# TP-Link Omada MCP server

> ## 🤖 AI-Developed Repository
>
> Since **March 2, 2026**, this repository contains no human-written code.
>
> All planning, development, and code review is performed by AI agents. Humans remain in the loop for direction, decisions, and final approval — but every line of code, every test, every commit, and every PR is the work of AI.
>
> This is not an experiment. This is how it works now. [Know more](https://miguel.ms)

---

A Model Context Protocol (MCP) server implemented in TypeScript that exposes the TP-Link Omada controller APIs to AI copilots and automation workflows. The server authenticates against a controller, lists sites, devices, and connected clients, and offers a generic tool to invoke arbitrary Omada API endpoints.

> **Compatibility:** Tested with Omada Controller versions 5.x and 6.x



## Quick Start

### Using with Claude Desktop (stdio)

1. **Pull the Docker image** (or build it locally with `npm run docker:build`):

   ```bash
   docker pull jmtvms/tplink-omada-mcp:latest
   ```

2. **Add the MCP server to Claude Desktop configuration**. Edit your Claude Desktop config file:
   - **macOS**: `~/Library/Application Support/Claude/claude_desktop_config.json`
   - **Windows**: `%APPDATA%\Claude\claude_desktop_config.json`

3. **Add the following configuration**:

   ```json
   {
     "mcpServers": {
       "tplink-omada": {
         "command": "docker",
         "args": [
           "run",
           "-i",
           "--rm",
           "-e", "OMADA_BASE_URL=https://your-omada-controller.local",
           "-e", "OMADA_CLIENT_ID=your-client-id",
           "-e", "OMADA_CLIENT_SECRET=your-client-secret",
           "-e", "OMADA_OMADAC_ID=your-omadac-id",
           "-e", "OMADA_SITE_ID=your-site-id",
           "-e", "OMADA_STRICT_SSL=false",
           "jmtvms/tplink-omada-mcp:latest"
         ]
       }
     }
   }
   ```

   Replace the environment variable values with your actual Omada controller credentials.

4. **Restart Claude Desktop** to load the new MCP server configuration.

5. **Verify the connection** by asking Claude to list your Omada sites or devices.

### Using Docker Containers

#### CLI/stdio Container

```bash
docker run -it --rm \
  --env-file .env \
  jmtvms/tplink-omada-mcp:latest
```

#### HTTP Server Container

```bash
docker run -d \
  --env-file .env \
  -e MCP_SERVER_USE_HTTP=true \
  -e MCP_HTTP_BIND_ADDR=0.0.0.0 \
  -p 3000:3000 \
  jmtvms/tplink-omada-mcp:latest
```

The HTTP server will be available at `http://localhost:3000/mcp`.

## Features

- OAuth client-credentials authentication with automatic token refresh
- Tools for retrieving sites, network devices, and connected clients
- Generic Omada API invoker for advanced automation scenarios
- Environment-driven configuration
- Per-tag Omada OpenAPI references stored under `docs/openapi`
- Ready-to-use devcontainer with a companion Omada controller service

## Getting started

### Prerequisites

- Docker (for running pre-built containers) or Node.js 24+ (for local development)
- Access to a TP-Link Omada controller (for example using the `mbentley/omada-controller` Docker image)

### Configuration

The MCP server reads its configuration from environment variables. See `.env.example` for a complete reference.

#### Tool Category Filtering

| Variable                  | Required | Default                                                      | Description                                          |
| ------------------------- | -------- | ------------------------------------------------------------ | ---------------------------------------------------- |
| `OMADA_TOOL_CATEGORIES` | No       | `dashboard:r,client-insights:r,clients:r,devices-all:r` | Comma-separated categories to enable at startup |
Each token is `<category>[:<suffix>]`. Permission suffixes:

| Suffix | Effect               |
| ------ | -------------------- |
| `:r` | Read tools only |
| `:w` | Write tools only |
| `:rw` | Read and write tools |
| _(none)_ | Same as `:rw`      |

##### Category Reference

Categories marked with `*` are reserved for upcoming phases and have no tool implementations yet. Specifying them will produce a startup warning and they will be skipped. Write (mutating) tools are available in the `clients`, `sites`, `wireless-ssid`, `wireless-auth`, `network-lan`, `network-nat`, `network-routing`, `network-services`, `firewall-acl`, `firewall-traffic`, `devices-general`, `devices-switch`, `vpn`, `profiles`, `auth-profiles`, `schedules`, `account-users` and `controller` categories; enable them with a write permission suffix (e.g. `clients:w`, `sites:rw`, `vpn:rw`). Categories not listed are read-only for now.

| Group                   | Categories                                                                    |
| ----------------------- | ----------------------------------------------------------------------------- |
| Dashboard & Insights    | `dashboard`, `client-insights`, `insights`*                                   |
| Clients                 | `clients`                                                                     |
| Devices                 | `devices-general`, `devices-ap`, `devices-switch`, `devices-gateway`          |
| Wireless                | `wireless-ssid`, `wireless-radio`, `wireless-auth`                            |
| Network                 | `network-wan`, `network-sim-lte`*, `network-lan`, `network-routing`, `network-nat`, `network-services` |
| Firewall & Security     | `firewall-acl`, `firewall-traffic`, `firewall-ids`, `security-threat`, `security-wids` |
| VPN                     | `vpn`                                                                         |
| Profiles & Schedules    | `profiles`, `schedules`, `auth-profiles`                                     |
| Logs                    | `logs`                                                                        |
| Controller & Org        | `controller`, `sites`, `maintenance`, `account-users`, `account-sso`*, `account-cloud` |
| Hotspot                 | `hotspot-portal`*, `hotspot-vouchers`*, `hotspot-users`*                      |
| Niche                   | `site-templates`*, `voip`*, `olt`*, `msp`*                                    |

Group aliases expand to all categories in their group:

| Alias          | Expands to                                                                                    |
| -------------- | --------------------------------------------------------------------------------------------- |
| `all` | Every category |
| `devices-all` | `devices-general`, `devices-ap`, `devices-switch`, `devices-gateway` |
| `wireless-all` | `wireless-ssid`, `wireless-radio`, `wireless-auth`                                            |
| `network-all` | `network-wan`, `network-lan`, `network-routing`, `network-nat`, `network-services` |
| `firewall-all` | `firewall-acl`, `firewall-traffic`, `firewall-ids`                                            |
| `security-all` | `security-threat`, `security-wids`                                                            |

Examples:

```bash
# Read-only access to everything
OMADA_TOOL_CATEGORIES=all:r

# Default safe subset (read only)
OMADA_TOOL_CATEGORIES=dashboard:r,client-insights:r,clients:r,devices-all:r

# Full access including write operations
OMADA_TOOL_CATEGORIES=all:rw

# Network read + client write operations
OMADA_TOOL_CATEGORIES=network-all:r,clients:rw
```

#### Omada Client Configuration

| Variable              | Required | Default | Description                                                                 |
| --------------------- | -------- | ------- | --------------------------------------------------------------------------- |
| `OMADA_BASE_URL` | Yes      | -       | Base URL of the Omada controller (e.g., `https://omada-controller.local`) |
| `OMADA_CLIENT_ID` | Yes      | -       | OAuth client ID generated under Omada Platform Integration |
| `OMADA_CLIENT_SECRET` | Yes      | -       | OAuth client secret associated with the client ID                           |
| `OMADA_OMADAC_ID` | Yes      | -       | Omada controller ID (omadacId) to target |
| `OMADA_SITE_ID` | No       | -       | Optional default site ID; if omitted, each MCP call must pass a siteId |
| `OMADA_STRICT_SSL` | No       | `true`  | Enforce strict SSL certificate validation (set to `false` for self-signed) |
| `OMADA_TIMEOUT` | No       | `30000` | HTTP request timeout in milliseconds |
#### MCP Generic Server Configuration

| Variable                 | Required | Default | Description                                                                 |
| ------------------------ | -------- | ------- | --------------------------------------------------------------------------- |
| `MCP_SERVER_LOG_LEVEL` | No       | `info`  | Logging verbosity (`debug`, `info`, `warn`, `error`, `silent`) |
| `MCP_SERVER_LOG_FORMAT` | No       | `plain` | Log output format (`plain`, `json`, or `gcp-json`) |
| `MCP_SERVER_USE_HTTP` | No       | `false` | Start HTTP server instead of stdio |
> **Session IDs and authentication:** When `OMADA_CLIENT_ID`, `OMADA_CLIENT_SECRET`, and `OMADA_OMADAC_ID` are provided (the default client-credentials mode), the server runs statelessly and treats the `Mcp-Session-Id` header as optional. A future OAuth-based user authentication mode will require this header again.

#### MCP Server HTTP Configuration

These variables are only used when `MCP_SERVER_USE_HTTP=true`:

| Variable                       | Required | Default                         | Description                                                                 |
| ------------------------------ | -------- | ------------------------------- | --------------------------------------------------------------------------- |
| `MCP_HTTP_PORT` | No       | `3000`                          | Port for the HTTP server |
| `MCP_HTTP_BIND_ADDR` | No       | `127.0.0.1`                     | Bind address (IPv4/IPv6). Use atapter IP address to expose to the network. |
| `MCP_HTTP_PATH` | No       | `/mcp`                          | Base path for MCP endpoints |
| `MCP_HTTP_ENABLE_HEALTHCHECK` | No       | `true`                          | Enable a healthcheck endpoint |
| `MCP_HTTP_HEALTHCHECK_PATH` | No       | `/healthz`                      | Path for the healthcheck endpoint |
| `MCP_HTTP_ALLOW_CORS` | No       | `true`                          | Enable CORS for the HTTP server |
| `MCP_HTTP_ALLOWED_ORIGINS` | No       | `127.0.0.1, localhost`          | Comma-separated list of allowed origins. Use `*` to allow all (dev only) |
| `MCP_HTTP_NGROK_ENABLED` | No       | `false`                         | Use ngrok to expose the HTTP server publicly |
| `MCP_HTTP_NGROK_AUTH_TOKEN` | No       | -                               | Ngrok auth token (required if `MCP_HTTP_NGROK_ENABLED=true`) |
Create a `.env` file (ignored by git) or export the variables before launching the server.

