NSX-T Data Center REST API

Associated URIs:

API Description	API Path
Get effective object permissions to object specified by path for current user. Returns none if user doesn't have access or feature_name from required request parameter is empty/invalid/doesn't match with object-path provided.	GET /policy/api/v1/aaa/effective-permissions (Experimental)
List feature permissions List features	GET /policy/api/v1/aaa/features-with-properties GET /api/v1/aaa/features-with-properties
List LDAP identity sources Return a list of all configured LDAP identity sources.	GET /policy/api/v1/aaa/ldap-identity-sources
Test an LDAP server Attempt to connect to an LDAP server and ensure that the server can be contacted using the given URL and authentication credentials.	POST /policy/api/v1/aaa/ldap-identity-sources?action=probe_ldap_server
Probe an LDAP identity source Verify that the configuration of an LDAP identity source is correct before actually creating the source.	POST /policy/api/v1/aaa/ldap-identity-sources?action=probe_identity_source
Fetch the server certificate of an LDAP server Attempt to connect to an LDAP server and retrieve the server certificate it presents.	POST /policy/api/v1/aaa/ldap-identity-sources?action=fetch_certificate
Delete an LDAP identity source Delete an LDAP identity source. Users defined in that source will no longer be able to access NSX.	DELETE /policy/api/v1/aaa/ldap-identity-sources/<ldap-identity-source-id>
Read a single LDAP identity source Return details about one LDAP identity source	GET /policy/api/v1/aaa/ldap-identity-sources/<ldap-identity-source-id>
Test the configuration of an existing LDAP identity source Attempt to connect to an existing LDAP identity source and report any errors encountered.	POST /policy/api/v1/aaa/ldap-identity-sources/<ldap-identity-source-id>?action=probe
Update an existing LDAP identity source Update the configuration of an existing LDAP identity source. You may wish to verify the new configuration using the POST /aaa/ldap-identity-sources?action=probe API before changing the configuration. Note that if you are using LDAP on an active and standby NSX-T Global Manager in a federated environment, you must use the same name for your LDAP identity sources on the active and standby Global Managers.	PUT /policy/api/v1/aaa/ldap-identity-sources/<ldap-identity-source-id>
Search the LDAP identity source Search the LDAP identity source for users and groups that match the given filter_value. In most cases, the LDAP source performs a case-insensitive search.	POST /policy/api/v1/aaa/ldap-identity-sources/<ldap-identity-source-id>/search
Delete object-permissions entries	DELETE /policy/api/v1/aaa/object-permissions (Experimental)
Get list of Object-level RBAC entries.	GET /policy/api/v1/aaa/object-permissions (Experimental)
Create/update object permission mappings	PATCH /policy/api/v1/aaa/object-permissions (Experimental)
Create registration access token The privileges of the registration token will be the same as the caller.	POST /policy/api/v1/aaa/registration-token POST /api/v1/aaa/registration-token
Delete registration access token	DELETE /policy/api/v1/aaa/registration-token/<token> DELETE /api/v1/aaa/registration-token/<token>
Get registration access token	GET /policy/api/v1/aaa/registration-token/<token> GET /api/v1/aaa/registration-token/<token>
Get all users and groups with their roles Get all users and groups with their roles.	GET /policy/api/v1/aaa/role-bindings GET /api/v1/aaa/role-bindings
Delete all stale role assignments	POST /policy/api/v1/aaa/role-bindings?action=delete_stale_bindings POST /api/v1/aaa/role-bindings?action=delete_stale_bindings
Assign roles to User or Group This API is used to assign a user/group any role(s) of choice. User has union of all the roles assigned to it. User name is dealt case-insensitively.	POST /policy/api/v1/aaa/role-bindings POST /api/v1/aaa/role-bindings
Delete user/group's roles assignment Delete the user/group's role assignment.	DELETE /policy/api/v1/aaa/role-bindings/<binding-id> DELETE /api/v1/aaa/role-bindings/<binding-id>
Get user/group's role information	GET /policy/api/v1/aaa/role-bindings/<binding-id> GET /api/v1/aaa/role-bindings/<binding-id>
Update User or Group's roles This API is used to update a user/group any role(s) of choice. User name is dealt case-insensitively.	PUT /policy/api/v1/aaa/role-bindings/<binding-id> PUT /api/v1/aaa/role-bindings/<binding-id>
Get information about all roles	GET /policy/api/v1/aaa/roles GET /api/v1/aaa/roles
Validate a new feature permission set Validate the permissions of an incoming role. Also, recommend the permissions which need to be corrected.	POST /policy/api/v1/aaa/roles?action=validate POST /api/v1/aaa/roles?action=validate
Get information about all roles with features and their permissions	GET /policy/api/v1/aaa/roles-with-feature-permissions GET /api/v1/aaa/roles-with-feature-permissions
Delete custom role If a role is assigned to a role binding then the deletion of the role is not allowed. Precanned roles cannot be deleted.	DELETE /policy/api/v1/aaa/roles/<role> DELETE /api/v1/aaa/roles/<role>
Get role information	GET /policy/api/v1/aaa/roles/<role> GET /api/v1/aaa/roles/<role>
