NSX-T Data Center REST API

Associated URIs:

API Description API Path

List Groups for a domain


List Groups for a domain. Groups can be filtered using member_types query parameter,
which returns the groups that contains the specified member types. Multiple member types
can be provided as comma separated values. The API also return groups having member
type that are subset of provided member_types.
GET /policy/api/v1/infra/domains/{domain-id}/groups
GET /policy/api/v1/global-infra/domains/{domain-id}/groups
GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups

Delete Group


Delete the group with group_id under domain domain_id. The force query parameter supported on the
API is deprecated. Usage of the force query parameter does not alter the behaviour of the API. The
API just ignores the force parameter.
DELETE /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}
DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}

Read group


Read group
GET /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}
GET /policy/api/v1/global-infra/domains/{domain-id}/groups/{group-id}
GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}

Patch a group


If a group with the group-id is not already present, create a new group.
If it already exists, patch the group.
Group created with Kubernetes membership criteria includes only Antrea reported inventory as its members.
Once created, Groups with Identity (Directory) Group members should be updated with the new Distinguished Name in case it is changed on AD Server.
Maximum of 500 malicious IP Groups (i.e Group with criteria having IPAddress equals All MALICIOUS_IP) should be created.
PATCH /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}
PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}

Create or update a group


If a group with the group-id is not already present, create a new group.
If it already exists, update the group.
Avoid creating groups with multiple MACAddressExpression and IPAddressExpression.
In future releases, group will be restricted to contain a single
MACAddressExpression and IPAddressExpression along with other expressions.
To group IPAddresses or MACAddresses, use nested groups instead of multiple
IPAddressExpressions/MACAddressExpression.
Group created with Kubernetes membership criteria includes only Antrea reported inventory as its members.
Once created, Groups with Identity (Directory) Group members should be updated with the new Distinguished Name in case it is changed on AD Server.
Maximum of 500 malicious IP Groups (i.e Group with criteria having IPAddress equals All MALICIOUS_IP) should be created.
PUT /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}
PUT /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}

Delete Group External ID Expression


Delete Group External ID Expression
DELETE /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Patch a group external ID expression


If a group ExternalIDexpression with the expression-id is not already present, create a new ExternalIDexpresison.
If it already exists, replace the existing ExternalIDexpression.
PATCH /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Add or Remove external id based members from/to a Group


It will add or remove the specified members having external ID for a given expression of a group.
POST /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}
POST /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/external-id-expressions/{expression-id}

Delete Group IPAddressExpression


Delete Group IPAddressExpression
DELETE /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Patch a group IP Address expression


If a group IPAddressExpression with the expression-id is not already present, create a new IPAddressExpression.
If it already exists, replace the existing IPAddressExpression.
PATCH /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Add or Remove IP Addresses from/to a Group


It will add or remove the specified IP Addresses from a given expression of a group.
POST /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}
POST /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/ip-address-expressions/{expression-id}

Delete Group MACAddressExpression


Delete Group MACAddressExpression
DELETE /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Patch a group MAC Address expression


If a group MACAddressExpression with the expression-id is not already present, create a new MACAddressExpression.
If it already exists, replace the existing MACAddressExpression.
PATCH /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Add or Remove MAC Addresses from/to a Group


It will add or remove the specified MAC Addresses from a given expression of a group.
POST /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}
POST /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/mac-address-expressions/{expression-id}

Delete Group Path Expression


Delete Group Path Expression
DELETE /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Patch a group path expression


If a group path_expression with the expression-id is not already present, create a new pathexpresison.
If it already exists, replace the existing pathexpression.
PATCH /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}

Add or Remove path based members from/to a Group


It will add or remove the specified members having path for a given expression of a group.
POST /policy/api/v1/infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}
POST /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/domains/{domain-id}/groups/{group-id}/path-expressions/{expression-id}