### Development

```bash
npm run dev
```

The dev mode keeps the TypeScript server running with live reload support via `tsx`.

### Building

```bash
npm run build
```

### Linting

```bash
npm run check
```

### Testing

#### Unit tests

```bash
npm test               # run all unit tests
npm run test:watch     # watch mode
npm run test:coverage  # with coverage report
```

Coverage thresholds:

| Level | Metric | Threshold |
|-------|--------|-----------|
| Per-file | Lines, Statements, Functions | 90% |
| Global | Branches | 70% |

#### Integration tests (Docker)

> Not implemented yet — this section documents the **planned** integration test strategy tracked in **#57** and **#58**.

Integration tests will run against a real Omada Software Controller in a Docker container. They are **not** planned to run on every PR — they serve as a milestone release gate and a test harness for write tools.

Planned layout:
- `test/docker/` (compose + snapshot/seed tooling)
- `tests/integration/`
- `npm run test:integration`

> ⚠️ **Phase 2 write tools must only be tested against the Docker controller — never against a production controller.**

### Running the MCP server

```bash
npm start
```

The MCP server communicates over standard input and output. Integrate it with MCP-compatible clients by referencing the `npm start` command and providing the required environment variables.

### Docker image

A container image is provided for running the MCP server:

```bash
npm run docker:build  # Build the Docker image (tag: jmtvms/tplink-omada-mcp:latest)
npm run docker:run    # Launch the container with your .env file
npm run docker:push   # Push the image to Docker Hub
```

You can also pull the pre-built image directly from Docker Hub:

```bash
docker pull jmtvms/tplink-omada-mcp:latest
```

The same image supports both stdio and HTTP transports - configure the desired mode using environment variables (e.g., set `MCP_SERVER_USE_HTTP=true` for HTTP mode).

### Debugging with MCP Inspector

Use the MCP Inspector to interactively test tools, resources, and prompts without leaving your browser. The inspector automatically adapts to your `.env` configuration:

- **`npm run inspector`** — Launches the inspector based on your `.env` settings:
  - If `MCP_SERVER_USE_HTTP=false` (or unset): Runs the server in stdio mode with `tsx src/index.ts` for live reload debugging
  - If `MCP_SERVER_USE_HTTP=true`: Connects to an already-running HTTP server at the configured port/transport (start the server first with `npm run dev`)
  
- **`npm run inspector:build`** — Compiles the project first, then launches the inspector against the production build (`dist/index.js`) to verify release parity. Also adapts to stdio or HTTP mode based on `.env`.

**Requirements:** The inspector requires a `.env` file at the repository root. It will load both `.env` and `.env.local` (if present) to determine the server mode, port, transport, and path.

The MCP Inspector tool automatically binds to localhost and generates a session token for authentication (printed to the console and auto-filled in the browser URL).

### Transport Protocols

The MCP server uses the **Streamable HTTP** transport, which implements the [MCP protocol version 2025-03-26](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#http-with-sse).

```bash
export MCP_SERVER_USE_HTTP=true
npm run dev
```

Features:

- Single endpoint for all operations (GET, POST, DELETE)
- Server-Sent Events for streaming responses
- Built-in session management with cryptographic session IDs (the server currently operates statelessly when using client credentials)

The endpoint defaults to `/mcp` and handles:

- `GET /mcp` - Establish SSE stream and initialize session
- `POST /mcp` - Send JSON-RPC messages
- `DELETE /mcp` - Terminate session

#### Security Considerations

DNS rebinding protection is enabled by default:

- **Origin Validation**: The server validates the `Origin` header on all incoming connections. Configure allowed origins with `MCP_HTTP_ALLOWED_ORIGINS` (default: `127.0.0.1, localhost`). Use `*` to allow all origins (development only, not recommended for production).
- **Network Binding**: The server binds to `127.0.0.1` by default, restricting access to localhost only. Set `MCP_HTTP_BIND_ADDR=0.0.0.0` to expose the server to your network (not recommended for production without additional security measures).

For more information on the MCP protocol and transports, see the [Model Context Protocol documentation](https://modelcontextprotocol.io/).

### HTTP transport usage

Start the HTTP transport with:

```bash
# Start with HTTP enabled
export MCP_SERVER_USE_HTTP=true
npm run dev    # live reload during development
npm run start  # run the compiled output
```

By default, the server listens on `127.0.0.1:3000` and exposes the MCP endpoint at `/mcp` with a health check on `/healthz`. Configure the bind address, port, and path using the optional `MCP_HTTP_*` environment variables documented in `.env.example`. The `npm run docker:run:http` helper wraps the HTTP image and publishes the port automatically.

#### Using ngrok

To share the local server with remote tooling, you can use ngrok to expose the HTTP server publicly.

##### Option 1: Built-in ngrok support (recommended)

Set the following environment variables:

```bash
export MCP_HTTP_NGROK_ENABLED=true
export MCP_HTTP_NGROK_AUTH_TOKEN=your-ngrok-auth-token
npm run dev
```

The server will automatically establish an ngrok tunnel and log the public URL.

##### Option 2: Manual ngrok setup

Run ngrok in a separate terminal after starting the server:

```bash
ngrok http 3000
```

This forwards a public HTTPS URL to `http://localhost:3000` and prints the tunnel address in the console.

In client-credentials mode the server already treats `Mcp-Session-Id` as optional; if the header is removed in transit, requests will still succeed.

## Tools

### Site & Client

| Tool                        | Description                                                                  |
| --------------------------- | ---------------------------------------------------------------------------- |
| `listSites` | Lists all sites configured on the controller. |
| `getSiteCapacity` | Get site capacity settings including maximum device and client counts. |
| `getSiteDetail` | Get detailed information about a site, including name, region, timezone, and configuration. |
| `getSiteDeviceAccount` | Get device account settings for a site. |
| `getSiteNtpStatus` | Get NTP server status and configuration for a site. |
| `getSiteRememberSetting` | Get the remember device setting for a site. |
| `getSiteSpecification` | Get site specification including device limits and feature capabilities. |
| `getSiteUrl` | Get the URL associated with a site for OpenAPI access. |
| `getSiteTemplateConfig` | Get configuration settings for a site template. Requires `siteTemplateId`. |
| `getSiteTemplateDetail` | Get detailed information about a site template. Requires `siteTemplateId`. |
| `getSiteTemplateList` | List all site templates configured on the controller. |
| `listClients` | Lists active client devices for a site. |
| `getClient` | [DEPRECATED] Use `listClients` instead. When you have a client MAC, `getClientDetail` is also available. This tool filters the site client list in-process. |
| `listMostActiveClients` | Gets the most active clients sorted by traffic usage. |
| `listClientsActivity` | Gets client activity statistics over time. |
| `listClientsPastConnections`| Gets past connection history for clients.                                    |
| `setClientRateLimit` | Sets custom bandwidth limits (download/upload) for a specific client. |
| `setClientRateLimitProfile` | Applies a predefined rate limit profile to a specific client.                |
| `disableClientRateLimit` | Disables bandwidth rate limiting for a specific client. |
| `blockClient` _(write)_ | Blocks a client from the network by MAC address. |
| `unblockClient` _(write)_ | Unblocks a previously blocked client. |
| `reconnectClient` _(write)_ | Forces a client to reconnect. |
| `disconnectClient` _(write)_ | Disconnects a client from the network. |
| `rebootClient` _(write)_ | Reboots a managed client device (where supported). |
| `updateClientName` _(write)_ | Sets a friendly display name for a client. |
| `deleteClient` _(write)_ | Deletes a client record from the site. |

### Write / CRUD tools

The following mutating tools require the corresponding category to be enabled with write permission (e.g. `sites:rw`, `clients:w`, `wireless-ssid:rw`, `network-lan:rw`). Free-form fields are passed through a `config` object; use the matching read tools (e.g. `getWlanGroupList`, `getSsidList`, `getLanNetworkList`) to discover ids and the expected payload shape.