Clone an already present role The role with id <role> is cloned and the new id, name and description are the ones provided in the request body.	POST /policy/api/v1/aaa/roles/<role>?action=clone POST /api/v1/aaa/roles/<role>?action=clone
Update custom role Creates a new role with id as <role> if there does not exist any role with id <role>, else updates the existing role.	PUT /policy/api/v1/aaa/roles/<role> PUT /api/v1/aaa/roles/<role>
Get the name and role information of the user. This API will return the name and role information of the user invoking this API request. This API is available for all NSX users no matter their authentication method (Local account, VIDM, LDAP etc).	GET /policy/api/v1/aaa/user-info GET /api/v1/aaa/user-info
Get all the User Groups where vIDM display name matches the search key case insensitively. The search key is checked to be a substring of display name. This is a non paginated API. This API will return as many results that vIDM returns to NSX during the search query. vIDM may not send all results at once so to zero in on the group of interest more characters need to be entered.	GET /policy/api/v1/aaa/vidm/groups GET /api/v1/aaa/vidm/groups
Get all the users and groups from vIDM matching the search key case insensitively. The search key is checked to be a substring of name or given name or family name of user and display name of group. This is a non paginated API. This API will return as many results that vIDM returns to NSX during the search query. vIDM may not send all results at once so to zero in on the user/group of interest more characters need to be entered.	POST /policy/api/v1/aaa/vidm/search POST /api/v1/aaa/vidm/search
Get all the users from vIDM whose userName, givenName or familyName matches the search key case insensitively. The search key is checked to be a substring of name or given name or family name. This is a non paginated API. This API will return as many results that vIDM returns to NSX during the search query. vIDM may not send all results at once so to zero in on the user of interest more characters need to be entered.	GET /policy/api/v1/aaa/vidm/users GET /api/v1/aaa/vidm/users
Read AAA provider vIDM properties	GET /api/v1/node/aaa/providers/vidm GET /api/v1/cluster/<cluster-node-id>/node/aaa/providers/vidm
Update AAA provider vIDM properties	PUT /api/v1/node/aaa/providers/vidm PUT /api/v1/cluster/<cluster-node-id>/node/aaa/providers/vidm
Read AAA provider vIDM status	GET /api/v1/cluster/<cluster-node-id>/node/aaa/providers/vidm/status GET /api/v1/node/aaa/providers/vidm/status
Return the list of OpenID Connect end-points.	GET /api/v1/trust-management/oidc-uris
Update a OpenID Connect end-point's thumbprint Update a OpenID Connect end-point's thumbprint used to connect to the oidc_uri through SSL	POST /api/v1/trust-management/oidc-uris?action=update_thumbprint
Add an OpenID Connect end-point. This request also fetches the issuer and jwks_uri meta-data from the OIDC end-point and stores it.	POST /api/v1/trust-management/oidc-uris
Get an OpenID Connect end-point. When ?refresh=true is added to the request, the meta-data is newly fetched from the OIDC end-point.	GET /api/v1/trust-management/oidc-uris/<id>
Return the list of principal identities Returns the list of principals registered with a certificate.	GET /api/v1/trust-management/principal-identities
Register a name-certificate combination. Associates a principal's name with a certificate that is used to authenticate. The combination name and node_id needs to be unique across token-based and certificate-based principal identities. Deprecated, use POST /trust-management/principal-identities/with-certificate instead.	POST /api/v1/trust-management/principal-identities (Deprecated)
Update a principal identity's certificate Update a principal identity's certificate	POST /api/v1/trust-management/principal-identities?action=update_certificate
Delete a principal identity Delete a principal identity. It does not delete the certificate.	DELETE /api/v1/trust-management/principal-identities/<principal-identity-id>
Get a principal identity Get a stored principal identity	GET /api/v1/trust-management/principal-identities/<principal-identity-id>
Register a name-certificate combination. Create a principal identity with a new, unused, certificate. The combination name and node_id needs to be unique across token-based and certificate-based principal identities.	POST /api/v1/trust-management/principal-identities/with-certificate
Return the list of token-based principal identities. | These don't have certificate or role information.	GET /api/v1/trust-management/token-principal-identities
Register a token-based principal identity. Register a principal identity that is going to be authenticated through a token. The combination name and node_id needs to be unique across token-based and certificate-based principal identities.	POST /api/v1/trust-management/token-principal-identities
Delete a token-based principal identity Delete a token-based principal identity.	DELETE /api/v1/trust-management/token-principal-identities/<principal-identity-id>
Get a token-based principal identity Get a stored token-based principal identity	GET /api/v1/trust-management/token-principal-identities/<principal-identity-id>