NSX-T Data Center REST API

Associated URIs:

API Description	API Path
List policy drafts List policy drafts.	GET /policy/api/v1/infra/drafts GET /policy/api/v1/global-infra/drafts GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts
Delete a manual draft Delete a manual draft.	DELETE /policy/api/v1/infra/drafts/{draft-id} DELETE /policy/api/v1/global-infra/drafts/{draft-id} DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}
Read draft Read a draft for a given draft identifier.	GET /policy/api/v1/infra/drafts/{draft-id} GET /policy/api/v1/global-infra/drafts/{draft-id} GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}
Patch a manual draft Create a new manual draft if the specified draft id does not correspond to an existing draft. Update the manual draft otherwise. Auto draft can not be updated.	PATCH /policy/api/v1/infra/drafts/{draft-id} PATCH /policy/api/v1/global-infra/drafts/{draft-id} PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}
Publish a draft Read a draft and publish it by applying changes onto current configuration. If there are additional changes on top of draft configuration, pass it as a request body, in form of Infra object. Otherwise, if there are no additional changes, then pass empty Infra object as a request body.	POST /policy/api/v1/infra/drafts/{draft-id}?action=publish POST /policy/api/v1/global-infra/drafts/{draft-id}?action=publish POST /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}?action=publish
Create or update a manual draft Create a new manual draft if the specified draft id does not correspond to an existing draft. Update the manual draft otherwise. Auto draft can not be updated.	PUT /policy/api/v1/infra/drafts/{draft-id} PUT /policy/api/v1/global-infra/drafts/{draft-id} PUT /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}
Get an aggregated configuration for the draft Get an aggregated configuration that will get applied onto current configuration during publish of this draft. The response is a hierarchical payload containing the aggregated configuration differences from the latest auto draft till the specified draft.	GET /policy/api/v1/infra/drafts/{draft-id}/aggregated GET /policy/api/v1/global-infra/drafts/{draft-id}/aggregated GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}/aggregated
Get paginated aggregated configuration for the draft Get a paginated aggregated configuration of a given draft. This aggregated configuration is the differnece between the current published firewall configuration and a firewall configuration stored in a given draft. For an initial API call, if request_id is present in a response, then this is a paginated aggregated configuration of a given draft, containing all the security policies from the aggregated configuration. Using this request_id, more granular aggregated configuration, at security policy level, can be fetched from subsequent API calls. Absence of request_id suggests that whole aggregated configuration has been returned as a response to initial API call, as the size of aggregated configuration is not big enough to need pagination.	GET /policy/api/v1/infra/drafts/{draft-id}/aggregated_with_pagination GET /policy/api/v1/global-infra/drafts/{draft-id}/aggregated_with_pagination GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}/aggregated_with_pagination
Get a preview of a configuration after publish of a draft Get a preview of a configuration which will be present after publish of a specified draft. The response essentially is a hierarchical payload containing the configuration, which will be in active after a specified draft gets published onto current configuration.	GET /policy/api/v1/infra/drafts/{draft-id}/complete GET /policy/api/v1/global-infra/drafts/{draft-id}/complete GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/drafts/{draft-id}/complete
Test a directory domain event log server connectivity This API tests a event log server connectivity before the actual domain or event log server is configured. If the connectivity is good, the response will be HTTP status 200. Otherwise the response will be HTTP status 200 and a corresponding error message will be returned.	POST /policy/api/v1/infra/firewall-identity-store-event-log-servers/status
Test a directory domain LDAP server connectivity This API tests a LDAP server connectivity before the actual domain or LDAP server is configured. If the connectivity is good, the response will be HTTP status 200. Otherwise the response will be HTTP status 500 and corresponding error message will be returned.	POST /policy/api/v1/infra/firewall-identity-store-ldap-server
Scan the size of a directory domain This call scans the size of a directory domain. It may be very | expensive to run this call in some AD domain deployments. Please | use it with caution.	POST /policy/api/v1/infra/firewall-identity-store-size
List all firewall identity stores List all firewall identity stores	GET /policy/api/v1/infra/firewall-identity-stores (Deprecated)
Fetch all organization units for a LDAP server.	POST /policy/api/v1/infra/firewall-identity-stores-org-units