| Tool | Category | Description |
| --- | --- | --- |
| `createSite` / `updateSite` / `deleteSite` | `sites` | Create, modify or delete a site. |
| `createWlanGroup` / `updateWlanGroup` / `deleteWlanGroup` | `wireless-ssid` | Manage WLAN groups. |
| `createSsid` / `updateSsid` / `deleteSsid` | `wireless-ssid` | Manage SSIDs within a WLAN group. |
| `createLanNetwork` / `updateLanNetwork` / `deleteLanNetwork` | `network-lan` | Manage LAN networks / VLANs (v2 endpoints). |
| `createPortForwarding` / `updatePortForwarding` / `deletePortForwarding` | `network-nat` | Manage port forwarding (NAT) rules. |
| `createOneToOneNat` / `updateOneToOneNat` / `deleteOneToOneNat` | `network-nat` | Manage One-to-One NAT rules. |
| `createStaticRoute` / `updateStaticRoute` / `deleteStaticRoute` | `network-routing` | Manage static routes. |
| `createPolicyRoute` / `updatePolicyRoute` / `deletePolicyRoute` | `network-routing` | Manage policy routes. |
| `createGatewayAcl` / `updateGatewayAcl` | `firewall-acl` | Manage gateway (OSG) firewall ACL rules. |
| `createSwitchAcl` / `updateSwitchAcl` | `firewall-acl` | Manage switch (OSW) ACL rules. |
| `createEapAcl` / `updateEapAcl` | `firewall-acl` | Manage EAP (AP) ACL rules. |
| `deleteAcl` | `firewall-acl` | Delete any ACL rule (gateway/switch/EAP) by id. |
| `adoptDevice` / `forgetDevice` | `devices-general` | Adopt a pending device / forget a managed device. |
| `rebootDevice` / `locateDevice` / `forceProvisionDevice` | `devices-general` | Reboot, flash the locate LED, or force re-provision a device. |
| `startOnlineUpgradeDevice` / `moveDeviceToSite` | `devices-general` | Start an online firmware upgrade / move a device to another site. |
| `setSwitchPortName` | `devices-switch` | Rename a switch port. |
| `rebootSwitchStack` / `forgetSwitchStack` | `devices-switch` | Reboot or forget a switch stack. |
| `create/update/deleteSiteToSiteVpn`, `…ClientToSiteVpnServer`, `…ClientToSiteVpnClient`, `…Wireguard`, `…WireguardPeer`, `…VpnUser` | `vpn` | Full CRUD for the VPN resources. |
| `create/update/deleteTimeRangeProfile`, `…RateLimitProfile`, `…ServiceType`, `…GroupProfile` | `profiles` | Profiles & IP/URL/App/MAC groups. |
| `create/update/deleteRadiusProfile`, `…RadiusUser`, `…LdapProfile` | `auth-profiles` | RADIUS & LDAP profiles/users. |
| `create/update/deleteUrlFilterRule`, `…QosClassRule`, `…QosBandwidthControl`, `…SessionLimitRule`, `…BandwidthControlRule` | `firewall-traffic` | URL filtering, QoS & rate/session limits. |
| `create/update/deleteUpgradeSchedule`, `…RebootSchedule`, `…PortSchedule`, `…PoeSchedule` | `schedules` | Reboot/PoE/port/upgrade schedules. |
| `create/update/deleteDhcpReservation`, `…LanDns`, `…IpMacBinding` | `network-lan` | DHCP reservations, LAN DNS, IP-MAC bindings. |
| `create/update/deleteDdns`, `…Mdns` | `network-services` | DDNS & mDNS entries. |
| `create/update/deleteMacFilter` | `wireless-auth` | Wireless MAC filter entries. |
| `create/update/deleteUser`, `…Role` | `account-users` | Controller users & roles (global). |
| `create/update/deleteWebhook` | `controller` | Global webhooks. |

### Device

| Tool                    | Description                                                                       |
| ----------------------- | --------------------------------------------------------------------------------- |
| `listDevices` | Lists provisioned devices for a given site. |
| `getDevice` | [DEPRECATED] Use `listDevices` instead and filter results client-side. This tool filters the site device list in-process; there is no dedicated device-detail endpoint. |
| `searchDevices` | Searches for devices globally across all sites the user has access to. |
| `listDevicesStats` | Queries statistics for global adopted devices with pagination and filtering. |
| `getSwitchStackDetail` | Retrieves detailed configuration and status for a switch stack. |
| `getSwitchDetail` | Fetches detailed configuration and status for a specific switch. |
| `getGatewayDetail` | Fetches detailed configuration and status for a specific gateway. |
| `getGatewayWanStatus` | Gets WAN port status for a specific gateway. |
| `getGatewayLanStatus` | Gets LAN port status for a specific gateway. |
| `getGatewayPorts` | Gets port information for a specific gateway. |
| `getApDetail` | Fetches detailed configuration and status for a specific access point. |
| `getApRadios` | Gets radio information for a specific access point. |
| `getStackPorts` | Gets port information for a switch stack. |
| `listPendingDevices` | Lists devices pending adoption in a site. |
| `getAllDeviceBySite` | Gets all devices in a site including offline and disconnected devices. |
| `getFirmwareInfo` | Gets the latest available firmware info for a device. Use `listDevices` for MACs. |
| `getGridAutoCheckUpgrade` | Gets the auto-check firmware upgrade plan list (paginated).                     |
| `listSwitchNetworks` | Lists VLAN network assignments for a switch (paginated). Requires `switchMac`. |
| `getSwitchGeneralConfig` | Gets general configuration for a switch. Requires `switchMac`.                  |
| `getCableTestLogs` | Gets cable test history for a switch. Requires `switchMac`. |
| `getCableTestFullResults` | Gets full per-port cable diagnostics for a switch. Requires `switchMac`.        |
| `getOswStackLagList` | Gets Link Aggregation Group (LAG) list for a switch stack. Requires `stackId`. |
| `getStackNetworkList` | Gets VLAN network list for a switch stack (paginated). Requires `stackId`. |
| `getApUplinkConfig` | Gets uplink configuration for an AP (wired/mesh mode). Requires `apMac`. |
| `getRadiosConfig` | Gets per-radio configuration for an AP (channel, power, width). Requires `apMac`. |
| `getApVlanConfig` | Get VLAN configuration for an access point, including management VLAN and per-SSID VLAN tagging settings. |
| `getMeshStatistics` | Gets mesh link statistics for an AP. Requires `apMac`. |
| `getRFScanResult` | Gets last RF scan results for an AP. Requires `apMac`. |
| `getSpeedTestResults` | Gets last speed test results for an AP. Requires `apMac`. |
| `getApSnmpConfig` | Gets SNMP configuration for an AP. Requires `apMac`. |
| `getApLldpConfig` | Gets LLDP configuration for an AP. Requires `apMac`. |
| `getApGeneralConfig` | Gets general configuration for an AP (name, LED, country). Requires `apMac`. |
| `getUplinkWiredDetail` | Get wired uplink detail for an access point: uplink switch, port number, link speed, and PoE status. |
| `getDownlinkWiredDevices` | Gets wired downlink devices on an AP's LAN ports. Requires `apMac`.            |
| `getFirmwareUpgradePlan` | Get the firmware upgrade plan list for devices managed by the controller. |
| `getUpgradeLogs` | Get firmware upgrade logs showing the history of upgrade operations performed on devices. |
| `getDeviceTagList` | Get the list of device tags defined in a site. |
| `getApQosConfig` | Get QoS configuration for a specific access point. Requires `apMac`. |
| `getApIpv6Config` | Get IPv6 configuration for a specific access point. Requires `apMac`. |
| `getSitesApsIpSetting` | Get IP settings for an AP. Requires `apMac`. |
| `getSitesApsChannelLimit` | Get channel limit configuration for an AP. Requires `apMac`. |
| `getSitesApsAvailableChannel` | Get list of available channels for an AP. Requires `apMac`. |
| `getSitesApsLoadBalance` | Get load balance configuration for an AP. Requires `apMac`. |
| `getSitesApsOfdma` | Get OFDMA configuration for an AP. Requires `apMac`. |
| `getSitesApsPowerSaving` | Get power saving configuration for an AP. Requires `apMac`. |
| `getSitesApsTrunkSetting` | Get trunk port setting for an AP. Requires `apMac`. |
| `getSitesApsBridge` | Get bridge configuration for an AP. Requires `apMac`. |
| `listSitesApsPorts` | List ports for an AP. Requires `apMac`. |
| `getSitesSwitchesEs` | Get ES switch details. Requires `switchMac`. |
| `getSitesSwitchesEsGeneralConfig` | Get ES switch general configuration. Requires `switchMac`. |
| `listSitesCableTestSwitchesPorts` | List cable test port info for a switch. Requires `switchMac`. |
| `listSitesCableTestSwitchesIncrementResults` | Get incremental cable test results for a switch. Requires `switchMac`. |
| `getUpgradeOverviewCritical` | Get the number of critical models available for upgrade. |
| `getUpgradeOverviewTryBeta` | Get the current status of the try-beta firmware upgrade switch. |
| `listUpgradeFirmwares` | List available firmware packages for upgrade (paginated). |
| `listUpgradeOverviewFirmwares` | List firmware overview for upgradeable devices (paginated). |
| `listSitesStacks` | List switch stacks in a site (paginated). |
| `getSitesDeviceWhiteList` | Get the device adoption whitelist for a site (paginated). |
| `getSitesGatewaysGeneralConfig` | Get general configuration for a gateway. Requires `gatewayMac`. |
| `getSitesGatewaysPin` | Get PIN information for a gateway. Requires `gatewayMac`. |
| `getSitesGatewaysSimCardUsed` | Get SIM card usage info for a gateway. Requires `gatewayMac`. |
| `getSitesHealthGatewaysWansDetails` | Get gateway WAN health details. Requires `gatewayMac`. |

