path": "/global-infra/sites/LM", "unique_id": "ffaca9ae-4a90-4f9f-ba88-4369e02bf3e3", "owner_id": "6c5b2358-5862-49d8-952e-611b8cd32bf1", "marked_for_delete": false, "overridden": false, "_create_time": 1718858458723, "_create_user": "admin", "_last_modified_time": 1718858458723, "_last_modified_user": "admin", "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteSecuritySetting+

SiteSecuritySetting (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
air_gapped	Flag to indicate air gapped deployments If true, deployment is marked as air gapped deployment and operations that requires internet connectivity are expected to be supported through Global Manager.	boolean	Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value SiteSecuritySetting	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Required Permissions: read Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

This routine will update site security setting

This routine will update site security setting.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/security-setting

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SiteSecuritySetting+

SiteSecuritySetting (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
air_gapped	Flag to indicate air gapped deployments If true, deployment is marked as air gapped deployment and operations that requires internet connectivity are expected to be supported through Global Manager.	boolean	Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value SiteSecuritySetting	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/sites/London/security-setting { "air_gapped": true } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

This routine will update site security setting

This routine will update site security setting.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/security-setting

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

SiteSecuritySetting+

SiteSecuritySetting (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
air_gapped	Flag to indicate air gapped deployments If true, deployment is marked as air gapped deployment and operations that requires internet connectivity are expected to be supported through Global Manager.	boolean	Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value SiteSecuritySetting	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/sites/London/security-setting { "air_gapped": true } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

SiteSecuritySetting+

SiteSecuritySetting (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
air_gapped	Flag to indicate air gapped deployments If true, deployment is marked as air gapped deployment and operations that requires internet connectivity are expected to be supported through Global Manager.	boolean	Default: "False"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value SiteSecuritySetting	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "air_gapped": true, "resource_type": "SiteSecuritySetting", "id": "security-setting", "display_name": "security-setting", "path": "/global-infra/sites/LM/security-setting", "relative_path": "security-setting", "parent_path": "/global-infra/sites/LM", "unique_id": "ffaca9ae-4a90-4f9f-ba88-4369e02bf3e3", "owner_id": "6c5b2358-5862-49d8-952e-611b8cd32bf1", "marked_for_delete": false, "overridden": false, "_create_time": 1718858458723, "_create_user": "admin", "_last_modified_time": 1718858458723, "_last_modified_user": "admin", "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

This routine will delete site security setting

This routine will delete site security setting.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/sites/{site-id}/security-setting

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/sites/London/security-setting Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_security_settings Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Inventory

Inventory: Context Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/context-profiles
DELETE /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
GET /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
PATCH /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
PUT /global-manager/api/v1/global-infra/context-profiles/{context-profile-id}
GET /global-manager/api/v1/global-infra/context-profiles/attribute-types
GET /global-manager/api/v1/global-infra/context-profiles/attributes
PATCH /global-manager/api/v1/global-infra/context-profiles/custom-attributes (Deprecated)
POST /global-manager/api/v1/global-infra/context-profiles/custom-attributes (Deprecated)
GET /global-manager/api/v1/global-infra/context-profiles/custom-attributes/default
PATCH /global-manager/api/v1/global-infra/context-profiles/custom-attributes/default
POST /global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Get PolicyContextProfiles

Get all PolicyContextProfiles
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles

Request Headers:

n/a

Query Parameters:

PolicyContextProfileListRequestParameters+

PolicyContextProfileListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
has_unsupported_app_ids	Filter by unsupported App IDs If true, returns only context profiles that contain unsupported App IDs. If false, returns only context profiles with supported App IDs. If not specified, returns all context profiles regardless of App ID status.	boolean
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/ { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "TLS" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V13" ], "datatype":"STRING" }, { "key":"ENCRYPTION_ALGORITHM", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ], }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING" } ] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfileListResult+

Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or partially update a Policy Context Profile

Creates a new Policy Context Profile or selectively updates the fields
provided in the request body of an existing one.
Rules for using attributes and sub-attributes in a single PolicyContextProfile:
1. Each attribute key may appear only once per profile. (e.g. APP_ID
can be specified at most once.)
2. Multiple values for an attribute must be supplied as an array.
3. When sub-attributes are provided for an attribute, that attribute
must have exactly one value.
4. The reserved id "custom_attributes" must not be used as a profile id.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "SSL" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value":[ "TLS_V13" ], "datatype":"STRING" }, { "key":"TLS_CIPHER_SUITE", "value":[ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ] }, { "key":"DOMAIN_NAME", "value":[ "*.office365.com" ], "datatype":"STRING" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or replace a Policy Context Profile

Creates a new Policy Context Profile or fully replaces an existing one.
The entire profile is replaced with the contents of the request body;
any fields not included in the request will be reset to their defaults.
Rules for using attributes and sub-attributes in a single PolicyContextProfile:
1. Each attribute key may appear only once per profile. (e.g. APP_ID
can be specified at most once.)
2. Multiple values for an attribute must be supplied as an array.
3. When sub-attributes are provided for an attribute, that attribute
must have exactly one value.
4. The reserved id "custom_attributes" must not be used as a profile id.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "SSL" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V13" ], "datatype":"STRING" }, { "key":"TLS_CIPHER_SUITE", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ] }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get PolicyContextProfile

Get a single PolicyContextProfile by id
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile { "resource_type":"PolicyContextProfile", "display_name":"testPolicyContextProfile", "description":"Test Policy Context Profile", "attributes":[ { "key":"APP_ID", "value":[ "TLS" ], "datatype":"STRING", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V13" ], "datatype":"STRING" }, { "key":"ENCRYPTION_ALGORITHM", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5" ], "datatype":"STRING" } ], }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfile+

PolicyContextProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attributes	Array of Policy Context Profile attributes Property containing attributes/sub-attributes for Policy Context Profile.	array of PolicyAttributes	Required
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyContextProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Policy Context Profile

Deletes the specified Policy Context Profile. If the Policy Context
Profile is consumed in a firewall rule, it won't get deleted.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/{context-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideDeleteRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/testPolicyContextProfile Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List Context Profile supported attribute types

Returns supported attribute type strings for Context Profile.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/attribute-types

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/global-manager/api/v1/global-infra/context-profiles/attribute-types Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ProfileSupportedAttributeTypesResult+

Example Response: { "attribute_types": [ "APP_ID", "DOMAIN_NAME", "URL_CATEGORY", "URL_REPUTATION", "CUSTOM_URL" ] } Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List Policy Context Profile supported attributes and sub-attributes

Returns supported attributes and sub-attributes along with their allowed
values. When an attribute_key query parameter is supplied, only the
matching attribute and its sub-attributes are returned. When omitted,
all supported attribute keys and their corresponding values are returned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/attributes

Request Headers:

n/a

Query Parameters:

ProfileSupportedAttributesListRequestParameters+

ProfileSupportedAttributesListRequestParameters (schema)

Name	Description	Type	Notes
attribute_key	Fetch attributes and sub-attributes for the given attribute key It fetches attributes and subattributes for the given attribute key supported in the system which can be used for Policy Context Profile creation.	string
attribute_source	Source of the attribute, System Defined or custom It fetches attributes and sub attributes for the given attribute key based on the source of attribute which can be used for Policy Context Profile creation.	string	Enum: ALL, CUSTOM, SYSTEM Default: "SYSTEM"
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/attributes Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfileListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "attributes":[ { "key":"APP_ID", "value": [ "SSL" ], "datatype":"STRING", "description":"SSL (Secure Sockets Layer) is a cryptographic protocol that provides security over the Internet.", "sub_attributes":[ { "key":"TLS_VERSION", "value": [ "TLS_V10", "TLS_V11", "TLS_V12", "TLS_V13" ], "datatype":"STRING" }, { "key":"TLS_CIPHER_SUITE", "value": [ "TLS_RSA_EXPORT_WITH_RC4_40_MD5", "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA", ] "datatype":"STRING" } ], }, { "key":"DOMAIN_NAME", "value": [ "*.office365.com" ], "datatype":"STRING", "description":"Office 365 url" } ] } ] } Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Update custom object attribute value list for given attribute key (Deprecated)

This API updates custom attribute value list for given key.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyAttributes+

PolicyAttributes (schema)

Name	Description	Type	Notes
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: SYSTEM, CUSTOM Default: "SYSTEM"
custom_url_partial_match	true value would be treated as a partial match for custom url True value for this flag will be treated as a partial match for custom url	boolean
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
isALGType	Is the value ALG type Describes whether the APP_ID value is ALG type or not.	boolean
key	Key for attribute Policy Attribute Key - Denotes the type of attribute we are adding to the context profile or the L7 access profile. The keys has to be one of the enums defined for this field.	string	Required Enum: APP_ID, DOMAIN_NAME, URL_CATEGORY, URL_REPUTATION, CUSTOM_URL
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For URL CATEGORY key , it specified super category for url category value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Adds/Removes custom attribute values from list (Deprecated)

This API adds/removes custom attribute values from list for a given attribute key.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes

Request Headers:

n/a

Query Parameters:

CustomAttributeAction+

Request Body:

PolicyAttributes+

PolicyAttributes (schema)

Name	Description	Type	Notes
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: SYSTEM, CUSTOM Default: "SYSTEM"
custom_url_partial_match	true value would be treated as a partial match for custom url True value for this flag will be treated as a partial match for custom url	boolean
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
isALGType	Is the value ALG type Describes whether the APP_ID value is ALG type or not.	boolean
key	Key for attribute Policy Attribute Key - Denotes the type of attribute we are adding to the context profile or the L7 access profile. The keys has to be one of the enums defined for this field.	string	Required Enum: APP_ID, DOMAIN_NAME, URL_CATEGORY, URL_REPUTATION, CUSTOM_URL
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For URL CATEGORY key , it specified super category for url category value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes?action=add Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Update custom attribute value list for given attribute key.

This API updates custom attribute value list for given key in the request. This replaces the
existing list with the list provided in the request
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyCustomAttributes+

PolicyCustomAttributes (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: CUSTOM, SYSTEM Default: "CUSTOM"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key	Key for attribute Policy Custom Attribute Key	string	Required Enum: DOMAIN_NAME, CUSTOM_URL
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For Custom URL key , it specified url type for url value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyCustomAttributes	string
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default { "key":"DOMAIN_NAME", "value":[ "*.customdomainname1.com", "*.customdomainname2.com" ], "datatype":"STRING" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Retrieves custom attribute values for given attribute key

This API lists all the custom attribute values defined in the system for the attribute_key
mentioned as part of the url.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Request Headers:

n/a

Query Parameters:

ProfileSupportedAttributesListRequestParameters+

ProfileSupportedAttributesListRequestParameters (schema)

Name	Description	Type	Notes
attribute_key	Fetch attributes and sub-attributes for the given attribute key It fetches attributes and subattributes for the given attribute key supported in the system which can be used for Policy Context Profile creation.	string
attribute_source	Source of the attribute, System Defined or custom It fetches attributes and sub attributes for the given attribute key based on the source of attribute which can be used for Policy Context Profile creation.	string	Enum: ALL, CUSTOM, SYSTEM Default: "SYSTEM"
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default?attribute_key=DOMAIN_NAME Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContextProfileListResult+

Example Response: { "key":"DOMAIN_NAME", "value":[ "*.office365.com", "*.azure.com" ], "datatype":"STRING" } Required Permissions: read Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Adds/Removes custom attribute values from list

This API adds/removes custom attribute values from list for a given attribute key. The values in the
request will be added or removed from the existing list.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default

Request Headers:

n/a

Query Parameters:

CustomAttributeAction+

Request Body:

PolicyCustomAttributes+

PolicyCustomAttributes (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attribute_source	Source of attribute value i.e whether system defined or custom value	string	Enum: CUSTOM, SYSTEM Default: "CUSTOM"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
datatype	Datatype for attribute	string	Required Enum: STRING
description	Description for attribute value	string
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
key	Key for attribute Policy Custom Attribute Key	string	Required Enum: DOMAIN_NAME, CUSTOM_URL
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
metadata	Provide additional meta information about key/values This is optional part that can hold additional data about the attribute key/values. Example - For Custom URL key , it specified url type for url value. This is generic array and can hold multiple meta information about key/values in future	array of ContextProfileAttributesMetadata
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyCustomAttributes	string
sub_attributes	Reference to sub attributes for the attribute	array of PolicySubAttributes
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
value	Value for attribute key Multiple attribute values can be specified as elements of array.	array of string	Required Minimum items: 1

Example Request: POST https://<policy-mgr>/global-manager/api/v1/global-infra/context-profiles/custom-attributes/default?action=add { "key":"DOMAIN_NAME", "value":[ "*.customdomainname5.com", "*.customdomainname6.com" ], "datatype":"STRING" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_context_profile Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Inventory: Group Members

Associated URIs:

GET /global-manager/api/v1/global-infra/bms-group-associations
GET /global-manager/api/v1/global-infra/bmsi-group-associations
GET /global-manager/api/v1/global-infra/cloud-native-service-group-associations
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/bms
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/bmsi
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/cloud-native-service-instances
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvpg
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvports
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-addresses
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-groups
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-ports (Deprecated)
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-switches (Deprecated)
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/pods
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segment-ports
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segments
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/vifs
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/virtual-machines
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/vpcs
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/tags
GET /global-manager/api/v1/global-infra/group-associations
GET /global-manager/api/v1/global-infra/ip-address-group-associations
GET /global-manager/api/v1/global-infra/pod-group-associations
GET /global-manager/api/v1/global-infra/virtual-machine-group-associations
GET /global-manager/api/v1/global-infra/virtual-network-interface-group-associations

Get groups for which the given bare metal server (BMS) is a member

Get policy groups for which the given bare metal server (BMS) is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/bms-group-associations

Request Headers:

n/a

Query Parameters:

BareMetalServerGroupAssociationRequestParams+

BareMetalServerGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
bms_external_id	BMS external ID	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/bms-group-associations?bms_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

Example Response: { "result_count": 2, "results": [ { { "path" : "/infra/domains/domain1/groups/g1", "target_id" : "g1", "target_display_name" : "group-1", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308" }, { "path" : "/infra/domains/domain1/groups/g2", "target_id" : "g2", "target_display_name" : "group-2", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308" } } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given bare metal server interface (BMSI) is a member

Get policy groups for which the given bare metal server interface (BMSI) is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/bmsi-group-associations

Request Headers:

n/a

Query Parameters:

BareMetalServerInterfaceGroupAssociationRequestParams+

BareMetalServerInterfaceGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
bmsi_external_id	BMSI external ID	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/bmsi-group-associations?bmsi_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given Cloud Native Service Instance is a member

Get policy groups for which the given Cloud Native Service Instance is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/cloud-native-service-group-associations

Request Headers:

n/a

Query Parameters:

CNSGroupAssociationRequestParams+

CNSGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cns_external_id	Cloud Native Service external ID	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/cloud-native-service-group-associations?cns_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Effective Bare Metal Servers(BMS) that belong to this group.

Returns Effective Bare metal servers(BMS) that belong to this group.
This API is applicable only for Groups containing BMS member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/bms

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/bms?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BareMetalServerListResult+

Example Response: { "cursor" : "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "result_count": 1, "results": [ { "display_name": "BM-1", "tags": [ { "scope": "os", "tag": "linux86" } ], "resource_type": "BareMetalServer", "source_id": "74730a28-e52d-11e5-936e-6f061d405a11", "external_id": "74730a28-e52d-11e5-936e-6f061d405a22", "cpu_cores": 4 "os_info": { "os_name": "Ubuntu Linux (64-bit)", "os_version": "20.0" }, "_last_sync_time": 1493291539130 } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Effective Bare Metal Server Interfaces(BMSI) that belong to this group.

Returns Effective Bare metal server interfaces (BMSI) that belong to this group.
This API is applicable only for Groups containing BMSI member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/bmsi

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/bmsi?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BareMetalServerInterfaceListResult+

Example Response: { "cursor" : "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "result_count": 1, "results": [ { "external_id": "5006d98a-352f-134f-df6b-33e7f8d5de65", "tags": [ { "scope": "os", "tag": "linux86" } ], "resource_type": "BareMetalServerInterface", "bms_external_id": "5006d98a-352f-134f-df6b-33e7f8d54444", "display_name": "Interface1", "ip_addresses": [ "172.16.20.10", "fe80::250:56ff:fe86:f2b2" ], "mac_address": "00:50:56:86:f2:b2", "source_id": "74730a28-e52d-11e5-936e-6f061d405a28", "is_mgmt_interface": "true", "state": "UP" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Effective Cloud Native Service Instances that belong to this group.

Returns Effective Cloud Native Service Instances that belong to this group.
This API is applicable only for Groups containing CloudNativeServiceInstance member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/cloud-native-service-instances

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/cloud-native-service-instances?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "cursor" : "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "result_count" : 1, "results" : [ { "display_name" : "CNS-2", "id" : "420e72c9-55e7-a4f7-81bf-673a2af1a6cf" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Discovered Port Groups that belong to this Group

Get Discovered Port Groups that belong to this Group
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvpg

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/dvpg?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "dvpg-1", "display_name": "segment-1", "path": "/infra/segments/segment-1" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get discovered ports that belong to this Group

Get discovered ports that belong to this Group
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/dvports

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/segment-ports?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "default:4a5a3cd0-6f0a-40b0-a31a-1f55d51e1824", "display_name": "nbokare-10.160.129.166-vdtest-97902/VM-1-10.160.129.166-20190505-122351-03783733@b089f7e1-433f-4ecc-9722-ab5f2b66d391", "path": "/infra/segments/segment-1/ports/default:4a5a3cd0-6f0a-40b0-a31a-1f55d51e1824" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get IP addresses that belong to this Group

Get IP addresses that belong to this Group.
This API is applicable for Groups containing either VirtualMachine, VIF,
Segment ,Segment Port or IP Address member type.For Groups containing other
member types,an empty list is returned
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-addresses

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/ip-addresses?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupIPMembersListResult+

Example Response: { "result_count": 3, "results": [ "192.168.0.0/24", "192.168.0.1", "192.168.0.1-192.168.0.100" ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Effective IPGroups that belong to this group.

Returns effective IPGroups that belong to this group.
This API is applicable only for Groups containing IPSet member type.
For Groups containing other member types,it returns an empty list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/ip-groups

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/ip-groups?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "cursor": "00361f148bdc-fe7c-4320-8ef3-594e28d57c87Iws-2", "sort_ascending": true, "result_count": 2, "results": [ { "target_id" : "fcb51d1d-b141-4f5b-a0b9-1063a1470a63", "target_display_name" : "IPSet1", "target_type" : "IPSet", }, { "id" : "3eecac54-15e7-4a0d-b418-001052fcfdcd", "display_name" : "IPSet2", "target_type" : "IPSet" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get logical ports that belong to this Group (Deprecated)

Get logical ports that belong to this Group
This API is applicable for Groups containing either VirtualMachine, VIF,
Segment or Segment Port member type.For Groups containing other
member types,an empty list is returned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-ports

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/logical-ports?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "result_count": 2, "results": [ { "id" : "20c1ac1f-58b5-4241-a352-f8e82c4a8c65", "display_name" : "LP-HR1" }, { "id" : "c07005fe-4a9a-47f1-9a1e-2db65a285124", "display_name" : "LP-HR2" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get logical switches that belong to this Group (Deprecated)

Get logical switches that belong to this Group.
This API is applicable for Groups containing Segment member type.
For Groups containing other member types, an empty list is returned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/logical-switches

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/logical-switches?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "result_count": 2, "results": [ { "id" : "20c1ac1f-58b5-4241-a352-f8e82c4a8c65", "display_name" : "LS-HR1" }, { "id" : "c07005fe-4a9a-47f1-9a1e-2db65a285124", "display_name" : "LS-HR2" } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get pods that belong to this Group

Get pods that belong to this Group. This API is applicable for Groups
containing either Pod, Cluster, Namespace, Service member type. For
Groups containing other member types an empty list is returned
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/pods

Request Headers:

n/a

Query Parameters:

ContainerListRequestParameters+

ContainerListRequestParameters (schema)

Name	Description	Type	Notes
cluster_id	Cluster ID ID of the cluster to query	string
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/pods?enforcement_point_path=/global-infra/sites/default/enforcement-points/default&cluster_id=6ar43cd0-6f0a-40b0-a31a-1f55d51e1824 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyContainerGroupMembersListResult+

Example Response: { "results": [ { "cluster_id":"6ar43cd0-6f0a-40b0-a31a-1f55d51e1824", "pods":[ { "id": "4a5a3cd0-6f0a-40b0-a31a-1f55d51e1824", "display_name": "Container1" }, { "id": "54R3W356-6f0a-40b0-a31a-1f55d51e1824", "display_name": "Container2" } ] } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get segment ports that belong to this Group

Get segment ports that belong to this Group
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segment-ports

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get segments that belong to this Group

Get segments that belong to this Group
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/segments

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/segments?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "segment-1", "display_name": "segment-1", "path": "/infra/segments/segment-1" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Virtual Network Interface instances that belong to this Group

Get Virtual Network Interface instances that belong to this Group.
This API is applicable for Groups containing VirtualNetworkInterface and VirtualMachine member types.
For Groups containing other member types,an empty list is returned.target_id in response
is external_id of VirtualNetworkInterface or VirtualMachine.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/vifs

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/vifs?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VirtualNetworkInterfaceListResult+

Example Response: { "results": [ { "external_id": "564dda4e-bc05-061c-dac7-7a314e0e0c9c-4000", "owner_vm_id": "1778a2b0-7f9b-4c64-806c-bc13d6d60762", "owner_vm_type": "REGULAR", "host_id": "28477562-ea6f-11e9-9c84-f98983786a98", "vm_local_id_on_host": "1", "device_key": "4000", "device_name": "Network adapter 1", "mac_address": "00:0c:29:0e:0c:9c", "ip_address_info": [ { "source": "VM_TOOLS", "ip_addresses": [ "10.170.66.155", "fd01:3:4:2825:c5dc:25a5:fbb9:6762", "fd01:3:4:2825:2c49:a400:48df:23dd", "fd01:3:4:2825:34ca:5670:96e0:6edf", "fd01:3:4:2825:d9e4:5e51:6df6:c93e", "fd01:3:4:2825:b002:86da:30d4:1030", "fd01:3:4:2825:20c:29ff:fe0e:c9c", "fe80::20c:29ff:fe0e:c9c", "fd01:3:4:2825:eddf:5879:67d5:6293", "fd01:3:4:2825:f027:6316:8de5:3a29" ] } ], "resource_type": "VirtualNetworkInterface", "display_name": "Network adapter 1", "_last_sync_time": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get Virtual machines that belong to this Group

Get Virtual machines that belong to this Group.
This API is applicable for Groups containing VirtualMachine,member type.
For Groups containing other member types,an empty list is returned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/virtual-machines

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/virtual-machines?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

RealizedVirtualMachineListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "RealizedVirtualMachine", "id": "564de333-15ac-de52-da90-974fe099a17b", "display_name": "1-vm_ubuntu_1404_srv_64-local-586-bb9bbaf4-7f29-4e7a-9216-ef33890bf081", "path": "/infra/realized-state/enforcement-points/nsx-1/virtual-machines/564de333-15ac-de52-da90-974fe099a17b", "parent_path": "/infra/realized-state/enforcement-points/nsx-1", "relative_path": "564de333-15ac-de52-da90-974fe099a17b", "intent_reference": [], "realization_specific_identifier": "564de333-15ac-de52-da90-974fe099a17b", "alarms": [], "state": "REALIZED", "runtime_status": "UNKNOWN", "compute_ids": [ "moIdOnHost:1", "hostLocalId:1", "locationId:564de333-15ac-de52-da90-974fe099a17b", "instanceUuid:bb9bbaf4-7f29-4e7a-9216-ef33890bf081", "externalId:564de333-15ac-de52-da90-974fe099a17b", "biosUuid:564de333-15ac-de52-da90-974fe099a17b" ], "power_state": "VM_RUNNING", "_create_user": "system", "_create_time": 1519383616259, "_last_modified_user": "system", "_last_modified_time": 1519383616259, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get VPCs that belong to this Group

Get VPCs that belong to this Group
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/members/vpcs

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/members/vpcs?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyGroupMembersListResult+

Example Response: { "results": [ { "id": "vpc-1", "display_name": "vpc-1", "path": "/orgs/default/projects/project-1/vpcs/vpc-1" } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get tags used to define conditions inside a Group

Get tags used to define conditions inside a Group. Also
includes tags inside nested groups.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/tags

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/d1/groups/g1/tags Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupTagsList+

Example Response: { "result_count": 2, "results": [ { "member_type" : "IPSet", "tags" : [ "Web", "DB", "App" ] }, { "member_type" : "VirtualMachine", "tags" : [ "Linux", "Windows", "Mac" ] } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given object is a member

Get policy groups for which the given object is a member.
In Federation environment, if the given object is a global entity
(eg: global segment) and if the entity is not stretched to the site
specified in the enforcement_point_path parameter,then the following is returned:-
1)If the entity is a member of any global group and that group is stretched
to the enforcement_point_path site,then the API returns an empty list.
2)If the entity is not a member of any global group,this API returns
an 'invalid path' error message.
3)If both the entity and its corresponding groups are stretched to the
enforcement_point_path site , then the API returns the groups list.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/group-associations

Request Headers:

n/a

Query Parameters:

IntentEnforcementPointListRequestParams+

IntentEnforcementPointListRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
intent_path	String path of the intent object	string	Required
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/group-associations?intent_path=/global-infra/segment/s1&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

Example Response: { "result_count": 2, "results": [ { { "path" : "/infra/domains/domain1/groups/g1", "target_id" : "g1", "target_display_name" : "group-1", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308" }, { "path" : "/infra/domains/domain1/groups/g2", "target_id" : "g2", "target_display_name" : "group-2", "target_type" : "DOMAIN_GROUP", "is_valid" : "true", "owner_id": "4c5c5516-087a-47cd-9fba-a7669775d308", "origin_site_id": "4c5c5516-087a-47cd-9fba-a7669775d308", } } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given IP address is a member

Get policy groups for which the given IP address is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/ip-address-group-associations

Request Headers:

n/a

Query Parameters:

IPAddressGroupAssociationRequestParams+

IPAddressGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
ip_address	IPAddress	string	Required
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/ip-address-group-associations?ip_address=10.1.19.10&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given pod is a member

Get policy groups for which the given pod is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/pod-group-associations

Request Headers:

n/a

Query Parameters:

ContainerApplicationInstanceGroupAssociationRequestParams+

ContainerApplicationInstanceGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
pod_id	ContainerApplicationInstance	string	Required
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/pod-group-associations?pod_id=64dde333-15ac-de52-da90-974de459a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given VM is a member

Get policy groups for which the given VM is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/virtual-machine-group-associations

Request Headers:

n/a

Query Parameters:

VMGroupAssociationRequestParams+

VMGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
vm_external_id	Virtual machine external ID	string	Required

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/virtual-machine-group-associations?vm_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get groups for which the given VIF is a member

Get policy groups for which the given VIF is a member.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/virtual-network-interface-group-associations

Request Headers:

n/a

Query Parameters:

