Policy Management Operations Index

Policy Management Operations Index

All available Policy Management Operations

Recommendation
POST
Create Recommendation Session

Initiates a new recommendation session to analyze network traffic and generate security policies.

Notes:

  • The session can be configured for CLASSIC, APPLICATION, or ENVIRONMENT recommendation types.
  • Analysis begins automatically upon creation based on the provided context and parameters.
  • Returns a 202 Accepted with an async operation ID. Use the /recommendations/{id}/status endpoint to poll for analysis completion.
GET
Get Recommendation Session

Fetches the complete configuration and current state of a specific recommendation session.

Notes:

  • Returns the full session payload including context inputs, analysis parameters, and metadata.
  • The embedded status object indicates if the recommendation is WAITING, ANALYSIS_IN_PROGRESS, READY_TO_PUBLISH, or ANALYSIS_FAILED.
  • To check only the status without retrieving the full configuration payload, use the /recommendations/{id}/status endpoint.
PUT
Update Recommendation Session

Modifies an existing recommendation session's parameters or triggers lifecycle actions like re-run or cancel analysis.

Notes:

  • Use the action field to trigger specific operations: ANALYZE (re-runs analysis) or CANCEL (stops an in-progress analysis).
  • Side Effect: Triggering an ANALYZE action will clean up any existing recommendation results for this session.
  • Certain configuration updates may be rejected if an analysis is currently in progress.
DELETE
Delete Recommendation Session

Permanently removes a recommendation session from the system.

Notes:

  • Side Effect: This is a cascading delete. All associated resources, including generated recommendation results, will be permanently cleaned up.
GET
Get Recommendation Session Status

Provides a lightweight way to poll the current progress and state of a recommendation session.

Notes:

  • Use this endpoint instead of the full session GET when polling for completion.
  • Returns the overall status, site-specific analysis states, status messages, and any alerts generated during analysis.
  • Indicates if a rerun is recommended due to environment changes.
GET
Get Recommendation Monitoring Result

Fetches the results of periodic continuous monitoring for a specific recommendation session to identify if the context has drifted.

Notes:

  • Results are only available if monitoring_enabled is true for the session AND system-wide monitoring is active.
  • Compares the original context against the latest effective members (VMs/servers) and segmentation strategies.
  • If rerun_recommended is true, the environment has changed significantly and the user should trigger a new ANALYZE action via the PUT endpoint.
POST
List Recommendation Sessions

Queries the system for recommendation sessions matching specific filter criteria.

Notes:

  • Uses POST instead of GET to accommodate complex, nested filter payloads.
  • Multiple top-level filter parameters are combined using AND logic.
  • Supports filtering by context inputs (VMs, groups, applications, environments), status, type, and time.
  • Returns paginated results.
GET
Get Recommendation Result

Fetches the generated security policy infrastructure payload and publication status for a specific site.

Notes:

  • Results are site-specific and only available once the session analysis reaches READY_TO_PUBLISH status.
  • Use the conflict_resolution_strategy query parameter to handle out-of-band NSX policy changes:
    • NONE: Retrieves the saved result as-is.
    • USE_LATEST_NSX_POLICY: Re-applies recommendation diffs on top of current NSX policies (preserves recent NSX changes).
    • USE_SAVED_RECOMMENDATION: Updates revision numbers to force the saved recommendation to be publishable (overrides recent NSX changes).
PUT
Update Recommendation Result

Modifies a recommendation result or triggers its publication to the NSX Policy Manager.

Notes:

  • To publish the generated infrastructure payload to NSX, include publish_action of PUBLISH or FORCE_PUBLISH in the request body.
  • Side Effect: Publishing to NSX applies the recommended security policies, rules, and groups directly to the live firewall environment.
  • Returns a 202 Accepted with an async operation ID. Use the result status endpoint to track publication progress.
GET
Get Recommendation Result Status

Provides a lightweight way to poll the publication status of a recommendation result.

Notes:

  • Use this endpoint to track progress after triggering a publish action.
  • Statuses include READY_TO_PUBLISH, PUBLISH_INITIATED, PUBLISHED, or PUBLISH_FAILED.
GET
Export Recommendation To Csv

Downloads the recommended infrastructure payload (policies, rules, groups) in a specified file format.

Notes:

  • Currently supports CSV output format via the output_format query parameter.
  • Use the detail_level query parameter to choose between SUMMARY (simplified fields) or DETAILED (full payload data).