Delete firewall identity store If the firewall identity store is removed, it will stop the identity store synchronization. User will not be able to define new IDFW rules	DELETE /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id} (Deprecated)
Read firewall identity store Return a firewall identity store based on the store identifier	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id} (Deprecated)
Create or update a firewall identity store If a firewall identity store with the firewall-identity-store-id is not already present, create a new firewall identity store. If it already exists, update the firewall identity store with specified attributes.	PATCH /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id} (Deprecated)
Invoke full sync or delta sync for a specific domain, with additional delay in seconds if needed. Stop sync will try to stop any pending sync if any to return to idle state.	POST /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}
Create or update a firewall identity store If a firewall identity store with the firewall-identity-store-id is not already present, create a new firewall identity store. If it already exists, replace the firewall identity store instance with the new object.	PUT /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id} (Deprecated)
Delete a Event Log server for Firewall Identity store	DELETE /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/event-log-servers/{event-log-server-id} (Deprecated)
Get a specific Event Log server for a given Firewall Identity store	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/event-log-servers/{event-log-server-id} (Deprecated)
Update a event log server for Firewall Identity store	PUT /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/event-log-servers/{event-log-server-id} (Deprecated)
Search for directory groups within a domain based on the substring of a distinguished name. (e.g. CN=User,DC=acme,DC=com) The search filter pattern can optionally support multiple (up to 100 maximum) search pattern separated by '|' (url encoded %7C). In this case, the search results will be returned as the union of all matching criteria. (e.g. CN=Ann,CN=Users,DC=acme,DC=com|CN=Bob,CN=Users,DC=acme,DC=com)	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/groups
List members of a directory group A member group could be either direct member of the group specified by group_id or nested member of it. Both direct member groups and nested member groups are returned. Directory group member sync must be enabled to get the correct results.	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/groups/{group-id}/member-groups
List all configured domain LDAP servers	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers (Deprecated)
Delete a LDAP server for Firewall Identity store	DELETE /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers/{ldap-server-id} (Deprecated)
Get a specific LDAP server for a given Firewall Identity store	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers/{ldap-server-id} (Deprecated)
Create a LDAP server for Firewall Identity store More than one LDAP server can be created and only one LDAP server is used to synchronize directory objects. If more than one LDAP server is configured, NSX will try all the servers until it is able to successfully connect to one.	PATCH /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers/{ldap-server-id} (Deprecated)
Test a LDAP server connection for directory domain The API tests a LDAP server connection for an already configured domain. If the connection is successful, the response will be HTTP status 200. Otherwise the response will be HTTP status 500 and corresponding error message will be returned.	POST /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers/{ldap-server-id}
Update a LDAP server for Firewall Identity store	PUT /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/ldap-servers/{ldap-server-id} (Deprecated)
Fetch all organization units for a Firewall Identity Store.	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/org-units
Get Firewall identity store sync statistics for the given identifier	GET /policy/api/v1/infra/firewall-identity-stores/{firewall-identity-store-id}/sync-stats
Get PolicyFirewallSchedulers Get all PolicyFirewallSchedulers	GET /policy/api/v1/infra/firewall-schedulers GET /policy/api/v1/global-infra/firewall-schedulers GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/firewall-schedulers
Delete Policy Firewall Scheduler Deletes the specified PolicyFirewallScheduler. If scheduler is consumed in a security policy, it won't get deleted.	DELETE /policy/api/v1/infra/firewall-schedulers/{firewall-scheduler-id} DELETE /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/firewall-schedulers/{firewall-scheduler-id}
Get PolicyFirewallScheduler Get a PolicyFirewallScheduler by id	GET /policy/api/v1/infra/firewall-schedulers/{firewall-scheduler-id} GET /policy/api/v1/global-infra/firewall-schedulers/{firewall-scheduler-id} GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/firewall-schedulers/{firewall-scheduler-id}