VIFGroupAssociationRequestParams+

VIFGroupAssociationRequestParams (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of groups needs to be fetched. Forward slashes must be escaped using %2F. If no enforcement point path is specified, the default enforcement point is considered	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
vif_external_id	Virtual network interface external ID	string	Required

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/virtual-network-interface-group-associations?vif_external_id=564de333-15ac-de52-da90-974fe099a17b&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceForEPListResult+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Inventory: Groups

Associated URIs:

GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
PUT /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
GET /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/member-types
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
POST /global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

List Groups for a domain

List Groups for a domain. Groups can be filtered using member_types query parameter,
which returns the groups that contains the specified member types. Multiple member types
can be provided as comma separated values. The API also return groups having member
type that are subset of provided member_types.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups

Request Headers:

n/a

Query Parameters:

GroupListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "Group", "description": "web group", "id": "webgroup", "display_name": "web group", "path": "/infra/domains/vmc/groups/webgroup", "parent_path": "/infra/domains/vmc", "relative_path": "webgroup", "expression": [ { "resource_type": "Condition", "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "_protection": "NOT_PROTECTED" } ], "_create_user": "admin", "_create_time": 1517308749250, "_last_modified_user": "admin", "_last_modified_time": 1517308749250, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a group

If a group with the group-id is not already present, create a new group.
If it already exists, patch the group.
Group created with Kubernetes membership criteria includes only Antrea reported inventory as its members.
Once created, Groups with Identity (Directory) Group members should be updated with the new Distinguished Name in case it is changed on AD Server.
Maximum of 500 malicious IP Groups (i.e Group with criteria having IPAddress equals All MALICIOUS_IP) should be created.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed the defined Config Max limit for the form-factor of Manager nodes. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group This field is no longer supported in this API. To get the realized status of the Group use the realized-state API.	string	Deprecated Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a group

If a group with the group-id is not already present, create a new group.
If it already exists, update the group.
Avoid creating groups with multiple MACAddressExpression and IPAddressExpression.
In future releases, group will be restricted to contain a single
MACAddressExpression and IPAddressExpression along with other expressions.
To group IPAddresses or MACAddresses, use nested groups instead of multiple
IPAddressExpressions/MACAddressExpression.
Group created with Kubernetes membership criteria includes only Antrea reported inventory as its members.
Once created, Groups with Identity (Directory) Group members should be updated with the new Distinguished Name in case it is changed on AD Server.
Maximum of 500 malicious IP Groups (i.e Group with criteria having IPAddress equals All MALICIOUS_IP) should be created.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed the defined Config Max limit for the form-factor of Manager nodes. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group This field is no longer supported in this API. To get the realized status of the Group use the realized-state API.	string	Deprecated Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup { "expression": [ { "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "resource_type": "Condition" } ], "description": "web group", "display_name": "web group", "_revision":0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed the defined Config Max limit for the form-factor of Manager nodes. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group This field is no longer supported in this API. To get the realized status of the Group use the realized-state API.	string	Deprecated Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Group", "description": "web group", "id": "webgroup", "display_name": "web group", "path": "/infra/domains/vmc/groups/webgroup", "parent_path": "/infra/domains/vmc", "relative_path": "webgroup", "expression": [ { "resource_type": "Condition", "member_type": "VirtualMachine", "value": "webvm", "key": "Tag", "operator": "EQUALS", "_protection": "NOT_PROTECTED" } ], "_create_user": "admin", "_create_time": 1517308749250, "_last_modified_user": "admin", "_last_modified_time": 1517308749250, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read a group by ID

Returns the configuration of a specific group within a domain, identified
by domain ID and group ID. Groups define membership criteria for workloads and are
used as sources, destinations, and scopes in security policies.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Group+

Group (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildDnsSecurityProfileBindingMap ChildGroupDiscoveryProfileBindingMap ChildPolicyFirewallFloodProtectionProfileBindingMap ChildPolicyFirewallSessionTimerProfileBindingMap
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
expression	Expression The expression list must follow below criteria: 1. A non-empty expression list, must be of odd size. In a list, with indices starting from 0, all non-conjunction expressions must be at even indices, separated by a conjunction expression at odd indices. 2. The total of ConditionExpression and NestedExpression in a list should not exceed 5. 3. The total of IPAddressExpression, MACAddressExpression, external IDs in an ExternalIDExpression and paths in a PathExpression must not exceed the defined Config Max limit for the form-factor of Manager nodes. 4. Each expression must be a valid Expression. See the definition of the Expression type for more information.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression
extended_expression	Extended Expression Extended Expression allows additional higher level context to be specified for grouping criteria. (e.g. user AD group) This field allow users to specified user context as the source of a firewall rule for IDFW feature. Current version only support a single IdentityGroupExpression. In the future, this might expand to support other conjunction and non-conjunction expression. The extended expression list must follow below criteria: 1. Contains a single IdentityGroupExpression. No conjunction expression is supported. 2. No other non-conjunction expression is supported, except for IdentityGroupExpression. 3. Each expression must be a valid Expression. See the definition of the Expression type for more information. 4. Extended expression are implicitly AND with expression. 5. No nesting can be supported if this value is used. 6. If a Group is using extended expression, this group must be the only member in the source field of an communication map.	array of Expression (Abstract type: pass one of the following concrete types) Condition ConjunctionOperator ExternalIDExpression GeoLocationExpression GroupScopeExpression IPAddressExpression IdentityGroupExpression MACAddressExpression NestedExpression PathExpression	Maximum items: 1
group_type	Indicates the group type. Group type can be specified during create and update of a group. Empty group type indicates a 'generic' group, ie group can include any entity from the valid GroupMemberType.	array of GroupTypes	Maximum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
reference	Indicates if the group is a reference. If true, indicates that this is a remote reference group. Such group will have span different from the its parent domain. Default value is false.	boolean	Readonly Default: "False"
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Group	string
state	Realization state of this group This field is no longer supported in this API. To get the realized status of the Group use the realized-state API.	string	Deprecated Readonly Enum: IN_PROGRESS, SUCCESS, FAILURE
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Group

Delete the group with group_id under domain domain_id. The force query parameter supported on the
API is deprecated. Usage of the force query parameter does not alter the behaviour of the API. The
API just ignores the force parameter.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}

Request Headers:

n/a

Query Parameters:

GroupDeleteRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a group external ID expression

If a group ExternalIDexpression with the expression-id is not already present, create a new ExternalIDexpresison.
If it already exists, replace the existing ExternalIDexpression.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ExternalIDExpression+

ExternalIDExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
external_ids	Array of external IDs for the specified member type This array can consist of one or more external IDs for the specified member type.	array of string	Required Minimum items: 1
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
member_type	External ID member type	string	Required Enum: VirtualMachine, VirtualNetworkInterface, CloudNativeServiceInstance, BareMetalServer, BareMetalServerInterface
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ExternalIDExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression, GeoLocationExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/external-id-expressions/exp1 { "member_type": "VirtualMachine", "external_ids": [ "00989582-0920-459e-a8a6-ebf65a140aa9" ], "resource_type": "ExternalIDExpression", "id": "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Group External ID Expression

Delete Group External ID Expression Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/external-id-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Add or Remove external id based members from/to a Group

It will add or remove the specified members having external ID for a given expression of a group.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

GroupMemberList+

Example Request: ## For adding external id based members to a Group POST /global-infra/domains/default/groups/VMGroup/external-id-expressions/vmexp?action=add { "members": [ "527ef6f5-0fea-b910-1efb-0991e41e44cd", "527ef6f5-0fea-b910-1efb-0991e41e44ce" ] } ## For removing external id based members from a Group POST /global-infra/domains/default/groups/VMGroup/external-id-expressions/vmexp?action=remove { "members": [ "527ef6f5-0fea-b910-1efb-0991e41e44cd", "527ef6f5-0fea-b910-1efb-0991e41e44ce" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a group IP Address expression

If a group IPAddressExpression with the expression-id is not already present, create a new IPAddressExpression.
If it already exists, replace the existing IPAddressExpression.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

IPAddressExpression+

IPAddressExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
ip_addresses	Array of IP addresses This array can consist of a single IP address, IP address range or a subnet. Its type can be of either IPv4 or IPv6. Both IPv4 and IPv6 addresses within one expression is not allowed. Supported list of formats are, "192.168.1.1", "192.168.1.1-192.168.1.100", "192.168.0.0/24", "fe80::250:56ff:fe83:318c", "fe80::250:56ff:fe83:3181-fe80::250:56ff:fe83:318c", "fe80::250:56ff:fe83:318c/64". The max limit for number of IP addresses applies across all expressions in a group. Please refer to Config Max limits specification document for a given environment.	array of IPElement	Required Minimum items: 1 Maximum items: 25000
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IPAddressExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression, GeoLocationExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/ip-address-expressions/exp1 { "ip_addresses": [ "10.110.9.21", "10.112.9.22" ], "resource_type": "IPAddressExpression", "id" : "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Group IPAddressExpression

Delete Group IPAddressExpression Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/ip-address-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Add or Remove IP Addresses from/to a Group

It will add or remove the specified IP Addresses from a given expression of a group.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

IPAddressList+

Example Request: ## For adding ip addresses to a Group POST /global-infra/domains/default/groups/IPGroup/ip-address-expressions/ipaddressexp?action=add { "ip_addresses": [ "10.110.9.4-10.110.9.10", "10.110.9.3/24" ] } ## For removing ip addresses from a Group POST /global-infra/domains/default/groups/IPGroup/ip-address-expressions/ipaddressexp?action=remove { "ip_addresses": [ "10.110.9.4-10.110.9.10", "10.110.9.3/24" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a group MAC Address expression

If a group MACAddressExpression with the expression-id is not already present, create a new MACAddressExpression.
If it already exists, replace the existing MACAddressExpression.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

MACAddressExpression+

MACAddressExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mac_addresses	Array of MAC addresses This array can consist of one or more MAC addresses. Max limit of 4000 MAC addresses applies across all the expressions.	array of MACAddress	Required Minimum items: 1 Maximum items: 4000
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value MACAddressExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression, GeoLocationExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/mac-address-expressions/exp1 { "mac_addresses": [ "00:0a:95:9d:68:21", "00:0a:95:9d:68:22" ], "resource_type": "MACAddressExpression", "id" : "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Group MACAddressExpression

Delete Group MACAddressExpression Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/mac-address-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Add or Remove MAC Addresses from/to a Group

It will add or remove the specified MAC Addresses from a given expression of a group.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

MACAddressList+

Example Request: ## For adding mac addresses to a Group POST /global-infra/domains/default/groups/MACGroup/mac-address-expressions/macaddressexp?action=add { "mac_addresses": [ "00:0a:95:9d:68:16", "00:0a:95:9d:68:17" ] } ## For removing mac addresses from a Group POST /global-infra/domains/default/groups/MACGroup/mac-address-expressions/macaddressexp?action=remove { "mac_addresses": [ "00:0a:95:9d:68:16", "00:0a:95:9d:68:17" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get member types for a given Group based on the expressions used in the group.

It retrieves member types for a given group - based on the expression used in the group or the definition of the
group via static and dynamic criteria. In case of nested groups, it calculates member types of child groups as well.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/member-types

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/member-types Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

GroupMemberTypeListResult+

Example Response: { "resultCount": 1, "results" : ["VirtualMachine"] } Required Permissions: read Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a group path expression

If a group path_expression with the expression-id is not already present, create a new pathexpresison.
If it already exists, replace the existing pathexpression.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PathExpression+

PathExpression (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
paths	Array of policy paths This array can consist of one or more policy paths. Only policy paths of groups, segments and policy logical ports are allowed.	array of string	Required Minimum items: 1
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PathExpression	string	Required Enum: Condition, ConjunctionOperator, NestedExpression, IPAddressExpression, MACAddressExpression, ExternalIDExpression, PathExpression, IdentityGroupExpression, GeoLocationExpression
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/path-expression/exp1 { "paths": [ "/global-infra/domains/default/groups/childgroup8" ], "resource_type": "PathExpression", "id": "exp1" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Group Path Expression

Delete Group Path Expression Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/domains/vmc/groups/webgroup/path-expressions/exp1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Add or Remove path based members from/to a Group

It will add or remove the specified members having path for a given expression of a group.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Request Headers:

n/a

Query Parameters:

GroupMemberActionParameters+

Request Body:

GroupMemberList+

Example Request: ## For adding path based members to a Group POST /global-infra/domains/default/groups/NestedGroup/path-expressions/pathexp?action=add { "members": [ "/global-infra/domains/default/groups/GroupTag", "/global-infra/domains/default/groups/VMGroup" ] } ## For removing path based members from a Group POST /global-infra/domains/default/groups/NestedGroup/path-expressions/pathexp?action=remove { "members": [ "/global-infra/domains/default/groups/GroupTag", "/global-infra/domains/default/groups/VMGroup" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_grouping Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Inventory: Services

Associated URIs:

GET /global-manager/api/v1/global-infra/services
DELETE /global-manager/api/v1/global-infra/services/{service-id}
GET /global-manager/api/v1/global-infra/services/{service-id}
PATCH /global-manager/api/v1/global-infra/services/{service-id}
PUT /global-manager/api/v1/global-infra/services/{service-id}
GET /global-manager/api/v1/global-infra/services/{service-id}/service-entries
DELETE /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}
GET /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}
PATCH /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}
PUT /global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

List all Services

Returns a paginated list of all services.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services

Request Headers:

n/a

Query Parameters:

ServiceListRequestParameters+

ServiceListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
default_service	Fetch all default services If set to true, then it will display only default services. If set to false, then it will display all user defined services. If it is not provided, then complete (default as well as user defined) list of services will be displayed.	boolean
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ServiceListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 402, "results": [ { "resource_type": "Service", "description": "AD Server", "id": "AD_Server", "display_name": "AD Server", "path": "/infra/services/AD_Server", "parent_path": "/infra/services/AD_Server", "relative_path": "AD_Server", "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "id": "AD_Server", "display_name": "AD Server", "path": "/infra/services/AD_Server/service-entries/AD_Server", "parent_path": "/infra/services/AD_Server", "relative_path": "AD_Server", "destination_ports": [ "1024" ], "l4_protocol": "TCP", "_create_user": "system", "_create_time": 1517296380484, "_last_modified_user": "system", "_last_modified_time": 1517296380484, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "_create_user": "system", "_create_time": 1517296380468, "_last_modified_user": "system", "_last_modified_time": 1517296380468, "_system_owned": true, "_protection": "NOT_PROTECTED", "_revision": 0 } } Required Permissions: read Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a Service

Create a new service if a service with the given ID does not already
exist. Creates new service entries if populated in the service.
If a service with the given ID already exists, update the service
including the nested service entries. This is a full replace.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, ETHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http { "description": "My HTTP", "display_name": "My HTTP", "_revision": 0, "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, ETHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "Service", "description": "My HTTP", "id": "my-http", "display_name": "My HTTP", "path": "/infra/services/my-http", "parent_path": "/infra/services/my-http", "relative_path": "my-http", "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "id": "MyHttpEntry", "display_name": "MyHttpEntry", "path": "/infra/services/my-http/service-entries/MyHttpEntry", "parent_path": "/infra/services/my-http", "relative_path": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517310677617, "_last_modified_user": "admin", "_last_modified_time": 1517310677617, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "_create_user": "admin", "_create_time": 1517310677604, "_last_modified_user": "admin", "_last_modified_time": 1517310677604, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a Service

Create a new service if a service with the given ID does not already
exist. Creates new service entries if populated in the service.
If a service with the given ID already exists, patch the service
including the nested service entries.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, ETHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http { "description": "My HTTP Patched", "display_name": "My HTTP", "service_entries": [ { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read a service by ID

Returns the configuration of a specific service identified by service ID.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Service+

Service (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource (Abstract type: pass one of the following concrete types) ChildServiceEntry
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
is_default	Flag for default services The flag, if true, indicates that service is created in the system by default. Such default services can't be modified/deleted.	boolean	Readonly Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Service	string
service_entries	Service type Service entries for this service	array of ServiceEntry (Abstract type: pass one of the following concrete types) ALGTypeServiceEntry EtherTypeServiceEntry ICMPTypeServiceEntry IGMPTypeServiceEntry IPProtocolServiceEntry L4PortSetServiceEntry NestedServiceServiceEntry
service_type	Type of service, ETHER or NON_ETHER	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Service

Delete Service Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List Service entries for the given service

Return list of Service entries for the given service
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries

Request Headers:

n/a

Query Parameters:

ServiceEntryListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ServiceEntryListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 2, "results": [ { "resource_type": "L4PortSetServiceEntry", "id": "MyHttpEntry", "display_name": "MyHttpEntry", "path": "/infra/services/my-http/service-entries/MyHttpEntry", "parent_path": "/infra/services/my-http", "relative_path": "MyHttpEntry", "destination_ports": [ "8080" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517310677617, "_last_modified_user": "admin", "_last_modified_time": 1517310677617, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "L4PortSetServiceEntry", "id": "https", "display_name": "MyHttps", "path": "/infra/services/my-http/service-entries/https", "parent_path": "/infra/services/my-http", "relative_path": "https", "destination_ports": [ "7443" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517316057383, "_last_modified_user": "admin", "_last_modified_time": 1517316057383, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a ServiceEntry

If a service entry with the service-entry-id is not already present,
create a new service entry. If it already exists, update the service
entry.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol for this service entry. NBNS_BROADCAST and NBDG_BROADCAST are deprecated; use a UDP L4PortSetServiceEntry instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number	IP protocol number IP protocol number (valid range: 0-255)	integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttps", "destination_ports": [ "7443" ], "l4_protocol": "TCP", "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol for this service entry. NBNS_BROADCAST and NBDG_BROADCAST are deprecated; use a UDP L4PortSetServiceEntry instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number	IP protocol number IP protocol number (valid range: 0-255)	integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "L4PortSetServiceEntry", "id": "https", "display_name": "MyHttps", "path": "/infra/services/my-http/service-entries/https", "parent_path": "/infra/services/my-http", "relative_path": "https", "destination_ports": [ "7443" ], "l4_protocol": "TCP", "_create_user": "admin", "_create_time": 1517316057383, "_last_modified_user": "admin", "_last_modified_time": 1517316057383, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch a ServiceEntry

If a service entry with the service-entry-id is not already present,
create a new service entry. If it already exists, patch the service
entry.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol for this service entry. NBNS_BROADCAST and NBDG_BROADCAST are deprecated; use a UDP L4PortSetServiceEntry instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number	IP protocol number IP protocol number (valid range: 0-255)	integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https { "resource_type": "L4PortSetServiceEntry", "display_name": "MyHttps", "destination_ports": [ "9443" ], "l4_protocol": "TCP" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read service entry

Read service entry Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ALGTypeServiceEntry+

ALGTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
alg	Application Layer Gateway (ALG) protocol The Application Layer Gateway (ALG) protocol for this service entry. NBNS_BROADCAST and NBDG_BROADCAST are deprecated; use a UDP L4PortSetServiceEntry instead.	string	Required Enum: ORACLE_TNS, FTP, SUN_RPC_TCP, SUN_RPC_UDP, MS_RPC_TCP, MS_RPC_UDP, NBNS_BROADCAST, NBDG_BROADCAST, TFTP
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	The destination_port cannot be empty and must be a single value.	array of PortElement	Required Minimum items: 1 Maximum items: 1
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ALGTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

EtherTypeServiceEntry+

EtherTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
ether_type	Type of the encapsulated protocol	integer	Required
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EtherTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

ICMPTypeServiceEntry+

ICMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
icmp_code	ICMP message code	integer	Minimum: 0 Maximum: 255
icmp_type	ICMP message type	integer	Minimum: 0 Maximum: 255
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol		string	Required Enum: ICMPv4, ICMPv6
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value ICMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IGMPTypeServiceEntry+

IGMPTypeServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IGMPTypeServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

IPProtocolServiceEntry+

IPProtocolServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protocol_number	IP protocol number IP protocol number (valid range: 0-255)	integer	Required Minimum: 0 Maximum: 255
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value IPProtocolServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

L4PortSetServiceEntry+

L4PortSetServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
l4_protocol		string	Required Enum: TCP, UDP
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value L4PortSetServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
source_ports	Number of values should not exceed 15, ranges count as 2 values.	array of PortElement	Maximum items: 15
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

NestedServiceServiceEntry+

NestedServiceServiceEntry (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
nested_service_path	path of nested service	string	Required
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value NestedServiceServiceEntry	string	Required Enum: IPProtocolServiceEntry, IGMPTypeServiceEntry, ICMPTypeServiceEntry, ALGTypeServiceEntry, L4PortSetServiceEntry, EtherTypeServiceEntry, NestedServiceServiceEntry
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Service entry

Delete Service entry Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/services/{service-id}/service-entries/{service-entry-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/services/my-http/service-entries/https Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_services Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Inventory: Tags

Associated URIs:

DELETE /global-manager/api/v1/global-infra/categories/{category-id}/tags/{tag-id}/attachments
GET /global-manager/api/v1/global-infra/categories/{category-id}/tags/{tag-id}/attachments
PATCH /global-manager/api/v1/global-infra/categories/{category-id}/tags/{tag-id}/attachments
GET /global-manager/api/v1/global-infra/tags
GET /global-manager/api/v1/global-infra/tags/effective-resources
GET /global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}
PUT /global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}
GET /global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}/status

Create or update vm tag attachment

Create or update vm tag attachment Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/categories/{category-id}/tags/{tag-id}/attachments

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

TagAttachment+

TagAttachment (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
remove_from	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
resource_type	Must be set to the value TagAttachment	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tag/tag1/attachments { "remove_from": [ {"resource_type" : "VIRTUAL_MACHINE", "resource_ids": ["vm0"] }, { "resource_type" : "VIRTUAL_MACHINE", "resource_ids": ["vm4"] }, { "resource_type" : "SEGMENT", "resource_ids": ["seg"] } ], "apply_to": [ { "resource_type" : "VIRTUAL_MACHINE", "resource_ids": ["vm1", "vm3"] }, { "resource_type" : "SEGMENT", "resource_ids": ["seg3","seg1"] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagAttachmentResponse+

TagAttachmentResponse (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attached_to	List of resources on which tag is applied List of resources on which tag is applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
failed_to_attach	List to resources on which tag can not be applied	array of ResourceInfo
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TagAttachmentResponse	string
tag_path	Tag path Tag policy path of the attachment	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "attached_to": [ { "resource_type": "VIRTUAL_MACHINE", "resource_ids": [ "vm1", "vm3" ] }, { "resource_type": "SEGMENT", "resource_ids": [ "seg1", "seg3" ] } ], "tag_path": "/infra/tag/tag1", "marked_for_delete": false, "overridden": false, "_protection": "NOT_PROTECTED" } Required Permissions: crud Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get tag attachments

Get tag attachments Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/categories/{category-id}/tags/{tag-id}/attachments

Request Headers:

n/a

Query Parameters:

TagAttachmentRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tag//attachments ### for particalar resource type GET https://<policy-mgr>/global-manager/api/v1/global-infra/tag//attachments?resource_type=VIRTUAL_MACHINE Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagAttachmentResponse+

TagAttachmentResponse (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
attached_to	List of resources on which tag is applied List of resources on which tag is applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
failed_to_attach	List to resources on which tag can not be applied	array of ResourceInfo
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value TagAttachmentResponse	string
tag_path	Tag path Tag policy path of the attachment	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete tag attachments

Delete tag attachments Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/categories/{category-id}/tags/{tag-id}/attachments

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tag//attachments Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List all unique tags.

Returns paginated list of all unique tags. Supports filtering by scope, tag and
source from which tags are synced. Supports starts with, ends with, equals and
contains operators on scope and tag values.
To filter tags by starts with on scope or tag, use '*' as suffix after the value.
To filter tags by ends with on scope or tag, use '*' as prefix before the value.
To filter tags by contain on scope or tag, use '*' as prefix and suffix on the value.
Below special characters in the filter value needs to be escaped with hex values.
- Character '&' needs to be escaped as '%26'
- Character '[' needs to be escaped as '%5B'
- Character ']' needs to be escaped as '%5D'
- Character '+' needs to be escaped as '%2B'
- Character '#' needs to be escaped as '%23'
Sort option for list of unique tags is available only on tag and scope properties.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags

Request Headers:

n/a

Query Parameters:

TagInfoListRequestParameters+

TagInfoListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
scope	Tag scope	string
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	Source from which tags are synced.	string	Enum: Amazon, Azure, NSX, ANY
tag	Tag value	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagInfoListResult+

Example Response: ## For /infra/tags ## { "results": [ { "scope": "os", "tag": "windows", "tagged_objects": 250 }, { "scope": "os", "tag": "ubantu", "tagged_objects": 100 } ], "result_count": 2 } ## For /infra/tags?tag=win* ## { "results": [ { "scope": "os", "tag": "windows", "tagged_objects": 250 } ], "result_count": 1 } ## For /infra/tags?tag=*ban* ## { "results": [ { "scope": "os", "tag": "ubantu", "tagged_objects": 100 } ], "result_count": 1 } Required Permissions: read Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List all objects assigned with matching scope and tag values

Paginated list of all objects assigned with matching scope and tag values. Objects
are represented in form of resource reference. Sort option is available only on
target_type and target_display_name properties.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags/effective-resources

Request Headers:

n/a

Query Parameters:

TaggedObjectsListRequestParameters+

TaggedObjectsListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
filter_by	Comma-separated list of field names to filter tagged objects. Comma-separated list of field names used to filter tagged objects. Supported field names are resource_type, display_name and external_id.	string
filter_text	Filter text to restrict tagged objects list with matching filter text.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
scope	Tag scope	string
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
tag	Tag value	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags/effective-resources?scope=type&tag=app Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyResourceReferenceListResult+

Example Response: { "results": [ { "target_type": "VirtualMachine", "target_display_name": "App-VM-1", "target_id": "564d8b81-983d-b8ef-686b-161205939c58" }, { "target_type": "Group", "target_display_name": "app-vms", "path": "/infra/domains/default/groups/app-vms" } ], "result_count": 2 } Required Permissions: read Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Assign or Unassign tag on multiple Virtual Machines.

