NSX-T Data Center Global Manager REST API

Associated URIs:

API Description API Path

List security policies


List all security policies for a domain.
GET /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies

Deletes a security policy from this domain


Deletes the security policy along with all the rules
DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}

Read security policy


Read security policy for a domain.
GET /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}

Patch security policy


Patch the security policy for a domain. If a security policy for the given
security-policy-id is not present, the object will get created and if it is
present it will be updated. This is a full replace.
Performance Note: If you want to edit several rules in a security policy
use this API. It will perform better than several individual rule APIs.
Just pass all the rules which you wish to edit as embedded rules to it.
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}

Revise the positioning of security policies


This is used to set a precedence of a security policy w.r.t others.
POST /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}?action=revise

Create or Update security policy


Create or Update the security policy for a domain. This is a full replace.
All the rules are replaced.
Performance Note: If you want to edit several rules in a security policy,
use this API. It will perform better than several individual rule APIs.
Just pass all the rules which you wish to edit as embedded rules to it.
PUT /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}

List rules


List rules 		GET /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules

Delete rule


Delete rule 		DELETE /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules/{rule-id}

Read rule


Read rule 		GET /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules/{rule-id}

Patch a rule


Patch the rule. If Rule corresponding to the the given rule-id is
not present, the object will get created and if it is present it will be
updated. This is a full replace.
Performance Note: If you want to edit several rules in a security policy,
prefer below mentioned API for optimal performance.
Pass all the rules which you wish to edit as embedded rules to it.
Use this API - PATCH (or PUT)
/infra/domains/<domain-id>/security-policies/<security-policy-id>
PATCH /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules/{rule-id}

Revise the positioning of rule


This is used to re-order a rule within a security policy.
POST /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules/{rule-id}?action=revise

Create or update a rule


Update the rule. Create new rule if a rule with the rule-id is not already
present.
Performance Note: If you wish to edit several rules in a security policy,
prefer below mentioned API for optimal performance.
Pass all the rules which you wish to edit as embedded rules to it.
Use this API - PATCH (or PUT)
/infra/domains/<domain-id>/security-policies/<security-policy-id>
PUT /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules/{rule-id}

Get rule statistics


Get statistics of a rule.
- no enforcement point path specified: Stats will be evaluated on each enforcement
point.
- {enforcement_point_path}: Stats are evaluated only on the given enforcement point.
GET /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/rules/{rule-id}/statistics

Get security policy statistics


Get statistics of a security policy.
- no enforcement point path specified: Stats will be evaluated on each enforcement
point.
- {enforcement_point_path}: Stats are evaluated only on the given enforcement point.
GET /global-manager/api/v1/global-infra/domains/{domain-id}/security-policies/{security-policy-id}/statistics

List policy drafts


List policy drafts. 		GET /global-manager/api/v1/global-infra/drafts

Delete a manual draft


Delete a manual draft. 		DELETE /global-manager/api/v1/global-infra/drafts/{draft-id}

Read draft


Read a draft for a given draft identifier.
GET /global-manager/api/v1/global-infra/drafts/{draft-id}

Patch a manual draft


Create a new manual draft if the specified draft id does not correspond
to an existing draft. Update the manual draft otherwise.
Auto draft can not be updated.
PATCH /global-manager/api/v1/global-infra/drafts/{draft-id}

Publish a draft


Read a draft and publish it by applying changes onto current configuration.
If there are additional changes on top of draft configuration, pass it as a
request body, in form of Infra object. Otherwise, if there are no additional
changes, then pass empty Infra object as a request body.
POST /global-manager/api/v1/global-infra/drafts/{draft-id}?action=publish

Create or update a manual draft


Create a new manual draft if the specified draft id does not correspond
to an existing draft. Update the manual draft otherwise.
Auto draft can not be updated.
PUT /global-manager/api/v1/global-infra/drafts/{draft-id}

Get an aggregated configuration for the draft


Get an aggregated configuration that will get applied onto current
configuration during publish of this draft.
The response is a hierarchical payload containing the aggregated
configuration differences from the latest auto draft till the specified draft.
GET /global-manager/api/v1/global-infra/drafts/{draft-id}/aggregated

