List all UniFi consoles (hosts) with firmware, WAN IP, and status.

Host records are returned verbatim, including reportedState GPS coordinates. By default every page is drained and the complete host list is returned. Pass page_token to fetch a single page manually (the response then carries a nextToken cursor to continue). A capped drain returns the hosts gathered so far with incomplete=true rather than truncating silently.

Get details for a single UniFi console by name or ID.

host: console name, ID, or composite ID (MAC:numericId format for cloud consoles). Host record is returned verbatim, including reportedState GPS coordinates.

List all sites with device/client counts and ISP info.

The siteId in the response is the Site Manager Fabric ObjectId (from the /v1/sites list) — it is NOT the same as the proxy-path UUID used by per-site tools. You do not need either ID: pass site names (e.g., "Default") to all tools and the server resolves the correct ID internally.

By default every page is drained and the complete site list is returned. Pass page_token to fetch a single page manually (the response then carries a nextToken cursor to continue). A capped drain returns the sites gathered so far with incomplete=true rather than truncating silently.

List all devices across the fleet with status, firmware, and model.

host: optional filter by console name, ID, or composite ID (MAC:numericId format). By default every page is drained and the complete device list is returned. Pass page_token to fetch a single page manually (the response then carries a nextToken cursor to continue). A capped drain returns the devices gathered so far with incomplete=true rather than truncating silently.

Get WAN health metrics (speed, latency, packet loss, uptime).

This is the simple, unfiltered variant (interval only). To scope by console/site or a time window, use query_isp_metrics instead.

interval: time bucket for metrics aggregation — '5m' or '1h'. Returns a dict with a 'periods' list containing WAN speed, latency, packet loss, and uptime.

Query filtered ISP metrics with optional site/time range filters.

This is the filtered variant of get_isp_metrics: pass host/site to scope the query and start_time/end_time to bound the window. For a quick unscoped read, use get_isp_metrics.

interval: time bucket for metrics aggregation — '5m' or '1h'. host: console name, ID, or composite ID (MAC:numericId format) — resolves to hostId. site: site name or ID — resolves to siteId automatically. sites: advanced use — list of raw {hostId, siteId} dicts; use host/site params instead for human-readable names. start_time/end_time: ISO 8601 UTC timestamp STRINGS, e.g. "2026-07-23T00:00:00Z". These are strings, NOT epoch numbers — passing an epoch integer (seconds or milliseconds) is rejected by schema validation with 'Input should be a valid string [type=string_type]'. (Note the deliberate inconsistency with the epoch-based history tools: list_protect_events, list_client_sessions and get_historical_stats take epoch SECONDS as integers, whereas this Site Manager tool takes ISO 8601 strings.) An epoch supplied AS a string (e.g. "1690000000000") is also rejected, with the expected format, rather than being forwarded to the API as a meaningless window.

List Site Magic (SD-WAN) VPN mesh configurations.

By default every page is drained and the complete config list is returned. Pass page_token to fetch a single page manually (the response then carries a nextToken cursor to continue). A capped drain returns the configs gathered so far with incomplete=true rather than truncating silently.

Get a single SD-WAN configuration by ID.

config_id: REQUIRED. Obtain it from list_sdwan_configs (its id field).

Get the status of an SD-WAN configuration by ID.

config_id: REQUIRED. Obtain it from list_sdwan_configs (its id field).

List all sites with aggregated health stats from the /v1/sites/ API.

Returns sites merged with health summary: device counts, client counts, alerts, and connectivity status in a single call.

Get health summary for a single site: uptime, alerts, and device counts.

site: site name or ID.

Compare health and performance metrics across multiple sites side-by-side.

sites: list of site names or IDs to compare.

Search for devices or clients matching a query across all sites.

query: search term matched against name, MAC address, IP, or model.

Get full inventory for a site: all devices and connected clients.

site: site name or ID.

Get the UniFi Network application version reported by a console.

host: console name, ID, or composite ID (MAC:numericId format).

List sites managed by one UniFi Network application.

host: console name, ID, or composite ID (MAC:numericId format). By default every page is drained and the complete list is returned. Pass offset/limit to fetch a single page manually (native envelope preserved). A capped drain returns the sites gathered so far with incomplete=true rather than truncating silently. filter: optional UniFi Integration API filter.

List all networks/VLANs for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Networks are offset-paginated (native default page size 25); by default every page is drained and the complete list is returned as {data, totalCount}. Pass offset or limit for a single manual page. filter: optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. vlanId.eq(100), name.like('*guest*'), metadata.origin.eq('USER_DEFINED')); omitted entirely when unset. A capped drain is flagged incomplete.

Create a new network/VLAN on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Validated locally before the request (a missing field raises ValueError naming it): management — the discriminator the controller validates first. The rest of the required schema is management-mode-specific and enforced by the controller. network_config: for management='GATEWAY' the controller also requires (verified live):

• name (str, max 32 chars)

• vlanId (int, 1-4094)

• enabled (bool)

• internetAccessEnabled (bool)

• isolationEnabled (bool)

• cellularBackupEnabled (bool)

• ipV4Configuration: {'dhcpMode': 'SERVER'|'RELAY'|'NONE', 'subnet': str CIDR, 'hostAddress': str, 'netmask': str, 'broadcastAddress': str, 'dhcpRangeStart': str, 'dhcpRangeStop': str} Optional: zoneId (str, zone UUID from list_firewall_zones_proxy), mdnsForwardingEnabled (bool). Field names are camelCase; there is no 'purpose' field in the Network Integration API.

D12 auto-exclusion: UniFi silently adds every new network to the excluded_networkconf_ids of ALL custom-tagged port profiles (tagged_vlan_mgmt == 'custom'), blackholing the VLAN at the host uplink. When that happens this response carries a warnings entry (code D12_AUTO_EXCLUSION) naming each affected profile; run allow_network_on_port_profile on each to restore tagging.

Get a single network/VLAN by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. network_id: REQUIRED. Obtain it from list_networks (its id field).

Update an existing network/VLAN.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. network_config: full network configuration to replace with. network_id: REQUIRED. Obtain it from list_networks (its id field).

Delete a network/VLAN.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. network_id: REQUIRED. Obtain it from list_networks (its id field).

Get all resources referencing a network — useful before deleting to check dependencies.

Returns WiFi broadcasts, firewall policies, and port profiles that use this network. host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. network_id: network UUID from list_networks.

List Link Aggregation Groups (LAGs) on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Drains all pages by default; pass offset/limit for a single manual page. A capped drain is flagged incomplete rather than truncated silently. filter: optional UniFi Integration API filter expression.

Get one Link Aggregation Group.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. lag_id: LAG UUID from list_lags.

List Multi-Chassis Link Aggregation (MC-LAG) domains on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Drains all pages by default; pass offset/limit for a single manual page. A capped drain is flagged incomplete rather than truncated silently. filter: optional UniFi Integration API filter expression.

Get one Multi-Chassis Link Aggregation domain.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. mc_lag_domain_id: domain UUID from list_mc_lag_domains.

List switch stacks on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Drains all pages by default; pass offset/limit for a single manual page. A capped drain is flagged incomplete rather than truncated silently. filter: optional UniFi Integration API filter expression.