Tag can be assigned or unassigned on multiple objects. Supported object type is
restricted to Virtual Machine for now and support for other objects will be added
later. Permissions for tag bulk operation would be similar to virtual machine
tag permissions.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

TagBulkOperation+

TagBulkOperation (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
remove_from	List of resources from which tag needs to be removed List of resources from which tag needs to be removed.	array of ResourceInfo
resource_type	Must be set to the value TagBulkOperation	string
tag	Tag	Tag	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tags/tag-operations/win-vm-update { "tag": { "scope": "os", "tag": "windows" }, "apply_to": [ { "resource_type": "VirtualMachine", "resource_ids": [ "ee98a906-7b84-42ae-9413-d812cdb64543" ] } ], "remove_from":[ { "resource_type": "VirtualMachine", "resource_ids": [ "564d8b81-983d-b8ef-686b-161205939c58" ] } ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagBulkOperation+

TagBulkOperation (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
remove_from	List of resources from which tag needs to be removed List of resources from which tag needs to be removed.	array of ResourceInfo
resource_type	Must be set to the value TagBulkOperation	string
tag	Tag	Tag	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "tag": { "scope": "os", "tag": "windows" }, "apply_to": [ { "resource_type": "VirtualMachine", "resource_ids": [ "ee98a906-7b84-42ae-9413-d812cdb64543" ] } ], "remove_from":[ { "resource_type": "VirtualMachine", "resource_ids": [ "564d8b81-983d-b8ef-686b-161205939c58" ] } ], "resource_type": "TagBulkOperation", "id": "win-vm-update", "display_name": "win-vm-update", "path": "/infra/tags/tag-operations/win-vm-update", "relative_path": "win-vm-update", "parent_path": "/infra/tags/tag-operations", "marked_for_delete": false, "_create_user": "admin", "_create_time": 1544641564432, "_last_modified_user": "admin", "_last_modified_time": 1544641564432, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get details of tag bulk operation request

Get details of tag bulk operation request with which tag is applied or removed
on virtual machines.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags/tag-operations/win-vm-update Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagBulkOperation+

TagBulkOperation (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
apply_to	List of resources on which tag needs to be applied List of resources on which tag needs to be applied.	array of ResourceInfo
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
remove_from	List of resources from which tag needs to be removed List of resources from which tag needs to be removed.	array of ResourceInfo
resource_type	Must be set to the value TagBulkOperation	string
tag	Tag	Tag	Required
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get status of tag bulk operation

Get status of tag bulk operation with details of tag operation on each virtual machine.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tags/tag-operations/{operation-id}/status

Request Headers:

n/a

Query Parameters:

RealizationListRequestParameters+

RealizationListRequestParameters (schema)

Name	Description	Type	Notes
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point The path of the enforcement point from which the list of members needs to be fetched. Forward slashes must be escaped using %2F.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tags/tag-operations/win-vm-update/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

TagBulkOperationStatus+

Example Response: { "tag": { "scope": "os", "tag": "windows" }, "status": "Error", "apply_to": [ { "resource_type": "VirtualMachine", "resource_tag_status": [ { "resource_id": "e98a906-7b84-42ae-9413-d812cdb64543", "tag_status": "Success" } ] } ], "remove_from":[ { "resource_type": "VirtualMachine", "resource_tag_status": [ { "resource_id": "564d8b81-983d-b8ef-686b-161205939c58", "tag_status": "Error", "details": "VM with external id not found" } ] } ], } Required Permissions: crud Feature: policy_vm_vm_tags Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Inventory: Vm

Associated URIs:

GET /global-manager/api/v1/global-infra/vm-tag-replication-policies
DELETE /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}
GET /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}
PATCH /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}
PUT /global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

List all VM tag replication policies

List all VM tag replication policies.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies

Request Headers:

n/a

Query Parameters:

VMTagReplicationPolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VMTagReplicationPolicyListResult+

Example Response: { "result_count": 1, "results": [ { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "vm_match_criteria": "MATCH_NSX_ATTACHMENT_ID", "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ], "id": "policy1", "path": "/global-infra/vm-tag-replication-policies/policy1", "_revision": 2 } ] } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the VM tag replication policy specified by id

Get the VM tag replication policy specified by id.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

Example Response: { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "vm_match_criteria": "MATCH_NSX_ATTACHMENT_ID", "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ], "id": "policy1", "path": "/global-infra/vm-tag-replication-policies/policy1", "_revision": 2 } Required Permissions: read Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update the VM tag replication policy

Create or update the VM tag replication policy.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

Example Request: PUT https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Patch the VM tag replication policy

Patch the VM tag replication policy.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

VMTagReplicationPolicy+

VMTagReplicationPolicy (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
groups	Paths of groups Paths of groups (VM tag-based, VM name-based, etc.) that translates into VMs to be replicated from protected site to recovery sites. If no group is specified, none of the VM tag will be replicated from protected site to recovery sites.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
protected_site	A path of protected site A path of protected site, from where tags of selected VMs will be replicated to recovery sites.	string	Required
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
recovery_sites	Paths of recovery sites Paths of recovery sites, where tags of selected VMs will be replicated to, from protected site.	array of string	Required Minimum items: 1 Maximum items: 1
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
replication_type	Replication type used in DR failover Specifies type of replication used in DR (Disaster Recovery) failover.	string	Enum: VSPHERE_REPLICATION, STORAGE_ARRAY_REPLICATION, OTHER Default: "OTHER"
resource_type	Must be set to the value VMTagReplicationPolicy	string
tag_delay_delete_time	Specifies delay time to be used for tags of virtual machine This specifies delay in minutes which is used for deletion of tags of virtual machines on recovery site. If a VM is deleted on protected site and has not appeared on recovery site (e.g. this can happen primarily when array based storage replication is used with SRM and DR failover is run while protected site is reachable), the tags will be retained for this much amount of time on recovery site. VM appears within this much time on recovery site, then tags will get applied on recovery site. If replication type is VSPHERE_REPLICATION or OTHER, then its default value is 0 minutes. If replication type is STORAGE_ARRAY_REPLICATION, then its default value is 30 minutes. If this value is not specified, then default value according to replication type will be applicable. The time for virtual machines to appear on recovery site after those are deleted from primary site in case of storage replication depends on count of virtual machines configured to failover, storage array performance and ESXi host.	integer	Minimum: 0 Maximum: 4320
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vm_match_criteria	Matching criteria used for associating VMs Matching criteria used for associating VMs from protected site to VMs on recovery sites. - MATCH_NSX_ATTACHMENT_ID : Associate VMs from the protected site and recovery sites based on NSX attachment ID. - MATCH_BIOS_UUID_NAME : Associate VMs from the protected site and recovery sites based on (VM BIOS UUID + VM Name).	string	Enum: MATCH_NSX_ATTACHMENT_ID, MATCH_BIOS_UUID_NAME Default: "MATCH_NSX_ATTACHMENT_ID"

Example Request: PATCH https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 { "display_name": "VMTag replication policy 1", "description": "VMTag replication policy 1", "protected_site": "/global-infra/sites/pune", "recovery_sites": [ "/global-infra/sites/london" ], "vm_match_criteria": "MATCH_BIOS_UUID_NAME", "groups": [ "/global-infra/domains/d1/groups/g1", "/global-infra/domains/d2/groups/g2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete the VM tag replication policy specified by id

Delete the VM tag replication policy specified by id.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/vm-tag-replication-policies/{id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<global-manager>/global_manager/api/v1/global-infra/vm-tag-replication-policies/policy1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: site_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Monitoring

Monitoring: Compliance

Associated URIs:

GET /global-manager/api/v1/compliance/status

Returns the compliance status

Returns the compliance status and details of non compliant configuration Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/compliance/status

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/compliance/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyComplianceStatus+

Example Response: { "last_updated_time" : 1535016210856, "non_compliant_configs": [ { "description": "TLS version 1.0 used for establishing secure socket connection. It is recommended to run TLSv 1.1 or higher and fully deactivate TLSv1.0 that have protocol weaknesses.", "reported_by": { "target_display_name": "test-profile", "is_valid": true, "target_type": "LB_CLIENT_SSL_PROFILE", "target_id": "/infra/lb-client-ssl-profiles/test-profile", "path": "/infra/lb-client-ssl-profiles/test-profile" }, "non_compliance_code": 72022 } ] } Required Permissions: read Feature: infra_admin Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Monitoring: Dashboard (Legacy Management Plane)

Associated URIs:

GET /global-manager/api/v1/ui-views (Deprecated)
POST /global-manager/api/v1/ui-views (Deprecated)
DELETE /global-manager/api/v1/ui-views/{view-id} (Deprecated)
GET /global-manager/api/v1/ui-views/{view-id} (Deprecated)
PUT /global-manager/api/v1/ui-views/{view-id} (Deprecated)
GET /global-manager/api/v1/ui-views/{view-id}/widgetconfigurations (Deprecated)
POST /global-manager/api/v1/ui-views/{view-id}/widgetconfigurations (Deprecated)
DELETE /global-manager/api/v1/ui-views/{view-id}/widgetconfigurations/{widgetconfiguration-id} (Deprecated)
GET /global-manager/api/v1/ui-views/{view-id}/widgetconfigurations/{widgetconfiguration-id} (Deprecated)
PUT /global-manager/api/v1/ui-views/{view-id}/widgetconfigurations/{widgetconfiguration-id} (Deprecated)

Returns the Views based on query criteria defined in ViewQueryParameters. (Deprecated)

If no query params are specified then all the views entitled for the user
are returned. The views to which a user is entitled to include the views
created by the user and the shared views.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/ui-views

Request Headers:

n/a

Query Parameters:

ViewQueryParameters+

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/ui-views Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ViewList+

Example Response: { "views" : [ { "display_name" : "System", "widgets" : [ { "widget_id" : "ContainerConfiguration_Clusters-Status", "weight" : 9000 }, { "widget_id" : "ContainerConfiguration_EPP-Deployment-Status", "weight" : 9100 }, { "widget_id" : "ContainerConfiguration_Fabric-Status", "weight" : 9010 }, { "widget_id" : "DonutConfiguration_All-Transport-Zones-Status", "weight" : 9542 }, { "widget_id" : "DonutConfiguration_Compute-Managers-Status", "weight" : 9543 }, { "widget_id" : "DonutConfiguration_EPP-Deployment-Status", "weight" : 9080 }, { "widget_id" : "DonutConfiguration_Edge-Transport-Nodes", "weight" : 9536 }, { "widget_id" : "DonutConfiguration_Host-Transport-Nodes", "weight" : 9535 }, { "widget_id" : "DonutConfiguration_Node-Cluster-Status", "weight" : 9562 }, { "widget_id" : "LabelValueConfiguration_Backups", "weight" : 9070 } ], "shared" : true, "weight" : 10, "resource_type" : "View", "id" : "dashboard_system", "description" : "Highlights the health of key entities in the NSX infrastructure and backup status of appliance.", "_create_time" : 1672635884575, "_create_user" : "system", "_last_modified_time" : 1672635885284, "_last_modified_user" : "system", "_system_owned" : true, "_protection" : "NOT_PROTECTED", "_revision" : 1 }, { "display_name" : "Networking & Security", "widgets" : [ { "widget_id" : "ContainerConfiguration_Networking-Status", "weight" : 2000 }, { "widget_id" : "ContainerConfiguration_POLICY_VPN-Status", "weight" : 3035 }, { "widget_id" : "ContainerConfiguration_Policy-Load-Balancers-Status", "weight" : 3000 }, { "widget_id" : "ContainerConfiguration_Security-Status", "weight" : 1000 }, { "widget_id" : "ContainerConfiguration_Segments-Status", "weight" : 2020 }, { "widget_id" : "DonutConfiguration_DFW_Sections-Status", "weight" : 2020 }, { "widget_id" : "DonutConfiguration_Groups-Status", "weight" : 1000 }, { "widget_id" : "DonutConfiguration_Load_Balancers-Status", "weight" : 3040 }, { "widget_id" : "DonutConfiguration_Networks-Status", "weight" : 3020 }, { "widget_id" : "DonutConfiguration_Providers-Status", "weight" : 3010 }, { "widget_id" : "DonutConfiguration_Segments-Status", "weight" : 3030 }, { "widget_id" : "SpacerWidgetConfiguration_L2_VPN-Status", "weight" : 4000 }, { "widget_id" : "SpacerWidgetConfiguration_L3_ROUTE_BASED_VPN-Status", "weight" : 4040 }, { "widget_id" : "StatsConfiguration_L2_VPN-Status", "weight" : 4010 }, { "widget_id" : "StatsConfiguration_L3_POLICY_BASED_VPN-Status", "weight" : 4020 }, { "widget_id" : "StatsConfiguration_L3_ROUTE_BASED_VPN-Status", "weight" : 4030 } ], "shared" : true, "weight" : 20, "resource_type" : "View", "id" : "dashboard_policy_networking_n_security", "description" : "Highlights the realization status of key Networking and Security Intent.", "_create_time" : 1672635885297, "_create_user" : "system", "_last_modified_time" : 1672635885733, "_last_modified_user" : "system", "_system_owned" : true, "_protection" : "NOT_PROTECTED", "_revision" : 1 }, { "display_name" : "Networking & Security", "widgets" : [ { "widget_id" : "ContainerConfiguration_Firewall", "weight" : 9040 }, { "widget_id" : "ContainerConfiguration_Load-Balancers-Status", "weight" : 9030 }, { "widget_id" : "ContainerConfiguration_Switching-Status", "weight" : 9060 }, { "widget_id" : "ContainerConfiguration_VPN-Status", "weight" : 9050 }, { "widget_id" : "LabelValueConfiguration_Firewall-Rules-Details", "weight" : 0 }, { "widget_id" : "LabelValueConfiguration_Firewall-Sections-Details", "weight" : 0 }, { "widget_id" : "MultiWidgetConfiguration_Switching-Container-Port-Status", "weight" : 9436 }, { "widget_id" : "MultiWidgetConfiguration_Switching-Logical-Switches-Status", "weight" : 9430 }, { "widget_id" : "MultiWidgetConfiguration_Switching-Switch-Port-Status", "weight" : 9432 }, { "widget_id" : "MultiWidgetConfiguration_Switching-VM-Port-Status", "weight" : 9434 }, { "widget_id" : "StatsConfiguration_Firewall-Members-Excluded", "weight" : 9310 }, { "widget_id" : "StatsConfiguration_Firewall-Rules", "weight" : 9305 }, { "widget_id" : "StatsConfiguration_Firewall-Sections", "weight" : 9300 }, { "widget_id" : "StatsConfiguration_L2VPN-Status", "weight" : 9671 }, { "widget_id" : "StatsConfiguration_L3VPN-Status", "weight" : 9670 }, { "widget_id" : "StatsConfiguration_Load-Balancers-Status", "weight" : 9255 }, { "widget_id" : "StatsConfiguration_Server-Pools-Status", "weight" : 9270 }, { "widget_id" : "StatsConfiguration_Switching-Container-Ports-Admin-Status", "weight" : 9657 }, { "widget_id" : "StatsConfiguration_Switching-Container-Ports-Operational-Status", "weight" : 9414 }, { "widget_id" : "StatsConfiguration_Switching-Logical-Switches-Admin-Status", "weight" : 9400 }, { "widget_id" : "StatsConfiguration_Switching-Logical-Switches-Config-Status", "weight" : 9402 }, { "widget_id" : "StatsConfiguration_Switching-Switch-Ports-Admin-Status", "weight" : 9404 }, { "widget_id" : "StatsConfiguration_Switching-Switch-Ports-Operational-Status", "weight" : 9406 }, { "widget_id" : "StatsConfiguration_Switching-VM-Ports-Admin-Status", "weight" : 9408 }, { "widget_id" : "StatsConfiguration_Switching-VM-Ports-Operational-Status", "weight" : 9410 }, { "widget_id" : "StatsConfiguration_Virtual-Servers-Status", "weight" : 9260 } ], "shared" : true, "weight" : 30, "resource_type" : "View", "id" : "dashboard_adv_networking_n_security", "description" : "Highlights the health of key realized entities for Networking and Security.", "_create_time" : 1672635885752, "_create_user" : "system", "_last_modified_time" : 1672635886232, "_last_modified_user" : "system", "_system_owned" : true, "_protection" : "NOT_PROTECTED", "_revision" : 1 }, { "display_name" : "Compliance Report", "widgets" : [ ], "shared" : true, "weight" : 50, "resource_type" : "View", "id" : "dashboard_compliance", "description" : "Highlights the compliance issues with entities in the deployment.", "_create_time" : 1672635885743, "_create_user" : "system", "_last_modified_time" : 1672635885743, "_last_modified_user" : "system", "_system_owned" : true, "_protection" : "NOT_PROTECTED", "_revision" : 0 }, { "display_name" : "Custom", "widgets" : [ { "label" : { "text" : "NETWORKING" }, "widget_id" : "LabelValueConfiguration_0d5c8a34-616b-44a1-8151-09362f4177e5", "weight" : 10005 } ], "shared" : true, "weight" : 1000, "resource_type" : "View", "id" : "dashboard_custom", "description" : "Custom Dashboard gives flexibility to user to add content on the dashboard, for entities of their choice. Please create views and add widgets using REST API to add content, useful to highlight status or summarize details.", "_create_time" : 1672635884565, "_create_user" : "system", "_last_modified_time" : 1672751592453, "_last_modified_user" : "system", "_system_owned" : true, "_protection" : "NOT_PROTECTED", "_revision" : 1 } ] } Required Permissions: read Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Creates a new View. (Deprecated)

Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/ui-views

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

View+

View (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Widget Title Title of the widget.	string	Required Maximum length: 255
exclude_roles	Roles to which the shared view is not visible Comma separated list of roles to which the shared view is not visible. Allows user to prevent the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles. If include_roles is specified then exclude_roles cannot be specified.	string	Maximum length: 1024
id	Unique identifier of this resource	string	Sortable
include_roles	Roles to which the shared view is visible Comma separated list of roles to which the shared view is visible. Allows user to specify the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles.	string	Maximum length: 1024
resource_type	Must be set to the value View	string
shared	Share the view with other users Defaults to false. Set to true to publish the view to other users. The widgets of a shared view are visible to other users.	boolean	Default: "False"
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
weight	Weightage or placement of the view Determines placement of view relative to other views. The lower the weight, the higher it is in the placement order.	int	Default: "10000"
widgets	Widgets Array of widgets that are part of the view.	array of WidgetItem	Required Minimum items: 0

Example Request: POST https://<nsx-mgr>/api/v1/ui-views { "resource_type": "View", "display_name": "My View 1", "shared": true, "weight": 19020, "widgets": [{ "widget_id": "DonutConfiguration_Host-Nodes-Deployment", "label": { "text": "Deployment" }, "weight": 9531 },{ "widget_id": "DonutConfiguration_Host-Nodes-Connectivity", "label": { "text": "Connectivity" }, "weight": 9535 }] } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

View+

View (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Widget Title Title of the widget.	string	Required Maximum length: 255
exclude_roles	Roles to which the shared view is not visible Comma separated list of roles to which the shared view is not visible. Allows user to prevent the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles. If include_roles is specified then exclude_roles cannot be specified.	string	Maximum length: 1024
id	Unique identifier of this resource	string	Sortable
include_roles	Roles to which the shared view is visible Comma separated list of roles to which the shared view is visible. Allows user to specify the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles.	string	Maximum length: 1024
resource_type	Must be set to the value View	string
shared	Share the view with other users Defaults to false. Set to true to publish the view to other users. The widgets of a shared view are visible to other users.	boolean	Default: "False"
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
weight	Weightage or placement of the view Determines placement of view relative to other views. The lower the weight, the higher it is in the placement order.	int	Default: "10000"
widgets	Widgets Array of widgets that are part of the view.	array of WidgetItem	Required Minimum items: 0

Example Response: { "id": "View_0de8406c", "resource_type": "View", "display_name": "My View 1", "shared": true, "weight": 19020, "widgets": [{ "widget_id": "DonutConfiguration_Host-Nodes-Deployment", "label": { "text": "Deployment" }, "weight": 9531 },{ "widget_id": "DonutConfiguration_Host-Nodes-Connectivity", "label": { "text": "Connectivity" }, "weight": 9535 }], "_create_user": "admin", "_create_time": 1496911709362, "_last_modified_user": "admin", "_last_modified_time": 1496911709362, "_system_owned": false, "_revision": 0 } Required Permissions: crud Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Returns View Information (Deprecated)

Returns Information about a specific View.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/ui-views/View_abe34406a Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

View+

View (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Widget Title Title of the widget.	string	Required Maximum length: 255
exclude_roles	Roles to which the shared view is not visible Comma separated list of roles to which the shared view is not visible. Allows user to prevent the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles. If include_roles is specified then exclude_roles cannot be specified.	string	Maximum length: 1024
id	Unique identifier of this resource	string	Sortable
include_roles	Roles to which the shared view is visible Comma separated list of roles to which the shared view is visible. Allows user to specify the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles.	string	Maximum length: 1024
resource_type	Must be set to the value View	string
shared	Share the view with other users Defaults to false. Set to true to publish the view to other users. The widgets of a shared view are visible to other users.	boolean	Default: "False"
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
weight	Weightage or placement of the view Determines placement of view relative to other views. The lower the weight, the higher it is in the placement order.	int	Default: "10000"
widgets	Widgets Array of widgets that are part of the view.	array of WidgetItem	Required Minimum items: 0

Example Response: { "id": "View_abe34406a", "resource_type": "View", "display_name": "My View 2", "shared": true, "weight": 19021, "widgets": [{ "widget_id": "DonutConfiguration_Edge-Nodes-Deployment", "label": { "text": "Deployment" }, "weight": 9532 },{ "widget_id": "DonutConfiguration_Edge-Nodes-Connectivity", "label": { "text": "Connectivity" }, "weight": 9536 }], "_create_user": "admin", "_create_time": 1496911709362, "_last_modified_user": "admin", "_last_modified_time": 1496911709362, "_system_owned": false, "_revision": 0 } Required Permissions: read Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Update View (Deprecated)

Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

View+

View (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Widget Title Title of the widget.	string	Required Maximum length: 255
exclude_roles	Roles to which the shared view is not visible Comma separated list of roles to which the shared view is not visible. Allows user to prevent the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles. If include_roles is specified then exclude_roles cannot be specified.	string	Maximum length: 1024
id	Unique identifier of this resource	string	Sortable
include_roles	Roles to which the shared view is visible Comma separated list of roles to which the shared view is visible. Allows user to specify the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles.	string	Maximum length: 1024
resource_type	Must be set to the value View	string
shared	Share the view with other users Defaults to false. Set to true to publish the view to other users. The widgets of a shared view are visible to other users.	boolean	Default: "False"
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
weight	Weightage or placement of the view Determines placement of view relative to other views. The lower the weight, the higher it is in the placement order.	int	Default: "10000"
widgets	Widgets Array of widgets that are part of the view.	array of WidgetItem	Required Minimum items: 0

Example Request: PUT https://<nsx-mgr>/api/v1/ui-views/View_0de8406c { "resource_type": "View", "display_name": "My View 1 Updated", "shared": true, "weight": 19020, "widgets": [{ "widget_id": "DonutConfiguration_Host-Nodes-Deployment", "label": { "text": "Deployment" }, "weight": 9531 },{ "widget_id": "DonutConfiguration_Host-Nodes-Connectivity", "label": { "text": "Connectivity" }, "weight": 9535 }], "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

View+

View (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Widget Title Title of the widget.	string	Required Maximum length: 255
exclude_roles	Roles to which the shared view is not visible Comma separated list of roles to which the shared view is not visible. Allows user to prevent the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles. If include_roles is specified then exclude_roles cannot be specified.	string	Maximum length: 1024
id	Unique identifier of this resource	string	Sortable
include_roles	Roles to which the shared view is visible Comma separated list of roles to which the shared view is visible. Allows user to specify the visibility of a shared view to the specified roles. User defined roles can also be specified in the list. The roles can be obtained via GET /api/v1/aaa/roles. Please visit API documentation for details about roles.	string	Maximum length: 1024
resource_type	Must be set to the value View	string
shared	Share the view with other users Defaults to false. Set to true to publish the view to other users. The widgets of a shared view are visible to other users.	boolean	Default: "False"
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
weight	Weightage or placement of the view Determines placement of view relative to other views. The lower the weight, the higher it is in the placement order.	int	Default: "10000"
widgets	Widgets Array of widgets that are part of the view.	array of WidgetItem	Required Minimum items: 0

Example Response: { "id": "View_0de8406c", "resource_type": "View", "display_name": "My View 1 Updated", "shared": true, "weight": 19020, "widgets": [{ "widget_id": "DonutConfiguration_Host-Nodes-Deployment", "label": { "text": "Deployment" }, "weight": 9531 },{ "widget_id": "DonutConfiguration_Host-Nodes-Connectivity", "label": { "text": "Connectivity" }, "weight": 9535 }], "_create_user": "admin", "_create_time": 1496911709362, "_last_modified_user": "admin", "_last_modified_time": 1496911902685, "_system_owned": false, "_revision": 1 } Required Permissions: crud Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete View (Deprecated)

Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/api/v1/ui-views/View_0de8406c Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Returns the Widget Configurations based on query criteria defined in WidgetQueryParameters. (Deprecated)

If no query params are specified then all the Widget Configurations of
the specified view are returned.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}/widgetconfigurations

Request Headers:

n/a

Query Parameters:

WidgetQueryParameters+

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/ui-views/dashboard/widgetconfigurations Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

WidgetConfigurationList+

Example Response: { "widgetconfigurations": [ { "id": "LabelValueConfiguration_0de8406c-ab4a-4973-83ef-a1c7a6655c13", "resource_type": "LabelValueConfiguration", "display_name": "Backups", "datasources": [{ "urls": [{ "alias": "config", "url": "api/v1/cluster/backups/config" },{ "alias": "status", "url": "api/v1/cluster/backups/history" }], "display_name": "default" }], "feature_set": { "feature_list": ["utilities_backup"], "require_all_permissions": false }, "navigation": "nsxapi/index.html#view=systemAdmin/utilities/backup", "footer": { "actions": [{ "dock_to_container_footer": true, "label": { "text": "Configure Backups" }, "url": "nsxapi/index.html#view=systemAdmin/utilities/backup" }] }, "properties": [{ "condition": "#{default.config.backup_enabled} == true", "field": "\"Automatic Backups Enabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "SUCCESS" }] }], "type": "String" },{ "condition": "#{default.config.backup_enabled} == false", "field": "\"Automatic Backups Disabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "NOT_AVAILABLE" },{ "type": "DETAIL", "placement": "POST", "tooltip": [{ "text": "\"Please enable automatic backups\"" }] }] }], "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() == 0", "field": "\"Not Configured\"", "heading": false, "render_configuration": [{ "icons": [{ "type": "WARNING" }] }], "label": { "text": "Node" }, "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() != 0", "field": "#{default.status.node_backup_statuses[0].end_time}", "heading": false, "render_configuration": [{ "condition": "#{default.status.node_backup_statuses[0].success}", "icons": [{ "type": "SUCCESS" }] },{ "condition": "#{default.status.node_backup_statuses[0].success} == false", "icons": [{ "type": "ERROR" }] }], "label": { "text": "Node" }, "type": "Date" }], "_create_user": "admin", "_create_time": 1496911709362, "_last_modified_user": "admin", "_last_modified_time": 1496911709362, "_system_owned": false, "_revision": 0 },{ "resource_type": "DonutConfiguration", "id": "DonutConfiguration_1bc7406c-ab4a-4973-aed5-a1c7a6659a87", "display_name": "Transport Nodes", "datasources": [{ "urls": [{ "alias": "status", "url": "api/v1/transport-nodes/status" }], "display_name": "default" }], "navigation": "nsxapi/index.html#view=fabric/nodes/transportnodes&id=", "label": { "text": "Nodes" }, "sections": [{ "template": false, "parts": [{ "field": "#{default.status.degraded_count}", "tooltip": [{ "text": "\"Degraded\"" },{ "text": "#{default.status.degraded_count} + \" Nodes \"" }], "render_configuration": [{ "color": "YELLOW" }], "label": { "text": "Degraded" } },{ "field": "#{default.status.down_count}", "tooltip": [{ "text": "\"Down\"" },{ "text": "#{default.status.down_count} + \" Nodes \"" }], "render_configuration": [{ "color": "RED" }], "label": { "text": "Down" } },{ "field": "#{default.status.up_count}", "tooltip": [{ "text": "\"Up\"" },{ "text": "#{default.status.up_count} + \" Nodes \"" }], "render_configuration": [{ "color": "GREEN" }], "label": { "text": "Up" } },{ "field": "#{default.status.unknown_count}", "tooltip": [{ "text": "\"Unknown\"" },{ "text": "#{default.status.unknown_count} + \" Nodes \"" }], "render_configuration": [{ "color": "GREY" }], "label": { "text": "Unknown" } }] }], "_create_time": 1490707552434, "_create_user": "admin", "_last_modified_time": 1490707552434, "_last_modified_user": "admin", "_system_owned": true, "_revision": 3 }] } Required Permissions: read Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Creates a new Widget Configuration. (Deprecated)

Creates a new Widget Configuration and adds it to the specified view.
Supported resource_types are LabelValueConfiguration, DonutConfiguration,
GridConfiguration, StatsConfiguration, MultiWidgetConfiguration,
GraphConfiguration and ContainerConfiguration.