Get paginated aggregated configuration for the draft


Get a paginated aggregated configuration of a given draft. This aggregated
configuration is the differnece between the current published firewall
configuration and a firewall configuration stored in a given draft.
For an initial API call, if request_id is present in a response, then this is
a paginated aggregated configuration of a given draft, containing all the
security policies from the aggregated configuration.
Using this request_id, more granular aggregated configuration, at security
policy level, can be fetched from subsequent API calls.
Absence of request_id suggests that whole aggregated configuration has been
returned as a response to initial API call, as the size of aggregated
configuration is not big enough to need pagination.
GET /global-manager/api/v1/global-infra/drafts/{draft-id}/aggregated_with_pagination

Get a preview of a configuration after publish of a draft


Get a preview of a configuration which will be present after publish of
a specified draft. The response essentially is a hierarchical payload
containing the configuration, which will be in active after a specified
draft gets published onto current configuration.
GET /global-manager/api/v1/global-infra/drafts/{draft-id}/complete

Test a directory domain event log server connectivity


This API tests a event log server connectivity before the actual domain or event log server is configured. If the connectivity is good, the response will be HTTP status 200. Otherwise the response will be HTTP status 200 and a corresponding error message will be returned. Note - Query param 'enforcement_point_path' would be honoured only in case of Global manager. 		POST /global-manager/api/v1/global-infra/firewall-identity-store-event-log-servers/status

Test a directory domain LDAP server connectivity


This API tests a LDAP server connectivity before the actual domain or LDAP server is configured. If the connectivity is good, the response will be HTTP status 200. Otherwise the response will be HTTP status 500 and corresponding error message will be returned. 		POST /global-manager/api/v1/global-infra/firewall-identity-store-ldap-server

Test a LDAP server connection for directory domain


The API tests a LDAP server connection for an already configured domain. If the connection is successful, the response will be HTTP status 200. Otherwise the response will be HTTP status 500 and corresponding error message will be returned. 		POST /global-manager/api/v1/global-infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers/{ldap-server-id}

Fetch all organization units for a Firewall Identity Store.


 GET /global-manager/api/v1/global-infra/firewall-identity-stores/{firewall-identity-store-id}/org-units

Get Firewall identity store sync statistics for the given identifier


 GET /global-manager/api/v1/global-infra/firewall-identity-stores/{firewall-identity-store-id}/sync-stats

IP Reputation feed configuration.


API to retrieve the current IP Reputation feed configuration.
GET /global-manager/api/v1/global-infra/firewall-ip-reputation-feed

IP reputation feed actions.


This API can be used to activate or deactivate auto-download of IP reputation
feed, it can also be used to trigger download of IP reputation
feed when required. Once auto-download is activated, IP reputation feed will
be downloaded at regular intervals of 720 mins(12 hrs).
Auto-download of IP reputation feed can be activated using the action
'enable_auto_download', to deactivate use action 'disable_auto_download' and to
trigger a download use action 'download'.
For Global Manager, the only action that is supported is action=download. The
enforcement_point_path of the site where the feed is to be downloaded should be
provided along with the action
POST /global-manager/api/v1/global-infra/firewall-ip-reputation-feed

API return the last feed download status on LM from NTICS.


NSX downloads the IP reputation feed from NTICS periodically and in realtime on user request.
The API return the status of last feed download from NTICS on a given site.
GET /global-manager/api/v1/global-infra/firewall-ip-reputation-feed/download/status

Get PolicyFirewallSchedulers


Get all PolicyFirewallSchedulers
GET /global-manager/api/v1/global-infra/firewall-schedulers

Delete Policy Firewall Scheduler


Deletes the specified PolicyFirewallScheduler. If scheduler
is consumed in a security policy, it won't get deleted.
DELETE /global-manager/api/v1/global-infra/firewall-schedulers/{firewall-scheduler-id}

Get PolicyFirewallScheduler


Get a PolicyFirewallScheduler by id
GET /global-manager/api/v1/global-infra/firewall-schedulers/{firewall-scheduler-id}

Create or Update PolicyFirewallScheduler


Creates/Updates a PolicyFirewallScheduler, which can be set at security
policy. Note that at least one property out of "days", "start_date",
"time_interval", "end_date" is required if "recurring" field is true. Also
"start_time" and "end_time" should not be present. And if "recurring"
field is false then "start_date" and "end_date" is mandatory, "start_time"
and "end_time" is optional. Also the fields "days" and "time_interval"
should not be present.
PATCH /global-manager/api/v1/global-infra/firewall-schedulers/{firewall-scheduler-id}