Get one switch stack.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. switch_stack_id: switch-stack UUID from list_switch_stacks.

List all WiFi broadcast SSIDs for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. filter: optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. enabled.eq(true), name.like('*Guest*')); omitted entirely when unset.

Create a new WiFi broadcast SSID on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Validated locally before the request (a missing field raises ValueError naming it): type — the discriminator the controller validates first (observed value: 'STANDARD'). The remaining fields are type-specific and enforced by the controller. broadcast: for a STANDARD SSID also include: {'name': str (SSID name), 'enabled': bool, 'securityConfiguration': {...}, 'network': str, 'broadcastingFrequenciesGHz': [...]}. Field names must be camelCase to match the UniFi Integration API.

Get a single WiFi broadcast SSID by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. broadcast_id: REQUIRED. Obtain it from list_wifi_broadcasts (its id field).

Update an existing WiFi broadcast SSID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. broadcast: full WiFi broadcast configuration to replace with. broadcast_id: REQUIRED. Obtain it from list_wifi_broadcasts (its id field).

Delete a WiFi broadcast SSID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. broadcast_id: REQUIRED. Obtain it from list_wifi_broadcasts (its id field).

List WAN interfaces for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Update a WAN interface configuration.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. wan_id: WAN interface ID to update. wan: fields to update (name, ip, gateway, dns, etc.).

List all adopted devices for a site via connector proxy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. By default every page is drained and the complete device list is returned. offset/limit: fetch a single page manually (the API's totalCount is surfaced so you can advance). filter: optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. state.eq('ONLINE'), model.eq('U6 Pro')); omitted entirely when unset. A capped drain returns the devices gathered so far with incomplete=true rather than truncating silently.

Adopt a device onto a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device: device adoption payload (mac, name, etc.).

Example: adopt_device(host="main-office", site="HQ", device={"mac": "aa:bb:cc:dd:ee:ff"})

Get details for a single adopted device.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: device UUID or MAC address (accepted formats: AA:BB:CC:DD:EE:FF, AABBCCDDEEFF, aa-bb-cc-dd-ee-ff).

Unadopt (remove) a device from a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: unique identifier of the device to remove.

Example: unadopt_device(host="main-office", site="HQ", device_id="device-uuid-here")

Execute a device action (restart, upgrade, locate, etc.).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. action: must include: {'action': str}. Common commands: {'action': 'restart'}, {'action': 'adopt'}, {'action': 'force-provision'}. Valid commands vary by device type. device_id: REQUIRED. Obtain it from list_devices (its id field).

Get latest statistics for a device.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: device UUID or MAC address (accepted formats: AA:BB:CC:DD:EE:FF, AABBCCDDEEFF, aa-bb-cc-dd-ee-ff).

Execute a port action on a device interface.

OPERATIONAL-ACTION-ONLY, NOT A CONFIG WRITER: this Integration port-actions endpoint performs a transient operational action; it does NOT persist port configuration. A PoE power cycle ({'action': 'power-cycle'}, canonical id POWER_CYCLE) is the only valid action -- it powers a PoE port off and back on (only meaningful on PoE-capable ports). Config-style actions such as {'action': 'set-poe-mode', ...} are rejected by the controller with HTTP 400 'unknown-type-id' and leave the port unchanged (verified live). Do NOT use this to set PoE mode, STP, VLAN, or any persistent port setting -- there is no confirmed per-port persistent-config writer on this API; a shared Ethernet Port Profile (update_port_profile) is a different, wide-blast-radius surface.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. port_idx: port index number (1-based, matching the switch's physical port numbering). action: the port-action payload, shape {'action': str}, forwarded verbatim to the UniFi Network Integration API port-actions endpoint. 'power-cycle' (POWER_CYCLE) is the one valid, documented action; other values return HTTP 400 'unknown-type-id' from the controller. device_id: REQUIRED. Obtain it from list_devices (its id field).

Restart an adopted device.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: REQUIRED. Obtain it from list_devices (its id field).

Toggle the locate LED on an adopted device.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. enabled: True to enable locate LED, False to disable. device_id: REQUIRED. Obtain it from list_devices (its id field).

Trigger a firmware upgrade on an adopted device.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: REQUIRED. Obtain it from list_devices (its id field).

List devices pending adoption on a console.

host: console name, ID, or composite ID (MAC:numericId format).

Create a device tag on a site. This is a write operation that modifies live config.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. tag: required fields:

• name (str): tag label shown in the UI Optional: color (str, hex color e.g. '#FF5733'). Tags can then be assigned to devices to group and filter them in the UniFi UI.

Update a device tag by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. tag_id: device tag ID to update. tag: fields to update (name, color, etc.).

Delete a device tag by ID. This permanently removes the tag from the site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. tag_id: device tag ID to delete.

Approve a pending device for adoption onto a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: device ID from list_pending_devices to approve.

Reject a pending device, preventing it from joining the site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: device ID from list_pending_devices to reject.

List connected clients for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. By default every page is drained and the complete client list is returned as {data, totalCount}. offset/limit: fetch a single page manually (the API's totalCount is surfaced so you can advance). client_type: convenience shorthand — WIRELESS, WIRED, or ALL (default: all types) — translated into the upstream type.eq(...) filter (the raw type query parameter is ignored by the UniFi API, so this translation is what actually narrows the result). filter: optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. type.eq('WIRED'), macAddress.eq('aa:bb:cc:dd:ee:ff')); omitted entirely when unset. client_type and an explicit filter are mutually exclusive (the upstream grammar has no conjunction operator to compose them); passing both raises an error rather than silently returning wrong results. A capped drain returns the clients gathered so far with incomplete=true rather than truncating silently.

Get details for a single client.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. client_id: REQUIRED. Obtain it from list_clients (its id field).

Execute a client action (block, unblock, reconnect).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. action: must include: {'action': str}. Common commands: {'action': 'block'}, {'action': 'unblock'}, {'action': 'reconnect'}. client_id: REQUIRED. Obtain it from list_clients (its id field).

Block a client on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. client_id: REQUIRED. Obtain it from list_clients (its id field).

Unblock a previously blocked client on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. client_id: REQUIRED. Obtain it from list_clients (its id field).

Force a client to reconnect on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. client_id: REQUIRED. Obtain it from list_clients (its id field).

List firewall policies for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. By default every page is drained and the complete policy list is returned as {data, totalCount}. Pass offset/limit to fetch a single page manually (the API's totalCount is surfaced so you can advance). filter: optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*'), metadata.origin.eq('USER_DEFINED')); omitted entirely when unset. A capped drain returns the policies gathered so far with incomplete=true rather than truncating silently.