Note: Expressions should be given in a single line. If an expression spans
multiple lines, then form the expression in a single line.
For label-value pairs, expressions are evaluated as follows:
a. First, render configurations are evaluated in their order of
appearance in the widget config. The 'field' is evaluated at the end.
b. Second, when render configuration is provided then the order of
evaluation is
1. If expressions provided in 'condition' and 'display value' are
well-formed and free of runtime-errors such as 'null pointers' and
evaluates to 'true'; Then remaining render configurations are not
evaluated, and the current render configuration's 'display value'
is taken as the final value.
2. If expression provided in 'condition' of render configuration is
false, then next render configuration is evaluated.
3. Finally, 'field' is evaluated only when every render configuration
evaluates to false and no error occurs during steps 1 and 2 above.

If an error occurs during evaluation of render configuration, then an
error message is shown. The display value corresponding to that label is
not shown and evaluation of the remaining render configurations continues
to collect and show all the error messages (marked with the 'Label' for
identification) as 'Error_Messages: {}'.

If during evaluation of expressions for any label-value pair an error
occurs, then it is marked with error. The errors are shown in the report,
along with the label value pairs that are error-free.

Important: For elements that take expressions, strings should be provided
by escaping them with a back-slash. These elements are - condition, field,
tooltip text and render_configuration's display_value.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}/widgetconfigurations

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ContainerConfiguration+

CustomFilterWidgetConfiguration+

CustomWidgetConfiguration+

DonutConfiguration+

DropdownFilterWidgetConfiguration+

FilterWidgetConfiguration+

GraphConfiguration+

GridConfiguration+

LabelValueConfiguration+

LegendWidgetConfiguration+

MultiWidgetConfiguration+

SpacerWidgetConfiguration+

StatsConfiguration+

TimeRangeDropdownFilterWidgetConfiguration+

WidgetConfiguration+

Example Request: POST https://<nsx-mgr>/api/v1/ui-views/dashboard_custom/widgetconfigurations { "resource_type": "LabelValueConfiguration", "display_name": "NETWORKING", "datasources": [ { "urls": [ { "alias": "overview", "url": "#urlPrefix/ui-controller/networking-overview?filter=overview&context=projects:#tenantContext" } ], "display_name": "default" } ], "is_drilldown": false, "sub_type": "VERTICALLY_ALIGNED", "properties": [ { "condition": "#isCustomProject == \"false\" && #{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER0\")]}.size() > 0", "label": { "text": "Tier-0 Gateways", "navigation":"/app/networks/providers/home/providers" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER0\")].count}.sum()", "heading": true, "render_configuration": [], "type": "Number", "separator": false }, { "condition": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER1\")]}.size() > 0", "label": { "text": "Tier-1 Gateways", "navigation":"/app/networks/networks/home/networks" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER1\")].count}.sum()", "heading": true, "render_configuration": [], "type": "Number", "separator": false }, { "condition": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_SEGMENTS\")]}.size() > 0", "label": { "text": "Segments", "navigation":"/app/networks/segments/module/home" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_SEGMENTS\")].count}.sum()", "heading": true, "render_configuration": [], "type": "Number", "separator": false }, { "condition": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_DVPG_SEGMENTS\")]}.size() > 0", "label": { "text": "Distributed Port Groups", "navigation":"app/networks/segments/module/distributed-port-groups/home" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_DVPG_SEGMENTS\")].count}.sum()", "heading": true, "render_configuration": [], "type": "Number", "separator": false } ], "weight": 10005 } Successful Response:

Response Code:

201 Created

Response Headers:

Content-type: application/json

Response Body:

ContainerConfiguration+

CustomFilterWidgetConfiguration+

CustomWidgetConfiguration+

DonutConfiguration+

DropdownFilterWidgetConfiguration+

FilterWidgetConfiguration+

GraphConfiguration+

GridConfiguration+

LabelValueConfiguration+

LegendWidgetConfiguration+

MultiWidgetConfiguration+

SpacerWidgetConfiguration+

StatsConfiguration+

TimeRangeDropdownFilterWidgetConfiguration+

WidgetConfiguration+

Example Response: { "sub_type": "VERTICALLY_ALIGNED", "properties": [ { "label": { "text": "Tier-0 Gateways", "hover": false, "navigation": "/app/networks/providers/home/providers" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER0\")].count}.sum()", "heading": true, "type": "Number", "condition": "#isCustomProject == \"false\" && #{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER0\")]}.size() > 0", "separator": false, "rowspan": 12 }, { "label": { "text": "Tier-1 Gateways", "hover": false, "navigation": "/app/networks/networks/home/networks" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER1\")].count}.sum()", "heading": true, "type": "Number", "condition": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_TIER1\")]}.size() > 0", "separator": false, "rowspan": 12 }, { "label": { "text": "Segments", "hover": false, "navigation": "/app/networks/segments/module/home" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_SEGMENTS\")].count}.sum()", "heading": true, "type": "Number", "condition": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_SEGMENTS\")]}.size() > 0", "separator": false, "rowspan": 12 }, { "label": { "text": "Distributed Port Groups", "hover": false, "navigation": "app/networks/segments/module/distributed-port-groups/home" }, "field": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_DVPG_SEGMENTS\")].count}.sum()", "heading": true, "type": "Number", "condition": "#{default.overview.entities[?(@.key == \"POLICY_HOME_LABEL_DVPG_SEGMENTS\")]}.size() > 0", "separator": false, "rowspan": 12 } ], "resource_type": "LabelValueConfiguration", "id": "LabelValueConfiguration_48e1015a-8e9a-4d69-9af1-38149e71166d", "display_name": "NETWORKING", "show_header": false, "datasources": [ { "display_name": "default", "urls": [ { "alias": "overview", "url": "#urlPrefix/ui-controller/networking-overview?filter=overview&context=projects:#tenantContext", "request_method": "Get" } ] } ], "weight": 10005, "is_drilldown": false, "filter_value_required": true, "filters": [], "rowspan": 12, "_create_time": 1672752309346, "_create_user": "admin", "_last_modified_time": 1672752309346, "_last_modified_user": "admin", "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Returns Widget Configuration Information (Deprecated)

Returns Information about a specific Widget Configuration.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}/widgetconfigurations/{widgetconfiguration-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<nsx-mgr>/api/v1/ui-views/dashboard/widgetconfigurations/ LabelValueConfiguration_BackupStatus Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ContainerConfiguration+

CustomFilterWidgetConfiguration+

CustomWidgetConfiguration+

DonutConfiguration+

DropdownFilterWidgetConfiguration+

FilterWidgetConfiguration+

GraphConfiguration+

GridConfiguration+

LabelValueConfiguration+

LegendWidgetConfiguration+

MultiWidgetConfiguration+

SpacerWidgetConfiguration+

StatsConfiguration+

TimeRangeDropdownFilterWidgetConfiguration+

WidgetConfiguration+

Example Response: { "id": "LabelValueConfiguration_0de8406c-ab4a-4973-83ef-a1c7a6655c13", "resource_type": "LabelValueConfiguration", "display_name": "Backups", "datasources": [{ "urls": [{ "alias": "config", "url": "api/v1/cluster/backups/config" },{ "alias": "status", "url": "api/v1/cluster/backups/history" }], "display_name": "default" }], "navigation": "nsxapi/index.html#view=systemAdmin/utilities/backup", "feature_set": { "feature_list": ["utilities_backup"], "require_all_permissions": false }, "footer": { "actions": [{ "dock_to_container_footer": true, "label": { "text": "Configure Backups" }, "url": "nsxapi/index.html#view=systemAdmin/utilities/backup" }] }, "properties": [{ "condition": "#{default.config.backup_enabled} == true", "field": "\"Automatic Backups Enabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "SUCCESS" }] }], "type": "String" },{ "condition": "#{default.config.backup_enabled} == false", "field": "\"Automatic Backups Disabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "NOT_AVAILABLE" },{ "type": "DETAIL", "placement": "POST", "tooltip": [{ "text": "\"Please enable automatic backups\"" }] }] }], "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() == 0", "field": "\"Not Configured\"", "heading": false, "render_configuration": [{ "icons": [{ "type": "WARNING" }] }], "label": { "text": "Node" }, "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() != 0", "field": "#{default.status.node_backup_statuses[0].end_time}", "heading": false, "render_configuration": [{ "condition": "#{default.status.node_backup_statuses[0].success}", "icons": [{ "type": "SUCCESS" }] },{ "condition": "#{default.status.node_backup_statuses[0].success} == false", "icons": [{ "type": "ERROR" }] }], "label": { "text": "Node" }, "type": "Date" }], "_create_user": "admin", "_create_time": 1496911709362, "_last_modified_user": "admin", "_last_modified_time": 1496911709362, "_system_owned": false, "_revision": 0 } Required Permissions: read Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Update Widget Configuration (Deprecated)

Updates the widget at the given view. If the widget is referenced by other
views, then the widget will be updated in all the views that it is part of.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}/widgetconfigurations/{widgetconfiguration-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

ContainerConfiguration+

CustomFilterWidgetConfiguration+

CustomWidgetConfiguration+

DonutConfiguration+

DropdownFilterWidgetConfiguration+

FilterWidgetConfiguration+

GraphConfiguration+

GridConfiguration+

LabelValueConfiguration+

LegendWidgetConfiguration+

MultiWidgetConfiguration+

SpacerWidgetConfiguration+

StatsConfiguration+

TimeRangeDropdownFilterWidgetConfiguration+

WidgetConfiguration+

Example Request: PUT https://<nsx-mgr>/api/v1/ui-views/dashboard_custom/widgetconfigurations/ LabelValueConfiguration_0de8406c-ab4a-4973-83ef-a1c7a6655c13 { "id": "LabelValueConfiguration_0de8406c-ab4a-4973-83ef-a1c7a6655c13", "resource_type": "LabelValueConfiguration", "display_name": "Backups Updated", "datasources": [{ "urls": [{ "alias": "config", "url": "api/v1/cluster/backups/config" },{ "alias": "status", "url": "api/v1/cluster/backups/history" }], "display_name": "default" }], "navigation": "nsxapi/index.html#view=systemAdmin/utilities/backup", "feature_set": { "feature_list": ["utilities_backup"], "require_all_permissions": false }, "footer": { "actions": [{ "dock_to_container_footer": true, "label": { "text": "Configure Backups" }, "url": "nsxapi/index.html#view=systemAdmin/utilities/backup" }] }, "properties": [{ "condition": "#{default.config.backup_enabled} == true", "field": "\"Automatic Backups Enabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "SUCCESS" }] }], "type": "String" },{ "condition": "#{default.config.backup_enabled} == false", "field": "\"Automatic Backups Disabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "NOT_AVAILABLE" },{ "type": "DETAIL", "placement": "POST", "tooltip": [{ "text": "\"Please enable automatic backups\"" }] }] }], "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() == 0", "field": "\"Not Configured\"", "heading": false, "render_configuration": [{ "icons": [{ "type": "WARNING" }] }], "label": { "text": "Node" }, "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() != 0", "field": "#{default.status.node_backup_statuses[0].end_time}", "heading": false, "render_configuration": [{ "condition": "#{default.status.node_backup_statuses[0].success}", "icons": [{ "type": "SUCCESS" }] },{ "condition": "#{default.status.node_backup_statuses[0].success} == false", "icons": [{ "type": "ERROR" }] }], "label": { "text": "Node" }, "type": "Date" }], "_create_user": "admin", "_create_time": 1496911709362, "_last_modified_user": "admin", "_last_modified_time": 1496911709362, "_system_owned": false, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ContainerConfiguration+

CustomFilterWidgetConfiguration+

CustomWidgetConfiguration+

DonutConfiguration+

DropdownFilterWidgetConfiguration+

FilterWidgetConfiguration+

GraphConfiguration+

GridConfiguration+

LabelValueConfiguration+

LegendWidgetConfiguration+

MultiWidgetConfiguration+

SpacerWidgetConfiguration+

StatsConfiguration+

TimeRangeDropdownFilterWidgetConfiguration+

WidgetConfiguration+

Example Response: { "id": "LabelValueConfiguration_0de8406c-ab4a-4973-83ef-a1c7a6655c13", "resource_type": "LabelValueConfiguration", "display_name": "Backups Updated", "datasources": [{ "urls": [{ "alias": "config", "url": "api/v1/cluster/backups/config" },{ "alias": "status", "url": "api/v1/cluster/backups/history" }], "display_name": "default" }], "navigation": "nsxapi/index.html#view=systemAdmin/utilities/backup", "feature_set": { "feature_list": ["utilities_backup"], "require_all_permissions": false }, "footer": { "actions": [{ "dock_to_container_footer": true, "label": { "text": "Configure Backups" }, "url": "nsxapi/index.html#view=systemAdmin/utilities/backup" }] }, "properties": [{ "condition": "#{default.config.backup_enabled} == true", "field": "\"Automatic Backups Enabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "SUCCESS" }] }], "type": "String" },{ "condition": "#{default.config.backup_enabled} == false", "field": "\"Automatic Backups Disabled\"", "heading": true, "render_configuration": [{ "icons": [{ "type": "NOT_AVAILABLE" },{ "type": "DETAIL", "placement": "POST", "tooltip": [{ "text": "\"Please enable automatic backups\"" }] }] }], "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() == 0", "field": "\"Not Configured\"", "heading": false, "render_configuration": [{ "icons": [{ "type": "WARNING" }] }], "label": { "text": "Node" }, "type": "String" },{ "condition": "#{default.status.node_backup_statuses}.size() != 0", "field": "#{default.status.node_backup_statuses[0].end_time}", "heading": false, "render_configuration": [{ "condition": "#{default.status.node_backup_statuses[0].success}", "icons": [{ "type": "SUCCESS" }] },{ "condition": "#{default.status.node_backup_statuses[0].success} == false", "icons": [{ "type": "ERROR" }] }], "label": { "text": "Node" }, "type": "Date" }], "_create_user": "admin", "_create_time": 1496911718391, "_last_modified_user": "admin", "_last_modified_time": 1496911718391, "_system_owned": false, "_revision": 1 } Required Permissions: crud Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete Widget Configuration (Deprecated)

Detaches widget from a given view. If the widget is no longer part of any
view, then it will be purged.
Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/ui-views/{view-id}/widgetconfigurations/{widgetconfiguration-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<nsx-mgr>/api/v1/ui-views/dashboard_custom/ widgetconfigurations/LabelValueConfiguration_BackupStatus Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: nsx_dashboard Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Monitoring: Finetuning

Associated URIs:

GET /global-manager/api/v1/fine-tuning/resources

For each type of entity what are the attributes owned by policy.

This API provides field names of attributes in NSX types that are owned by
Policy, as opposed to those owned by the enforcement point. For any type on NSX,
some of the attributes of that type may be owned and set by Policy when realizing
the intent, while some others may be owned and set by the enforcement point itself.
This information can be used to deactivate updates to Policy owned attributes by the
advanced networking UI, while allowing tweaking to the attributes owned by the
management plane.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/fine-tuning/resources

Request Headers:

n/a

Query Parameters:

ResourceInfoSearchParameters+

Request Body:

n/a

Example Request: https://<policy-mgr>/global-manager/api/v1/fine-tuning/resources?type=InstanceDeploymentConfigDto Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ResourceInfoListResult+

Example Response: { "result_count": 1, "results": [{ "resource_name": "InstanceDeploymentConfigDto", "fields": [{ "sub_type": { "resource_name": "VmNicInfoDto", "fields": [{ "sub_type": { "resource_name": "NicInfoDto", "fields": [{ "field_name": "gateway_address" }, { "field_name": "network_id" }, { "field_name": "subnet_mask" }, { "field_name": "ip_address" }] }, "field_name": "nic_infos" }] }, "field_name": "vm_nic_infos" }, { "field_name": "compute_id" }, { "field_name": "storage_id" }, { "field_name": "context_id" }] }] } Required Permissions: read Feature: policy_fine_tuning Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Multi-Tenancy

Multi-Tenancy: Constraints

Associated URIs:

GET /global-manager/api/v1/global-infra/constraints
GET /global-manager/api/v1/global-infra/constraints/{constraint-id}

List tenant Constraints.

List tenant constraints. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/constraints

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>policy/api/v1/global-infra/constraints Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

ConstraintListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 3, "results": [ { "constraint_expression": { "resource_type": "RelatedAttributeConditionalExpression", "condition": { "value_constraint": { "resource_type": "ValueConstraintExpression", "values": [ "/infra/services/HTTP", "/infra/services/HTTPS" ], "operator": "INCLUDES", "_protection": "NOT_PROTECTED" }, "rhs_value": [ "/infra/domains/mgw/groups/VCENTER" ], "operator": "INCLUDES" }, "related_attribute": { "attribute": "destinationGroups" }, "_protection": "NOT_PROTECTED" }, "target": { "target_resource_type": "CommunicationEntry", "attribute": "services", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }, "_protection": "NOT_PROTECTED" }, { "constraint_expression": { "resource_type": "ValueConstraintExpression", "values": [ "ALLOW" ], "operator": "EQUALS", "_protection": "NOT_PROTECTED" }, "target": { "target_resource_type": "CommunicationEntry", "attribute": "action", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }, "_protection": "NOT_PROTECTED" }, { "constraint_expression": { "resource_type": "ValueConstraintExpression", "values": [ "/infra/domains/amar/groups/VCENTER" ], "operator": "INCLUDES", "_protection": "NOT_PROTECTED" }, "target": { "target_resource_type": "CommunicationEntry", "attribute": "destinationGroups", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }, "_protection": "NOT_PROTECTED" }, { "constraint_expressions": [{ "resource_type": "EntityCountConstraintExpression", "target_resource_type": "Group", "operator": "<", "count" : 2 }, { "resource_type": "EntityCountConstraintExpression", "target_resource_type": "Vpc", "operator": "<", "count" : 2 }] "targets": [{ "path_prefix": "/orgs/org1/projects/project1/" }, { "path_prefix": "/orgs/org1/projects/project2/" }] "_protection": "NOT_PROTECTED" } ] } Required Permissions: read Feature: policy_constraints Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read tenant Constraint.

Read tenant constraint. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/constraints/{constraint-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>policy/api/v1/global-infra/constraints/related-attribute-constraint Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

Constraint+

Constraint (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
constraint_expression	Expression to constrain the target attribute value. This property is deprecated. Please use the "constraint_expressions" property instead to specify one or more constraint expressions. If this property is populated, then the "constraint_expressions" value is ignored.	ConstraintExpression (Abstract type: pass one of the following concrete types) EntityInstanceCountConstraintExpression FieldSanityConstraintExpression RelatedAttributeConditionalExpression ValueConstraintExpression	Deprecated
constraint_expressions	Expressions to constrain the target attribute value.	array of ConstraintExpression (Abstract type: pass one of the following concrete types) EntityInstanceCountConstraintExpression FieldSanityConstraintExpression RelatedAttributeConditionalExpression ValueConstraintExpression
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
message	User friendly message to be shown to users upon violation.	string
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value Constraint	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
target	Target resource attribute details. This property is deprecated. Please use the "targets" property instead to specify one or more targets. If this property is populated, then the "targets" value is ignored.	ConstraintTarget	Deprecated
target_owner_type	Constraint target's owner type	string	Enum: GM, LM, ALL
targets	Collection of target resources attribute details.	array of ConstraintTarget
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "constraint_expressions": [{ "resource_type": "RelatedAttributeConditionalExpression", "condition": { "value_constraint": { "resource_type": "ValueConstraintExpression", "values": [ "/infra/services/HTTP", "/infra/services/HTTPS" ], "operator": "INCLUDES", "_protection": "NOT_PROTECTED" }, "rhs_value": [ "/infra/domains/mgw/groups/VCENTER" ], "operator": "INCLUDES" }, "related_attribute": { "attribute": "destinationGroups" }, "_protection": "NOT_PROTECTED" }], "targets": [{ "target_resource_type": "CommunicationEntry", "attribute": "services", "path_prefix": "/infra/domains/amar/edge-communication-maps/default/communication-entries/" }], "_protection": "NOT_PROTECTED" } Required Permissions: read Feature: policy_constraints Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dhcp)

Networking (Dhcp): DHCP Leases

Associated URIs:

POST /global-manager/api/v1/global-infra/segments/{segment-id}?action=delete_dhcp_leases
POST /global-manager/api/v1/global-infra/tier-1s/{tier1-id}/segments/{segment-id}?action=delete_dhcp_leases

Delete DHCP lease(s) specified by IP and MAC

Delete one or multiple DHCP lease(s) specified by IP and MAC.

If there is a DHCP server running upon the given segment, or this segment
is using a DHCP server running in its connected Tier-0 or Tier-1, the DHCP
lease(s) which match exactly the IP address and the MAC address will be
deleted. If no such lease matches, the deletion for this lease will be
ignored.

The DHCP lease to be deleted will be removed by the system from both active
and standby node. The system will report error if the DHCP lease could not
be removed from both nodes. If the DHCP lease could not be removed on either
node, please check the DHCP server status. Once the DHCP server status is
UP, please invoke the deletion API again to ensure the lease gets deleted
from both nodes.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}?action=delete_dhcp_leases

Request Headers:

n/a

Query Parameters:

EnforcementPointRequest+

Request Body:

DhcpDeleteLeases+

Example Request: POST /global-infra/segments/seg-1?action=delete_dhcp_leases { "leases": [ { "ip": "40.1.1.1", "mac": "02:42:21:4d:bc:b7" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DHCP lease(s) specified by IP and MAC

Delete one or multiple DHCP lease(s) specified by IP and MAC under a Tier-1.

If there is a DHCP server running upon the given segment, or this segment
is using a DHCP server running in its connected Tier-1, the DHCP lease(s)
which match exactly the IP address and the MAC address will be deleted.
If no such lease matches, the deletion for this lease will be ignored.

The DHCP lease to be deleted will be removed by the system from both active
and standby node. The system will report error if the DHCP lease could not
be removed from both nodes. If the DHCP lease could not be removed on either
node, please check the DHCP server status. Once the DHCP server status is
UP, please invoke the deletion API again to ensure the lease gets deleted
from both nodes.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier1-id}/segments/{segment-id}?action=delete_dhcp_leases

Request Headers:

n/a

Query Parameters:

EnforcementPointRequest+

Request Body:

DhcpDeleteLeases+

Example Request: POST /global-infra/tier-1s/t1/segments/seg-1?action=delete_dhcp_leases { "leases": [ { "ip": "40.1.1.1", "mac": "02:42:21:4d:bc:b7" } ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dhcp): DHCP Relay Configs

Associated URIs:

GET /global-manager/api/v1/global-infra/dhcp-relay-configs
DELETE /global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}
GET /global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}
PATCH /global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}
PUT /global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}

List DHCP relay config instances

Paginated list of all DHCP relay config instances
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-relay-configs

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-relay-configs Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpRelayConfigListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "DhcpRelayConfig", "id": "dhcp-relay1", "display_name": "dhcp-relay1", "path": "/infra/dhcp-relay-configs/dhcp-relay1", "parent_path": "/infra", "relative_path": "dhcp-relay1", "server_addresses": [ "10.1.1.1", "10.1.1.2" ] "_create_user": "admin", "_create_time": 1516668826912, "_last_modified_user": "admin", "_last_modified_time": 1516668826912, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP relay configuration

If DHCP relay config with the dhcp-relay-config-id is not already present,
create a new DHCP relay config instance. If it already exists, replace
the DHCP relay config instance with this object.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpRelayConfig+

DhcpRelayConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpRelayConfig	string
server_addresses	DHCP relay addresses DHCP server IP addresses for DHCP relay configuration. Both IPv4 and IPv6 addresses are supported.	array of IPAddress	Required Maximum items: 8
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-relay-configs/dhcp-relay1 { "server_addresses": [ "10.1.1.1", "10.1.1.2" ], "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpRelayConfig+

DhcpRelayConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpRelayConfig	string
server_addresses	DHCP relay addresses DHCP server IP addresses for DHCP relay configuration. Both IPv4 and IPv6 addresses are supported.	array of IPAddress	Required Maximum items: 8
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "DhcpRelayConfig", "id": "dhcp-relay1", "display_name": "dhcp-relay1", "path": "/infra/dhcp-relay-configs/dhcp-relay1", "parent_path": "/infra", "relative_path": "dhcp-relay1", "server_addresses": [ "10.1.1.1", "10.1.1.2" ] "_create_user": "admin", "_create_time": 1516668826912, "_last_modified_user": "admin", "_last_modified_time": 1516668826912, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP relay configuration

If DHCP relay config with the dhcp-relay-config-id is not already present, create a new DHCP relay config instance.
If it already exists, update the DHCP relay config instance with specified attributes.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpRelayConfig+

DhcpRelayConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpRelayConfig	string
server_addresses	DHCP relay addresses DHCP server IP addresses for DHCP relay configuration. Both IPv4 and IPv6 addresses are supported.	array of IPAddress	Required Maximum items: 8
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-relay-configs/dhcp-relay1 { "server_addresses": [ "10.1.1.1", "10.1.1.2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP relay configuration

Read DHCP relay configuration Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-relay-configs/dhcp-relay1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpRelayConfig+

DhcpRelayConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpRelayConfig	string
server_addresses	DHCP relay addresses DHCP server IP addresses for DHCP relay configuration. Both IPv4 and IPv6 addresses are supported.	array of IPAddress	Required Maximum items: 8
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DHCP relay configuration

Delete DHCP relay configuration Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-relay-configs/{dhcp-relay-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-relay-configs/dhcp-relay1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dhcp): DHCP Server Configs

Associated URIs:

GET /global-manager/api/v1/global-infra/dhcp-server-configs
GET /global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/leases
GET /global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/state
GET /global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/stats
POST /global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/stats?action=reset
GET /global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/status
DELETE /global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}
GET /global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}
PATCH /global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}
PUT /global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}