Create or Update PolicyFirewallScheduler


Updates a PolicyFirewallScheduler, which can be set at security policy.
Note that at least one property out of "days", "start_date",
"time_interval", "end_date" is required if "recurring" field is true. Also
"start_time" and "end_time" should not be present. And if "recurring"
field is false then "start_date" and "end_date" is mandatory, "start_time"
and "end_time" is optional. Also the fields "days" and "time_interval"
should not be present.
PUT /global-manager/api/v1/global-infra/firewall-schedulers/{firewall-scheduler-id}

List all firewall identity stores


List all firewall identity stores 		GET /global-manager/api/v1/global-infra/identity-firewall-stores

Delete firewall identity store


If the firewall identity store is removed, it will stop the identity
store synchronization. User will not be able to define new IDFW rules
DELETE /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}

Read firewall identity store


Return a firewall identity store based on the store identifier 		GET /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}

Create or update a firewall identity store


If a firewall identity store with the firewall-identity-store-id
is not already present, create a new firewall identity store. If it
already exists, update the firewall identity store with specified
attributes.
PATCH /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}

Create or update a firewall identity store


If a firewall identity store with the firewall-identity-store-id
is not already present, create a new firewall identity store. If it
already exists, replace the firewall identity store instance with
the new object.
PUT /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}

Delete a Event Log server for Firewall Identity store


 DELETE /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/event-log-servers/{event-log-server-id}

Get a specific Event Log server for a given Firewall Identity store


 GET /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/event-log-servers/{event-log-server-id}

Update a event log server for Firewall Identity store


 PUT /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/event-log-servers/{event-log-server-id}

List all configured domain LDAP servers


 GET /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers

Delete a LDAP server for Firewall Identity store


 DELETE /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}

Get a specific LDAP server for a given Firewall Identity store


 GET /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}

Create a LDAP server for Firewall Identity store


More than one LDAP server can be created and only one LDAP
server is used to synchronize directory objects. If more
than one LDAP server is configured, NSX will try all the
servers until it is able to successfully connect to one.
PATCH /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}

Update a LDAP server for Firewall Identity store


 PUT /global-manager/api/v1/global-infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}

Import K8s network policies to DFW Security Policies


This is used to import a set of K8s network policies into DFW security
policies
POST /global-manager/api/v1/global-infra/import-k8s-np-to-dfw

It returns the exclusion IP list present in the default malicious group


Querying the API on GM with a valid enforcement point path, the API will return the list of exclusion IPs
from the default malicious IP group of the site represented by the enforcement point path.
In the absence of an enforcement point path, the API returns the exclusion IPs present in the global default
malicious IP group of GM.
Querying the API on LM, the api will return a list of exclusion IP addresses present in the local default malicious
ip group.
The API will not consider the IP addresses present in the user created malicious group.
GET /global-manager/api/v1/global-infra/ip-reputation-exclusion-list

List IP reputation site mapping for all sites.


List IP reputation site mapping details.
GET /global-manager/api/v1/global-infra/ip-reputation-site-mappings

Delete IP Reputation site mapping on GM


Delete IP Reputation site mapping from GM. On deletion of the site mapping for a given site,
site specific local default malicious security policies/rules will be enabled and the global ip
reputation default security policies will be removed from the site.
DELETE /global-manager/api/v1/global-infra/ip-reputation-site-mappings/{mapping-id}

Read IP reputation site mapping on GM.


Read IP reputation site mapping details for a given site.
GET /global-manager/api/v1/global-infra/ip-reputation-site-mappings/{mapping-id}

Patch IP Reputation site mapping on GM


Create IP reputation site mapping for a specific site. IP reputation site mapping provides
a way for the user to control the management of IP reputation based security policies from GM.
Creation of site mapping for a site results in disabling IP reputation default security policies
on sites. Post creation of the site mapping the global default security policies from GM gets pushed
to the site.
PATCH /global-manager/api/v1/global-infra/ip-reputation-site-mappings/{mapping-id}

Create or update IP Reputation site mapping on GM


Create IP reputation site mapping for a specific site. IP reputation site mapping provides
a way for the user to control the management of IP reputation based security policies from GM.
Creation of site mapping for a site results in disabling IP reputation default security policies
on sites. Post creation of the site mapping the global default security policies from GM gets pushed
to the site.
PUT /global-manager/api/v1/global-infra/ip-reputation-site-mappings/{mapping-id}

Get the information of export task


Get the information of the latest export task.
GET /global-manager/api/v1/global-infra/settings/firewall/export