Create a new firewall policy on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy: required fields (all validated locally — a missing field raises ValueError naming it — and all verified against the live controller):

• name (str)

• enabled (bool)

• action: {'type': 'ALLOW'|'DENY'|'REJECT', 'allowReturnTraffic': bool}

• source: {'zoneId': str}

• destination: {'zoneId': str}

• ipProtocolScope: {'ipVersion': 'IPV4'|'IPV6'|'BOTH'}

• loggingEnabled (bool) Note: there is NO 'index' field; use set_firewall_policy_ordering to manage rule order. Get zone IDs from list_firewall_zones_proxy. trafficFilter (optional; may appear on source and/or destination) narrows the match beyond the zone pair. Set trafficFilter.type plus the ONE matching nested object:

  • IP_ADDRESS -> ipAddressFilter.items[] (IP addresses / CIDRs)

  • NETWORK -> networkFilter.networkIds[] (network UUIDs)

  • PORT -> portFilter.items[] (ports / port ranges)

  • MAC_ADDRESS -> macAddressFilter.macAddresses[] (client MAC addresses) The controller may also support further types (e.g. region/identity-based); list_firewall_policies only reveals the types already in use on a site, so an unlisted type is not evidence it is unsupported. PORT-FILTER PLACEMENT FOOTGUN: a portFilter under source.trafficFilter filters SOURCE ports, which for outbound flows are ephemeral (random high ports) -> the rule silently matches nothing. A destination-port rule MUST use destination.trafficFilter with type PORT, never a source portFilter. (create/update_firewall_policy log a runtime warning when a source PORT filter is combined with an any-destination ALLOW.)

Get a single firewall policy by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy_id: REQUIRED. The policy's id; obtain it from list_firewall_policies (its id field).

Full-replace a firewall policy by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy: full firewall policy configuration to replace with. policy_id: REQUIRED. The policy's id; obtain it from list_firewall_policies (its id field). trafficFilter (optional; may appear on source and/or destination) narrows the match beyond the zone pair. Set trafficFilter.type plus the ONE matching nested object:

• IP_ADDRESS -> ipAddressFilter.items[] (IP addresses / CIDRs)

• NETWORK -> networkFilter.networkIds[] (network UUIDs)

• PORT -> portFilter.items[] (ports / port ranges)

• MAC_ADDRESS -> macAddressFilter.macAddresses[] (client MAC addresses) The controller may also support further types (e.g. region/identity-based); list_firewall_policies only reveals the types already in use on a site, so an unlisted type is not evidence it is unsupported. PORT-FILTER PLACEMENT FOOTGUN: a portFilter under source.trafficFilter filters SOURCE ports, which for outbound flows are ephemeral (random high ports) -> the rule silently matches nothing. A destination-port rule MUST use destination.trafficFilter with type PORT, never a source portFilter. (create/update_firewall_policy log a runtime warning when a source PORT filter is combined with an any-destination ALLOW.)

Partially update a firewall policy by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. fields: fields to update on the policy. policy_id: REQUIRED. The policy's id; obtain it from list_firewall_policies (its id field).

Delete a firewall policy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy_id: REQUIRED. The policy's id; obtain it from list_firewall_policies (its id field).

Get the ordering of firewall policies for a site filtered by source and destination zone.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. source_zone_id: UUID of the source firewall zone (required by the API). destination_zone_id: UUID of the destination firewall zone (required by the API).

Set the ordering of firewall policies within one source/destination zone pair.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. source_zone_id: UUID of the source firewall zone. REQUIRED by the API and sent as a query parameter (NOT read from the ordering body); omitting it returns HTTP 400. destination_zone_id: UUID of the destination firewall zone. Same requirement as source_zone_id. Use the same zone pair you read with get_firewall_policy_ordering. ordering: policy ordering configuration (the ordered policy list for that zone pair).

List all firewall zones for a site via connector proxy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Zones are offset-paginated (native default page size 25); by default every page is drained and the complete list is returned as {data, totalCount}. Pass offset or limit for a single manual page. A capped drain is flagged incomplete.

Create a new firewall zone on a site via connector proxy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. zone: must include {'name': str, 'networkIds': [str]} — both required, validated locally (a missing field raises ValueError naming it) and verified against the live controller. Get network IDs from list_networks.

Get a single firewall zone by ID via connector proxy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. zone_id: REQUIRED. Obtain it from list_firewall_zones_proxy (its id field).

Update a firewall zone by ID via connector proxy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. zone: full firewall zone configuration to replace with. zone_id: REQUIRED. Obtain it from list_firewall_zones_proxy (its id field).

Delete a firewall zone via connector proxy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. zone_id: REQUIRED. Obtain it from list_firewall_zones_proxy (its id field).

List all ACL rules for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Create a new ACL rule on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Validated locally before the request (a missing field raises ValueError naming it): type — the discriminator the controller validates first (verified live: an empty body is rejected with Missing $.type value; observed value: 'MAC'). The remaining fields are type-specific and enforced by the controller. rule: for a MAC-type rule the live object also carries: name (str), action, enabled (bool), sourceFilter, networkIdFilter. Read an existing rule with get_acl_rule to see the exact shape for the type you want. Note: ACL rules are for intra-VLAN/inter-network L3 filtering. For zone-based perimeter firewall rules, use create_firewall_policy instead.

Get a single ACL rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. rule_id: REQUIRED. The rule's id; obtain it from list_acl_rules (its id field).

Update an existing ACL rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. rule: full ACL rule configuration to replace with. rule_id: REQUIRED. The rule's id; obtain it from list_acl_rules (its id field).

Delete an ACL rule.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. rule_id: REQUIRED. The rule's id; obtain it from list_acl_rules (its id field).

Get the ordering of ACL rules for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Set the ordering of ACL rules for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. ordering: ACL rule ordering configuration.

List all DNS policies for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. DNS policies are offset-paginated (native default page size 25); by default every page is drained and the complete list is returned as {data, totalCount}. Pass offset or limit for a single manual page. A capped drain is flagged incomplete.

Create a new DNS policy on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Validated locally before the request (a missing field raises ValueError naming it): type — the discriminator the controller validates first (verified live: an empty body is rejected with Missing $.type value). The remaining fields are type-specific and enforced by the controller. policy: for a typical policy also include a name and the network scope; read an existing policy with get_dns_policy to confirm the exact shape for the type you want.

Get a single DNS policy by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy_id: REQUIRED. The policy's id; obtain it from list_dns_policies (its id field).

Update a DNS policy by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy: full DNS policy configuration to replace with. policy_id: REQUIRED. The policy's id; obtain it from list_dns_policies (its id field).

Delete a DNS policy.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. policy_id: REQUIRED. The policy's id; obtain it from list_dns_policies (its id field).

List all traffic matching lists for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Create a new traffic matching list on a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Validated locally before the request (a missing field raises ValueError naming it): a top-level type — the discriminator the controller validates first (verified live: an empty body is rejected with Missing $.type value; observed value: 'PORTS'). traffic_list: for a PORTS list the live object also carries name (str) and items (list). Note: the list field is 'items', not 'entries'.

Get a single traffic matching list by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. list_id: REQUIRED. Obtain it from list_traffic_matching_lists (its id field).

Update a traffic matching list by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. traffic_list: full traffic matching list configuration to replace with. list_id: REQUIRED. Obtain it from list_traffic_matching_lists (its id field).

Delete a traffic matching list.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. list_id: REQUIRED. Obtain it from list_traffic_matching_lists (its id field).

List VPN servers for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. VPN servers are offset-paginated (native default page size 25); by default every page is drained and the complete list is returned as {data, totalCount}. Pass offset or limit for a single manual page. A capped drain is flagged incomplete.