List DHCP server config instances

Paginated list of all DHCP server config instances
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpServerConfigListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 1, "results": [ { "resource_type": "DhcpServerConfig", "id": "dhcp-srv1", "display_name": "dhcp-srv1", "path": "/infra/dhcp-server-configs/dhcp-srv1", "parent_path": "/infra", "relative_path": "dhcp-srv1", "server_address": "10.1.1.1/30", "lease_time": 10000, "_create_user": "admin", "_create_time": 1516668826912, "_last_modified_user": "admin", "_last_modified_time": 1516668826912, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP server leases

Read DHCP server leases Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/leases

Request Headers:

n/a

Query Parameters:

DhcpServerLeaseRequestParameters+

DhcpServerLeaseRequestParameters (schema)

Name	Description	Type	Notes
address	IP or MAC address IP address, IP range or MAC address to retrieve specific lease information. Either a "address" or a "segment_path" can be provided, but not both in the same call.	string
connectivity_path	String Path of Tier0, Tier1 or Segment String Path of Tier0, Tier1 or Segment where DHCP server is deployed. Specify Tier0/Tier1 gateway path for DHCP server attached to the gateway. Segment path must be specified for local DHCP server configuration.	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point Enforcement point path. Required when multiple enforcement points are configured.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
segment_path	Segment path to retrieve lease information Segment path to retrieve lease information. Either a "address" or a "segment_path" can be provided, but not both in the same call.	string
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string
source	The data source The data source, either realtime or cached. If not provided, cached data is returned.	DataSourceType

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/default/leases?segment_path=/global-infra/segments/web&connectivity_path=/global-infra/tier-1s/it_t1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpLeasesResult+

DhcpLeasesResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
connectivity_path	Policy path to Segment, Tier0 or Tier1 gateway Policy path to Segment, Tier0 or Tier1 gateway where DHCP server is attached.	string
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
dhcp_server_id	dhcp server uuid	string
ipv6_leases	The ipv6 lease info list of the server	array of DhcpV6Lease	Minimum items: 0 Maximum items: 65535
leases	The lease info list of the server	array of DhcpLeasePerIP	Minimum items: 0 Maximum items: 65535
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly
timestamp	timestamp of the lease info	EpochMsTimestamp

Example Response: { "leases" : [ { "subnet" : "184.168.1.0", "start_time" : "2017-06-26 18:34:34 +0000", "mac_address" : "00:50:56:ae:6b:01", "lease_time" : "3600", "expire_time" : "2017-06-26 19:34:35 +0000", "ip_address" : "184.168.1.3" } ], "dhcp_server_id" : "9f34f749-08d9-4744-b1e9-9f079f9ce726", "timestamp" : 1498503052577 } Required Permissions: read Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP server state

Read DHCP server state Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/state

Request Headers:

n/a

Query Parameters:

DhcpServerRequestParameters+

DhcpServerRequestParameters (schema)

Name	Description	Type	Notes
connectivity_path	String Path of Tier0, Tier1 or Segment String Path of Tier0, Tier1 or Segment where DHCP server is deployed. Specify Tier0/Tier1 gateway path for DHCP server attached to the gateway. Segment path must be specified for local DHCP server configuration.	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point Enforcement point path. Required when multiple enforcement points are configured.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/default/state?connectivity_path=/global-infra/tier-1s/it_t1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpServerState+

DhcpServerState (schema)

Name	Description	Type	Notes
details	Array of configuration state of various sub systems	array of ConfigurationStateElement	Readonly
failure_code	Error code	integer	Readonly
failure_message	Error message in case of failure	string	Readonly
state	Overall state of desired configuration Gives details of state of desired configuration. Additional enums with more details on progress/success/error states are sent for edge node. The success states are NODE_READY and TRANSPORT_NODE_READY, pending states are {VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, REGISTRATION_PENDING} and other values indicate failures. "in_sync" state indicates that the desired configuration has been received by the host to which it applies, but is not yet in effect. When the configuration is actually in effect, the state will change to "success". Please note, failed state is deprecated.	string	Required Readonly Enum: pending, in_progress, success, failed, partial_success, orphaned, unknown, error, in_sync, NOT_AVAILABLE, VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, VM_DEPLOYMENT_FAILED, VM_POWER_ON_IN_PROGRESS, VM_POWER_ON_FAILED, REGISTRATION_PENDING, NODE_NOT_READY, NODE_READY, VM_POWER_OFF_IN_PROGRESS, VM_POWER_OFF_FAILED, VM_UNDEPLOY_IN_PROGRESS, VM_UNDEPLOY_FAILED, VM_UNDEPLOY_SUCCESSFUL, EDGE_CONFIG_ERROR, VM_DEPLOYMENT_RESTARTED, REGISTRATION_FAILED, TRANSPORT_NODE_SYNC_PENDING, TRANSPORT_NODE_CONFIGURATION_MISSING, EDGE_HARDWARE_NOT_SUPPORTED, MULTIPLE_OVERLAY_TZS_NOT_SUPPORTED, TN_OVERLAY_TZ_IN_USE_BY_EDGE_CLUSTER, VC_VCP_ACTION_PENDING, VC_VCP_ACTION_FAILED, TZ_ENDPOINTS_NOT_SPECIFIED, NO_PNIC_PREPARED_IN_EDGE, APPLIANCE_INTERNAL_ERROR, VTEP_DHCP_NOT_SUPPORTED, UNSUPPORTED_HOST_SWITCH_PROFILE, UPLINK_HOST_SWITCH_PROFILE_NOT_SPECIFIED, HOSTSWITCH_PROFILE_NOT_FOUND, LLDP_SEND_ENABLED_NOT_SUPPORTED, UNSUPPORTED_NAMED_TEAMING_POLICY, LBSRCID_NOT_SUPPORTED_FOR_EDGE_VM, LACP_NOT_SUPPORTED_FOR_EDGE_VM, STANDBY_UPLINKS_NOT_SUPPORTED_FOR_EDGE_VM, MULTIPLE_ACTIVE_UPLINKS_NOT_SUPPORTED_FOR_EDGE, UNSUPPORTED_LACP_LB_ALGO_FOR_NODE, EDGE_NODE_VERSION_NOT_SUPPORTED, NO_PNIC_SPECIFIED_IN_TN, INVALID_PNIC_DEVICE_NAME, TRANSPORT_NODE_READY, VM_NETWORK_EDIT_PENDING, UNSUPPORTED_DEFAULT_TEAMING_POLICY, MPA_DISCONNECTED, VM_RENAME_PENDING, VM_CONFIG_EDIT_PENDING, VM_NETWORK_EDIT_FAILED, VM_RENAME_FAILED, VM_CONFIG_EDIT_FAILED, VM_CONFIG_DISCREPANCY, VM_NODE_REFRESH_FAILED, VM_PLACEMENT_REFRESH_FAILED, REGISTRATION_TIMEDOUT, REPLACE_FAILED, UPLINK_FROM_TEAMING_POLICY_NOT_MAPPED, LOGICAL_SWITCH_NAMED_TEAMING_HAS_NO_PNIC_BACKING, DELETE_VM_IN_REDEPLOY_FAILED, DEPLOY_VM_IN_REDEPLOY_FAILED, INSUFFICIENT_RESOURCES_IN_EDGE_NODE_FOR_SERVICE, VM_RESOURCE_RESERVATION_FAILED, DUPLICATE_PNICS_IN_TEAMINGS_WITH_MULTIPLE_UPLINKS_AND_FAILOVER_ORDER, DUPLICATE_VLANS_SHARING_SAME_PNICMULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, EDGE_NODE_SETTINGS_MISMATCH_RESOLVE, EDGE_VM_VSPHERE_SETTINGS_MISMATCH_RESOLVE, EDGE_NODE_SETTINGS_AND_VSPHERE_SETTINGS_ARE_CHANGED_RESOLVE, EDGE_VSPHERE_LOCATION_MISMATCH_RESOLVE, COMPUTE_MANAGER_NOT_FOUND, DELETE_IN_PROGRESS, ADVANCED_CONFIG_EDIT_FAILED, UPT_MODE_REALIZATION_POLL_TIMED_OUT, DATAPATH_CONFIGURATION_EDIT_FAILED, MAINTENANCE_MODE_ENABLED, ERROR_IN_ENABLE_MAINTENANCE_MODE, ERROR_IN_DISABLE_MAINTENANCE_MODE, CONFIGURE_UPT_ON_VM_FAILED, VM_VERSION_IS_UPT_INCOMPATIBLE, DELETE_FAILED_FOR_DIFFERENT_MOREF_ID, DELETE_FAILED_ON_VM_NOT_FOUND, DELETE_FAILED_FOR_NON_LCM_EDGE, ADVANCED_CONFIG_EDIT_PENDING, DUPLICATE_VLANS_SHARING_SAME_PNIC, MULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, REDEPLOY_ACTIVITY_FAILED, REDEPLOY_ACTIVITY_IN_PROGRESS, REDEPLOY_ACTIVITY_SCHEDULED, REDEPLOY_ACTIVITY_SUCCESSFUL, REPLACE_ACTIVITY_FAILED, REPLACE_ACTIVITY_IN_PROGRESS, REPLACE_ACTIVITY_SCHEDULED, REPLACE_ACTIVITY_SUCCESSFUL, REPLACED_RPC_CLIENT_OF_TN, RETRYING_REPLACE, UNABLE_TO_DELETE_EDGE_NODE_VM_INTERNAL_ERROR, VM_REDEPLOY_FAILED, VM_RESOURCE_RESERVATION_EDIT_PENDING, REDEPLOYED_VM_REGISTRATION_PENDING

Example Response: { "details": [ { "sub_system_type": "TransportNode", "sub_system_id": "fe651e63-04bd-43a4-a8ec-45381a3b71b9", "state": "in_progress", "failure_message": "CCP Id:ab5958df-d98a-468e-a72b-d89dcdae5346, Message:State realization is in progress at the node." }, { "sub_system_type": "TransportNode", "sub_system_id": "ebe174ac-e4f1-4135-ba72-3dd2eb7099e3", "state": "in_sync" } ], "state": "in_progress", "failure_message": "The state realization is in progress at transport nodes." } Required Permissions: read Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP server statistics

Read DHCP server statistics Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/stats

Request Headers:

n/a

Query Parameters:

DhcpServerRequestParameters+

DhcpServerRequestParameters (schema)

Name	Description	Type	Notes
connectivity_path	String Path of Tier0, Tier1 or Segment String Path of Tier0, Tier1 or Segment where DHCP server is deployed. Specify Tier0/Tier1 gateway path for DHCP server attached to the gateway. Segment path must be specified for local DHCP server configuration.	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point Enforcement point path. Required when multiple enforcement points are configured.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/default/stats?connectivity_path=/global-infra/tier-1s/it_t1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpServerStatistics+

DhcpServerStatistics (schema)

Name	Description	Type	Notes
acks	The total number of DHCP ACK packets	integer
declines	The total number of DHCP DECLINE packets	integer
dhcp_server_id	dhcp server uuid	string
discovers	The total number of DHCP DISCOVER packets	integer
errors	The total number of DHCP errors	integer
informs	The total number of DHCP INFORM packets	integer
ip_pool_stats	The DHCP ip pool usage statistics	array of DhcpIpPoolUsage
nacks	The total number of DHCP NACK packets	integer
offers	The total number of DHCP OFFER packets	integer
releases	The total number of DHCP RELEASE packets	integer
requests	The total number of DHCP REQUEST packets	integer
timestamp	timestamp of the statistics	EpochMsTimestamp

Example Response: { "dhcp_server_id": "0c660543-5edf-463a-ace8-bec9b9651d02", "timestamp": 1578798980607, "discovers": 0, "offers": 0, "requests": 0, "acks": 0, "nacks": 0, "declines": 0, "releases": 0, "informs": 0, "errors": 0 } Required Permissions: read Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Reset DHCP server statistics counters

Reset DHCP statistics counters of a DHCP server represented by the
connectivity_path and the enforecement_point_path where the
dhcp-server-config was applied to. The connectivity_path can be the Tier0
path, Tier1 path or a segment path. If the given Tier0/1 or Segment has
DHCP server applied, the resetting will succeed and the DHCP statistics
counters will be reset to 0. But if it has no DHCP server applied, the
reseting will fail with proper error message.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/stats?action=reset

Request Headers:

n/a

Query Parameters:

DhcpServerRequestParameters+

DhcpServerRequestParameters (schema)

Name	Description	Type	Notes
connectivity_path	String Path of Tier0, Tier1 or Segment String Path of Tier0, Tier1 or Segment where DHCP server is deployed. Specify Tier0/Tier1 gateway path for DHCP server attached to the gateway. Segment path must be specified for local DHCP server configuration.	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point Enforcement point path. Required when multiple enforcement points are configured.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/default/stats?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP server status

Read DHCP server status Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{config-id}/status

Request Headers:

n/a

Query Parameters:

DhcpServerRequestParameters+

DhcpServerRequestParameters (schema)

Name	Description	Type	Notes
connectivity_path	String Path of Tier0, Tier1 or Segment String Path of Tier0, Tier1 or Segment where DHCP server is deployed. Specify Tier0/Tier1 gateway path for DHCP server attached to the gateway. Segment path must be specified for local DHCP server configuration.	string	Required
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string
enforcement_point_path	String Path of the enforcement point Enforcement point path. Required when multiple enforcement points are configured.	string
include_mark_for_delete_objects	Include objects that are marked for deletion in results If true, resources that are marked for deletion will be included in the results. By default, these resources are not included.	boolean	Default: "False"
included_fields	Comma separated list of fields that should be included in query result Note - this parameter currently only works when used with the search APIs /policy/api/v1/search/query and /policy/api/v1/search/dsl. It is ignored for other list APIs.	string
page_size	Maximum number of results to return in this page (server may return fewer)	integer	Minimum: 0 Maximum: 1000 Default: "1000"
sort_ascending	If true, results are sorted in ascending order	boolean
sort_by	Field by which records are sorted	string

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/default/status?connectivity_path=/global-infra/tier-1s/it_t1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpServerStatus+

Example Response: { "active_node": "/infra/sites/default/enforcement-points/default/edge-clusters/43436d79-05ce-4c0b-b31f-078989d4e6fd/edge-nodes/bf80b020-2df8-11ea-986b-000c291ec83c", "stand_by_node": "/infra/sites/default/enforcement-points/default/edge-clusters/43436d79-05ce-4c0b-b31f-078989d4e6fd/edge-nodes/c03dadec-2df8-11ea-a4e6-000c295fbd46", "service_status": "UP" } Required Permissions: read Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP server configuration

If DHCP server config with the dhcp-server-config-id is not already
present, create a new DHCP server config instance. If it already exists,
replace the DHCP server config instance with this object.

Realized entities of this API can be found using the path of Tier-0, Tier1,
or Segment where this config is applied on.

Modification of edge_cluster_path in DhcpServerConfig will lose all
existing DHCP leases.

If both the preferred_edge_paths in the DhcpServerConfig are changed
in a same PUT API, e.g. change from [a,b] to [x,y], the current DHCP
server leases will be lost, which could cause network connectivity
issues. It is recommended to change only one member index in an update
call, e.g. from [a, b] to [a,y].

Clearing preferred_edge_paths will not reassign edge nodes from the
edge cluster. Instead, the previously-allocated edge nodes will be
retained to avoid loss of leases.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpServerConfig+

DhcpServerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_cluster_path	Edge cluster path The reference to the edge cluster using the policy path of the edge cluster. Auto assigned if only one edge cluster is configured on enforcement-point. Modifying edge cluster will reallocate DHCP server to the new edge cluster. Please note that re-allocating edge-cluster will result in losing of all exisitng DHCP lease information. Change edge cluster only when losing DHCP leases is not a real problem, e.g. cross-site migration or failover and all client hosts will be reboot and get new IP addresses.	string
enable_standby_relocation	Stand-By Relocation If no "preferred-edge-paths" were defined, and the "enable-standby-relocation"=true, once a new edge-node was added to the edge-cluster, the stand-by node of the DHCP could possibly be moved to another edge-node. But there is no guarantee that the stand-by will be moved. Please note, if the dhcp-server-config was applied to a gateway, and this gateway has defined its own edge-cluster and preferred edge-nodes, then the edge-cluster and nodes defined in dhcp-server-config will be ignored.	boolean	Default: "False"
id	Unique identifier of this resource	string	Sortable
lease_time	IP address lease time in seconds IP address lease time in seconds.	integer	Deprecated Minimum: 60 Maximum: 4294967295 Default: "86400"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_edge_paths	Edge node path Policy paths to edge nodes on which the DHCP servers run. The first edge node is assigned as active edge, and second one as standby edge. If only one edge node is specified, the DHCP servers will run without HA support. When this property is not specified, edge nodes are auto-assigned during realization of the DHCP server.	array of string	Maximum items: 2
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpServerConfig	string
server_address	DHCP server address in CIDR format DHCP server address in CIDR format. Prefix length should be less than or equal to 30. DHCP server is deployed as DHCP relay service. This property is deprecated, use server_addresses instead. Both properties cannot be specified together with different new values.	string	Deprecated Format: ip-cidr-block
server_addresses	DHCP server address in CIDR format DHCP server address in CIDR format. Both IPv4 and IPv6 address families are supported. Prefix length should be less than or equal to 30 for IPv4 address family and less than or equal to 126 for IPv6. When not specified, IPv4 value is auto-assigned to 100.96.0.1/30. Ignored when this object is configured at a Segment.	array of string	Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/dhcp-srv1 { "server_address": "10.1.1.1/30", "lease_time": 10000, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpServerConfig+

DhcpServerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_cluster_path	Edge cluster path The reference to the edge cluster using the policy path of the edge cluster. Auto assigned if only one edge cluster is configured on enforcement-point. Modifying edge cluster will reallocate DHCP server to the new edge cluster. Please note that re-allocating edge-cluster will result in losing of all exisitng DHCP lease information. Change edge cluster only when losing DHCP leases is not a real problem, e.g. cross-site migration or failover and all client hosts will be reboot and get new IP addresses.	string
enable_standby_relocation	Stand-By Relocation If no "preferred-edge-paths" were defined, and the "enable-standby-relocation"=true, once a new edge-node was added to the edge-cluster, the stand-by node of the DHCP could possibly be moved to another edge-node. But there is no guarantee that the stand-by will be moved. Please note, if the dhcp-server-config was applied to a gateway, and this gateway has defined its own edge-cluster and preferred edge-nodes, then the edge-cluster and nodes defined in dhcp-server-config will be ignored.	boolean	Default: "False"
id	Unique identifier of this resource	string	Sortable
lease_time	IP address lease time in seconds IP address lease time in seconds.	integer	Deprecated Minimum: 60 Maximum: 4294967295 Default: "86400"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_edge_paths	Edge node path Policy paths to edge nodes on which the DHCP servers run. The first edge node is assigned as active edge, and second one as standby edge. If only one edge node is specified, the DHCP servers will run without HA support. When this property is not specified, edge nodes are auto-assigned during realization of the DHCP server.	array of string	Maximum items: 2
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpServerConfig	string
server_address	DHCP server address in CIDR format DHCP server address in CIDR format. Prefix length should be less than or equal to 30. DHCP server is deployed as DHCP relay service. This property is deprecated, use server_addresses instead. Both properties cannot be specified together with different new values.	string	Deprecated Format: ip-cidr-block
server_addresses	DHCP server address in CIDR format DHCP server address in CIDR format. Both IPv4 and IPv6 address families are supported. Prefix length should be less than or equal to 30 for IPv4 address family and less than or equal to 126 for IPv6. When not specified, IPv4 value is auto-assigned to 100.96.0.1/30. Ignored when this object is configured at a Segment.	array of string	Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "DhcpServerConfig", "id": "dhcp-srv1", "display_name": "dhcp-srv1", "path": "/infra/dhcp-server-configs/dhcp-srv1", "parent_path": "/infra", "relative_path": "dhcp-srv1", "server_address": "10.1.1.1/30", "lease_time": 10000, "_create_user": "admin", "_create_time": 1516668826912, "_last_modified_user": "admin", "_last_modified_time": 1516668826912, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP server configuration

If DHCP server config with the dhcp-server-config-id is not already
present, create a new DHCP server config instance. If it already exists,
update the DHCP server config instance with specified attributes.

Realized entities of this API can be found using the path of Tier-0, Tier1,
or Segment where this config is applied on.

Modification of edge_cluster_path in DhcpServerConfig will lose all
existing DHCP leases.

If both the preferred_edge_paths in the DhcpServerConfig are changed
in a same PATCH API, e.g. change from [a,b] to [x,y], the current DHCP
server leases will be lost, which could cause network connectivity
issues. It is recommended to change only one member index in an update
call, e.g. from [a, b] to [a,y].

Clearing preferred_edge_paths will not reassign edge nodes from the
edge cluster. Instead, the previously-allocated edge nodes will be
retained to avoid loss of leases.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpServerConfig+

DhcpServerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_cluster_path	Edge cluster path The reference to the edge cluster using the policy path of the edge cluster. Auto assigned if only one edge cluster is configured on enforcement-point. Modifying edge cluster will reallocate DHCP server to the new edge cluster. Please note that re-allocating edge-cluster will result in losing of all exisitng DHCP lease information. Change edge cluster only when losing DHCP leases is not a real problem, e.g. cross-site migration or failover and all client hosts will be reboot and get new IP addresses.	string
enable_standby_relocation	Stand-By Relocation If no "preferred-edge-paths" were defined, and the "enable-standby-relocation"=true, once a new edge-node was added to the edge-cluster, the stand-by node of the DHCP could possibly be moved to another edge-node. But there is no guarantee that the stand-by will be moved. Please note, if the dhcp-server-config was applied to a gateway, and this gateway has defined its own edge-cluster and preferred edge-nodes, then the edge-cluster and nodes defined in dhcp-server-config will be ignored.	boolean	Default: "False"
id	Unique identifier of this resource	string	Sortable
lease_time	IP address lease time in seconds IP address lease time in seconds.	integer	Deprecated Minimum: 60 Maximum: 4294967295 Default: "86400"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_edge_paths	Edge node path Policy paths to edge nodes on which the DHCP servers run. The first edge node is assigned as active edge, and second one as standby edge. If only one edge node is specified, the DHCP servers will run without HA support. When this property is not specified, edge nodes are auto-assigned during realization of the DHCP server.	array of string	Maximum items: 2
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpServerConfig	string
server_address	DHCP server address in CIDR format DHCP server address in CIDR format. Prefix length should be less than or equal to 30. DHCP server is deployed as DHCP relay service. This property is deprecated, use server_addresses instead. Both properties cannot be specified together with different new values.	string	Deprecated Format: ip-cidr-block
server_addresses	DHCP server address in CIDR format DHCP server address in CIDR format. Both IPv4 and IPv6 address families are supported. Prefix length should be less than or equal to 30 for IPv4 address family and less than or equal to 126 for IPv6. When not specified, IPv4 value is auto-assigned to 100.96.0.1/30. Ignored when this object is configured at a Segment.	array of string	Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/dhcp-srv1 { "server_address": "10.1.1.1/30", "lease_time": 10000 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP server configuration

Read DHCP server configuration Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/dhcp-srv1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpServerConfig+

DhcpServerConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
edge_cluster_path	Edge cluster path The reference to the edge cluster using the policy path of the edge cluster. Auto assigned if only one edge cluster is configured on enforcement-point. Modifying edge cluster will reallocate DHCP server to the new edge cluster. Please note that re-allocating edge-cluster will result in losing of all exisitng DHCP lease information. Change edge cluster only when losing DHCP leases is not a real problem, e.g. cross-site migration or failover and all client hosts will be reboot and get new IP addresses.	string
enable_standby_relocation	Stand-By Relocation If no "preferred-edge-paths" were defined, and the "enable-standby-relocation"=true, once a new edge-node was added to the edge-cluster, the stand-by node of the DHCP could possibly be moved to another edge-node. But there is no guarantee that the stand-by will be moved. Please note, if the dhcp-server-config was applied to a gateway, and this gateway has defined its own edge-cluster and preferred edge-nodes, then the edge-cluster and nodes defined in dhcp-server-config will be ignored.	boolean	Default: "False"
id	Unique identifier of this resource	string	Sortable
lease_time	IP address lease time in seconds IP address lease time in seconds.	integer	Deprecated Minimum: 60 Maximum: 4294967295 Default: "86400"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_edge_paths	Edge node path Policy paths to edge nodes on which the DHCP servers run. The first edge node is assigned as active edge, and second one as standby edge. If only one edge node is specified, the DHCP servers will run without HA support. When this property is not specified, edge nodes are auto-assigned during realization of the DHCP server.	array of string	Maximum items: 2
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpServerConfig	string
server_address	DHCP server address in CIDR format DHCP server address in CIDR format. Prefix length should be less than or equal to 30. DHCP server is deployed as DHCP relay service. This property is deprecated, use server_addresses instead. Both properties cannot be specified together with different new values.	string	Deprecated Format: ip-cidr-block
server_addresses	DHCP server address in CIDR format DHCP server address in CIDR format. Both IPv4 and IPv6 address families are supported. Prefix length should be less than or equal to 30 for IPv4 address family and less than or equal to 126 for IPv6. When not specified, IPv4 value is auto-assigned to 100.96.0.1/30. Ignored when this object is configured at a Segment.	array of string	Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DHCP server configuration

Delete DHCP server configuration Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/dhcp-server-configs/{dhcp-server-config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/dhcp-server-configs/dhcp-srv1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_dhcp Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dhcp): DHCP Static Bindings (Fixed Segments)

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

List all DHCP static bindings

Paginated list of all DHCP static binding instances
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/mgw/segments/web_seg/dhcp-static-binding-configs Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpStaticBindingConfigListResult+

Example Response: { "results": [ { "gateway_address": "10.1.1.1", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "mac_address": "11:22:33:44:55:67", "lease_time": 86400, "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "resource_type": "DhcpV4StaticBindingConfig", "id": "address1", "display_name": "address1", "path": "/infra/tier-1s/mgw/segments/web1/dhcp-static-binding-configs/address1", "relative_path": "address1", "parent_path": "/infra/tier-1s/mgw/segments/web1", "unique_id": "32fdd5b6-e3e7-4e62-867b-fc805c9de77e", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "admin", "_create_time": 1594595467056, "_last_modified_user": "admin", "_last_modified_time": 1594595467058, "_protection": "NOT_PROTECTED", "_revision": 0 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP static binding

If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with this object.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/mgw/segments/web1/dhcp-static-binding-configs/address1 { "resource_type": "DhcpV4StaticBindingConfig", "gateway_address": "10.1.1.1", "mac_address": "11:22:33:44:55:67", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "gateway_address": "10.1.1.1", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "mac_address": "11:22:33:44:55:67", "lease_time": 86400, "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "resource_type": "DhcpV4StaticBindingConfig", "id": "address1", "display_name": "address1", "path": "/infra/tier-1s/mgw/segments/web1/dhcp-static-binding-configs/address1", "relative_path": "address1", "parent_path": "/infra/tier-1s/mgw/segments/web1", "unique_id": "32fdd5b6-e3e7-4e62-867b-fc805c9de77e", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "admin", "_create_time": 1594595467056, "_last_modified_user": "admin", "_last_modified_time": 1594595467058, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP static binding

