Get Groups Flow Topology

Get group-level flow topology graph

Returns a topology graph where security groups are nodes and inter-group communication paths are edges. Each edge represents that at least one flow was observed between members of two groups within the requested time window.

Notes:

start_time is required. Either site_id or site_ids must also be provided.
Group membership is determined at flow ingestion time -- the groups each compute belonged to when the flow was recorded, not the current membership.
Use entity_limit to cap the number of group nodes returned. When the number of groups exceeds this threshold, low-traffic groups are collapsed into an "Other" node.
When an "Other" node is present in the response, call POST /visualization/topology/groups-flow-topology/other-members to list the groups it contains.
filters accepts up to 300 filter entries.
The group-id of each node in the response can be used directly with POST /visualization/flow-analysis/groups/{group-id}/flow-details to drill into flow records for that group, or with POST /visualization/security-analysis/groups/{group-id}/related-dfw-rules to see its associated DFW rules.
Each group-id value is the NSX realization UUID of the group.

Request

URI

POST

https://{api_host}/intelligence/visualization/topology/groups-flow-topology

COPY

Request Body

Wrapper request for GroupsFlowTopology with restricted filter keys

VizGroupsFlowTopologyRequest of type(s) application/json

Required

This request body class requires all of the following: VizFlowsTopologyRequest , InlineVizGroupsFlowTopologyRequest1

{
    "site_id": "2996d590-1afe-49a1-905b-3f39b8228da7",
    "start_time": 1779132178395,
    "entity_limit": 10,
    "filters": [],
    "cluster_info": {
        "cluster_type": "FLOW"
    }
}

Authentication

This operation uses the following authentication methods.

Responses

200

success

Returns TopologyResponse of type(s) application/json

{
    "time_interval": {
        "start_time": 1781771317000,
        "end_time": 1781811437000
    },
    "topology": {
        "partial_result": [
            "ENTITY_THRESHOLD_EXCEEDED",
            "GROUP_NUMBER_IN_FLOW_THRESHOLD_EXCEEDED"
        ],
        "entities": [
            {
                "entity_type": "UNCATEGORIZED",
                "id": "UNCATEGORIZED",
                "reference_id": "UNCATEGORIZED",
                "name": "Uncategorized Computes",
                "config_events": [],
                "highlight": false,
                "compute_count": 5
            }
        ],
        "connections": {
            "flow_connections": []
        },
        "uuid_mapping": {},
        "has_communities": false,
        "communities": []
    }
}

object

time_interval

Optional

Represents a continuous span of time defined by a required start and end timestamp.

object

topology

Optional

The graph representation of a network topology, consisting of entities (nodes) and connections (edges) between them.

400

Bad Request

Returns BadRequest of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

401

Unauthorized

Returns Unauthorized of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

403

Forbidden

Returns Forbidden of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

412

Precondition Failed

Returns PreconditionFailed of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

428

Precondition Required

Returns PreconditionRequired of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

429

Too Many Requests

Returns TooManyRequests of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

default

Error

Returns Error of type(s) application/json

{
    "error_code": 0,
    "module_name": "string",
    "error_message": "string"
}

integer

error_code

Required

HTTP Status or Application error code.

string

module_name

Optional

Module where the error happened.

string

error_message

Required

Message describing the error.

Code Samples

COPY

                    curl -X POST -H 'Authorization: <value>' -H 'Content-Type: application/json' -d '{}' https://{api_host}/intelligence/visualization/topology/groups-flow-topology

On This Page

Description

Request

Request Body

Authentication

Response

200 Response Body

Errors

Security Explorer Operations

POST

Get App Flow Details

POST