List site-to-site VPN tunnels for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

List RADIUS profiles for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. RADIUS profiles are offset-paginated (native default page size 25); by default every page is drained and the complete list is returned as {data, totalCount}. Pass offset or limit for a single manual page. A capped drain is flagged incomplete.

List all hotspot/guest vouchers for a site (there is no list_vouchers — this is it).

This is the voucher-listing tool; the family is list_hotspot_vouchers, create_hotspot_vouchers, get_hotspot_voucher, delete_hotspot_voucher — all prefixed hotspot_. There is no shorter list_vouchers/get_voucher alias.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Vouchers are offset-paginated (native default page size 100) and batches routinely exceed that; by default every page is drained and the complete list is returned as {data, totalCount}. Pass offset or limit for a single manual page. A capped drain is flagged incomplete.

Generate hotspot vouchers for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. voucher_config: required fields (validated locally — a missing field raises ValueError naming it — and verified against the live controller): name and timeLimitMinutes (voucher validity window, minutes). Optional: count, quota, bandwidth limits, etc.

Get a single hotspot voucher by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. voucher_id: REQUIRED. Obtain it from list_hotspot_vouchers (its id field).

Delete a single hotspot voucher.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. voucher_id: REQUIRED. Obtain it from list_hotspot_vouchers (its id field).

Bulk delete hotspot vouchers matching filter criteria.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. filter_params: filter parameters to select vouchers for deletion.

List all device tags defined in a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

List all countries with ISO codes available on a console.

host: console name, ID, or composite ID (MAC:numericId format).

List all cameras on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format).

Get details for a single Protect camera by ID.

host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Update settings for a Protect camera (name, recording mode, etc.).

host: console name, ID, or composite ID (MAC:numericId format). settings: key-value pairs of camera settings to update. camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Get a snapshot from a Protect camera. Returns base64-encoded JPEG image data.

host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Get existing RTSPS stream URLs for a Protect camera.

host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Create an RTSPS stream for a Protect camera.

host: console name, ID, or composite ID (MAC:numericId format). qualities: list of channel names to enable. The exhaustive set is 'high', 'medium', 'low', and 'package' (verified live against get_rtsps_stream, which reports exactly these four channel keys). 'package' exists only on package-camera doorbells; on other cameras it is null. There is NO 'highest' channel. Case-insensitive — values are normalized to lowercase before sending. The list is forwarded to the API as-is with no local allow-list, so an unrecognised name is not validated here; the upstream Protect API governs the outcome (a name with no matching channel yields no stream for that entry rather than a local error). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Delete an RTSPS stream for a Protect camera.

host: console name, ID, or composite ID (MAC:numericId format). qualities: list of channel names to delete. The exhaustive set is 'high', 'medium', 'low', and 'package' (verified live; 'package' only on package-camera doorbells). There is NO 'highest' channel. Case-insensitive — values are normalized to lowercase before sending. Forwarded to the API as-is with no local allow-list; an unrecognised name is not validated here and the upstream Protect API governs the outcome. camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Start a talkback audio session on a Protect camera.

host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Permanently disable the microphone on a Protect camera. This cannot be undone.

host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Move a PTZ camera to a preset position slot.

host: console name, ID, or composite ID (MAC:numericId format). slot: preset slot number to move to. camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Start a PTZ patrol on a preset slot.

host: console name, ID, or composite ID (MAC:numericId format). slot: patrol preset slot number. camera_id: REQUIRED. Obtain it from list_cameras (its id field).

Stop the current PTZ patrol on a camera.

host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field).

List all sensors on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format).

Get details for a single Protect sensor by ID.

host: console name, ID, or composite ID (MAC:numericId format). sensor_id: REQUIRED. Obtain it from list_sensors (its id field).

Update settings for a Protect sensor.

host: console name, ID, or composite ID (MAC:numericId format). settings: key-value pairs of sensor settings to update. sensor_id: REQUIRED. Obtain it from list_sensors (its id field).

Query historical Protect events (motion, smart-detect, sensor open/close, etc.).

This uses the private /proxy/protect/api/events REST path — the ONLY source of historical events. The official Protect Integration API exposes events solely over WebSocket (/v1/subscribe/events) with no REST query endpoint, so do not expect the integration path to answer this.

REQUIRED: host, start, and end. start/end are epoch SECONDS as INTEGERS (e.g. 1690000000 for 2023-07-22T06:13:20Z), NOT milliseconds and NOT an ISO 8601 string: a millisecond-magnitude value is rejected up front, and a string fails schema validation. This differs on purpose from query_isp_metrics, whose start_time/end_time are ISO 8601 STRINGS — do not carry a format across the two tools.

host: console name, ID, or composite ID (MAC:numericId format). start/end: REQUIRED. Epoch SECONDS (UTC) as integers, converted to milliseconds internally. Ranges are inclusive on both ends. History depth is bounded by the NVR's retention. (Contrast query_isp_metrics, which wants ISO 8601 strings.) types: filter by event TYPE; single value or a list. Verified-present values: motion, smartDetectZone, smartAudioDetect, sensorOpened, sensorClosed, access. NOTE: person/face/animal/alrmSpeak are NOT event types — they are smart-detect subtypes and belong in smart_detect_types, not here. An unrecognised value returns zero events. smart_detect_types: filter by the smart-detect SUBTYPE — person, vehicle, animal, package, face, licensePlate (on smartDetectZone events) and the audio alarms alrmSpeak, alrmSiren, alrmBark, alrmCarHorn (on smartAudioDetect events). This is a distinct upstream parameter from types. The API only honours it when types is also set to the relevant event type(s); passing smart_detect_types alone is a silent no-op upstream, so this tool rejects that with a clear error. Example: types="smartDetectZone", smart_detect_types="person" for just person detections; types="smartAudioDetect", smart_detect_types="alrmSpeak" to isolate the dominant audio-alarm noise. cameras: filter by camera NAME or ID; single value or list. Names resolve to IDs (case-insensitive) — an unknown name errors rather than silently matching nothing. categories: filter by event category; single value or list. Verified values: motion, smart, iot, admin. Unknown values are silently ignored by the upstream API. without_descriptions: when true, ask the API to omit each event's description block (~16% smaller payload). Opt-in only — full-fidelity records are the default and descriptions are never dropped automatically. limit/offset: offset-based pagination (not cursor-based). By default (neither given) every page is drained and the complete event set for the window is returned — a wide window can hold tens of thousands of events, so expect all of them, not just the first page. Pass offset or limit to fetch a single manual page instead; a capped drain is flagged incomplete rather than truncating. order_direction: "ASC" (default, oldest-first) or "DESC" (newest-first).

Sensor events set the top-level sensor field to null; the sensor reference at metadata.sensorId.text is promoted to that field so you can filter/join on it. Events are passed through verbatim, including identifiers (MAC/IP/hostname/name) and the metadata.name object carrying camera / recognised-person / license-plate text; the recognised-person name on face events is at metadata.detectedThumbnails[].matchedName.

List recognition groups (enrolled faces / vehicles) on a Protect console.