### Network

| Tool                          | Description                                                                 |
| ----------------------------- | --------------------------------------------------------------------------- |
| `getInternetInfo` | Gets internet configuration information for a site. |
| `getInternet` | [DEPRECATED] Use `getInternetInfo` instead. Gets full WAN/Internet configuration for the site gateway. |
| `getInternetBasicPortInfo` | Gets WAN port summary/basic info for the site gateway. |
| `getInternetLoadBalance` | Gets WAN load balancing configuration (failover/load balance). |
| `getWanPortsConfig` | Gets per-port WAN configuration including connection type and IP settings. |
| `getWanLanStatus` | Gets WAN-LAN connectivity status for a site. |
| `getGridVirtualWan` | Gets virtual WAN list (paginated). |
| `getIspBandScan` | Gets ISP band scan results for a WAN port. Requires `portUuid`. |
| `getDisableNatList` | Gets the list of wired networks with NAT disabled (paginated). |
| `getLtePortConfig` | Gets LTE/cellular WAN port configuration. |
| `getWanPortDetail` | [DEPRECATED] Use `getWanPortsConfig` instead. Gets detailed WAN port configuration for all gateway WAN ports. |
| `getWanIspProfile` | Gets ISP scan profile result for a WAN port. Requires `portUuid`. |
| `getWanQosConfig` | Gets QoS configuration for gateway WAN ports. |
| `getWanHealthDetail` | [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires `gatewayMac`. |
| `getWanUsageStats` | [DEPRECATED] Use `getDashboardTrafficActivities` instead. Gets WAN traffic usage statistics for the site. |
| `getWanNatConfig` | Gets one-to-one NAT rules (paginated). |
| `getPortForwardingStatus` | Gets port forwarding status and rules. Required: `type` (`user` or `upnp`). Optional pagination: `page` (default 1), `pageSize` (default 10). |
| `getLanNetworkList` | [DEPRECATED] Use `getLanNetworkListV2` instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated. |
| `getLanNetworkListV2` | Get the LAN network list using the v2 API, with richer VLAN and DHCP data (paginated). |
| `getInterfaceLanNetwork` | Gets interface-level LAN network bindings. Optional type filter (0=WAN, 1=LAN). |
| `getInterfaceLanNetworkV2` | Get interface-level LAN network bindings (v2 API). Returns richer per-interface VLAN and network data. |
| `getLanProfileList` | Gets the list of LAN profiles configured in a site. |
| `getApLoadBalance` | [DEPRECATED] Use `getSitesApsLoadBalance` instead. Same endpoint, retained for backward compatibility. getSitesApsLoadBalance is the canonical tool name. |
| `getApOfdmaConfig` | [DEPRECATED] Use `getSitesApsOfdma` instead. Same endpoint, retained for backward compatibility. getSitesApsOfdma is the canonical tool name. |
| `getMulticastRateLimit` | Get multicast rate limit settings for a site. |
| `getWlanGroupList` | Gets the list of WLAN groups configured in a site. |
| `getSsidList` | Gets the list of SSIDs in a WLAN group. |
| `getSsidDetail` | Gets detailed information for a specific SSID. Required: `wlanId` and `ssidId`. |
| `listAllSsids` | Lists wireless SSIDs across all WLAN groups. |
| `getFirewallSetting` | Gets firewall configuration and rules for a site. |
| `getVpnSettings` | Gets VPN settings for a site. |
| `listSiteToSiteVpns` | Lists site-to-site VPN configurations. |
| `listPortForwardingRules` | [DEPRECATED] Use `getPortForwardingList` instead. Lists NAT port forwarding rules. |
| `listOsgAcls` | Lists gateway (OSG) ACL rules. |
| `listEapAcls` | Lists access point (EAP) ACL rules. |
| `listStaticRoutes` | [DEPRECATED] Use `getGridStaticRouting` instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page. |
| `getStaticRoutingInterfaceList` | Gets available interfaces for static routing.                             |
| `listPolicyRoutes` | [DEPRECATED] Use `getGridPolicyRouting` instead. This tool aggregates all pages; getGridPolicyRouting is paginated. |
| `getGridPolicyRouting` | Gets policy routing rules (paginated). |
| `getOspfProcess` | Gets OSPF process configuration for the site gateway. |
| `getOspfInterface` | Gets OSPF interface configuration for the site gateway. |
| `getVrrpConfig` | Gets VRRP configuration for OSW devices. |
| `getOspfNeighbors` | Gets OSPF neighbor devices for the site gateway. |
| `getGridOtoNats` | Gets 1:1 NAT rules (paginated). |
| `getAlg` | Gets ALG (Application Layer Gateway) configuration. |
| `getUpnpSetting` | Gets UPnP setting for the site gateway. |
| `getDdnsGrid` | Gets DDNS entries (paginated). |
| `getDhcpReservationGrid` | Gets DHCP reservations (paginated). |
| `getGridIpMacBinding` | Gets IP-MAC binding entries (paginated). |
| `getIpMacBindingGeneralSetting` | Gets IP-MAC binding global toggle setting.                               |
| `getBandwidthControl` | Gets global bandwidth control configuration. |
| `getGridBandwidthCtrlRule` | Gets bandwidth control rules (paginated). |
| `getSessionLimit` | Gets session limit global setting. |
| `getGridSessionLimitRule` | Gets per-rule session limit rules (paginated). |
| `getSnmpSetting` | Gets SNMP configuration (version, community string). |
| `getLldpSetting` | Gets LLDP global setting. |
| `getRemoteLoggingSetting` | Gets remote logging (syslog) configuration. |
| `getDnsCacheDataList` | Gets the DNS cache data list (paginated). |
| `getIptvSetting` | Gets IPTV service configuration for the site. |
| `getNtpSetting` | Gets NTP server configuration and synchronisation status. |
| `getSyslogConfig` | Deprecated; alias of `getRemoteLoggingSetting` for controller syslog configuration. |
| `getAccessControl` | Gets controller access control configuration. |
| `getDnsCacheSetting` | Gets DNS cache setting. |
| `getDnsProxy` | Gets DNS proxy configuration. |
| `getIgmp` | Gets IGMP snooping and proxy setting. |
| `getSwitchVlanInterface` | Gets VLAN interface configuration for a specific switch. Requires `switchMac`. |
| `getLanDnsRules` | Gets LAN DNS rules for the site (paginated). |
| `getLanProfileEsUsage` | Gets EAP/switch device usage for a LAN profile. Requires `profileId`. |
| `getLanClientCount` | Gets client distribution breakdown across LAN segments. |
| `listRadiusProfiles` | Lists RADIUS authentication profiles. |
| `listGroupProfiles` | Lists group profiles (IP, MAC, or port groups). |
| `getApplicationControlStatus` | Gets application control status for a site.                                 |
| `getSshSetting` | Gets SSH settings for a site. |
| `listTimeRangeProfiles` | Lists time range profiles. |
| `getRateLimitProfiles` | Gets the list of available rate limit profiles for bandwidth control. |
### Firewall & ACL

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getDot1xConfig` | Get 802.1X switch port authentication setting. Alias for `getSwitchDot1xSetting`. |
| `getRadiusProxyConfig` | Get global RADIUS proxy configuration (controller-level, no siteId). |
| `getApplicationAcl` | [DEPRECATED] Get application control rules. Alias for `getAppControlRules`. |
### Firewall Traffic & QoS

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getGatewayQosClassRules` | Get gateway QoS class rules (paginated). |
| `getBandwidthCtrlDetail` | Get bandwidth control details for a site. |
| `getAppControlRules` | Get application control rules (paginated). |
| `getAppControlCategories` | Get application control category list. |
| `getUrlFilterRules` | Get URL filter gateway rules. Alias for `getGridGatewayRule`. |
| `getUrlFilterBlacklist` | Get URL filter MAC deny list. Alias for `getGridDenyMacFiltering`. |
| `getUrlFilterWhitelist` | Get URL filter MAC allow list. Alias for `getGridAllowMacFiltering`. |
| `getMacFilterDetail` | Get MAC filter general setting. Alias for `getMacFilteringGeneralSetting`. |
| `getQosPolicy` | Get QoS policy configuration for a site. |
| `getTrafficPriority` | Get traffic priority rules for a site. |
| `getTrafficStats` | [DEPRECATED] Use `getDashboardTrafficActivities` instead. Get WAN usage statistics. Alias for `getWanUsageStats`. |
| `getQosPolicyRule` | [DEPRECATED] Alias for `getQosPolicy`. |
| `getQosMarkingRule` | [DEPRECATED] Alias for `getQosPolicy`. |
| `getDscpConfig` | [DEPRECATED] Alias for `getQosPolicy`. |
### Firewall IDS / IPS

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getGlobalSecuritySetting` | [DEPRECATED] Use `getThreatList` instead. Get global security/threat management list. Alias for `getThreatList`. |
### Security & Threat Management

| Tool              | Description                                               |
| ----------------- | --------------------------------------------------------- |
| `getThreatList` | Gets global threat management list. Required: `archived` (bool). Optional: `startTime`/`endTime` (seconds since epoch), `severity` (0=Critical, 1=Major, 2=Moderate/Concerning, 3=Minor, 4=Low), `page`, `pageSize`. |
| `getTopThreats` | Gets top threats from the global threat management view. |
### Dashboard / Monitor

| Tool                         | Description                                                     |
| ---------------------------- | --------------------------------------------------------------- |
| `getDashboardWifiSummary` | Gets WiFi summary from the site dashboard. |
| `getDashboardSwitchSummary` | Gets switch summary from the site dashboard. |
| `getDashboardTrafficActivities` | Gets traffic activity data from the site dashboard.          |
| `getDashboardPoEUsage` | Gets PoE usage data from the site dashboard. |
| `getDashboardTopCpuUsage` | Gets top CPU usage data from the site dashboard. |
| `getDashboardTopMemoryUsage` | Gets top memory usage data from the site dashboard.             |
| `getDashboardMostActiveSwitches` | Gets most active switches from the site dashboard.          |
| `getDashboardMostActiveEaps` | Gets most active access points from the site dashboard.         |
| `getDashboardOverview` | Get the site overview: device counts, client counts, connectivity graph, and overall health status. |
| `getTrafficDistribution` | Gets traffic distribution by protocol/app type over a time range. Requires `start` and `end` timestamps (seconds). |
| `getRetryAndDroppedRate` | Gets wireless retry rate and dropped packet rate over a time range. Requires `start` and `end` timestamps (seconds). |
| `getIspLoad` | Gets per-WAN ISP link load over a time range. Requires `start` and `end` timestamps (seconds). |
| `getChannels` | Gets channel distribution and utilization across all APs. |
| `getInterference` | Gets top RF interference sources detected by APs. |
| `getGridDashboardTunnelStats` | Gets VPN tunnel statistics. Required: `type` (0 = Server, 1 = Client). |
| `getGridDashboardIpsecTunnelStats` | Gets IPsec tunnel statistics.                            |
| `getGridDashboardOpenVpnTunnelStats` | Gets OpenVPN tunnel statistics by type. Requires `type` parameter. |