If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with specified attributes.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/mgw/segments/web_seg/dhcp-static-binding-configs/binding1 { "resource_type": "DhcpV4StaticBindingConfig", "gateway_address": "10.1.1.1", "mac_address": "11:22:33:44:55:67", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } } } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP static binding

Read DHCP static binding Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/mgw/segments/web_seg/dhcp-static-binding-configs/binding1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DHCP static binding

Delete DHCP static binding Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/mgw/segments/web_seg/dhcp-static-binding-configs/binding1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dhcp): DHCP Static Bindings (Segments)

Associated URIs:

GET /global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs
DELETE /global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
PATCH /global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
PUT /global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}
GET /global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-bindings/{binding-id}/state
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-bindings/{binding-id}/state

List all DHCP static bindings

Paginated list of all DHCP static binding instances
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web1/dhcp-static-binding-configs Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpStaticBindingConfigListResult+

Example Response: { "results": [ { "gateway_address": "10.1.1.1", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "mac_address": "11:22:33:44:55:67", "lease_time": 86400, "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "resource_type": "DhcpV4StaticBindingConfig", "id": "address1", "display_name": "vm1-address", "path": "/infra/segments/web1/dhcp-static-binding-configs/address1", "relative_path": "address1", "parent_path": "/infra/segments/web1", "unique_id": "32fdd5b6-e3e7-4e62-867b-fc805c9de77e", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "admin", "_create_time": 1594595467056, "_last_modified_user": "admin", "_last_modified_time": 1594595977854, "_protection": "NOT_PROTECTED", "_revision": 2 } ], "result_count": 1, "sort_by": "display_name", "sort_ascending": true } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP static binding

If binding with the binding-id is not already present,
create a new DHCP static binding instance. If it already exists, replace
the existing DHCP static binding instance with this object.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web1/dhcp-static-binding-configs/address1 { "display_name": "vm1-address", "resource_type": "DhcpV4StaticBindingConfig", "gateway_address": "10.1.1.1", "mac_address": "11:22:33:44:55:67", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "_revision": 0 } example_response: | { "gateway_address": "10.1.1.1", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "mac_address": "11:22:33:44:55:67", "lease_time": 86400, "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "resource_type": "DhcpV4StaticBindingConfig", "id": "address1", "display_name": "vm1-address", "path": "/global-infra/segments/web1/dhcp-static-binding-configs/address1", "relative_path": "address1", "parent_path": "/global-infra/segments/web1", "unique_id": "32fdd5b6-e3e7-4e62-867b-fc805c9de77e", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "admin", "_create_time": 1594595467056, "_last_modified_user": "admin", "_last_modified_time": 1594595977854, "_protection": "NOT_PROTECTED", "_revision": 2 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update DHCP static binding

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web1/dhcp-static-binding-configs/address1 { "display_name": "vm1-address", "resource_type": "DhcpV4StaticBindingConfig", "gateway_address": "10.1.1.1", "mac_address": "11:22:33:44:55:67", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "_revision": 0 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP static binding

Read DHCP static binding Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web1/dhcp-static-binding-configs/address1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpV4StaticBindingConfig+

DhcpV4StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
gateway_address	Gateway IP address When not specified, gateway address is auto-assigned from segment configuration.	IPv4Address
host_name	Host name Hostname to assign to the host.	string	Maximum length: 63
id	Unique identifier of this resource	string	Sortable
ip_address	IP assigned to host IP assigned to host. The IP address must belong to the subnet, if any, configured on Segment.	IPv4Address	Required
lease_time	Lease time DHCP lease time in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address of host MAC address of the host.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
options	DHCP options IPv4 DHCP options.	DhcpV4Options
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV4StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

DhcpV6StaticBindingConfig+

DhcpV6StaticBindingConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_nameservers	DNS nameservers to be set to client host When not specified, no DNS nameserver will be set to client host.	array of string	Minimum items: 0 Maximum items: 2
domain_names	Domain names to be assigned to client host When not specified, no domain name will be assigned to client host.	array of string
id	Unique identifier of this resource	string	Sortable
ip_addresses	IP addresses to be assigned to client host When not specified, no ip address will be assigned to client host.	array of IPv6Address	Minimum items: 0 Maximum items: 1
lease_time	Lease time Lease time, in seconds.	integer	Minimum: 60 Maximum: 4294967295 Default: "86400"
mac_address	MAC address The MAC address of the client host. Either client-duid or mac-address, but not both.	MACAddress	Required
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
preferred_time	Preferred time Preferred time, in seconds. If this value is not provided, the value of lease_time*0.8 will be used.	integer	Minimum: 48 Maximum: 4294967295
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value DhcpV6StaticBindingConfig	string	Required Enum: DhcpV4StaticBindingConfig, DhcpV6StaticBindingConfig
sntp_servers	SNTP server ips SNTP server IP addresses.	array of IPv6Address	Minimum items: 0 Maximum items: 2
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "gateway_address": "10.1.1.1", "host_name": "vm1.vmware.com", "ip_address": "30.30.30.175", "mac_address": "11:22:33:44:55:67", "lease_time": 86400, "options": { "option121": { "static_routes": [ { "network": "10.22.12.1/23", "next_hop": "2.2.2.2" }, { "network": "129.0.0.1/32", "next_hop": "0.0.0.0" } ] } }, "resource_type": "DhcpV4StaticBindingConfig", "id": "address1", "display_name": "vm1-address", "path": "/infra/segments/web1/dhcp-static-binding-configs/address1", "relative_path": "address1", "parent_path": "/infra/segments/web1", "unique_id": "32fdd5b6-e3e7-4e62-867b-fc805c9de77e", "marked_for_delete": false, "overridden": false, "_system_owned": false, "_create_user": "admin", "_create_time": 1594595467056, "_last_modified_user": "admin", "_last_modified_time": 1594595977854, "_protection": "NOT_PROTECTED", "_revision": 2 } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DHCP static binding

Delete DHCP static binding Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-binding-configs/{binding-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web_seg/dhcp-static-binding-configs/binding1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: 200 OK Required Permissions: crud Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP static binding state

Read DHCP static binding state Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/segments/{segment-id}/dhcp-static-bindings/{binding-id}/state

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/segments/web_seg/dhcp-static-bindings/server1/state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpStaticBindingState+

DhcpStaticBindingState (schema)

Name	Description	Type	Notes
details	Array of configuration state of various sub systems	array of ConfigurationStateElement	Readonly
failure_code	Error code	integer	Readonly
failure_message	Error message in case of failure	string	Readonly
state	Overall state of desired configuration Gives details of state of desired configuration. Additional enums with more details on progress/success/error states are sent for edge node. The success states are NODE_READY and TRANSPORT_NODE_READY, pending states are {VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, REGISTRATION_PENDING} and other values indicate failures. "in_sync" state indicates that the desired configuration has been received by the host to which it applies, but is not yet in effect. When the configuration is actually in effect, the state will change to "success". Please note, failed state is deprecated.	string	Required Readonly Enum: pending, in_progress, success, failed, partial_success, orphaned, unknown, error, in_sync, NOT_AVAILABLE, VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, VM_DEPLOYMENT_FAILED, VM_POWER_ON_IN_PROGRESS, VM_POWER_ON_FAILED, REGISTRATION_PENDING, NODE_NOT_READY, NODE_READY, VM_POWER_OFF_IN_PROGRESS, VM_POWER_OFF_FAILED, VM_UNDEPLOY_IN_PROGRESS, VM_UNDEPLOY_FAILED, VM_UNDEPLOY_SUCCESSFUL, EDGE_CONFIG_ERROR, VM_DEPLOYMENT_RESTARTED, REGISTRATION_FAILED, TRANSPORT_NODE_SYNC_PENDING, TRANSPORT_NODE_CONFIGURATION_MISSING, EDGE_HARDWARE_NOT_SUPPORTED, MULTIPLE_OVERLAY_TZS_NOT_SUPPORTED, TN_OVERLAY_TZ_IN_USE_BY_EDGE_CLUSTER, VC_VCP_ACTION_PENDING, VC_VCP_ACTION_FAILED, TZ_ENDPOINTS_NOT_SPECIFIED, NO_PNIC_PREPARED_IN_EDGE, APPLIANCE_INTERNAL_ERROR, VTEP_DHCP_NOT_SUPPORTED, UNSUPPORTED_HOST_SWITCH_PROFILE, UPLINK_HOST_SWITCH_PROFILE_NOT_SPECIFIED, HOSTSWITCH_PROFILE_NOT_FOUND, LLDP_SEND_ENABLED_NOT_SUPPORTED, UNSUPPORTED_NAMED_TEAMING_POLICY, LBSRCID_NOT_SUPPORTED_FOR_EDGE_VM, LACP_NOT_SUPPORTED_FOR_EDGE_VM, STANDBY_UPLINKS_NOT_SUPPORTED_FOR_EDGE_VM, MULTIPLE_ACTIVE_UPLINKS_NOT_SUPPORTED_FOR_EDGE, UNSUPPORTED_LACP_LB_ALGO_FOR_NODE, EDGE_NODE_VERSION_NOT_SUPPORTED, NO_PNIC_SPECIFIED_IN_TN, INVALID_PNIC_DEVICE_NAME, TRANSPORT_NODE_READY, VM_NETWORK_EDIT_PENDING, UNSUPPORTED_DEFAULT_TEAMING_POLICY, MPA_DISCONNECTED, VM_RENAME_PENDING, VM_CONFIG_EDIT_PENDING, VM_NETWORK_EDIT_FAILED, VM_RENAME_FAILED, VM_CONFIG_EDIT_FAILED, VM_CONFIG_DISCREPANCY, VM_NODE_REFRESH_FAILED, VM_PLACEMENT_REFRESH_FAILED, REGISTRATION_TIMEDOUT, REPLACE_FAILED, UPLINK_FROM_TEAMING_POLICY_NOT_MAPPED, LOGICAL_SWITCH_NAMED_TEAMING_HAS_NO_PNIC_BACKING, DELETE_VM_IN_REDEPLOY_FAILED, DEPLOY_VM_IN_REDEPLOY_FAILED, INSUFFICIENT_RESOURCES_IN_EDGE_NODE_FOR_SERVICE, VM_RESOURCE_RESERVATION_FAILED, DUPLICATE_PNICS_IN_TEAMINGS_WITH_MULTIPLE_UPLINKS_AND_FAILOVER_ORDER, DUPLICATE_VLANS_SHARING_SAME_PNICMULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, EDGE_NODE_SETTINGS_MISMATCH_RESOLVE, EDGE_VM_VSPHERE_SETTINGS_MISMATCH_RESOLVE, EDGE_NODE_SETTINGS_AND_VSPHERE_SETTINGS_ARE_CHANGED_RESOLVE, EDGE_VSPHERE_LOCATION_MISMATCH_RESOLVE, COMPUTE_MANAGER_NOT_FOUND, DELETE_IN_PROGRESS, ADVANCED_CONFIG_EDIT_FAILED, UPT_MODE_REALIZATION_POLL_TIMED_OUT, DATAPATH_CONFIGURATION_EDIT_FAILED, MAINTENANCE_MODE_ENABLED, ERROR_IN_ENABLE_MAINTENANCE_MODE, ERROR_IN_DISABLE_MAINTENANCE_MODE, CONFIGURE_UPT_ON_VM_FAILED, VM_VERSION_IS_UPT_INCOMPATIBLE, DELETE_FAILED_FOR_DIFFERENT_MOREF_ID, DELETE_FAILED_ON_VM_NOT_FOUND, DELETE_FAILED_FOR_NON_LCM_EDGE, ADVANCED_CONFIG_EDIT_PENDING, DUPLICATE_VLANS_SHARING_SAME_PNIC, MULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, REDEPLOY_ACTIVITY_FAILED, REDEPLOY_ACTIVITY_IN_PROGRESS, REDEPLOY_ACTIVITY_SCHEDULED, REDEPLOY_ACTIVITY_SUCCESSFUL, REPLACE_ACTIVITY_FAILED, REPLACE_ACTIVITY_IN_PROGRESS, REPLACE_ACTIVITY_SCHEDULED, REPLACE_ACTIVITY_SUCCESSFUL, REPLACED_RPC_CLIENT_OF_TN, RETRYING_REPLACE, UNABLE_TO_DELETE_EDGE_NODE_VM_INTERNAL_ERROR, VM_REDEPLOY_FAILED, VM_RESOURCE_RESERVATION_EDIT_PENDING, REDEPLOYED_VM_REGISTRATION_PENDING

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read DHCP static binding state

Read DHCP static binding state Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/segments/{segment-id}/dhcp-static-bindings/{binding-id}/state

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/mgw/segments/web_seg/dhcp-static-bindings/server1/state Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

DhcpStaticBindingState+

DhcpStaticBindingState (schema)

Name	Description	Type	Notes
details	Array of configuration state of various sub systems	array of ConfigurationStateElement	Readonly
failure_code	Error code	integer	Readonly
failure_message	Error message in case of failure	string	Readonly
state	Overall state of desired configuration Gives details of state of desired configuration. Additional enums with more details on progress/success/error states are sent for edge node. The success states are NODE_READY and TRANSPORT_NODE_READY, pending states are {VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, REGISTRATION_PENDING} and other values indicate failures. "in_sync" state indicates that the desired configuration has been received by the host to which it applies, but is not yet in effect. When the configuration is actually in effect, the state will change to "success". Please note, failed state is deprecated.	string	Required Readonly Enum: pending, in_progress, success, failed, partial_success, orphaned, unknown, error, in_sync, NOT_AVAILABLE, VM_DEPLOYMENT_QUEUED, VM_DEPLOYMENT_IN_PROGRESS, VM_DEPLOYMENT_FAILED, VM_POWER_ON_IN_PROGRESS, VM_POWER_ON_FAILED, REGISTRATION_PENDING, NODE_NOT_READY, NODE_READY, VM_POWER_OFF_IN_PROGRESS, VM_POWER_OFF_FAILED, VM_UNDEPLOY_IN_PROGRESS, VM_UNDEPLOY_FAILED, VM_UNDEPLOY_SUCCESSFUL, EDGE_CONFIG_ERROR, VM_DEPLOYMENT_RESTARTED, REGISTRATION_FAILED, TRANSPORT_NODE_SYNC_PENDING, TRANSPORT_NODE_CONFIGURATION_MISSING, EDGE_HARDWARE_NOT_SUPPORTED, MULTIPLE_OVERLAY_TZS_NOT_SUPPORTED, TN_OVERLAY_TZ_IN_USE_BY_EDGE_CLUSTER, VC_VCP_ACTION_PENDING, VC_VCP_ACTION_FAILED, TZ_ENDPOINTS_NOT_SPECIFIED, NO_PNIC_PREPARED_IN_EDGE, APPLIANCE_INTERNAL_ERROR, VTEP_DHCP_NOT_SUPPORTED, UNSUPPORTED_HOST_SWITCH_PROFILE, UPLINK_HOST_SWITCH_PROFILE_NOT_SPECIFIED, HOSTSWITCH_PROFILE_NOT_FOUND, LLDP_SEND_ENABLED_NOT_SUPPORTED, UNSUPPORTED_NAMED_TEAMING_POLICY, LBSRCID_NOT_SUPPORTED_FOR_EDGE_VM, LACP_NOT_SUPPORTED_FOR_EDGE_VM, STANDBY_UPLINKS_NOT_SUPPORTED_FOR_EDGE_VM, MULTIPLE_ACTIVE_UPLINKS_NOT_SUPPORTED_FOR_EDGE, UNSUPPORTED_LACP_LB_ALGO_FOR_NODE, EDGE_NODE_VERSION_NOT_SUPPORTED, NO_PNIC_SPECIFIED_IN_TN, INVALID_PNIC_DEVICE_NAME, TRANSPORT_NODE_READY, VM_NETWORK_EDIT_PENDING, UNSUPPORTED_DEFAULT_TEAMING_POLICY, MPA_DISCONNECTED, VM_RENAME_PENDING, VM_CONFIG_EDIT_PENDING, VM_NETWORK_EDIT_FAILED, VM_RENAME_FAILED, VM_CONFIG_EDIT_FAILED, VM_CONFIG_DISCREPANCY, VM_NODE_REFRESH_FAILED, VM_PLACEMENT_REFRESH_FAILED, REGISTRATION_TIMEDOUT, REPLACE_FAILED, UPLINK_FROM_TEAMING_POLICY_NOT_MAPPED, LOGICAL_SWITCH_NAMED_TEAMING_HAS_NO_PNIC_BACKING, DELETE_VM_IN_REDEPLOY_FAILED, DEPLOY_VM_IN_REDEPLOY_FAILED, INSUFFICIENT_RESOURCES_IN_EDGE_NODE_FOR_SERVICE, VM_RESOURCE_RESERVATION_FAILED, DUPLICATE_PNICS_IN_TEAMINGS_WITH_MULTIPLE_UPLINKS_AND_FAILOVER_ORDER, DUPLICATE_VLANS_SHARING_SAME_PNICMULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, EDGE_NODE_SETTINGS_MISMATCH_RESOLVE, EDGE_VM_VSPHERE_SETTINGS_MISMATCH_RESOLVE, EDGE_NODE_SETTINGS_AND_VSPHERE_SETTINGS_ARE_CHANGED_RESOLVE, EDGE_VSPHERE_LOCATION_MISMATCH_RESOLVE, COMPUTE_MANAGER_NOT_FOUND, DELETE_IN_PROGRESS, ADVANCED_CONFIG_EDIT_FAILED, UPT_MODE_REALIZATION_POLL_TIMED_OUT, DATAPATH_CONFIGURATION_EDIT_FAILED, MAINTENANCE_MODE_ENABLED, ERROR_IN_ENABLE_MAINTENANCE_MODE, ERROR_IN_DISABLE_MAINTENANCE_MODE, CONFIGURE_UPT_ON_VM_FAILED, VM_VERSION_IS_UPT_INCOMPATIBLE, DELETE_FAILED_FOR_DIFFERENT_MOREF_ID, DELETE_FAILED_ON_VM_NOT_FOUND, DELETE_FAILED_FOR_NON_LCM_EDGE, ADVANCED_CONFIG_EDIT_PENDING, DUPLICATE_VLANS_SHARING_SAME_PNIC, MULTIPLE_UPLINKS_IN_NAMED_TEAMING_NOT_SUPPORTED_IF_UPLINK_IN_DEFAULT_TEAMING, REDEPLOY_ACTIVITY_FAILED, REDEPLOY_ACTIVITY_IN_PROGRESS, REDEPLOY_ACTIVITY_SCHEDULED, REDEPLOY_ACTIVITY_SUCCESSFUL, REPLACE_ACTIVITY_FAILED, REPLACE_ACTIVITY_IN_PROGRESS, REPLACE_ACTIVITY_SCHEDULED, REPLACE_ACTIVITY_SUCCESSFUL, REPLACED_RPC_CLIENT_OF_TN, RETRYING_REPLACE, UNABLE_TO_DELETE_EDGE_NODE_VM_INTERNAL_ERROR, VM_REDEPLOY_FAILED, VM_RESOURCE_RESERVATION_EDIT_PENDING, REDEPLOYED_VM_REGISTRATION_PENDING

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dns Forwarder)

Networking (Dns Forwarder): DNS Zones

Associated URIs:

GET /global-manager/api/v1/global-infra/dns-forwarder-zones
DELETE /global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}
GET /global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}
PATCH /global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}
PUT /global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}

List Dns Forwarder Zones

Paginated list of all Dns Forwarder Zones
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dns-forwarder-zones

Request Headers:

n/a

Query Parameters:

PolicyDnsForwarderZoneListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dns-forwarder-zones Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarderZoneListResult+

Example Response: { "sort_ascending" : true, "sort_by" : "display_name", "result_count" : 2, "results" : [ { "resource_type" : "PolicyDnsForwarderZone", "id" : "default-1", "display_name" : "$1", "path" : "/infra/dns-forwarder-zones/default-1", "parent_path" : "/infra/dns-forwarder-zones/default-1", "relative_path" : "default-1", "dns_domain_names" : [ ], "upstream_servers" : [ "3.3.3.3", "4.4.4.4" ], "_create_user" : "a;a", "_create_time" : 1517400275031, "_last_modified_user" : "a;a", "_last_modified_time" : 1517400275031, "_system_owned" : false, "_protection" : "NOT_PROTECTED", "_revision" : 0 }, { "resource_type" : "PolicyDnsForwarderZone", "id" : "conditional-1", "display_name" : "$1", "path" : "/infra/dns-forwarder-zones/conditional-1", "parent_path" : "/infra/dns-forwarder-zones/conditional-1", "relative_path" : "conditional-1", "dns_domain_names" : [ "foo.com" ], "upstream_servers" : [ "1.1.1.1", "2.2.2.2" ], "_create_user" : "a;a", "_create_time" : 1517400132921, "_last_modified_user" : "a;a", "_last_modified_time" : 1517400132921, "_system_owned" : false, "_protection" : "NOT_PROTECTED", "_revision" : 0 } ] } Required Permissions: read Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update the DNS Forwarder Zone

Create or update the DNS Forwarder Zone Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyDnsForwarderZone+

PolicyDnsForwarderZone (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_domain_names	List of domain names List of domain names on which conditional forwarding is based. This field is required if the DNS Zone is being used for a conditional forwarder. This field will also be used for conditional reverse lookup. Example 1, if for one of the zones, one of the entries in the fqdn is example.com, all the DNS requests under the domain example.com will be served by the corresponding upstream DNS server. Example 2, if for one of the zones, one of the entries in the fqdn list is "13.12.30.in-addr.arpa", reverse lookup for 30.12.13.0/24 will go to the corresponding DNS server.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarderZone	string
source_ip	Source IP used by DNS Forwarder zone The source IP used by the DNS Forwarder zone.	IPv4Address
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
upstream_servers	DNS servers to which the DNS request needs to be forwarded Max of 3 DNS servers can be configured	array of IPv4Address	Required Maximum items: 3

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/dns-forwarder-zones/conditional-1 { "display_name" : "Conditional 1", "dns_domain_names" : [ "foo.com" ], "upstream_servers" : [ "1.1.1.1", "2.2.2.2" ] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update the DNS Forwarder Zone

Create or update the DNS Forwarder Zone Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyDnsForwarderZone+

PolicyDnsForwarderZone (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_domain_names	List of domain names List of domain names on which conditional forwarding is based. This field is required if the DNS Zone is being used for a conditional forwarder. This field will also be used for conditional reverse lookup. Example 1, if for one of the zones, one of the entries in the fqdn is example.com, all the DNS requests under the domain example.com will be served by the corresponding upstream DNS server. Example 2, if for one of the zones, one of the entries in the fqdn list is "13.12.30.in-addr.arpa", reverse lookup for 30.12.13.0/24 will go to the corresponding DNS server.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarderZone	string
source_ip	Source IP used by DNS Forwarder zone The source IP used by the DNS Forwarder zone.	IPv4Address
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
upstream_servers	DNS servers to which the DNS request needs to be forwarded Max of 3 DNS servers can be configured	array of IPv4Address	Required Maximum items: 3

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/dns-forwarder-zones/conditional-1 { "display_name" : "Conditional 1", "dns_domain_names" : [ "foo.com" ], "upstream_servers" : [ "1.1.1.1", "2.2.2.2" ], "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarderZone+

PolicyDnsForwarderZone (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_domain_names	List of domain names List of domain names on which conditional forwarding is based. This field is required if the DNS Zone is being used for a conditional forwarder. This field will also be used for conditional reverse lookup. Example 1, if for one of the zones, one of the entries in the fqdn is example.com, all the DNS requests under the domain example.com will be served by the corresponding upstream DNS server. Example 2, if for one of the zones, one of the entries in the fqdn list is "13.12.30.in-addr.arpa", reverse lookup for 30.12.13.0/24 will go to the corresponding DNS server.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarderZone	string
source_ip	Source IP used by DNS Forwarder zone The source IP used by the DNS Forwarder zone.	IPv4Address
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
upstream_servers	DNS servers to which the DNS request needs to be forwarded Max of 3 DNS servers can be configured	array of IPv4Address	Required Maximum items: 3

Example Response: { "resource_type" : "PolicyDnsForwarderZone", "id" : "conditional-1", "display_name" : "$1", "path" : "/infra/dns-forwarder-zones/conditional-1", "parent_path" : "/infra/dns-forwarder-zones/conditional-1", "relative_path" : "conditional-1", "dns_domain_names" : [ "foo.com" ], "upstream_servers" : [ "1.1.1.1", "2.2.2.2" ], "_create_user" : "a;a", "_create_time" : 1517400132921, "_last_modified_user" : "a;a", "_last_modified_time" : 1517400132921, "_system_owned" : false, "_protection" : "NOT_PROTECTED", "_revision" : 1 } Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read the DNS Forwarder Zone

Read the DNS Forwarder Zone Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/dns-forwarder-zones/conditional-1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarderZone+

PolicyDnsForwarderZone (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
dns_domain_names	List of domain names List of domain names on which conditional forwarding is based. This field is required if the DNS Zone is being used for a conditional forwarder. This field will also be used for conditional reverse lookup. Example 1, if for one of the zones, one of the entries in the fqdn is example.com, all the DNS requests under the domain example.com will be served by the corresponding upstream DNS server. Example 2, if for one of the zones, one of the entries in the fqdn list is "13.12.30.in-addr.arpa", reverse lookup for 30.12.13.0/24 will go to the corresponding DNS server.	array of string
id	Unique identifier of this resource	string	Sortable
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarderZone	string
source_ip	Source IP used by DNS Forwarder zone The source IP used by the DNS Forwarder zone.	IPv4Address
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
upstream_servers	DNS servers to which the DNS request needs to be forwarded Max of 3 DNS servers can be configured	array of IPv4Address	Required Maximum items: 3

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete the DNS Forwarder Zone

Delete the DNS Forwarder Zone Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/dns-forwarder-zones/{dns-forwarder-zone-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/dns-forwarder-zones/conditional-1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dns Forwarder): Tier-0S

Associated URIs:

DELETE /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder
PATCH /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder
POST /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder
PUT /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/failed-queries
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/nslookup
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/statistics
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/status

Update the DNS Forwarder

Update the DNS Forwarder Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/<tier-0-id>/dns-forwarder { "display_name" : "dns-forwarder", "listener_ip" : "5.5.5.5", "default_forwarder_zone_path" : "/global-infra/dns-forwarder-zones/default-1", "conditional_forwarder_zone_paths" : ["/global-infra/dns-forwarder-zones/conditional-1"] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Update the DNS Forwarder

Update the DNS Forwarder Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/<tier-0-id>/dns-forwarder { "display_name" : "dns-forwarder", "listener_ip" : "5.5.5.5", "default_forwarder_zone_path" : "/global-infra/dns-forwarder-zones/default-1", "conditional_forwarder_zone_paths" : ["/global-infra/dns-forwarder-zones/conditional-1"], "enabled": false, "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type" : "PolicyDnsForwarder", "id" : "dns-forwarder", "display_name" : "dns-forwarder", "path" : "/infra/tier-0s/prv/dns-forwarder", "parent_path" : "/infra/tier-0s/prv", "relative_path" : "dns-forwarder", "listener_ip" : "5.5.5.5", "conditional_forwarder_zone_paths" : [ "/infra/dns-forwarder-zones/conditional-1" ], "log_level" : "INFO", "enabled" : false, "default_forwarder_zone_path" : "/infra/dns-forwarder-zones/default-1", "_create_user" : "a;a", "_create_time" : 1517403652195, "_last_modified_user" : "a;a", "_last_modified_time" : 1517403652195, "_system_owned" : false, "_protection" : "NOT_PROTECTED", "_revision" : 1 } Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read the DNS Forwarder for the given tier-0 instance