Uses the private /proxy/protect/api/recognition/{type}/groups REST path (not the Protect Integration API, which has no recognition surface). Each group is a recognised subject with a stable, monotonic id (face_1, face_90, …), a name / matchedName label, a detectionsCount, and createdAt/firstDetectedAt/lastDetectedAt timestamps usable as sync and change-detection keys. This is a faithful pass-through: the name label is returned as-is and nothing is redacted.

Response shape: {"groups": [...], "count": N} (plus "nextPage" / "incomplete" when paging manually). The array key is "groups", NOT "data" — unlike the offset-proxy tools that return {"data": [...], "totalCount": N}; read the list from result["groups"].

host: console name, ID, or composite ID (MAC:numericId format). type: recognition type. Use 'face' or 'vehicle' (singular). Plural forms ('faces', 'vehicles') are NOT valid and return HTTP 400 from upstream — two separate agents have guessed plural and hit this error. The value is forwarded as-is, so any other type the console accepts also works, and any it rejects is answered by the API's own error. has_name: when true, return only named groups (unnamed groups are filtered out). page_size: API page size; also the drain page size. Defaults to 200. order_by / order_direction: server-side sort. order_direction is 'asc' or 'desc', case-insensitive ('ASC'/'DESC' behave identically); an unrecognised value is rejected upstream with HTTP 400. It only takes effect together with order_by (e.g. order_by='name') — with order_by set but order_direction omitted the API defaults to descending. order_by accepts name, createdAt, lastDetectedAt, or detectionsCount. page: fetch a single page (1-based) instead of draining. The response pages via a links.next envelope; by default every page is drained and the complete group set is returned. Pass page to fetch one page manually — nextPage is then surfaced.

Get aggregate recognition-group counts for a Protect console.

Returns totals such as totalCount, nameNotNullCount (named groups), nameIsNullCount, notificationEnabledCount, and degradedCount.

host: console name, ID, or composite ID (MAC:numericId format). type: recognition type. Use 'face' or 'vehicle' (singular — plural forms return HTTP 400 from upstream). Forwarded to the API as-is.

Get a recognition group's reference crop. Returns base64-encoded JPEG image data.

host: console name, ID, or composite ID (MAC:numericId format). type: recognition type. Use 'face' or 'vehicle' (singular -- plural forms return HTTP 400 from upstream). Forwarded to the API as-is. group_id: the group's stable id, e.g. face_90.

List a recognition group's detections (individual sightings) on a Protect console.

REQUIRED: both type and group_id. group_id identifies which enrolled subject to list sightings for — obtain a valid one from list_recognition_groups (its id field, e.g. face_90); there is no "all groups" mode. Calling without group_id fails schema validation, and passing an id that does not exist on the console returns HTTP 404.

Each detection carries id, eventId (joinable against list_protect_events), thumbnailId (fetch the crop with get_thumbnail), detectedAt (epoch ms), cameraId, and matchedGroupConfidence (0-100).

Response shape: {"detections": [...], "count": N} (plus "nextPage" / "incomplete" when paging manually). The array key is "detections", NOT "data" — unlike the offset-proxy tools that return {"data": [...], "totalCount": N}; read the list from result["detections"].

host: console name, ID, or composite ID (MAC:numericId format). type: recognition type. Use 'face' or 'vehicle' (singular -- plural forms return HTTP 400 from upstream). Forwarded to the API as-is. group_id: REQUIRED. The group's stable id, e.g. face_90 — take it from a list_recognition_groups result (the id field). Not optional; not guessable. page_size: API page size; also the drain page size. Defaults to 200. start/end: optional time window in epoch SECONDS (UTC), converted to milliseconds internally. Verified live: the endpoint filters detections server-side by detectedAt against this window, so an arbitrary range (e.g. the last hour, 30 days, or 90 days) can be requested directly. Omit both for all detections. page: fetch a single page (1-based) instead of draining. The response pages via a links.next envelope; by default every page is drained so the complete detection set for the group (and window, if given) is returned. Pass page to fetch one page manually — nextPage is then surfaced.

Get a detection thumbnail crop. Returns base64-encoded JPEG image data.

host: console name, ID, or composite ID (MAC:numericId format). thumbnail_id: the thumbnailId from a detection record.

List all lights on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format).

Get details for a single Protect light by ID.

host: console name, ID, or composite ID (MAC:numericId format). light_id: REQUIRED. Obtain it from list_lights (its id field).

Update settings for a Protect light (brightness, sensitivity, etc.).

host: console name, ID, or composite ID (MAC:numericId format). settings: key-value pairs of light settings to update. light_id: REQUIRED. Obtain it from list_lights (its id field).

List all chimes on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format).

Get details for a single Protect chime by ID.

host: console name, ID, or composite ID (MAC:numericId format). chime_id: REQUIRED. Obtain it from list_chimes (its id field).

Update settings for a Protect chime (volume, ringtone, etc.).

host: console name, ID, or composite ID (MAC:numericId format). settings: key-value pairs of chime settings to update. chime_id: REQUIRED. Obtain it from list_chimes (its id field).

List all viewers on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format).

Get details for a single Protect viewer by ID.

host: console name, ID, or composite ID (MAC:numericId format). viewer_id: REQUIRED. Obtain it from list_viewers (its id field).

Update settings for a Protect viewer (liveview assignment, etc.).

host: console name, ID, or composite ID (MAC:numericId format). settings: key-value pairs of viewer settings to update. viewer_id: REQUIRED. Obtain it from list_viewers (its id field).

List all liveviews on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format).

Get details for a single Protect liveview by ID.

host: console name, ID, or composite ID (MAC:numericId format). liveview_id: REQUIRED. Obtain it from list_liveviews (its id field).

Create a liveview on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format). name: liveview display name. settings: optional additional liveview fields (layout, slots, etc.).

Update a liveview on a Protect console.

host: console name, ID, or composite ID (MAC:numericId format). settings: key-value pairs of liveview settings to update. liveview_id: REQUIRED. Obtain it from list_liveviews (its id field).

Get NVR details from a Protect console.

Returns NVR hardware info, storage status, firmware version, and system health. host: console name, ID, or composite ID (MAC:numericId format).

List Protect device asset files of a given type.

host: console name, ID, or composite ID (MAC:numericId format). file_type: Protect asset category. 'sounds' and 'images' are the known categories. The GET endpoint does NOT validate this value — an unrecognised category returns HTTP 200 with an empty list rather than an error, so a wrong value is indistinguishable from a genuinely empty category. Pass a known category exactly.

Upload a Protect device asset file. WARNING: Uploads asset file to NVR storage. Overwriting system files may not be reversible.

host: console name, ID, or composite ID (MAC:numericId format). file_type: Protect asset category. 'sounds' and 'images' are the known categories; the value selects the upload target path (/files/{file_type}). The category is not validated on read-back, so pass a known category exactly. filename: name of the file to upload (e.g. 'alert.mp3'). file_content_base64: base64-encoded file content.

Trigger an alarm manager webhook by ID. WARNING: triggers physical alarm hardware. Verify webhook ID is correct before confirming.

host: console name, ID, or composite ID (MAC:numericId format). webhook_id: alarm webhook ID to trigger. confirm: must be True to execute. Prevents accidental triggers on live infrastructure.

List arm profiles on a Protect console (GET /v1/arm-profiles via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format). Availability requires a Protect application exposing the v7.1.87 Integration API.