### Insight

| Tool                      | Description                                                        |
| ------------------------- | ------------------------------------------------------------------ |
| `listSiteThreatManagement`| Lists site-level threat management events.                         |
| `getWids` | Gets WIDS (Wireless Intrusion Detection) information for a site. |
| `getRogueAps` | Gets rogue access points detected in a site. |
| `getVpnTunnelStats` | Gets VPN tunnel statistics for a site. |
### VPN

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getIpsecTunnelList` | List all site-to-site VPN (IPsec) tunnels. Alias for `listSiteToSiteVpns`. |
| `getIpsecTunnelDetail` | Get detailed config for a specific IPsec tunnel by ID. Alias for `getSiteToSiteVpnInfo`. |
| `getAdvancedVpnSetting` | Get advanced VPN configuration settings for a site. Alias for `getVpnSettings`. |
| `getVpnUserList` | Get VPN users for a site (paginated). |
| `getVpnUserDetail` | Get users for a specific client-to-site VPN server. |
| `getVpnClientStatus` | Get status of client-to-site VPN clients. Alias for `listClientToSiteVpnClients`. |
| `getVpnRouteConfig` | [DEPRECATED] Use `getGridPolicyRouting` instead. This tool aggregates all pages; getGridPolicyRouting is paginated. |
### Profiles

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getGoogleLdapProfile` | Get Google LDAP profile configuration for a site. |
| `getBuiltinRadiusUsers` | Get built-in RADIUS server user list (paginated). |
| `getRadiusUserDetail` | [DEPRECATED] Alias for `getBuiltinRadiusUsers`. |
| `getPpskNetworkProfile` | List PPSK network profiles for a site by type. |
| `getPpskUserGroup` | Get PPSK user group details for a specific profile. |
| `getPpskUserList` | [DEPRECATED] Alias for `getPpskUserGroup`. |
| `getServiceProfile` | Get service type profiles (paginated). Alias for `listServiceType`. |
| `getQosProfile` | Get rate limit profiles. Alias for `getRateLimitProfiles`. |
| `getScheduleProfile` | Get time range profiles. Alias for `listTimeRangeProfiles`. |
| `getGroupPolicyDetail` | Get group policy profiles filtered by group type. |
| `getIpGroupProfile` | [DEPRECATED] Get IP group profiles. Alias for `getGroupPolicyDetail` with groupType="0". |
| `getUrlGroupProfile` | [DEPRECATED] Get URL/port group profiles. Alias for `getGroupPolicyDetail` with groupType="1". |
| `getAppGroupProfile` | [DEPRECATED] Get MAC group profiles. Alias for `getGroupPolicyDetail` with groupType="2". |
| `getVlanProfile` | Get LAN/VLAN profiles. Alias for `getLanProfileList`. |
| `getUserRoleProfile` | Get user role profiles from the controller (global, no siteId). |
| `getPortalProfile` | Get captive portal profiles for a site. |
### Logs

| Tool                  | Description                                                  |
| --------------------- | ------------------------------------------------------------ |
| `listSiteEvents` | Lists site event logs. |
| `listSiteAlerts` | Lists site alert logs. |
| `listSiteAuditLogs` | Lists site audit logs. |
| `listGlobalEvents` | Lists global event logs across all sites. |
| `listGlobalAlerts` | Lists global alert logs across all sites. |
### Controller

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getCertificate` | Get SSL/TLS certificate configuration for the controller. |
| `getClientHistoryDataEnable` | Get the client history data collection enable setting. |
| `getControllerPort` | Get the controller port configuration for device adoption. |
| `getDataRetention` | Get data retention settings for the controller. |
| `getExperienceImprovement` | Get the experience improvement program setting (telemetry). |
| `getGlobalDashboardOverview` | Get global controller dashboard overview without client data. |
| `getPortalPort` | Get portal port configuration for the controller web interface. |
### Maintenance

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getBackupFileList` | List available controller backup files. |
| `getBackupResult` | Get the result of the most recent controller backup operation. |
| `getRestoreResult` | Get the result of the most recent controller restore operation. |
| `getSiteBackupFileList` | List available backup files for a site. |
| `getSiteBackupResult` | Get the backup result for a site. |
### Account Users

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getAllCloudUsers` | List all cloud users on the controller, excluding the root account. |
| `getAllLocalUsers` | List all local users on the controller, excluding the root account. |
| `getAllRoles` | [DEPRECATED] Use `getUserRoleProfile` instead. List all user roles configured on the controller. |
| `getAllUsersApp` | List all users (cloud and local) in grid view. |
| `getAvailableRoles` | List roles available for user assignment. |
| `getRoleDetail` | Get detailed information about a specific role. Requires `roleId`. |
### Account Cloud

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getCloudAccessStatus` | Get cloud access status for the controller. |
| `getCloudUserInfo` | Get cloud user account information. |
| `getMfaStatus` | Get global MFA (multi-factor authentication) status. |
| `getRemoteBindingStatus` | Get remote binding status between controller and cloud. |
### Schedules

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getPoeScheduleList` | List PoE schedules for a site. |
| `getPortScheduleList` | List port schedules for a site. |
| `getPortSchedulePorts` | List ports with port schedule assignments for a site. |
| `getRebootScheduleList` | List device reboot schedules for a site template. Requires `siteTemplateId`. |
| `getUpgradeScheduleList` | List firmware upgrade schedules for a site. |
## Supported Omada API Operations