Create or Update PolicyFirewallScheduler Creates/Updates a PolicyFirewallScheduler, which can be set at security policy. Note that at least one property out of "days", "start_date", "time_interval", "end_date" is required if "recurring" field is true. Also "start_time" and "end_time" should not be present. And if "recurring" field is false then "start_date" and "end_date" is mandatory, "start_time" and "end_time" is optional. Also the fields "days" and "time_interval" should not be present.	PATCH /policy/api/v1/infra/firewall-schedulers/{firewall-scheduler-id} PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/firewall-schedulers/{firewall-scheduler-id}
Create or Update PolicyFirewallScheduler Updates a PolicyFirewallScheduler, which can be set at security policy. Note that at least one property out of "days", "start_date", "time_interval", "end_date" is required if "recurring" field is true. Also "start_time" and "end_time" should not be present. And if "recurring" field is false then "start_date" and "end_date" is mandatory, "start_time" and "end_time" is optional. Also the fields "days" and "time_interval" should not be present.	PUT /policy/api/v1/infra/firewall-schedulers/{firewall-scheduler-id} PUT /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/firewall-schedulers/{firewall-scheduler-id}
List all firewall identity stores List all firewall identity stores	GET /policy/api/v1/infra/identity-firewall-stores
Delete firewall identity store If the firewall identity store is removed, it will stop the identity store synchronization. User will not be able to define new IDFW rules	DELETE /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}
Read firewall identity store Return a firewall identity store based on the store identifier	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}
Create or update a firewall identity store If a firewall identity store with the firewall-identity-store-id is not already present, create a new firewall identity store. If it already exists, update the firewall identity store with specified attributes.	PATCH /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}
Create or update a firewall identity store If a firewall identity store with the firewall-identity-store-id is not already present, create a new firewall identity store. If it already exists, replace the firewall identity store instance with the new object.	PUT /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}
Delete a Event Log server for Firewall Identity store	DELETE /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/event-log-servers/{event-log-server-id}
Get a specific Event Log server for a given Firewall Identity store	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/event-log-servers/{event-log-server-id}
Update a event log server for Firewall Identity store	PUT /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/event-log-servers/{event-log-server-id}
List group's children groups and Users A member group could be either direct member of the group specified by group_id or nested member of it. Both direct member groups and nested member groups are returned.	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/groups/{group-id}/children
List group's all direct and grand parent groups Returns all the direct and grand parent groups of a group.	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/groups/{group-id}/parent-groups
List all configured domain LDAP servers	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers
Delete a LDAP server for Firewall Identity store	DELETE /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}
Get a specific LDAP server for a given Firewall Identity store	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}
Create a LDAP server for Firewall Identity store More than one LDAP server can be created and only one LDAP server is used to synchronize directory objects. If more than one LDAP server is configured, NSX will try all the servers until it is able to successfully connect to one.	PATCH /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}
Update a LDAP server for Firewall Identity store	PUT /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/ldap-servers/{ldap-server-id}
List users by user name Return all the users based on the user name.	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/users
List user's all direct and grand parent groups Returns all the direct and grand parent groups of a user.	GET /policy/api/v1/infra/identity-firewall-stores/{identity-firewall-store-id}/users/{user-id}/parent-groups
List compute cluster idfw Configuration API will list all compute cluster wise identity firewall configuration	GET /policy/api/v1/infra/settings/firewall/idfw/cluster
Delete compute cluster idfw configuration Delete compute cluster identity firewall configuration.	DELETE /policy/api/v1/infra/settings/firewall/idfw/cluster/{cluster-id}
Read compute cluster idfw configuration Read compute cluster identity firewall configuration	GET /policy/api/v1/infra/settings/firewall/idfw/cluster/{cluster-id}
Patch compute cluster idfw configuration Patch compute cluster identity firewall configuration.	PATCH /policy/api/v1/infra/settings/firewall/idfw/cluster/{cluster-id}
Create or update compute cluster idfw configuration Update the compute cluster idfw configuration	PUT /policy/api/v1/infra/settings/firewall/idfw/cluster/{cluster-id}