Get one arm profile by id (filters GET /v1/arm-profiles; no GET-by-id exists upstream).

host: console name, ID, or composite ID (MAC:numericId format). arm_profile_id: REQUIRED. Obtain it from list_arm_profiles (its id field).

Create an arm profile (POST /v1/arm-profiles via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format). name: REQUIRED display name for the profile. settings: the rest of the required body — automations, schedules, recordEverything, activationDelay (server-side validated). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Update an arm profile (PATCH /v1/arm-profiles/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). arm_profile_id: REQUIRED. Obtain it from list_arm_profiles (its id field). settings: fields to change. If all already match, no write is sent (status=noop). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Delete an arm profile (DELETE /v1/arm-profiles/{id}). Irreversible — no undo.

host: console name, ID, or composite ID (MAC:numericId format). arm_profile_id: REQUIRED. Obtain it from list_arm_profiles (its id field). confirm: must be true to execute. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Select the active arm profile (PATCH /v1/arm-profiles/settings).

host: console name, ID, or composite ID (MAC:numericId format). arm_profile_id: REQUIRED. Obtain it from list_arm_profiles (its id field); this becomes the console's selected arm profile. Reads the NVR armMode before/after (no-op if already selected). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Enable the arm alarm using the selected profile (POST /v1/arm-profiles/enable).

WARNING: arms the alarm system (physical side effects); requires a local Alarm Manager. host: console name, ID, or composite ID (MAC:numericId format). confirm: must be true to execute. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Disable the arm alarm (POST /v1/arm-profiles/disable). Disarms the system.

WARNING: physical side effects; requires a local Alarm Manager. host: console name, ID, or composite ID (MAC:numericId format). confirm: must be true to execute. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List sirens on a Protect console (GET /v1/sirens via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one siren by id (GET /v1/sirens/{id}).

host: console name, ID, or composite ID (MAC:numericId format). siren_id: REQUIRED. Obtain it from list_sirens (its id field).

Update siren settings (PATCH /v1/sirens/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). siren_id: REQUIRED. Obtain it from list_sirens (its id field). settings: fields to change (name, volume 1-100, ledSettings). No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Sound a siren (POST /v1/sirens/{id}/play). WARNING: physical alarm sound.

host: console name, ID, or composite ID (MAC:numericId format). siren_id: REQUIRED. Obtain it from list_sirens (its id field). confirm: must be true to execute. duration: seconds (5/10/20/30; defaults to 5 upstream). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Stop a sounding siren (POST /v1/sirens/{id}/stop). WARNING: physical action.

host: console name, ID, or composite ID (MAC:numericId format). siren_id: REQUIRED. Obtain it from list_sirens (its id field). confirm: must be true to execute. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Test a siren's sound (POST /v1/sirens/{id}/test-sound). WARNING: physical sound.

host: console name, ID, or composite ID (MAC:numericId format). siren_id: REQUIRED. Obtain it from list_sirens (its id field). confirm: must be true to execute. volume: 1-100 (defaults to device volume upstream). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List fobs on a Protect console (GET /v1/fobs via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one fob by id (GET /v1/fobs/{id}).

host: console name, ID, or composite ID (MAC:numericId format). fob_id: REQUIRED. Obtain it from list_fobs (its id field).

Update fob settings (PATCH /v1/fobs/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). fob_id: REQUIRED. Obtain it from list_fobs (its id field). settings: fields to change. No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List relays on a Protect console (GET /v1/relays via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one relay by id (GET /v1/relays/{id}).

host: console name, ID, or composite ID (MAC:numericId format). relay_id: REQUIRED. Obtain it from list_relays (its id field).

Update relay settings (PATCH /v1/relays/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). relay_id: REQUIRED. Obtain it from list_relays (its id field). settings: fields to change. No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Switch a relay output (POST /v1/relays/{id}/outputs/{outputId}/activate).

WARNING: physically switches hardware. host: console name, ID, or composite ID (MAC:numericId format). relay_id: REQUIRED. Obtain it from list_relays (its id field). output_id: REQUIRED output identifier on that relay. confirm: must be true to execute. state: 'on'|'off' (omit to toggle). pulse_duration: auto-off ms (only when state='on'). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List speakers on a Protect console (GET /v1/speakers via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one speaker by id (GET /v1/speakers/{id}).

host: console name, ID, or composite ID (MAC:numericId format). speaker_id: REQUIRED. Obtain it from list_speakers (its id field).

Update speaker settings (PATCH /v1/speakers/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). speaker_id: REQUIRED. Obtain it from list_speakers (its id field). settings: fields to change. No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Test a speaker's sound (POST /v1/speakers/{id}/test-sound). WARNING: physical sound.

host: console name, ID, or composite ID (MAC:numericId format). speaker_id: REQUIRED. Obtain it from list_speakers (its id field). confirm: must be true to execute. volume: 0-100 (defaults to device volume upstream). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List bridges on a Protect console (GET /v1/bridges via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one bridge by id (GET /v1/bridges/{id}).

host: console name, ID, or composite ID (MAC:numericId format). bridge_id: REQUIRED. Obtain it from list_bridges (its id field).

Update bridge settings (PATCH /v1/bridges/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). bridge_id: REQUIRED. Obtain it from list_bridges (its id field). settings: fields to change. No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List link stations on a Protect console (GET /v1/link-stations via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one link station by id (GET /v1/link-stations/{id}).

host: console name, ID, or composite ID (MAC:numericId format). link_station_id: REQUIRED. Obtain it from list_link_stations (its id field).

Update link-station settings (PATCH /v1/link-stations/{id}) with read/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). link_station_id: REQUIRED. Obtain it from list_link_stations (its id field). settings: fields to change. No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List alarm hubs on a Protect console (GET /v1/alarm-hubs via Fabric proxy).

host: console name, ID, or composite ID (MAC:numericId format).

Get one alarm hub by id (GET /v1/alarm-hubs/{id}).

host: console name, ID, or composite ID (MAC:numericId format). alarm_hub_id: REQUIRED. Obtain it from list_alarm_hubs (its id field).

Update alarm-hub settings (PATCH /v1/alarm-hubs/{id}) with read-before/no-op/read-after.

host: console name, ID, or composite ID (MAC:numericId format). alarm_hub_id: REQUIRED. Obtain it from list_alarm_hubs (its id field). settings: fields to change. No write when all match. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

Trigger an alarm-hub output (POST /v1/alarm-hubs/{id}/outputs/{outputId}/trigger).

WARNING: physically triggers alarm-hub output hardware. host: console name, ID, or composite ID (MAC:numericId format). alarm_hub_id: REQUIRED. Obtain it from list_alarm_hubs (its id field). output_id: REQUIRED output identifier on that hub. confirm: must be true to execute. enable: true on / false off (omit to toggle). delay: ms before activating. duration: ms to stay active (0 = indefinite). Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List Protect users (GET /v1/users via Fabric proxy). Read-only in the Integration API.

host: console name, ID, or composite ID (MAC:numericId format).

Get one Protect user by id (GET /v1/users/{id}). Read-only.

host: console name, ID, or composite ID (MAC:numericId format). user_id: REQUIRED. Obtain it from list_protect_users (its id field).