Read the DNS Forwarder for the given tier-0 instance Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/<tier-0-id>/dns-forwarder Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type" : "PolicyDnsForwarder", "id" : "dns-forwarder", "display_name" : "dns-forwarder", "path" : "/infra/tier-0s/prv/dns-forwarder", "parent_path" : "/infra/tier-0s/prv", "relative_path" : "dns-forwarder", "listener_ip" : "5.5.5.5", "conditional_forwarder_zone_paths" : [ "/infra/dns-forwarder-zones/conditional-1" ], "log_level" : "INFO", "enabled" : true, "default_forwarder_zone_path" : "/infra/dns-forwarder-zones/default-1", "_create_user" : "a;a", "_create_time" : 1517403652195, "_last_modified_user" : "a;a", "_last_modified_time" : 1517403652195, "_system_owned" : false, "_protection" : "NOT_PROTECTED", "_revision" : 1 } Required Permissions: read Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DNS configuration for tier-0 instance

Delete DNS configuration for tier-0 instance Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/<tier-0-id>/dns-forwarder Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Perform the specified DNS forwarder action

Perform the specified action for Tier0 DNS forwarder on specified enforcement point.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

EPActionForDnsForwarderRequestParameters+

Request Body:

n/a

Example Request: 1. Clear cache POST https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/tier0/dns-forwarder?action=clear_cache Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the recent failed DNS queries

Return the given count of recent failed DNS queries from DNS forwarder.
Since the DNS forwarder is running in Active/Standby HA mode on transport
nodes, the given count of queries will be returned from each nodes. Hence
the total queries returned could be doubled.
If no count is specified, 100 recent failed queries are returned. If the
recent failures is less than the given count, all the failures will be
returned. The maximum count is 1,000.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/failed-queries

Request Headers:

n/a

Query Parameters:

PolicyDnsFailedQueryRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/tier0/dns-forwarder/failed-queries Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsFailedQueries+

Example Response: { "timestamp" : "2019-02-12 09:08:12.120", "per_node_failed_queries" : [ { "node_id" : "aedc2af2-4c5c-11e9-aa7d-0200400d53ef", "timestamp" : "2019-02-12 09:09:12.120", "results" : [ { "timestamp": "2019-02-11 18:20:20.026", "address" : "dev.vmware.com", "record_type" : "A", "client_ip": "192.168.7.10", "forwarder_ip": "172.128.10.10", "source_ip": "192.168.7.10", "upstream_server_ip": "11.11.11.1", "time_spent": 120, "error_type": "NXDOMAIN", "error_message" : "NXDOMAIN" }, { "timestamp": "2019-02-11 08:21:28.200", "address" : "abc.vmware.com", "record_type" : "A", "client_ip": "11.11.11.11", "forwarder_ip": "172.128.11.77", "source_ip": "11.11.11.11", "upstream_server_ip": "8.8.8.8", "time_spent": 60008, "error_type": "timeout", "error_message" : "connection timeout" }], "edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/aedc2af2-4c5c-11e9-aa7d-0200400d53ef" }, { "node_id" : "c73e587c-4c5c-11e9-87cb-0200407787ca", "timestamp" : "2019-02-12 09:10:12.120", "results" : [ { "timestamp": "2019-02-11 18:20:20.026", "address" : "host1.vmc.vmware.com", "record_type" : "A", "client_ip": "117.168.10.22", "forwarder_ip": "172.128.50.11", "source_ip": "192.168.7.10", "upstream_server_ip": "11.11.11.1", "time_spent": 1100, "error_type": "NXDOMAIN", "error_message" : "NXDOMAIN" }, { "timestamp": "2019-02-11 08:21:28.200", "address" : "host1.wix.vmware.com", "record_type" : "A", "client_ip": "22.22.22.22", "forwarder_ip": "172.128.5.8", "source_ip": "11.11.11.10", "upstream_server_ip": "9.9.9.9", "time_spent": 51002, "error_type": "timeout", "error_message" : "connection timeout" }], "edge_node_path": "/infra/sites/default/enforcement-points/default/edge-clusters/b051d3f9-3ad8-4831-9d67-8ae1cd3f5a1e/edge-nodes/c73e587c-4c5c-11e9-87cb-0200407787ca" }] } Required Permissions: read Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Resolve a given address via the dns forwarder at Tier0

Query the nameserver for an ip-address or a FQDN of the given an address optionally using
an specified DNS server. If the address is a fqdn, nslookup will resolve ip-address with it.
If the address is an ip-address, do a reverse lookup and answer fqdn(s).
If enforcement point is specified, then DNS forwarder nslookup answer will get fetched from
specified enforcement point. Otherwise from all enforcement points.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/nslookup

Request Headers:

n/a

Query Parameters:

PolicyNsLookupParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/tier0/dns-forwarder/nslookup?address=vmware.com&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

AggregatePolicyDnsAnswer+

Example Response: { "dns_answer_per_enforcement_point": [ { "resource_type": "NsxTDnsAnswer", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "dns_server" : "192.168.144.144:53", "edge_node_id" : "e2fa39aa-f4ca-4781-ac48-60a6c47d34e0", "answers" : [ { "raw_string": "server.example.com. 300 IN A 192.168.1.10" } ], "raw_answer": "; (()) DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu (()) @192.168.144.144 -b 192.168.144.144 server.example.com +timeout=5 +tries=3 +nosearch ; (1 server found) ;; global options: +cmd ;; Got answer: ;; -))HEADER((- opcode: QUERY, status: NOERROR, id: 49577 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;server.example.com. IN A ;; ANSWER SECTION: server.example.com. 300 IN A 192.168.1.10 ;; Query time: 4 msec ;; SERVER: 192.168.144.144:53(192.168.144.144) (UDP) ;; WHEN: Mon May 19 03:16:57 UTC 2025 ;; MSG SIZE rcvd: 63" } ], "intent_path": "/infra/tier-0s/tier0/dns-forwarder" } Required Permissions: read Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get tier-0 DNS forwarder statistics

Get statistics of tier-0 DNS forwarder.
- no enforcement point path specified: Statistics will be evaluated on each enforcement
point.
- {enforcement_point_path}: Statistics are evaluated only on the given enforcement point.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/statistics

Request Headers:

n/a

Query Parameters:

PolicyRuntimeOnEpRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/tier-01/dns-forwarder/statistics Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

AggregateDNSForwarderStatistics+

Example Response: { "statistics_per_enforcement_point": [ { "resource_type": "NsxTDNSForwarderStatistics", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "queries_answered_locally": 0, "conditional_forwarder_statistics": [ { "upstream_statistics": [ { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "10.0.0.0" }, { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "10.2.0.0" } ], "domain_names": [ "fqdn1", "fqdn2" ] } ], "default_forwarder_statistics": { "upstream_statistics": [ { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "11.0.0.0" }, { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "11.2.0.0" } ] }, "used_cache_stats": [ { "node_id": "6f1c310b-aeed-445e-aef9-9722c8967ab8", "used_cache_size": 300, "cached_entries_number": 200 }, { "node_id": "5b171969-1539-4be4-a761-83f46b6a262f", "used_cache_size": 200, "cached_entries_number": 190 } ], "queries_forwarded": 0, "configured_cache_size": 4096, "total_queries": 0 } ], "intent_path": "/infra/tier-0s/tier-01/dns-forwarder" } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get current status of tier-0 DNS forwarder

Get current status of tier-0 DNS forwarder.
- no enforcement point path specified: Status will be evaluated on each enforcement
point.
- {enforcement_point_path}: Status will be evaluated only on the given enforcement
point.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/dns-forwarder/status

Request Headers:

n/a

Query Parameters:

PolicyRuntimeOnEpRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/tier-01/dns-forwarder/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

AggregateDNSForwarderStatus+

Example Response: { "status_per_enforcement_point": [ { "resource_type": "NsxTDNSForwarderStatus", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "timestamp": 1537263302625, "status": "UP" }, { "resource_type": "NsxTDNSForwarderStatus", "enforcement_point_path": "/infra/sites/default/enforcement-points/default1", "extra_message": "ERROR status could be an intermediate state during failover between transport nodes. Please recheck the status a few minutes later.", "timestamp": 1537263302625, "status": "ERROR" } ], "intent_path": "/infra/tier-0s/tier-01/dns-forwarder" } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Dns Forwarder): Tier-1S

Associated URIs:

DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder
POST /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/failed-queries
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/nslookup
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/statistics
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/status

Create or update the DNS Forwarder

Create or update the DNS Forwarder Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/<tier-1-id>/dns-forwarder { "display_name" : "dns-forwarder", "listener_ip" : "5.5.5.5", "default_forwarder_zone_path" : "/global-infra/dns-forwarder-zones/default-1", "conditional_forwarder_zone_paths" : ["/global-infra/dns-forwarder-zones/conditional-1"] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update the DNS Forwarder

Create or update the DNS Forwarder Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/<tier-1-id>/dns-forwarder { "display_name" : "dns-forwarder", "listener_ip" : "5.5.5.5", "default_forwarder_zone_path" : "/global-infra/dns-forwarder-zones/default-1", "conditional_forwarder_zone_paths" : ["/global-infra/dns-forwarder-zones/conditional-1"], "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type" : "PolicyDnsForwarder", "id" : "dns-forwarder", "display_name" : "dns-forwarder", "path" : "/infra/tier-1s/net-1/dns-forwarder", "parent_path" : "/infra/tier-1s/net-1", "relative_path" : "dns-forwarder", "listener_ip" : "5.5.5.5", "conditional_forwarder_zone_paths" : [ "/infra/dns-forwarder-zones/conditional-1" ], "log_level" : "INFO", "enabled" : true, "default_forwarder_zone_path" : "/infra/dns-forwarder-zones/default-1", "_create_user" : "a;a", "_create_time" : 1517403652195, "_last_modified_user" : "a;a", "_last_modified_time" : 1517403652195, "_system_owned" : false, "_protection" : "NOT_PROTECTED", "_revision" : 1 } Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read the DNS Forwarder for the given tier-1 instance

Read the DNS Forwarder for the given tier-1 instance Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/<tier-1-id>/dns-forwarder Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsForwarder+

PolicyDnsForwarder (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
cache_size	Cache size in KB One DNS answer cache entry will consume ~120 bytes. Hence 1 KB cache size can cache ~8 DNS answer entries, and the default 1024 KB cache size can hold ~8k DNS answer entries.	int	Minimum: 1 Maximum: 16777216 Default: "1024"
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
conditional_forwarder_zone_paths	Path of conditional DNS zones Max of 5 DNS servers can be configured	array of string	Maximum items: 5
default_forwarder_zone_path	Path of the default DNS zone. This is the zone to which DNS requests are forwarded by default	string	Required
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	DNS forwarder enabled flag The flag, which suggests whether the DNS forwarder is enabled or disabled. The default is True.	boolean	Default: "True"
id	Unique identifier of this resource	string	Sortable
listener_ip	IP on which the DNS Forwarder listens. This is the IP on which the DNS Forwarder listens.	IPv4Address	Required
log_level	Log level of the dns forwarder Set log_level to DISABLED will stop dumping fowarder log.	string	Enum: DEBUG, INFO, WARNING, ERROR, FATAL Default: "INFO"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyDnsForwarder	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete DNS configuration for tier-1 instance

Delete DNS configuration for tier-1 instance Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/<tier-1-id>/dns-forwarder Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Perform the specified DNS forwarder action

Perform the specified action for Tier0 DNS forwarder on specified enforcement point.
Request:

Method:

POST

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder

Request Headers:

n/a

Query Parameters:

EPActionForDnsForwarderRequestParameters+

Request Body:

n/a

Example Request: 1. Clear cache POST https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/tier1/dns-forwarder?action=clear_cache&enforcement_point_path=/global-infra/sites/default/enforcement-points/ep Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get the recent failed DNS queries

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/failed-queries

Request Headers:

n/a

Query Parameters:

PolicyDnsFailedQueryRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/dns-forwarder/failed-queries Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyDnsFailedQueries+

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Resolve a given address via the dns forwarder at Tier1

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/nslookup

Request Headers:

n/a

Query Parameters:

PolicyNsLookupParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier1/dns-forwarder/nslookup?address=vmware.com&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

AggregatePolicyDnsAnswer+

Example Response: { "dns_answer_per_enforcement_point": [ { "resource_type": "NsxTDnsAnswer", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "dns_server" : "192.168.144.144#53", "edge_node_id" : "e2fa39aa-f4ca-4781-ac48-60a6c47d34e0", "answers" : [ { "raw_string": "server.example.com. 300 IN A 192.168.1.10" } ], "raw_answer": "; (()) DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu (()) @192.168.144.144 -b 192.168.144.144 server.example.com +timeout=5 +tries=3 +nosearch ; (1 server found) ;; global options: +cmd ;; Got answer: ;; -))HEADER((- opcode: QUERY, status: NOERROR, id: 49577 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;server.example.com. IN A ;; ANSWER SECTION: server.example.com. 300 IN A 192.168.1.10 ;; Query time: 4 msec ;; SERVER: 192.168.144.144:53(192.168.144.144) (UDP) ;; WHEN: Mon May 19 03:16:57 UTC 2025 ;; MSG SIZE rcvd: 63" } ], "intent_path": "/infra/tier-1s/tier1/dns-forwarder" } Required Permissions: read Feature: policy_dns Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get tier-1 DNS forwarder statistics

Get statistics of tier-1 DNS forwarder.
- no enforcement point path specified: Statistics will be evaluated on each enforcement
point.
- {enforcement_point_path}: Statistics are evaluated only on the given enforcement point.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/statistics

Request Headers:

n/a

Query Parameters:

PolicyRuntimeOnEpRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/dns-forwarder/statistics?enforcement_point_path=/global-infra/sites/default/enforcement-points/ep1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

AggregateDNSForwarderStatistics+

Example Response: { "statistics_per_enforcement_point": [ { "resource_type": "NsxTDNSForwarderStatistics", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "queries_answered_locally": 0, "conditional_forwarder_statistics": [ { "upstream_statistics": [ { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "10.0.0.0" }, { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "10.2.0.0" } ], "domain_names": [ "fqdn1", "fqdn2" ] } ], "default_forwarder_statistics": { "upstream_statistics": [ { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "11.0.0.0" }, { "queries_succeeded": 0, "queries_failed": 0, "upstream_server": "11.2.0.0" } ] }, "used_cache_stats": [ { "node_id": "6f1c310b-aeed-445e-aef9-9722c8967ab8", "used_cache_size": 300, "cached_entries_number": 200 }, { "node_id": "5b171969-1539-4be4-a761-83f46b6a262f", "used_cache_size": 200, "cached_entries_number": 190 } ], "queries_forwarded": 0, "configured_cache_size": 2048, "total_queries": 0 } ], "intent_path": "/infra/tier-1s/tier-1/dns-forwarder" } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get current status of tier-1 DNS forwarder

Get current status of tier-1 DNS forwarder.
- no enforcement point path specified: Status will be evaluated on each enforcement
point.
- {enforcement_point_path}: Status will be evaluated only on the given enforcement
point.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/dns-forwarder/status

Request Headers:

n/a

Query Parameters:

PolicyRuntimeOnEpRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/tier-1/dns-forwarder/status?enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

AggregateDNSForwarderStatus+

Example Response: { "status_per_enforcement_point": [ { "resource_type": "NsxTDNSForwarderStatus", "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "timestamp": 1537263302625, "status": "UP" } ], "intent_path": "/infra/tier-1s/tier-1/dns-forwarder" } Required Permissions: read Feature: policy_statistics Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Nat)

Networking (Nat): NAT Rules (Tier-0S)

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules
DELETE /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}
PATCH /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}
PUT /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

List Policy NAT types.

List all NAT sections under the given Tier-0 ID.
For more details related to NAT section please refer to PolicyNAT schema.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat

Request Headers:

n/a

Query Parameters:

PolicyNatListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_provider-demo/nat Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 4, "results": [ { "nat_type": "DEFAULT", "resource_type": "PolicyNat", "id": "DEFAULT", "display_name": "DEFAULT", "path": "/infra/tier-0s/pepsi/nat/DEFAULT", "relative_path": "DEFAULT", "parent_path": "/infra/tier-0s/pepsi", "unique_id": "053c5df4-13f2-4573-84b3-b6f3356283f8", "realization_id": "053c5df4-13f2-4573-84b3-b6f3356283f8", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385506470, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385506470, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "nat_type": "INTERNAL", "resource_type": "PolicyNat", "id": "INTERNAL", "display_name": "INTERNAL", "path": "/infra/tier-0s/pepsi/nat/INTERNAL", "relative_path": "INTERNAL", "parent_path": "/infra/tier-0s/pepsi", "unique_id": "8680b58e-7013-434a-af56-1917c25cbc75", "realization_id": "8680b58e-7013-434a-af56-1917c25cbc75", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385506447, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385506447, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "nat_type": "NAT64", "resource_type": "PolicyNat", "id": "NAT64", "display_name": "NAT64", "path": "/infra/tier-0s/pepsi/nat/NAT64", "relative_path": "NAT64", "parent_path": "/infra/tier-0s/pepsi", "unique_id": "a96329d1-c8d7-43c7-b2ac-5fb1283e4201", "realization_id": "a96329d1-c8d7-43c7-b2ac-5fb1283e4201", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385506470, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385506470, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "nat_type": "USER", "resource_type": "PolicyNat", "id": "USER", "display_name": "USER", "path": "/infra/tier-0s/pepsi/nat/USER", "relative_path": "USER", "parent_path": "/infra/tier-0s/pepsi", "unique_id": "d76c8c31-aff3-437c-bb13-be0c15e65afb", "realization_id": "d76c8c31-aff3-437c-bb13-be0c15e65afb", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385506468, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385506468, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List NAT Rules

List NAT Rules from Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH/PUT API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules

Request Headers:

n/a

Query Parameters:

PolicyNatRuleListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRuleListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 3, "results": [ { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRule", "display_name": "MyNATRule", "path": "/infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRule", "parent_path": "/infra/tier-0s/vmc_provider-demo/nat/USER", "relative_path": "MyNATRule", "sequence_number": 1, "service": "", "scope": [], "action": "REFLEXIVE", "source_network": "10.117.5.73", "translated_network": "192.168.1.1", "enabled": true, "logging": false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_create_user": "admin", "_create_time": 1516015559976, "_last_modified_user": "admin", "_last_modified_time": 1516015559976, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRule3", "display_name": "MyNATRule3", "path": "/infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRule3", "parent_path": "/infra/tier-0s/vmc_provider-demo/nat/USER", "relative_path": "MyNATRule3", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [], "action": "DNAT", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "enabled": true, "logging": false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_create_user": "admin", "_create_time": 1516084472276, "_last_modified_user": "admin", "_last_modified_time": 1516084472276, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRuleDemo", "display_name": "MyNATRuleDemo", "path": "/infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRuleDemo", "parent_path": "/infra/tier-0s/vmc_provider-demo/nat/USER", "relative_path": "MyNATRuleDemo", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [ "infra/tier-0s/provider1/local-services/localService1/interfaces/internet" ], "action": "DNAT", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "enabled": true, "logging": false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_create_user": "admin", "_create_time": 1516181809835, "_last_modified_user": "admin", "_last_modified_time": 1516181809835, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a NAT Rule on tier-0

If a NAT Rule is not already present on Tier-0 denoted by Tier-0 ID,
under NAT section denoted by <nat-id>, create a new NAT Rule.
If it already exists, update the NAT Rule.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
NAT rule cannot be applied to a loopback interface or a label referencing loopback interfaces.
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRuleDemo { "display_name" : "MyNATRuleDemo", "description" : "Example of a NAT rule", "action" : "DNAT", "destination_network" : "10.117.5.19", "service": "/global-infra/services/AD_Server", "translated_network" : "192.168.1.1", "translated_ports" : "80-82", "sequence_number" : 10, "scope" : ["infra/tier-0s/provider1/local-services/localService1/interfaces/internet"], "enabled": true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get NAT Rule

Get NAT Rule from Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PUT/PATCH API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRule3 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRule3", "display_name": "MyNATRule3", "path": "/infra/tier-0s/vmc_provider-demo//nat/USER/nat-rules/MyNATRule3", "parent_path": "/infra/tier-0s/vmc_provider-demo/nat/USER", "relative_path": "MyNATRule3", "sequence_number": 10, "service": "/infra/services/AD_Server", "enabled": true, "logging": false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "scope": [], "action": "DNAT", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "_create_user": "admin", "_create_time": 1516084472276, "_last_modified_user": "admin", "_last_modified_time": 1516084472276, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete NAT Rule

Delete NAT Rule from Tier-0 denoted by Tier-0 ID, under NAT section denoted by <nat-id>. Under tier-0 there will be 3 different NATs(sections). (INTERNAL, USER and DEFAULT) For more details related to NAT section please refer to PolicyNAT schema. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRule4 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update NAT Rule

Create or update NAT Rule on Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
NAT rule cannot be applied to a loopback interface or a label referencing loopback interfaces.
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PUT API, the path returned in the PUT/GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRuleDemo { "display_name" : "MyNATRuleDemo", "description" : "Example of a NAT rule", "action" : "DNAT", "destination_network" : "10.117.5.19", "service": "/global-infra/services/AD_Server", "translated_network" : "192.168.1.1", "translated_ports" : "80-82", "sequence_number" : 10, "scope" : ["infra/tier-0s/provider1/local-services/localService1/interfaces/internet"], "enabled": true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_revision" : 0 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRuleDemo", "display_name": "MyNATRuleDemo", "path": "/infra/tier-0s/vmc_provider-demo/nat/USER/nat-rules/MyNATRuleDemo", "parent_path": "/infra/tier-0s/vmc_provider-demo/nat/USER", "relative_path": "MyNATRuleDemo", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [ "infra/tier-0s/provider1/local-services/localService1/interfaces/internet" ], "action": "DNAT", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_create_user": "admin", "_create_time": 1516181809835, "_last_modified_user": "admin", "_last_modified_time": 1516181809835, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Nat): NAT Rules (Tier-1S)

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules
DELETE /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}
PATCH /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}
PUT /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

List Policy NAT types.

List all NAT sections under the given Tier-1 ID.
For more details related to NAT section please refer to PolicyNAT schema.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat

Request Headers:

n/a

Query Parameters:

PolicyNatListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/vmc_network-demo/nat Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 4, "results": [ { "nat_type": "DEFAULT", "resource_type": "PolicyNat", "id": "DEFAULT", "display_name": "DEFAULT", "path": "/infra/tier-1s/it_t1/nat/DEFAULT", "relative_path": "DEFAULT", "parent_path": "/infra/tier-1s/it_t1", "unique_id": "6c029b55-56aa-4f30-8dda-50745853c78f", "realization_id": "6c029b55-56aa-4f30-8dda-50745853c78f", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385644756, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385644756, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "nat_type": "INTERNAL", "resource_type": "PolicyNat", "id": "INTERNAL", "display_name": "INTERNAL", "path": "/infra/tier-1s/it_t1/nat/INTERNAL", "relative_path": "INTERNAL", "parent_path": "/infra/tier-1s/it_t1", "unique_id": "2ede024b-2bbc-429c-b5de-dff7131a7900", "realization_id": "2ede024b-2bbc-429c-b5de-dff7131a7900", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385644745, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385644745, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "nat_type": "NAT64", "resource_type": "PolicyNat", "id": "NAT64", "display_name": "NAT64", "path": "/infra/tier-1s/it_t1/nat/NAT64", "relative_path": "NAT64", "parent_path": "/infra/tier-1s/it_t1", "unique_id": "8ff75480-5cc5-4bce-9ed5-6bb948a65b3d", "realization_id": "8ff75480-5cc5-4bce-9ed5-6bb948a65b3d", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385644758, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385644758, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "nat_type": "USER", "resource_type": "PolicyNat", "id": "USER", "display_name": "USER", "path": "/infra/tier-1s/it_t1/nat/USER", "relative_path": "USER", "parent_path": "/infra/tier-1s/it_t1", "unique_id": "202e658c-17bd-41bb-bc72-bfdef716ba9b", "realization_id": "202e658c-17bd-41bb-bc72-bfdef716ba9b", "marked_for_delete": false, "overridden": false, "_system_owned": true, "_create_time": 1633385644755, "_create_user": "admin", "_last_modified_user": "admin", "_last_modified_time": 1633385644755, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List NAT Rules

List NAT Rules from Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH/PUT PoliycNatRule API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules

Request Headers:

n/a

Query Parameters:

PolicyNatRuleListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/vmc_network-demo/nat/USER/nat-rules Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRuleListResult+

Example Response: { "sort_ascending": true, "sort_by": "display_name", "result_count": 3, "results": [ { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRule", "display_name": "MyNATRule", "path": "/infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRule", "parent_path": "/infra/tier-1s/vmc_network-demo/nat/USER", "relative_path": "MyNATRule", "sequence_number": 1, "service": "", "scope": [], "action": "REFLEXIVE", "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "source_network": "10.117.5.73", "translated_network": "192.168.1.1", "_create_user": "admin", "_create_time": 1516015559976, "_last_modified_user": "admin", "_last_modified_time": 1516015559976, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRule3", "display_name": "MyNATRule3", "path": "/infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRule3", "parent_path": "/infra/tier-1s/vmc_network-demo/nat/USER", "relative_path": "MyNATRule3", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [], "action": "DNAT", "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "_create_user": "admin", "_create_time": 1516084472276, "_last_modified_user": "admin", "_last_modified_time": 1516084472276, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 }, { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRuleDemo", "display_name": "MyNATRuleDemo", "path": "/infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRuleDemo", "parent_path": "/infra/tier-1s/vmc_network-demo/nat/USER", "relative_path": "MyNATRuleDemo", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [ "infra/tier-0s/tier-0-vmc/interfaces/internet" ], "action": "DNAT", "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "_create_user": "admin", "_create_time": 1516181809835, "_last_modified_user": "admin", "_last_modified_time": 1516181809835, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a Nat Rule

If a NAT Rule is not already present on Tier-1 denoted by Tier-1 ID,
under NAT section denoted by <nat-id>, create a new NAT Rule.
If it already exists, update the NAT Rule.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRuleDemo { "display_name" : "MyNATRuleDemo", "description" : "Example of a NAT rule", "action" : "DNAT", "destination_network" : "10.117.5.19", "service": "/global-infra/services/AD_Server", "translated_network" : "192.168.1.1", "translated_ports" : "80-82", "sequence_number" : 10, "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "scope" : ["infra/tier-0s/tier-0-vmc/interfaces/internet"] } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get NAT Rule