| Operation ID                        | Description                                               | Tool                          |
| ----------------------------------- | --------------------------------------------------------- | ----------------------------- |
| `getSiteList` | List controller sites.                                    | `listSites` |
| `getDeviceList` | List devices assigned to a site.                          | `listDevices`, ~~`getDevice`~~ [DEPRECATED] |
| `searchGlobalDevice` | Search for devices across all accessible sites.           | `searchDevices` |
| `getGridAdoptedDevicesStatByGlobal` | Query statistics for global adopted devices.              | `listDevicesStats`            |
| `getOswStackDetail` | Retrieve details for a switch stack.                      | `getSwitchStackDetail` |
| `getSwitch` | Get detailed info for a specific switch.                  | `getSwitchDetail` |
| `getGateway` | Get detailed info for a specific gateway.                 | `getGatewayDetail` |
| `getGatewayWanPortStatus` | Get WAN port status for a specific gateway.               | `getGatewayWanStatus` |
| `getGatewayLanPortStatus` | Get LAN port status for a specific gateway.               | `getGatewayLanStatus` |
| `getGatewayPorts` | Get port info for a specific gateway.                     | `getGatewayPorts` |
| `getAp` | Get detailed info for a specific access point.            | `getApDetail` |
| `getApRadios` | Get radio info for a specific access point.               | `getApRadios` |
| `getStackPorts` | Get port info for a switch stack.                         | `getStackPorts` |
| `getGridPendingDevices` | List devices pending adoption in a site.                  | `listPendingDevices` |
| `getGridActiveClients` | List active clients connected to a site.                  | `listClients`, ~~`getClient`~~ [DEPRECATED] |
| `getMostActiveClients` | Get most active clients sorted by traffic.                | `listMostActiveClients` |
| `getClientActivity` | Get client activity statistics over time.                 | `listClientsActivity` |
| `getGridPastConnections` | Get client past connection history.                       | `listClientsPastConnections` |
| `updateClientRateLimitSetting` | Set rate limit setting for a client.                      | `setClientRateLimit`, `setClientRateLimitProfile`, `disableClientRateLimit` |
| `getRateLimitProfileList` | Get rate limit profile list.                              | `getRateLimitProfiles` |
| `getGlobalThreatList` | Get global view threat management list.                   | `getThreatList` |
| `getTopThreatList` | Get top threats from global threat management.            | `getTopThreats` |
| `getInternet` | [DEPRECATED] Use `getInternetInfo` instead. Get internet configuration info for a site.               | `getInternetInfo` |
| `getPortForwardStatus` | Get port forwarding status by type.                       | `getPortForwardingStatus` |
| `getLanProfileList` | Get LAN profile list.                                     | `getLanProfileList` |
| `getWlanGroupList` | Get WLAN group list.                                      | `getWlanGroupList` |
| `getSsidList` | Get SSID list for a WLAN group.                           | `getSsidList` |
| `getSsidDetail` | Get detailed SSID configuration.                          | `getSsidDetail` |
| `getSsidListAll` | List SSIDs across all WLAN groups.                        | `listAllSsids` |
| `getFirewallSetting` | Get firewall configuration for a site.                    | `getFirewallSetting` |
| `getVpn` | Get VPN settings for a site.                              | `getVpnSettings` |
| `getSiteToSiteVpnList` | List site-to-site VPN configurations.                     | `listSiteToSiteVpns` |
| `getPortForwardingList` | List NAT port forwarding rules.                           | `getPortForwardingList` (prefer); ~~`listPortForwardingRules`~~ [DEPRECATED] |
| `getOsgAclList` | List gateway ACL rules.                                   | `listOsgAcls` |
| `getEapAclList` | List access point ACL rules.                              | `listEapAcls` |
| `getStaticRoutingList` | List static routing rules.                                | `getGridStaticRouting` (prefer); ~~`listStaticRoutes`~~ [DEPRECATED] |
| `getRadiusProfileList` | List RADIUS authentication profiles.                      | `listRadiusProfiles` |
| `getGroupProfileList` | List group profiles (IP, MAC, port groups).               | `listGroupProfiles` |
| `getApplicationControlStatus` | Get application control status for a site.                | `getApplicationControlStatus` |
| `getSshSetting` | Get SSH settings for a site.                              | `getSshSetting` |
| `getTimeRangeProfileList` | List time range profiles.                                 | `listTimeRangeProfiles` |
| `getWanLanStatus` | Get WAN-LAN connectivity status for a site.               | `getWanLanStatus` |
| `getSiteThreatManagementList` | List site-level threat management events.                 | `listSiteThreatManagement` |
| `getWids` | Get WIDS information for a site.                          | `getWids` |
| `getRogueAps` | Get rogue access points detected in a site.               | `getRogueAps` |
| `getVpnTunnelStats` | Get VPN tunnel statistics for a site.                     | `getVpnTunnelStats` |
| `getSiteEvents` | List site event logs.                                     | `listSiteEvents` |
| `getSiteAlerts` | List site alert logs.                                     | `listSiteAlerts` |
| `getSiteAuditLogs` | List site audit logs.                                     | `listSiteAuditLogs` |
| `getEvents` | List global event logs across all sites.                  | `listGlobalEvents` |
| `getAlerts` | List global alert logs across all sites.                  | `listGlobalAlerts` |
| `disableClientRateLimit` | Disable rate limiting for a specific client, removing any bandwidth.... | `disableClientRateLimit` |
| `getAccessControl` | Get controller access control configuration. | `getAccessControl` |
| `getAlg` | Get ALG (Application Layer Gateway) configuration for the site gateway. | `getAlg` |
| `getAllDeviceBySite` | Get all devices in a site including offline and disconnected devices. | `getAllDeviceBySite` |
| `getApDetail` | Fetch full configuration and status for a specific access point: mo.... | `getApDetail` |
| `getApGeneralConfig` | Get general configuration for an access point. | `getApGeneralConfig` |
| `getApLldpConfig` | Get LLDP (Link Layer Discovery Protocol) configuration for an acces.... | `getApLldpConfig` |
| `getApRadios` | Get radio status for a specific access point: 2.4GHz and 5GHz band .... | `getApRadios` |
| `getApSnmpConfig` | Get SNMP configuration for an access point. | `getApSnmpConfig` |
| `getApUplinkConfig` | Get the uplink configuration for an access point. | `getApUplinkConfig` |
| `getBandwidthControl` | Get the global bandwidth control configuration for the site. | `getBandwidthControl` |
| `getCableTestLogs` | Get cable test logs for a switch. | `getCableTestLogs` |
| `getChannels` | Get channel distribution and utilization across all APs. | `getChannels` |
| `getClient` | [DEPRECATED] Use `listClients` instead. When you have a client MAC, `getClientDetail` is also available. This tool filters the site client list in-process. | `getClient` |
| `getDashboardPoEUsage` | Get PoE (Power over Ethernet) usage statistics for a site, showing .... | `getDashboardPoEUsage` |
| `getDashboardSwitchSummary` | Get switch summary for a site dashboard: total switch count, total .... | `getDashboardSwitchSummary` |
| `getDashboardTopCpuUsage` | Get the top devices by CPU usage for a site, useful for identifying.... | `getDashboardTopCpuUsage` |
| `getDashboardWifiSummary` | Get WiFi summary for a site dashboard: total APs, connected AP coun.... | `getDashboardWifiSummary` |
| `getDdnsGrid` | Get DDNS (Dynamic DNS) entries for the site gateway. | `getDdnsGrid` |
| `getDevice` | [DEPRECATED] Use `listDevices` instead. This alias filters the device list in-process to return a single device; there is no separate device-detail API. | `getDevice` |
| `getDhcpReservationGrid` | Get DHCP reservations for the site. | `getDhcpReservationGrid` |
| `getDnsCacheSetting` | Get DNS cache setting for the site gateway. | `getDnsCacheSetting` |
| `getDnsProxy` | Get DNS proxy configuration for the site gateway. | `getDnsProxy` |
| `getFirewallSetting` | Get firewall configuration and rules for a site, including ACL rule.... | `getFirewallSetting` |
| `getFirmwareInfo` | Get the latest available firmware information for a device. | `getFirmwareInfo` |
| `getGatewayDetail` | Fetch full configuration and status for a specific gateway: model, .... | `getGatewayDetail` |
| `getGatewayLanStatus` | Get LAN port status for a specific gateway: port link state, speed,.... | `getGatewayLanStatus` |
| `getGatewayPorts` | Get all WAN and LAN port details for a specific gateway: link statu.... | `getGatewayPorts` |
| `getGatewayWanStatus` | Get the WAN port status and connectivity information for a specific.... | `getGatewayWanStatus` |
| `getGridBandwidthCtrlRule` | Get bandwidth control rules for the site gateway. | `getGridBandwidthCtrlRule` |
| `getGridIpMacBinding` | Get IP-MAC binding entries for the site. | `getGridIpMacBinding` |
| `getGridOtoNats` | Get 1:1 NAT rules for the site gateway. | `getGridOtoNats` |
| `getGridPolicyRouting` | Get policy routing rules for the site gateway. | `getGridPolicyRouting` |
| `getGridSessionLimitRule` | Get per-rule session limit rules for the site gateway. | `getGridSessionLimitRule` |
| `getGridVirtualWan` | Get virtual WAN list for the site gateway. | `getGridVirtualWan` |
| `getIgmp` | Get IGMP (Internet Group Management Protocol) setting for the site. | `getIgmp` |
| `getInterfaceLanNetwork` | Get interface-level LAN network bindings. | `getInterfaceLanNetwork` |
| `getInterference` | Get top RF interference sources detected by APs. | `getInterference` |
| `getInternet` | [DEPRECATED] Use `getInternetInfo` instead. Get full WAN/Internet configuration for the site gateway. | `getInternet` |
| `getInternetBasicPortInfo` | Get WAN port summary / basic info for the site gateway. | `getInternetBasicPortInfo` |
| `getInternetInfo` | Get internet configuration information for a site, including WAN se.... | `getInternetInfo` |
| `getInternetLoadBalance` | Get WAN load balancing configuration for the site gateway. | `getInternetLoadBalance` |
| `getIspBandScan` | Get ISP band scan results for a WAN port. Requires `portUuid`. | `getIspBandScan` |
| `getIspLoad` | Get per-WAN ISP link load over a time range. | `getIspLoad` |
| `getLanClientCount` | Get client distribution breakdown across LAN segments (wired, wireless, guest). | `getLanClientCount` |
| `getLanDnsRules` | Get LAN DNS rules configured for the site (paginated). | `getLanDnsRules` |
| `getLanNetworkList` | [DEPRECATED] Use `getLanNetworkListV2` instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated. | `getLanNetworkList` |
| `getLanProfileEsUsage` | Get EAP/switch device usage for a specific LAN profile. Requires `profileId`. | `getLanProfileEsUsage` |