Get Protect application metadata (GET /v1/meta/info via Fabric proxy). Read-only.

Reports the Protect application version and Integration-API capabilities — the authoritative check for which extended Protect families this console supports. host: console name, ID, or composite ID (MAC:numericId format).

List ULP (UniFi account) users (GET /v1/ulp-users). Read-only.

Distinct from list_protect_users (/v1/users): these are UI-account identities. host: console name, ID, or composite ID (MAC:numericId format).

Get one ULP (UniFi account) user by id (GET /v1/ulp-users/{id}). Read-only.

host: console name, ID, or composite ID (MAC:numericId format). ulp_user_id: REQUIRED. Obtain it from list_ulp_users (its id field).

Ingest a POS transaction overlay onto camera footage.

Route: POST /v1/pos/cameras/{id}/transactions (Fabric proxy).

WARNING: creates a footage overlay event with no documented rollback. This has its own confirmation boundary and an idempotency guard; the POS write is never auto-retried. host: console name, ID, or composite ID (MAC:numericId format). camera_id: REQUIRED. Obtain it from list_cameras (its id field). transaction: REQUIRED posTransactionRequest object. Must include type ('sale'|'refund'), externalId (per-camera unique idempotency/dedup key), and amount; optional currency/lineItems/location/paymentTypes/timestamp pass through. confirm: must be true to execute. Governed by UNIFI_PROTECT_MUTATIONS_ENABLED.

List all port forwarding rules for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Create a port forwarding rule via the Classic REST API.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. payload: port forward config. Required fields (validated locally — a missing field raises ValueError naming it): name, dst_port, fwd, fwd_port. proto is optional (the controller defaults it, typically 'tcp_udp'). This Classic REST endpoint enforces no required fields server-side (verified live: it accepts an empty body and silently creates a broken rule), so the local check is the only guard. Example: {"enabled": true, "name": "SSH", "pfwd_interface": "wan", "src": "any", "dst_port": "2222", "fwd": "192.168.1.10", "fwd_port": "22", "proto": "tcp", "log": false}

Update a port forwarding rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. forward_id: port forward rule ID. payload: fields to update.

Delete a port forwarding rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. forward_id: REQUIRED. Obtain it from list_port_forwards (its id field).

List traffic matching rules (QoS, application, IP group matching).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Create a traffic matching rule (QoS, block, or route by application/IP group).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. payload: required fields (validated locally — a missing field raises ValueError naming it — and verified against the live controller):

• action: 'BLOCK'|'THROTTLE_RATE'|'QUEUE'

• matching_target: 'INTERNET'|'LOCAL'|'ALL' or a traffic matching list ID

• target_devices: the devices/networks the rule applies to (required by the API; previously undocumented) Optional (NOT required by the API): description (str), enabled (bool, controller defaults it), matching_target_type ('INTERNET'|'DOMAIN'|'IP_GROUP'|'APPLICATION_GROUP'), bandwidth_limit (dict with up_limit_kbps/down_limit_kbps for THROTTLE_RATE). Note: uses the Classic REST v2 API (/v2/api/site/{siteId}/trafficrules). May not exist on firmware 10.2.105 and below.

Update a traffic rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. rule_id: traffic rule ID. payload: fields to update.

Delete a traffic rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. rule_id: REQUIRED. The rule's id; obtain it from list_traffic_rules (its id field).

Create a site-to-site VPN tunnel. This is a write operation that modifies live config.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. tunnel: tunnel configuration payload (remoteIp, psk, networks, enabled, etc.).

Update a site-to-site VPN tunnel by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. tunnel_id: tunnel ID to update. tunnel: fields to update (remoteIp, psk, networks, enabled, etc.).

Delete a site-to-site VPN tunnel by ID. This permanently removes the tunnel config.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. tunnel_id: tunnel ID to delete.

Get a single VPN server configuration by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. server_id: VPN server ID.

Create a VPN server (OpenVPN, WireGuard, or L2TP).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. vpn_type: 'openvpn', 'wireguard', or 'l2tp'. subnet: VPN client address pool CIDR.

Update a VPN server configuration by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. server_id: VPN server ID. fields: fields to update (name, type, subnet, enabled, etc.).

Delete a VPN server by ID. WARNING: Permanently removes VPN server. Connected clients will lose access immediately.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. server_id: VPN server ID.

Get a single RADIUS authentication profile by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. profile_id: RADIUS profile ID.

Create a RADIUS authentication profile.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. name: REQUIRED. Display name for the new RADIUS profile. auth_server_ip: REQUIRED. RADIUS authentication server IP address (string). auth_server_port: REQUIRED. RADIUS authentication server UDP port (integer, e.g. 1812). auth_server_secret: REQUIRED. Shared secret (string) for the RADIUS authentication server. acct_server_ip/port/secret: optional accounting server details. Note: if the console returns HTTP 405, RADIUS profile creation is not supported on this firmware version and profiles are effectively read-only. Use list_radius_profiles instead.

List hotspot operator accounts for captive portal management.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Create a hotspot operator account.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. name: operator username. password: operator password.

Update a hotspot operator by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. operator_id: hotspot operator ID. fields: fields to update (name, x_password, note, etc.).

Delete a hotspot operator by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. operator_id: hotspot operator ID.

List all configured API keys with their labels and types.

Shows which API keys are available for MSP multi-console queries. Returns labels and org-key status without exposing actual key values.

List all devices across the entire fleet.

Aggregates devices from all consoles. Optionally filter by status (e.g. 'offline', 'online', 'updating') to find problem devices quickly. status_filter is applied LOCALLY by exact (case-insensitive) match against each device's status/state. WARNING: an unrecognised value is NOT rejected — it matches nothing and returns an EMPTY device list, so a typo (e.g. 'ofline') looks like a healthy fleet with zero problem devices rather than an error. Omit status_filter to get the full fleet, then read the real status values off the returned records. key_label: scope query to a specific API key (use list_configured_api_keys to see available keys).

List all connected clients across all sites.

Fans out requests to every site and aggregates results with source host/site annotations on each client record. key_label: scope query to consoles visible to a specific API key.

Get a high-level fleet summary: host, site, and device counts with status breakdowns.

Useful for a quick overview of the entire UniFi deployment. key_label: scope summary to consoles visible to a specific API key.

Search for a device by name, MAC address, or model across the entire fleet.

Returns all matching devices from all consoles. key_label: scope search to consoles visible to a specific API key. query: REQUIRED. Search string matched against device name, model, and MAC across the fleet.

Get site health statistics: latency, throughput, and client counts per subsystem.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns a list of subsystem health objects from the Classic REST /stat/health endpoint.

Get controller/console system info: version, uptime, and memory.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns system info objects from the Classic REST /stat/sysinfo endpoint.

List detailed per-client statistics: traffic, signal strength, and experience score.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns a list of client stat objects from the Classic REST /stat/sta endpoint.

List per-device statistics: CPU load, memory, uptime, and port throughput.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns a list of device stat objects from the Classic REST /stat/device endpoint.

Get first-class per-client link/policy diagnostics for one or more clients.