Get NAT Rule from Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PATCH/PUT PoliycNatRule API, the path returned in the GET response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRule3 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRule3", "display_name": "MyNATRule3", "path": "/infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRule3", "parent_path": "/infra/tier-1s/vmc_network-demo/nat/USER", "relative_path": "MyNATRule3", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [], "action": "DNAT", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_create_user": "admin", "_create_time": 1516084472276, "_last_modified_user": "admin", "_last_modified_time": 1516084472276, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete NAT Rule

Delete NAT Rule from Tier-1 denoted by Tier-1 ID, under NAT section denoted by <nat-id>. Under tier-1 there will be 3 different NATs(sections). (INTERNAL, USER and DEFAULT) For more details related to NAT section please refer to PolicyNAT schema. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRule4 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update NAT Rule

Create or update NAT Rule on Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Note:
IPSecVpnSession as Scope: Please note that old IPSecVpnSession policy path deprecated. If user specifiy old IPSecVpnSession path in the
scope property in the PUT API, the path returned in the GET/PUT response payload will be a new path instead of the deprecated IPSecVpnSession path
Both old and new IPSecVpnSession path refer to same resource. there is no functional impact.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRuleDemo { "display_name" : "MyNATRuleDemo", "description" : "Example of a NAT rule", "action" : "DNAT", "destination_network" : "10.117.5.19", "service": "/global-infra/services/AD_Server", "translated_network" : "192.168.1.1", "translated_ports" : "80-82", "sequence_number" : 10, "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "scope" : ["infra/tier-0s/tier-0-vmc/interfaces/internet"] } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRule+

PolicyNatRule (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
action	Represents action of NAT Rule SNAT, DNAT, REFLEXIVE Source NAT(SNAT) - translates a source IP address in an outbound packet so that the packet appears to originate from a different network. SNAT is only supported when the logical router is running in active-standby mode. Destination NAT(DNAT) - translates the destination IP address of inbound packets so that packets are delivered to a target address into another network. DNAT is only supported when the logical router is running in active-standby mode. Reflexive NAT(REFLEXIVE) - IP-Range and CIDR are supported to define the "n". The number of original networks should be exactly the same as that of translated networks. The address translation is deterministic. Reflexive is supported on both Active/Standby and Active/Active LR. NO_SNAT and NO_DNAT - These do not have support for translated_fields, only source_network and destination_network fields are supported. NAT64 - translates an external IPv6 address to a internal IPv4 address.	string	Required Enum: SNAT, DNAT, REFLEXIVE, NO_SNAT, NO_DNAT, NAT64
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
destination_network	Represents the destination network This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For DNAT and NO_DNAT rules, this is a mandatory field, and represents the destination network for the incoming packets. For other type of rules, optionally it can contain destination network of outgoing packets. NULL value for this field represents ANY network. For VPC DNAT NATRule, destination network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
enabled	Policy NAT Rule enabled flag The flag, which suggests whether the NAT rule is enabled or disabled. The default is True.	boolean	Default: "True"
firewall_match	Represents the firewall match flag It indicates how the firewall matches the address after NATing if firewall stage is not skipped. MATCH_EXTERNAL_ADDRESS indicates the firewall will be applied to external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the translated source address after NAT is done; To ingress traffic, the firewall will be applied to the original destination address before NAT is done. MATCH_INTERNAL_ADDRESS indicates the firewall will be applied to internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done. For REFLEXIVE, to egress traffic, the firewall will be applied to the original source address before NAT is done; To ingress traffic, the firewall will be applied to the translated destination address after NAT is done. BYPASS indicates the firewall stage will be skipped. For NO_SNAT or NO_DNAT, it must be BYPASS or leave it unassigned	string	Enum: MATCH_EXTERNAL_ADDRESS, MATCH_INTERNAL_ADDRESS, BYPASS Default: "MATCH_INTERNAL_ADDRESS"
id	Unique identifier of this resource	string	Sortable
logging	Policy NAT Rule logging flag The flag, which suggests whether the logging of NAT rule is enabled or disabled. The default is False.	boolean	Default: "False"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
policy_based_vpn_mode	Indicates NSX edge Nat behaviour for inbound VPN tra It indicates how the NSX edge applies Nat Policy for VPN traffic. It is supported only for Nat Rule action type DNAT and NO_DNAT. For all other NAT action, leave it unassigned. BYPASS - Default vpn mode. It indicates that Nat policy will be applied to the inbound traffic on Routed Based VPN tunnel, if the policy based VTI is in the "scope" for this rule. Default value will be set to BYPASS if MATCH - It indicates that this NAT rule will only match the Policy Based VPN traffic.	string	Enum: BYPASS, MATCH
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value PolicyNatRule	string
scope	Array of policy paths of labels, ProviderInterface, NetworkInterface Represents the array of policy paths of ProviderInterface or NetworkInterface or labels of type ProviderInterface or NetworkInterface or IPSecVpnSession on which the NAT rule should get enforced. The interfaces must belong to the same router for which the NAT Rule is created.	array of string
sequence_number	Sequence number of the Nat Rule The sequence_number decides the rule_priority of a NAT rule. Sequence_number and rule_priority have 1:1 mapping.For each NAT section, there will be reserved rule_priority numbers.The valid range of rule_priority number is from 0 to 2147483647(MAX_INT). 1. INTERNAL section rule_priority reserved from 0 - 1023 (1024 rules) valid sequence_number range 0 - 1023 2. USER section rule_priority reserved from 1024 - 2147482623 (2147481600 rules) valid sequence_number range 0 - 2147481599 3. DEFAULT section rule_priority reserved from 2147482624 - 2147483647 (1024 rules) valid sequence_number range 0 - 1023	int	Default: "0"
service	Represents the service on which the NAT rule will be applied It represents the path of Service on which the NAT rule will be applied. If not provided or if it is blank then Policy manager will consider it as ANY. Please note, if this is a DNAT, the destination_port of the service will be realized on NSX Manager as the translated_port. And if this is a SNAT, the destination_port will be ignored.	string
source_network	Represents the source network address This supports single IP address or comma separated list of single IP addresses or CIDR. This does not support IP range or IP sets. For SNAT, NO_SNAT, NAT64 and REFLEXIVE rules, this is a mandatory field and represents the source network of the packets leaving the network. For DNAT and NO_DNAT rules, optionally it can contain source network of incoming packets. NULL value for this field represents ANY network.	IPElementList
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
translated_network	Represents the translated network address This supports single IP address or comma separated list of single IP addresses or CIDR. If user specify the CIDR, this value is actually used as an IP pool that includes both the subnet and broadcast addresses as valid for NAT translations. This does not support IP range or IP sets. Comma separated list of single IP addresses is not suported for DNAT and REFLEXIVE rules. For SNAT, DNAT, NAT64 and REFLEXIVE rules, this ia a mandatory field, which represents the translated network address. For NO_SNAT and NO_DNAT this should be empty. For VPC SNAT and Refelexive NATRule, translated network address should be IPv4 address allocated from External Block associated with VPC.	IPElementList
translated_ports	Port number or port range Please note, if there is service configured in this NAT rule, the translated_port will be realized on NSX Manager as the destination_port. If there is no sevice configured, the port will be ignored.	PortElement
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "resource_type": "PolicyNatRule", "description": "Example of a NAT rule", "id": "MyNATRuleDemo", "display_name": "MyNATRuleDemo", "path": "/infra/tier-1s/vmc_network-demo/nat/USER/nat-rules/MyNATRuleDemo", "parent_path": "/infra/tier-1s/vmc_network-demo/nat/USER", "relative_path": "MyNATRuleDemo", "sequence_number": 10, "service": "/infra/services/AD_Server", "scope": [ "infra/tier-0s/tier-0-vmc/interfaces/internet" ], "action": "DNAT", "translated_ports": "80-82", "destination_network": "10.117.5.19", "translated_network": "192.168.1.1", "enabled" : true, "logging" : false, "firewall_match" : "MATCH_EXTERNAL_ADDRESS", "_create_user": "admin", "_create_time": 1516181809835, "_last_modified_user": "admin", "_last_modified_time": 1516181809835, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Nat): NAT Statistics

Associated URIs:

GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}/statistics
GET /global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/statistics
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}/statistics
GET /global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/statistics

Get NAT Rule Statistics

Get NAT Rule Statistics from Tier-0 denoted by Tier-0 ID, under NAT section
denoted by <nat-id>.
Under tier-0 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/{nat-id}/nat-rules/{nat-rule-id}/statistics

Request Headers:

n/a

Query Parameters:

PolicyStatisticsAggregateParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/ServerT0_AS/nat/USER/nat-rules/ANYANY/statistics Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRuleStatisticsListResult+

PolicyNatRuleStatisticsListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results	List of NAT rule statistics per enforcement point For every enforcement point, it lists the warning message of NAT rule statistics, the current number of active traffic sessions matching the NAT rule, and the total number of packets and bytes processed on the NAT rule since the time the rule was created.	array of PolicyNatRuleStatisticsPerEnforcementPoint	Required
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "results": [ { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "rule_path": "/infra/tier-0s/ServerT0_AS/nat/USER/nat-rules/ANYANY", "rule_statistics": [ { "last_update_timestamp": 1726032957830, "total_bytes": 0, "total_packets": 0, "active_sessions": 0 } ] } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List NAT Rules Statistics

List NAT Rules Statistics from Tier-0 denoted by Tier-0 ID. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-0s/{tier-0-id}/nat/statistics

Request Headers:

n/a

Query Parameters:

PolicyNatRuleStatisticsListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-0s/Tier0Gateway1_child_vrf1/nat/statistics Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRuleStatisticsPerLogicalRouterListResult+

PolicyNatRuleStatisticsPerLogicalRouterListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results	List of aggregated NAT rule statistics per logical router per enforcement point For every enforcement point, it provides the aggregated statistics and per transport node statistics of all NAT rules in a logical router since the time the rules were created.	array of PolicyNatRuleStatisticsPerLogicalRouter	Required
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "router_path": "/infra/tier-0s/Tier0Gateway1_child_vrf1", "last_update_timestamp": 1725968007133, "statistics": { "total_bytes": 7242, "total_packets": 42, "active_sessions": 0 }, "per_node_statistics": [ { "transport_node_path": "0", "last_update_timestamp": 1725968007133, "total_bytes": 0, "total_packets": 0, "active_sessions": 0 }, { "transport_node_path": "0", "last_update_timestamp": 1725968007133, "total_bytes": 7242, "total_packets": 42, "active_sessions": 0 } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get NAT Rule Statistics

Get NAT Rule Statistics from Tier-1 denoted by Tier-1 ID, under NAT section
denoted by <nat-id>.
Under tier-1 there will be 3 different NATs(sections).
(INTERNAL, USER and DEFAULT)
For more details related to NAT section please refer to PolicyNAT schema.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/{nat-id}/nat-rules/{nat-rule-id}/statistics

Request Headers:

n/a

Query Parameters:

PolicyStatisticsAggregateParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/TLR1_Server/nat/USER/nat-rules/TEST-DNAT/statistics Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRuleStatisticsListResult+

PolicyNatRuleStatisticsListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results	List of NAT rule statistics per enforcement point For every enforcement point, it lists the warning message of NAT rule statistics, the current number of active traffic sessions matching the NAT rule, and the total number of packets and bytes processed on the NAT rule since the time the rule was created.	array of PolicyNatRuleStatisticsPerEnforcementPoint	Required
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "results": [ { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "rule_path": "/infra/tier-1s/TLR1_Server/nat/USER/nat-rules/TEST-DNAT", "rule_statistics": [ { "last_update_timestamp": 1725960690467, "total_bytes": 11424, "total_packets": 136, "active_sessions": 0 } ] } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

List NAT Rules Statistics

List NAT Rules Statistics from Tier-1 denoted by Tier-1 ID. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/tier-1s/{tier-1-id}/nat/statistics

Request Headers:

n/a

Query Parameters:

PolicyNatRuleStatisticsListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/tier-1s/TLR1_Server/nat/statistics Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyNatRuleStatisticsPerLogicalRouterListResult+

PolicyNatRuleStatisticsPerLogicalRouterListResult (schema)

Name	Description	Type	Notes
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
cursor	Opaque cursor to be used for getting next page of records (supplied by current result page)	string	Readonly
result_count	Count of results found (across all pages), set only on first page	integer	Readonly
results	List of aggregated NAT rule statistics per logical router per enforcement point For every enforcement point, it provides the aggregated statistics and per transport node statistics of all NAT rules in a logical router since the time the rules were created.	array of PolicyNatRuleStatisticsPerLogicalRouter	Required
sort_ascending	If true, results are sorted in ascending order	boolean	Readonly
sort_by	Field by which records are sorted	string	Readonly

Example Response: { "results": [ { "enforcement_point_path": "/infra/sites/default/enforcement-points/default", "router_path": "/infra/tier-1s/TLR1_Server", "last_update_timestamp": 1726031919747, "statistics": { "total_bytes": 16380, "total_packets": 195, "active_sessions": 0 }, "per_node_statistics": [ { "transport_node_path": "1", "last_update_timestamp": 1726031919747, "total_bytes": 16380, "total_packets": 195, "active_sessions": 0 }, { "transport_node_path": "1", "last_update_timestamp": 1726031919527, "total_bytes": 0, "total_packets": 0, "active_sessions": 0 } ] } ] } Required Permissions: read Feature: policy_nat_rules Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Network Services)

Networking (Network Services): Metadata Proxies

Associated URIs:

GET /global-manager/api/v1/global-infra/metadata-proxies/{metadata-proxy-id}/statistics
GET /global-manager/api/v1/global-infra/metadata-proxies/{metadata-proxy-id}/status

Get metadata proxy status

Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/metadata-proxies/{metadata-proxy-id}/statistics

Request Headers:

n/a

Query Parameters:

MetadataProxyRuntimeRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/global-manager/api/v1/global-infra/metadata-proxies/p1/statistics?segment_path=/global-infra/segments/md-proxy-seg1&enforcement_point_path=/global-infra/sites/default/enforcement-points/default Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyMetadataProxyStatistics+

Example Response: { "metadata_proxy_path": "/infra/metadata-proxies/p1", "timestamp": 1591854737938, "statistics": [ { "segment_path": "/infra/segments/md-proxy-seg1", "requests_from_clients": 0, "responses_to_clients": 0, "requests_to_nova_server": 0, "succeeded_responses_from_nova_server": 0, "error_responses_from_nova_server": 0 } ] } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Get metadata proxy status

Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/metadata-proxies/{metadata-proxy-id}/status

Request Headers:

n/a

Query Parameters:

MetadataProxyRuntimeRequestParameters+

Request Body:

n/a

Example Request: https://{{nsx-mgr}}/api/v1/md-proxies/8966db98-e2ca-4757-af3b-330755ca3e94/6b169af5-4579-481d-a886-9ef7846a7603/status Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

PolicyMetadataProxyStatus+

Example Response: { "transport_nodes": [ "12176406-a7c9-11ea-8166-020063c85974", "a831390e-a7c8-11ea-9102-020063e79023" ], "proxy_status": "DOWN", "error_message": "ErrorCode: INTERNAL_ERROR, Detail: backend nova server connection is broken with reason: UNKNOWN;; ErrorCode: INTERNAL_ERROR, Detail: backend nova server connection is broken with reason: UNKNOWN;" } Required Permissions: read Feature: policy_segment Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Networking Profiles)

Networking (Networking Profiles): BFD Profiles

Associated URIs:

GET /global-manager/api/v1/global-infra/bfd-profiles
DELETE /global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}
GET /global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}
PATCH /global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}
PUT /global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}

List BfdProfiles

Paginated list of all BfdProfiles.
Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/bfd-profiles

Request Headers:

n/a

Query Parameters:

PolicyListRequestParameters+

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/bfd-profiles Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BfdProfileListResult+

Example Response: { "results": [ { "interval": 500, "multiple": 3, "resource_type": "BfdProfile", "id": "config1", "display_name": "config1", "path": "/infra/bfd-profiles/config1", "relative_path": "config1", "parent_path": "/infra", "unique_id": "09b937cf-81e8-4684-be01-a8b0a6b78400", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579244895250, "_last_modified_user": "admin", "_last_modified_time": 1579244895250, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } ] } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a BfdProfile

If a BfdProfile with the bfd-profile-id is not already present,
create a new BfdProfile. If it already exists, update the
BfdProfile. This operation will fully replace the object.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

BfdProfile+

BfdProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
interval	Time interval between heartbeat packets in milliseconds Time interval between heartbeat packets in milliseconds.	int	Minimum: 50 Maximum: 60000 Default: "500"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
multiple	Declare dead multiple Declare dead multiple. Number of times heartbeat packet is missed before BFD declares the neighbor is down.	int	Minimum: 2 Maximum: 16 Default: "3"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value BfdProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PUT https://<policy-mgr>/global-manager/api/v1/global-infra/bfd-profiles/config2 { "interval": 500, "multiple": 3 } Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BfdProfile+

BfdProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
interval	Time interval between heartbeat packets in milliseconds Time interval between heartbeat packets in milliseconds.	int	Minimum: 50 Maximum: 60000 Default: "500"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
multiple	Declare dead multiple Declare dead multiple. Number of times heartbeat packet is missed before BFD declares the neighbor is down.	int	Minimum: 2 Maximum: 16 Default: "3"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value BfdProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "interval": 500, "multiple": 3, "resource_type": "BfdProfile", "id": "config2", "display_name": "config2", "path": "/infra/bfd-profiles/config2", "relative_path": "config2", "parent_path": "/infra", "unique_id": "94e10261-d7e7-4655-b0a8-e0feb7afe13a", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579245303690, "_last_modified_user": "admin", "_last_modified_time": 1579245303690, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or update a BfdProfile

If a BfdProfile with the bfd-profile-id is not already present,
create a new BfdProfile. If it already exists, update the
BfdProfile. This operation will fully replace the object.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

BfdProfile+

BfdProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
interval	Time interval between heartbeat packets in milliseconds Time interval between heartbeat packets in milliseconds.	int	Minimum: 50 Maximum: 60000 Default: "500"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
multiple	Declare dead multiple Declare dead multiple. Number of times heartbeat packet is missed before BFD declares the neighbor is down.	int	Minimum: 2 Maximum: 16 Default: "3"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value BfdProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Request: PATCH https://<policy-mgr>/global-manager/api/v1/global-infra/bfd-profiles/config1 { "interval": 500, "multiple": 3 } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Read a BfdProfile

Read a BfdProfile. Request:

Method:

GET

URI Path(s):

/global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

n/a

Example Request: GET https://<policy-mgr>/global-manager/api/v1/global-infra/bfd-profiles/config1 Successful Response:

Response Code:

200 OK

Response Headers:

Content-type: application/json

Response Body:

BfdProfile+

BfdProfile (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
interval	Time interval between heartbeat packets in milliseconds Time interval between heartbeat packets in milliseconds.	int	Minimum: 50 Maximum: 60000 Default: "500"
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
multiple	Declare dead multiple Declare dead multiple. Number of times heartbeat packet is missed before BFD declares the neighbor is down.	int	Minimum: 2 Maximum: 16 Default: "3"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value BfdProfile	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly

Example Response: { "interval": 500, "multiple": 3, "resource_type": "BfdProfile", "id": "config1", "display_name": "config1", "path": "/infra/bfd-profiles/config1", "relative_path": "config1", "parent_path": "/infra", "unique_id": "09b937cf-81e8-4684-be01-a8b0a6b78400", "marked_for_delete": false, "overridden": false, "_create_user": "admin", "_create_time": 1579244895250, "_last_modified_user": "admin", "_last_modified_time": 1579244895250, "_system_owned": false, "_protection": "NOT_PROTECTED", "_revision": 0 } Required Permissions: read Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Delete BFD Config and all the entities contained by this BfdProfile

Delete BFD Config and all the entities contained by this BfdProfile. Request:

Method:

DELETE

URI Path(s):

/global-manager/api/v1/global-infra/bfd-profiles/{bfd-profile-id}

Request Headers:

n/a

Query Parameters:

OverrideRequestParameters+

Request Body:

n/a

Example Request: DELETE https://<policy-mgr>/global-manager/api/v1/global-infra/bfd-profiles/config1 Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Example Response: {} Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Networking (Networking Profiles): EVPN Tenant Configuration

Associated URIs:

PATCH /global-manager/api/v1/global-infra/evpn-tenant-configs/{config-id}
PUT /global-manager/api/v1/global-infra/evpn-tenant-configs/{config-id}

Create or Update Evpn Tenant Configuration

Create a global evpn tenant configuration if it is not already present,
otherwise update the evpn tenant configuration.
Request:

Method:

PATCH

URI Path(s):

/global-manager/api/v1/global-infra/evpn-tenant-configs/{config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

EvpnTenantConfig+

EvpnTenantConfig (schema)

Name	Description	Type	Notes
_create_time	Timestamp of resource creation	EpochMsTimestamp	Readonly Sortable
_create_user	ID of the user who created this resource	string	Readonly
_last_modified_time	Timestamp of last modification	EpochMsTimestamp	Readonly Sortable
_last_modified_user	ID of the user who last modified this resource	string	Readonly
_links	References related to this resource The server will populate this field when returing the resource. Ignored on PUT and POST.	array of ResourceLink	Readonly
_protection	Indicates protection status of this resource Protection status is one of the following: PROTECTED - the client who retrieved the entity is not allowed to modify it. NOT_PROTECTED - the client who retrieved the entity is allowed to modify it REQUIRE_OVERRIDE - the client who retrieved the entity is a super user and can modify it, but only when providing the request header X-Allow-Overwrite=true. UNKNOWN - the _protection field could not be determined for this entity.	string	Readonly
_revision	Generation of this resource config The _revision property describes the current revision of the resource. To prevent clients from overwriting each other's changes, PUT operations must include the current _revision of the resource, which clients should obtain by issuing a GET operation. If the _revision provided in a PUT request is missing or stale, the operation will be rejected.	int
_schema	Schema for this resource	string	Readonly
_self	Link to this resource	SelfResourceLink	Readonly
_system_owned	Indicates system owned resource	boolean	Readonly
children	Subtree for this type within policy tree Subtree for this type within policy tree containing nested elements. Note that this type is applicable to be used in Hierarchical API only.	array of ChildPolicyConfigResource Children are not allowed for this type
description	Description of this resource	string	Maximum length: 1024 Sortable
display_name	Identifier to use when displaying entity in logs or GUI Defaults to ID if not set	string	Maximum length: 255 Sortable
id	Unique identifier of this resource	string	Sortable
mappings	VLANs to VNIs mapping spec This property specifies a mapping spec of incoming Evpn tenant vlan-ids to VXLAN VNIs used for overlay transmission to Physical-Gateways used by vRouters.	array of VlanVniRangePair	Required Minimum items: 1 Maximum items: 2000
marked_for_delete	Indicates whether the intent object is marked for deletion Intent objects are not directly deleted from the system when a delete is invoked on them. They are marked for deletion and only when all the realized entities for that intent object get deleted, the intent object is deleted. Objects that are marked for deletion are not returned in GET call. One can use the search API to get these objects.	boolean	Readonly Default: "False"
origin_site_id	A unique identifier assigned by the system for knowing which site owns an object This is a UUID generated by the system for knowing which site owns an object.	string	Readonly
overridden	Indicates whether this object is the overridden intent object Global intent objects cannot be modified locally by the user. However, certain global intent objects can be overridden locally by use of this property. In such cases, the overridden local values take precedence over the globally defined values for the properties.	boolean	Readonly Default: "False"
owner_id	A unique identifier assigned by the system for the ownership of an object This is a UUID generated by the system for knowing who owns this object.	string	Readonly
parent_path	Path of its parent Path of its parent	string	Readonly
path	Absolute path of this object Absolute path of this object	string	Readonly
realization_id	A unique identifier assigned by the system for realizing intent This is a UUID generated by the system for realizing the entity object. In most cases this should be same as 'unique_id' of the entity. However, in some cases this can be different because of entities have migrated their unique identifier to NSX Policy intent objects later in the timeline and did not use unique_id for realization. Realization id is helpful for users to debug data path to correlate the configuration with corresponding intent.	string	Readonly
relative_path	Relative path of this object Path relative from its parent	string	Readonly
remote_path	Path of the object on the remote end. This path is populated only in case of multi-site scenario. Currently it is supported only for LM objects. When LM is onboarded to multi-site platform like NAPP or GM, remote_path will be set to the globally unique path across multi-site topology . It is generated based on local site-name and uses /org tree namespace. Note: It is populated only for LM objects. Not supported on the GM.	string	Readonly
resource_type	Must be set to the value EvpnTenantConfig	string
tags	Opaque identifiers meaningful to the API user	array of Tag	Maximum items: 30
transport_zone_path	Policy path to the transport zone Policy path to transport zone. Only overlay transport zone is supported.	string	Required
unique_id	A unique identifier assigned by the system This is a UUID generated by the GM/LM to uniquely identify entities in a federated environment. For entities that are stretched across multiple sites, the same ID will be used on all the stretched sites.	string	Readonly
vni_pool_path	Policy path to the vni pool Policy path to the vni pool used for Evpn in ROUTE-SERVER mode.	string	Required

Example Request: PATCH /global-infra/evpn-tenant-configs/config { "mappings": [{ "vlans": "13", "vnis": "86015" },{ "vlans": "40-50", "vnis": "86000-86010" },{ "vlans": "100-150", "vnis": "86050-86100" }], "transport_zone_path": "/global-infra/sites/default/enforcement-points/default/transport-zones/dab3561c-d1ee-41db-ad26-67c5bd0f2414", "vni_pool_path": "/global-infra/vni-pools/vnipool" } Successful Response:

Response Code:

200 OK

Response Headers:

n/a

Response Body:

n/a

Required Permissions: crud Feature: policy_profiles Additional Errors:

301 Moved Permanently
307 Temporary Redirect
400 Bad Request
403 Forbidden
404 Not Found
405 Method Not Allowed
409 Conflict
412 Precondition Failed
415 Unsupported Media Type
428 Precondition Required
429 Too Many Requests
500 Internal Server Error
503 Service Unavailable

Create or Update Evpn Tenant Configuration

Create or update Evpn Tenant configuration.
Request:

Method:

PUT

URI Path(s):

/global-manager/api/v1/global-infra/evpn-tenant-configs/{config-id}

Request Headers:

n/a

Query Parameters:

n/a

Request Body:

EvpnTenantConfig+

NSX Global Policy API Guide

NSX Global Policy API Guide

Table of Contents

Introduction

API Data Types and Allowed Ranges

Formats

Request Failures

Request Authentication

HTTP Basic Authentication

Session-Based Authentication

Authentication using an X.509 certificate and a Principal Identity

API Pagination

Example Requests and Responses

Collection List Pagination

Optimistic Concurrency Control and the _revision property

Overview

Exceptions for /policy APIs

PATCH and _revision for /policy APIs

PUT Operations

API Rate Limiting

Designing API client code to work gracefully with rate limits

OpenAPI Specification of NSX APIs

Get infra segment cross site traffic statistics (Deprecated)

Get RTEP span and mac address-table (Deprecated)

Get RTEP mesh connectivity status (Deprecated)

Get segment cross site traffic statistics (Deprecated)

Update custom object attribute value list for given attribute key (Deprecated)

Adds/Removes custom attribute values from list (Deprecated)