| `getLanProfileList` | Get the list of LAN profiles configured in a site. | `getLanProfileList` |
| `getLtePortConfig` | Get LTE/cellular WAN port configuration for the site gateway. | `getLtePortConfig` |
| `getLldpSetting` | Get LLDP (Link Layer Discovery Protocol) global setting for the site. | `getLldpSetting` |
| `getMeshStatistics` | Get mesh link statistics for an access point. | `getMeshStatistics` |
| `getOswStackLagList` | Get Link Aggregation Group (LAG) list for a switch stack. | `getOswStackLagList` |
| `getPortForwardingList` | Get a paginated page of NAT port forwarding rules for the site gateway. | `getPortForwardingListPage` |
| `getPortForwardingStatus` | Get port forwarding status and rules for a site. | `getPortForwardingStatus` |
| `getRFScanResult` | [DEPRECATED] Get the last RF scan results for an access point. | `getRFScanResult` |
| `getRadiosConfig` | Get per-radio configuration for an access point. | `getRadiosConfig` |
| `getRateLimitProfiles` | Get the list of available rate limit profiles for a site. | `getRateLimitProfiles` |
| `getRemoteLoggingSetting` | Get remote logging (syslog) configuration for the site. | `getRemoteLoggingSetting` |
| `getDnsCacheDataList` | Get the DNS cache data list for the site (paginated). | `getDnsCacheDataList` |
| `getDisableNatList` | Get the list of wired networks with NAT disabled (paginated). | `getDisableNatList` |
| `getIptvSetting` | Get IPTV service configuration for the site. | `getIptvSetting` |
| `getNtpSetting` | Get NTP server configuration and synchronisation status for the site. | `getNtpSetting` |
| `getOspfInterface` | Get OSPF interface configuration for the site gateway. | `getOspfInterface` |
| `getOspfNeighbors` | Get OSPF neighbor devices for the site gateway. | `getOspfNeighbors` |
| `getOspfProcess` | Get OSPF process configuration for the site gateway. | `getOspfProcess` |
| `getSwitchVlanInterface` | Get VLAN interface configuration for a specific switch. Requires `switchMac`. | `getSwitchVlanInterface` |
| `getSyslogConfig` | [DEPRECATED] Alias of `getRemoteLogging` for controller syslog configuration. | `getSyslogConfig` |
| `getVrrpConfig` | Get VRRP configuration for OSW devices on the site. | `getVrrpConfig` |
| `getWanHealthDetail` | [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires `gatewayMac`. | `getWanHealthDetail` |
| `getWanIspProfile` | Get ISP scan profile result for a WAN port. Requires `portUuid`. | `getWanIspProfile` |
| `getWanNatConfig` | Get one-to-one NAT configuration (WAN NAT rules) for the site gateway (paginated). | `getWanNatConfig` |
| `getWanPortDetail` | [DEPRECATED] Use `getWanPortsConfig` instead. Get detailed WAN port configuration for all gateway WAN ports on the site. | `getWanPortDetail` |
| `getWanQosConfig` | Get QoS configuration for gateway WAN ports on the site. | `getWanQosConfig` |
| `getWanUsageStats` | [DEPRECATED] Use `getDashboardTrafficActivities` instead. Get WAN traffic usage statistics and activity data for the site. | `getWanUsageStats` |
| `getRetryAndDroppedRate` | Get wireless retry rate and dropped packet rate over a time range. | `getRetryAndDroppedRate` |
| `getRogueAps` | Get the list of rogue (unauthorized) access points detected by WIDS.... | `getRogueAps` |
| `getSessionLimit` | Get the session limit global setting for the site gateway. | `getSessionLimit` |
| `getSnmpSetting` | Get SNMP configuration for the site. | `getSnmpSetting` |
| `getSpeedTestResults` | Get the last speed test results for an access point. | `getSpeedTestResults` |
| `getSshSetting` | Get SSH access settings for a site. | `getSshSetting` |
| `getSsidDetail` | Get detailed information for a specific SSID (wireless network), in.... | `getSsidDetail` |
| `getSsidList` | Get the list of SSIDs (wireless networks) configured in a WLAN group. | `getSsidList` |
| `getStackNetworkList` | Get the VLAN network list for a switch stack. | `getStackNetworkList` |
| `getStackPorts` | Get all port information for a switch stack. | `getStackPorts` |
| `getSwitchDetail` | Fetch full configuration and status for a specific switch: model, f.... | `getSwitchDetail` |
| `getSwitchStackDetail` | Fetch detailed information for a specific switch stack. | `getSwitchStackDetail` |
| `getThreatList` | Get the global view threat management list. | `getThreatList` |
| `getTopThreats` | Get the top threats from the global threat management view across a.... | `getTopThreats` |
| `getTrafficDistribution` | Get traffic distribution by protocol and application type over a ti.... | `getTrafficDistribution` |
| `getUpnpSetting` | Get UPnP (Universal Plug and Play) setting for the site. | `getUpnpSetting` |
| `getVpnSettings` | Get VPN configuration settings for a site. | `getVpnSettings` |
| `getVpnTunnelStats` | Get VPN tunnel statistics for a site (paginated), including active .... | `getVpnTunnelStats` |
| `getWanLanStatus` | Get the WAN and LAN connectivity status for a site. | `getWanLanStatus` |
| `getWanPortsConfig` | Get WAN port settings for the site gateway. | `getWanPortsConfig` |
| `getWids` | Get Wireless Intrusion Detection System (WIDS) information for a si.... | `getWids` |
| `getWlanGroupList` | Get the list of WLAN groups configured in a site. | `getWlanGroupList` |
| `listAllSsids` | List all wireless SSIDs across all WLAN groups in a site: SSID name.... | `listAllSsids` |
| `listClients` | List all network clients (wired and wireless) connected to a site. | `listClients` |
| `listClientsActivity` | Get client activity statistics over time from the dashboard. | `listClientsActivity` |
| `listClientsPastConnections` | Get client past connection list with historical connection data. | `listClientsPastConnections` |
| `listDevices` | List all provisioned (adopted) network devices in a site: gateways,.... | `listDevices` |
| `listEapAcls` | List EAP (access point) ACL rules for a site: wireless client acces.... | `listEapAcls` |
| `listGlobalAlerts` | List alert logs across all sites on the controller: threshold breac.... | `listGlobalAlerts` |
| `listGlobalEvents` | List system event logs across all sites on the controller. | `listGlobalEvents` |
| `listGroupProfiles` | List group profiles (IP groups, MAC groups, port groups) configured.... | `listGroupProfiles` |
| `listMostActiveClients` | Get the most active clients in a site, sorted by total traffic. | `listMostActiveClients` |
| `listOsgAcls` | List gateway (OSG) ACL rules for a site: firewall rules controlling.... | `listOsgAcls` |
| `listPendingDevices` | List devices discovered on the network but not yet adopted into thi.... | `listPendingDevices` |
| `listPolicyRoutes` | [DEPRECATED] Use `getGridPolicyRouting` instead. This tool aggregates all pages; getGridPolicyRouting is paginated. | `listPolicyRoutes` |
| `listPortForwardingRules` | [DEPRECATED] Use `getPortForwardingList` instead. List all NAT port forwarding rules for a site: external port, inter.... | `listPortForwardingRules` |
| `listRadiusProfiles` | List RADIUS authentication profiles configured for a site: server I.... | `listRadiusProfiles` |
| `listSiteAlerts` | List alert logs for a site: threshold breaches, device failures, se.... | `listSiteAlerts` |
| `listSiteAuditLogs` | List admin audit logs for a site: who made what configuration chang.... | `listSiteAuditLogs` |
| `listSiteEvents` | List system event logs for a site: device online/offline, client co.... | `listSiteEvents` |
| `listSiteThreatManagement` | List site-level threat management events detected by IPS, with opti.... | `listSiteThreatManagement` |
| `listSiteToSiteVpns` | List site-to-site VPN configurations: tunnel name, remote IP, statu.... | `listSiteToSiteVpns` |
| `listSites` | List all sites configured on the Omada controller. | `listSites` |
| `listStaticRoutes` | [DEPRECATED] Use `getGridStaticRouting` instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page. | `listStaticRoutes` |
| `listSwitchNetworks` | List VLAN network assignments for a switch. | `listSwitchNetworks` |
| `listTimeRangeProfiles` | List time range profiles configured for a site. | `listTimeRangeProfiles` |
| `searchDevices` | Search for devices globally across all sites the user has access to. | `searchDevices` |
| `setClientRateLimit` | Set custom rate limit (bandwidth control) for a specific client. | `setClientRateLimit` |
| `getAclConfigTypeSetting` | Get the ACL configuration type setting for the site gateway (L2 or .... | `getAclConfigTypeSetting` |
| `getAttackDefenseSetting` | Get the DDoS and attack defense configuration, including flood prot.... | `getAttackDefenseSetting` |
| `getAuditLogSettingForGlobal` | Get global audit log notification settings for the controller. | `getAuditLogSettingForGlobal` |
| `getAuditLogSettingForSite` | Get site-level audit log notification settings, including audit eve.... | `getAuditLogSettingForSite` |
| `getAuditLogsForGlobal` | Get global audit logs (paginated). | `getAuditLogsForGlobal` |
| `getBandSteeringSetting` | Get the band steering configuration. | `getBandSteeringSetting` |
| `getBandwidthCtrl` | [DEPRECATED] Use `getBandwidthControl` instead. Get the global bandwidth control configuration for the site. | `getBandwidthControl` |
| `getBeaconControlSetting` | Get the beacon control setting, which manages 802.11 beacon transmi.... | `getBeaconControlSetting` |
| `getChannelLimitSetting` | [DEPRECATED] Get the channel limit setting that restricts which cha.... | `getChannelLimitSetting` |
| `getClientActiveTimeout` | Get the client inactivity timeout setting. | `getClientActiveTimeout` |
| `getClientDetail` | Get full detail for a specific client by MAC address, including con.... | `getClientDetail` |
| `getClientToSiteVpnServerInfo` | Get detailed configuration for a specific client-to-site VPN server.... | `getClientToSiteVpnServerInfo` |
| `getClientsDistribution` | Get client count distribution by connection type and band (wired, 2.... | `getClientsDistribution` |
| `getControllerStatus` | Get the Omada controller health and status, including running state.... | `getControllerStatus` |
| `getDeviceAccessManagement` | Get the device access management settings, controlling which device.... | `getDeviceAccessManagement` |
| `getEapDot1xSetting` | Get the 802.1X EAP setting for access points, controlling port-base.... | `—` |
| `getGeneralSettings` | Get the global general settings for the Omada controller, including.... | `getGeneralSettings` |
| `getGridAllowList` | Get the IPS allow list (paginated). | `getGridAllowList` |
| `getGridAllowMacFiltering` | Get the MAC address allow-list entries (paginated). | `getGridAllowMacFiltering` |
| `getGridBlockList` | Get the IPS block list (paginated). | `getGridBlockList` |
| `getGridClientHistory` | Get per-client connection history (paginated). | `getGridClientHistory` |
| `getGridDenyMacFiltering` | Get the MAC address deny-list entries (paginated). | `getGridDenyMacFiltering` |
| `getGridEapRule` | Get the URL filter AP rules (paginated). | `getGridEapRule` |
| `getGridGatewayRule` | Get the URL filter gateway rules (paginated). | `getGridGatewayRule` |