Download exported file


Download the exported file generated from the last export task. The request
should have proper headers set to download the file. Please add the below
two headers, if it is not already present
Accept application/json, text/plain, */*
Accept-Encoding gzip, deflate, br
GET /global-manager/api/v1/global-infra/settings/firewall/export?action=download

Invoke export task


Invoke export task. There can be only one export task run at any point of
time. Hence invocation of another export task will be discarded, when there
exist an already running export task.
Exported configuration will be in a CSV format. This CSV file will be zipped
into a ZIP file, that can be downloaded after the completion of export task.
POST /global-manager/api/v1/global-infra/settings/firewall/export

Cancel a running export task


This operation cancels an export task. Task needs to be in running state.
POST /global-manager/api/v1/global-infra/settings/firewall/export?action=cancel

Get all IDFW Group VM details for a given Group


Get all Identity Firewall Group VM details for a given Group.
GET /global-manager/api/v1/global-infra/settings/firewall/idfw/group-vm-details

Get IDFW system statistics data


It will get IDFW system statistics data.
GET /global-manager/api/v1/global-infra/settings/firewall/idfw/system-stats

Get user session data


It will get user session data.
GET /global-manager/api/v1/global-infra/settings/firewall/idfw/user-session-data

Get IDFW user login events for a given VM


It will get IDFW user login events for a given VM
(all active plus up to 5 most recent archived entries).
GET /global-manager/api/v1/global-infra/settings/firewall/idfw/vm-stats/{vm-id}

Get the information of import task


Get the information of the latest import task.
GET /global-manager/api/v1/global-infra/settings/firewall/import

Invoke import task


Invoke import task. There can be only one import task run at any point of
time. Hence invocation of another import task will be discarded, when there
exist an already running import task.
POST /global-manager/api/v1/global-infra/settings/firewall/import

Cancel a running import task


This operation cancels an import task. Task needs to be in running state.
POST /global-manager/api/v1/global-infra/settings/firewall/import?action=cancel

Get dfw firewall configuration


Get the current dfw firewall configurations. 		GET /global-manager/api/v1/global-infra/settings/firewall/security

Update dfw firewall configuration


Update dfw firewall related configurations.
Turning off distributed services ("enable_firewall": false) will turn off Distributed Firewall, Identity Firewall,
Distributed Intrusion Detection and Prevention Service, Distributed Load Balancer.
PATCH /global-manager/api/v1/global-infra/settings/firewall/security

Update dfw firewall configuration


Update dfw firewall related configurations.
Turning off distributed services ("enable_firewall": false) will turn off Distributed Firewall, Identity Firewall,
Distributed Intrusion Detection and Prevention Service, Distributed Load Balancer.
PUT /global-manager/api/v1/global-infra/settings/firewall/security

Get the list of distributed firewall dependent services


Get the list of distributed firewall dependent services
GET /global-manager/api/v1/global-infra/settings/firewall/security/dependent-services

Read security policy exclude list


Read exclude list for firewall
GET /global-manager/api/v1/global-infra/settings/firewall/security/exclude-list

Read security policy exclude list including system and user excluded members


Read security policy exclude list including system and user excluded members.
GET /global-manager/api/v1/global-infra/settings/firewall/security/exclude-list?system_owned=true

Patch exclusion list for security policy


Patch exclusion list for security policy.
PATCH /global-manager/api/v1/global-infra/settings/firewall/security/exclude-list

Filter the firewall exclude list


Filter the firewall exclude list by the given object, to check whether
the object is a member of this exclude list.
POST /global-manager/api/v1/global-infra/settings/firewall/security/exclude-list?action=filter

Create or update exclusion list for security policy


Update the exclusion list for security policy
PUT /global-manager/api/v1/global-infra/settings/firewall/security/exclude-list

Reset firewall rule statistics


Sets firewall rule statistics counter to zero. This operation is supported
for given category, for example: DFW i.e. for all layer3 firewall
(transport nodes only) rules or EDGE i.e. for all layer3 edge firewall
(edge nodes only) rules.
- no enforcement point path specified:
On global manager, it is mandatory to give an enforcement point path.
On local manager, reset of stats will be executed for each enforcement point.
- {enforcement_point_path}: Reset of stats will be executed only for the given enforcement point.
POST /global-manager/api/v1/global-infra/settings/firewall/stats?action=reset
Additional Links