Get IDFW status for a Compute Collection Get IDFW status for a specific Compute Collection	GET /policy/api/v1/infra/settings/firewall/idfw/compute-collections/{compute-collection-id}/status
List IDFW status for Transport Nodes in a Compute Collection This API will list all transport node and statuses based on idfw enabled compute collection ID.	GET /policy/api/v1/infra/settings/firewall/idfw/compute-collections/{compute-collection-id}/transport-nodes/status
Get IDFW status for all Compute Collections Get IDFW status for all Compute Collections	GET /policy/api/v1/infra/settings/firewall/idfw/compute-collections/status
Get all IDFW Group VM details for a given Group Get all Identity Firewall Group VM details for a given Group.	GET /policy/api/v1/infra/settings/firewall/idfw/group-vm-details
Read idfw configuration for standalone host Read identity firewall configuration for standalone host	GET /policy/api/v1/infra/settings/firewall/idfw/standalone-host-switch-setting
Patch idfw configuration for standalone host Patch identity firewall configuration for standalone host	PATCH /policy/api/v1/infra/settings/firewall/idfw/standalone-host-switch-setting
Create or update idfw configuration for standalone host Update the idfw configuration for standalone host	PUT /policy/api/v1/infra/settings/firewall/idfw/standalone-host-switch-setting
Get IDFW system statistics data It will get IDFW system statistics data.	GET /policy/api/v1/infra/settings/firewall/idfw/system-stats
List IDFW status of VMs by transport node id This API will list all VMs and statuses based on transport node ID of idfw enabled compute collection.	GET /policy/api/v1/infra/settings/firewall/idfw/transport-nodes/{transport-node-id}/vms/status
Get user session data It will get user session data.	GET /policy/api/v1/infra/settings/firewall/idfw/user-session-data
Get IDFW user login events for a given user It will get IDFW user login events for a given user.	GET /policy/api/v1/infra/settings/firewall/idfw/user-stats/{user-id}
Get IDFW user login events for a given VM It will get IDFW user login events for a given VM (all active plus up to 5 most recent archived entries).	GET /policy/api/v1/infra/settings/firewall/idfw/vm-stats/{vm-id}
Get dfw firewall configuration Get the current dfw firewall configurations.	GET /policy/api/v1/infra/settings/firewall/security GET /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/settings/firewall/security
Update dfw firewall configuration Update dfw firewall related configurations. Turning off distributed services ("enable_firewall": false) will turn off Distributed Firewall, Identity Firewall, Distributed Intrusion Detection and Prevention Service, Distributed Load Balancer.	PATCH /policy/api/v1/infra/settings/firewall/security PATCH /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/settings/firewall/security
Update dfw firewall configuration Update dfw firewall related configurations. Turning off distributed services ("enable_firewall": false) will turn off Distributed Firewall, Identity Firewall, Distributed Intrusion Detection and Prevention Service, Distributed Load Balancer.	PUT /policy/api/v1/infra/settings/firewall/security PUT /policy/api/v1/orgs/{org-id}/projects/{project-id}/infra/settings/firewall/security
Get the list of distributed firewall dependent services Get the list of distributed firewall dependent services	GET /policy/api/v1/infra/settings/firewall/security/dependent-services
Read security policy exclude list including system and user excluded members Read security policy exclude list including system and user excluded members.	GET /policy/api/v1/infra/settings/firewall/security/exclude-list?system_owned=true GET /policy/api/v1/global-infra/settings/firewall/security/exclude-list?system_owned=true
Read security policy exclude list Read exclude list for firewall	GET /policy/api/v1/infra/settings/firewall/security/exclude-list GET /policy/api/v1/global-infra/settings/firewall/security/exclude-list
Patch exclusion list for security policy Patch exclusion list for security policy.	PATCH /policy/api/v1/infra/settings/firewall/security/exclude-list
Filter the firewall exclude list Filter the firewall exclude list by the given object, to check whether the object is a member of this exclude list.	POST /policy/api/v1/infra/settings/firewall/security/exclude-list?action=filter POST /policy/api/v1/global-infra/settings/firewall/security/exclude-list?action=filter
Create or update exclusion list for security policy Update the exclusion list for security policy	PUT /policy/api/v1/infra/settings/firewall/security/exclude-list
Read security policy exclude list Read exclude list for firewall	GET /policy/api/v1/infra/settings/firewall/security/exclude-list/global
Patch exclusion list Patch exclusion list.	PATCH /policy/api/v1/infra/settings/firewall/security/exclude-list/global
Create or update exclusion list Update the exclusion list	PUT /policy/api/v1/infra/settings/firewall/security/exclude-list/global
Post User Login/Logout events for IDFW API to receive User Login and Logout events for IDFW	POST /policy/api/v1/system/input/login-logout-events