| `getGridIpsecFailover` | Get IPsec failover configuration (paginated). | `getGridIpsecFailover` |
| `getGridKnownClients` | Get historical known clients list (paginated). | `getGridKnownClients` |
| `getGridSignature` | Get the IPS signature list (paginated). | `getGridSignature` |
| `getGridStaticRouting` | Get static routing rules for the site gateway with explicit pagination. | `getGridStaticRouting` |
| `getGroupProfilesByType` | Get group profiles filtered by type (e.g. | `getGroupProfilesByType` |
| `getIpsConfig` | Get the IPS (Intrusion Prevention System) global configuration, inc.... | `getIpsConfig` |
| `getIpsecVpnStats` | Get IPsec VPN tunnel statistics for a site (paginated), including a.... | `getIpsecVpnStats` |
| `getLdapProfileList` | List all LDAP authentication profiles configured on the site. | `getLdapProfileList` |
| `getLogSettingForGlobal` | Get global log notification settings (v1), including global alert r.... | `getLogSettingForGlobal` |
| `getLogSettingForGlobalV2` | Get global log notification settings (v2), with extended notificati.... | `—` |
| `getLogSettingForSite` | Get site-level log notification settings (v1), including alert reci.... | `getLogSettingForSite` |
| `getLogSettingForSiteV2` | Get site-level log notification settings (v2), with extended notifi.... | `—` |
| `getLogging` | Get the controller logging configuration, including log levels and .... | `getLogging` |
| `getMacAuthSetting` | Get the MAC authentication global setting. | `getMacAuthSetting` |
| `getMacAuthSsids` | Get per-SSID MAC authentication settings showing which SSIDs have M.... | `getMacAuthSsids` |
| `getMacFilteringGeneralSetting` | Get the MAC filtering global setting. | `getMacFilteringGeneralSetting` |
| `getMailServerStatus` | Get the mail server connection status for the controller. | `getMailServerStatus` |
| `getMeshSetting` | Get the mesh networking configuration including mesh topology mode .... | `getMeshSetting` |
| `getOsgCustomAclList` | Get the custom gateway ACL rules list (paginated). | `getOsgCustomAclList` |
| `getOswAclList` | Get the switch ACL list (paginated). | `getOswAclList` |
| `getOuiProfileList` | Get the OUI-based device profile list (paginated). | `getOuiProfileList` |
| `getPPSKProfiles` | List Private PSK (PPSK) profiles for the site by type. | `getPPSKProfiles` |
| `getPastClientNum` | Get historical client count trend over a time range. | `getPastClientNum` |
| `getRadioFrequencyPlanningConfig` | Get the RF planning configuration for the site, including frequency.... | `getRadioFrequencyPlanningConfig` |
| `getRadioFrequencyPlanningResult` | Get the RF planning result for the site. | `getRadioFrequencyPlanningResult` |
| `getRadiusServer` | Get the global RADIUS server configuration for the controller. | `getRadiusServer` |
| `getRadiusUserList` | List local RADIUS server users (paginated). | `getRadiusUserList` |
| `getRemoteLogging` | Get the global syslog/remote logging configuration, including syslo.... | `getRemoteLogging` |
| `getRetention` | Get the data retention configuration for the controller, including .... | `getRetention` |
| `getRoamingSetting` | Get the client roaming configuration, including 802.11r/k/v setting.... | `getRoamingSetting` |
| `getRoutingTable` | Get the live routing table for a site filtered by type. | `getRoutingTable` |
| `getServiceTypeSummary` | Get a summary of service type profiles for the site, including pred.... | `getServiceTypeSummary` |
| `getSiteToSiteVpnInfo` | Get detailed information about a specific site-to-site VPN by ID, i.... | `getSiteToSiteVpnInfo` |
| `getSsidsBySite` | Get a flat SSID list filtered by device type. | `getSsidsBySite` |
| `getSslVpnServerSetting` | Get the SSL VPN server configuration, including port, protocol, and.... | `getSslVpnServerSetting` |
| `getSwitchDot1xSetting` | Get the 802.1X switch port authentication setting. | `—` |
| `getThreatCount` | Get the global threat count grouped by severity level (critical, hi.... | `getThreatSeverity` |
| `getThreatDetail` | Get detailed information about a specific IPS threat event by its ID. | `getThreatDetail` |
| `getUiInterface` | Get the UI interface settings for the controller, including timeout.... | `getUiInterface` |
| `getUrlFilterGeneral` | Get the URL filter global setting, including whether URL filtering .... | `getUrlFilterGeneral` |
| `getWebhookForGlobal` | Get the global webhook notification settings, including webhook URL.... | `getWebhookForGlobal` |
| `getWebhookLogsForGlobal` | Get webhook dispatch logs (paginated). | `getWebhookLogsForGlobal` |
| `getWidsBlacklist` | Get the WIPS (Wireless Intrusion Prevention System) rogue AP blackl.... | `getWidsBlacklist` |
| `getWireguardSummary` | Get a summary of WireGuard VPN configurations for the site, includi.... | `getWireguardSummary` |
| `listClientToSiteVpnClients` | List all client-to-site VPN client configurations on the site. | `listClientToSiteVpnClients` |
| `listClientToSiteVpnServers` | List all client-to-site VPN server configurations on the site, incl.... | `listClientToSiteVpnServers` |
| `listDevicesStats` | Query statistics for global adopted devices with pagination and fil.... | `listDevicesStats` |
| `listMdnsProfile` | List all Bonjour/mDNS service profiles configured on the site for c.... | `listMdnsProfile` |
| `listServiceType` | List service type profiles (paginated). | `listServiceType` |
| `listWireguard` | List WireGuard VPN tunnels (paginated). | `listWireguard` |
| `listWireguardPeers` | List WireGuard peers (paginated). | `listWireguardPeers` |
| `getDashboardMostActiveEaps` | Get the most active access points from the site dashboard by traffic. | `getDashboardMostActiveEaps` |
| `getDashboardTopMemoryUsage` | Get top memory usage data for devices from the site dashboard. | `getDashboardTopMemoryUsage` |
| `getDashboardTrafficActivities` | Get traffic activity data and throughput summary from the site dashboard. | `getDashboardTrafficActivities` |
| `getGridDashboardTunnelStats` | Get VPN tunnel statistics for the grid dashboard view. | `getGridDashboardTunnelStats` |
| `setClientRateLimitProfile` | Apply a predefined rate limit profile to a specific client. | `setClientRateLimitProfile` |
| `getGatewayQosClassRules` | Get gateway QoS class rules (paginated). | `getGatewayQosClassRules` |
| `getBandwidthCtrlDetail` | Get bandwidth control details for a site. | `getBandwidthCtrlDetail` |
| `getAppControlRules` | Get application control rules (paginated). | `getAppControlRules` |
| `getAppControlCategories` | Get application control category list. | `getAppControlCategories` |
| `getQosPolicy` | Get QoS policy configuration for a site. | `getQosPolicy` |
| `getTrafficPriority` | Get traffic priority rules for a site. | `getTrafficPriority` |
| `getVpnUserList` | Get VPN users for a site (paginated). | `getVpnUserList` |
| `getVpnUserDetail` | Get users for a specific client-to-site VPN server by ID. | `getVpnUserDetail` |
| `getGoogleLdapProfile` | Get Google LDAP profile configuration for a site. | `getGoogleLdapProfile` |
| `getPpskUserGroup` | Get PPSK user group details for a specific profile ID. | `getPpskUserGroup` |
| `getPortalProfile` | Get captive portal profiles for a site. | `getPortalProfile` |
| `getUserRoleProfile` | Get user role profiles from the controller (global). | `getUserRoleProfile` |
| `getRadiusProxyConfig` | Get global RADIUS proxy configuration (controller-level). | `getRadiusProxyConfig` |
| `getSiteEntity` | Get site detail. | `getSiteDetail` |
| `getSiteUrlByOpenApi` | Get site URL. | `getSiteUrl` |
| `getNtpServerStatus` | Get NTP server status for a site. | `getSiteNtpStatus` |
| `getSiteSpecification` | Get site specification. | `getSiteSpecification` |
| `getSiteRememberSettingByOpenApi` | Get site remember device setting. | `getSiteRememberSetting` |
| `getSiteDeviceAccountSetting` | Get site device account setting. | `getSiteDeviceAccount` |
| `getSiteSettingCap` | Get site capacity setting. | `getSiteCapacity` |
| `getSiteTemplateList` | List site templates. | `getSiteTemplateList` |
| `getSiteTemplateEntity` | Get site template detail. | `getSiteTemplateDetail` |
| `getSiteTemplateConfiguration` | Get site template configuration. | `getSiteTemplateConfig` |
| `getDataRetention` | Get data retention settings. | `getDataRetention` |
| `getControllerPort` | Get controller port setting. | `getControllerPort` |
| `getPortalPort` | Get portal port setting. | `getPortalPort` |
| `getCertificate` | Get certificate configuration. | `getCertificate` |
| `getExpImprove` | Get experience improvement setting. | `getExperienceImprovement` |
| `getGernalSettings_1` | Get global dashboard overview without client data. | `getGlobalDashboardOverview` |
| `getClientHistoryDataEnable` | Get client history data enable setting. | `getClientHistoryDataEnable` |
| `getSelfServerFileList` | List controller backup files. | `getBackupFileList` |
| `getBackupResult` | Get controller backup result. | `getBackupResult` |
| `getRestoreResult` | Get controller restore result. | `getRestoreResult` |
| `getSiteBackupResult` | Get site backup result. | `getSiteBackupResult` |
| `getSelfServerSiteFileList` | List site backup files. | `getSiteBackupFileList` |
| `getAllCloudUsersExcludeRoot` | List all cloud users excluding root. | `getAllCloudUsers` |
| `getAllLocalUsersExcludeRoot` | List all local users excluding root. | `getAllLocalUsers` |
| `getAllRoles` | [DEPRECATED] Use `getUserRoleProfile` instead. List all roles. | `getAllRoles` |
| `getRole` | Get role detail. | `getRoleDetail` |
| `getAvailableRole` | List available roles. | `getAvailableRoles` |
| `getAppGridUsers` | List all users in app grid view. | `getAllUsersApp` |
| `getCloudAccessStatus` | Get cloud access status. | `getCloudAccessStatus` |
| `getCloudUserInfo` | Get cloud user info. | `getCloudUserInfo` |
| `getGlobalMFAStatus` | Get global MFA status. | `getMfaStatus` |
| `getRemoteBindingStatus` | Get remote binding status. | `getRemoteBindingStatus` |
| `getUpgradeScheduleList` | List upgrade schedules for a site. | `getUpgradeScheduleList` |
| `getRebootScheduleList_1` | List reboot schedules for a site template. | `getRebootScheduleList` |
| `getPoeScheduleList` | List PoE schedules for a site. | `getPoeScheduleList` |
| `getPortScheduleList` | List port schedules for a site. | `getPortScheduleList` |
| `getPortSchedulePorts` | List ports with port schedules. | `getPortSchedulePorts` |
| `getMulticastRateLimitByOpenApi` | Get multicast rate limit setting. | `getMulticastRateLimit` |
| `getApLoadBalanceConfig` | Get AP load balance configuration. | `getApLoadBalance` |
| `getApOfdmaConfig` | [DEPRECATED] Use `getSitesApsOfdma` instead. Same endpoint, retained for backward compatibility. getSitesApsOfdma is the canonical tool name. | `getApOfdmaConfig` |

## Devcontainer support

The repository includes a ready-to-use [devcontainer](https://containers.dev/) configuration with a dedicated Omada controller sidecar for local development and testing. See [`.devcontainer/README.md`](.devcontainer/README.md) for details.

## License

This project is licensed under the [MIT License](LICENSE).