Read-only and Fabric-only: reuses the same Classic REST /v1/connector/consoles/{host_id}/proxy/network/api/s/{site_slug}/stat/sta request as list_active_clients_stats, then selects the requested client(s) from that payload in memory. Surfaces link quality (rssi, signal, noise, channel, radio_name), rx_rate/tx_rate and retry counters, satisfaction_reason, network/VLAN identity, QoS, fixed-IP, and virtual-network override fields when upstream provides them — the matching record is returned unchanged, so unknown/future fields survive.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. client_id: a single client selector — its /stat/sta _id, id, or mac (case- and separator-insensitive). Provide EITHER client_id OR client_ids, not both. client_ids: a bounded, explicit list of client selectors (max 64) for multi-client selection; returns the matching records as a list. A selector that matches no client fails clearly rather than being silently skipped.

Get switch port health, PoE, optics, and LLDP telemetry for a device.

Read-only and Fabric-only: reuses the same Classic REST /v1/connector/consoles/{host_id}/proxy/network/api/s/{site_slug}/stat/device request as list_device_stats (one call, no new route), then projects the selected device's port telemetry from that payload. Upstream operational fields are preserved verbatim — link state/speed/duplex, rx/tx byte/packet/error/drop counters, PoE state and draw (poe_enable/poe_good/poe_power/poe_voltage/poe_current/poe_class/poe_mode), SFP/optics fields where present, and port config identity — nothing is renamed or dropped.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: device selector — its /stat/device _id, id, or mac (case- and separator-insensitive). port_idx: optional 1-based port number. Omit it for the device view (verbatim port_table and lldp_table plus a thermal/power summary); set it to return that single port_table row verbatim. An unknown port_idx fails clearly.

Get per-device STP/RSTP state and per-port STP role/state/path-cost.

Read-only and Fabric-only: reads the same Classic REST /v1/connector/consoles/{host_id}/proxy/network/api/s/{site_slug}/stat/device payload as list_device_stats and projects the selected device's STP fields. Returns the device-level stp_version, stp_priority, root_switch/root (and any other stp_* field present) plus per-port STP role/state/path-cost where upstream provides them, all verbatim. This tool is read-only: STP-priority write support is documented in the PR description only and no write is performed here.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. device_id: device selector — its /stat/device _id, id, or mac (case- and separator-insensitive).

List historical client connection sessions from the Classic REST /stat/session endpoint.

This is the highest-value history tool: retention is ~90 days, so it covers far more than the currently-connected client list.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. start/end: epoch SECONDS (UTC). This endpoint uses seconds natively — passing milliseconds returns HTTP 200 with an EMPTY array and no error, so seconds are enforced (millisecond-magnitude values are rejected). session_type: session class filter. The values that actually narrow the result are "all" (default — the full unfiltered set), "user" (regular clients), and "guest" (guest-network clients). WARNING: an unrecognised value is NOT rejected and does NOT return an empty array — the endpoint silently ignores it and returns the full "all" set, so a typo yields everything rather than a visible error or "no data". (UniFi documents "voucher" as a fourth class; on tested firmware it returned the full set, so prefer "user"/"guest" for real narrowing.)

Each session includes mac, is_wired, assoc_time (session start, epoch seconds), duration (seconds), ap_mac, rx_bytes, tx_bytes, satisfaction, hostname, ip, _id, and roaming_sessions[]. Two things that surprise callers:

• There is NO explicit disconnect timestamp — session end is assoc_time + duration.

• Radio band lives ONLY inside roaming_sessions[] (radio_band: na/ng/6e), never at the top level. Wired sessions have ap_mac=null and carry sw_mac/sw_port instead.

The response is passed through verbatim, including identifiers (MAC/IP/hostname).

Get bucketed historical statistics from the Classic REST /stat/report endpoint.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. interval: one of "5minutes", "hourly", "daily". scope: one of "ap", "user", "site". The "ap" scope carries num_sta per AP per bucket. start/end: epoch SECONDS (UTC). Unlike /stat/session, this endpoint requires MILLISECONDS — the tool converts seconds to milliseconds internally, so callers always pass seconds for a consistent interface. attrs: metrics to aggregate; defaults to num_sta, rx_bytes, tx_bytes.

Retention differs by interval: 5minutes ~1 day, hourly ~7 days, daily ~91 days. Output "time" is epoch milliseconds. Note: rx_bytes/tx_bytes come back as JSON floats in scientific notation (e.g. 5.27e9) — treat them as floats, not ints.

The response is passed through verbatim.

List the full per-site client roster incl. offline history (Classic REST /stat/alluser).

Unlike list_active_clients_stats (currently-connected only), this includes clients seen historically — typically far more entries. (Distinct from the fleet-wide list_all_clients aggregation tool, which spans every console.) This endpoint accepts GET.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Each entry includes mac, first_seen, last_seen, disconnect_timestamp (all epoch seconds), is_wired, oui, last_ip, last_radio, hostname, and device-fingerprint fields.

The response is passed through verbatim, including identifiers (MAC/IP/hostname/name).

List DHCP fixed-IP reservations and client aliases for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns entries with fields: name, note, fixed_ip, use_fixedip, network_id.

Get a single DHCP/client-alias entry by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. user_id: REQUIRED. Obtain it from list_users (its id field).

Update a DHCP/client-alias entry by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. payload: fields to update (name, note, fixed_ip, use_fixedip, network_id). user_id: REQUIRED. Obtain it from list_users (its id field).

List static/policy traffic routes for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Create a traffic route on a site (policy-based routing / WAN load-balancing).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. payload: required fields (validated locally — a missing field raises ValueError naming it — and verified against the live controller). This v2 endpoint uses snake_case wire field names (verified: 'network_id' is accepted, 'networkId' is not):

• network_id (str): source network UUID (from list_networks), or 'ANY'

• matching_target: 'INTERNET'|'ALL' or a traffic matching list ID

• target_devices: the devices/networks the route applies to Optional: matching_target_type ('INTERNET'|'DOMAIN'|'IP_GROUP'), description (str).

Get a single traffic route by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. route_id: REQUIRED. Obtain it from list_traffic_routes (its id field).

Update a traffic route by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. payload: full traffic route configuration to replace with. route_id: REQUIRED. Obtain it from list_traffic_routes (its id field).

Delete a traffic route by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. route_id: REQUIRED. Obtain it from list_traffic_routes (its id field).

List all controller setting groups for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns a list of setting objects grouped by key (mgmt, super_smtp, guest_access, etc.).

Get a controller setting group by key.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. setting_key: setting group identifier (e.g. 'mgmt', 'super_smtp', 'guest_access').

There is no schema endpoint, so reading a group is how you discover what it accepts: the returned object lists every settable field and its current (valid) value. Inspect it before calling update_setting — the controller silently drops any field or enum value it does not recognise, so match an existing field's shape exactly. Common keys and notable enum fields (grounded in live responses): mdns (mode, enabled_for), ntp (setting_preference), doh (state), ips (ips_mode), global_nat (mode), ssl_inspection (state), dashboard (layout_preference), locale (timezone), country (code), guest_access (auth), super_mgmt (data_retention_setting_preference). Fields prefixed 'x_' hold credentials/secrets and are returned verbatim.

Update a controller setting group by key.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. setting_key: setting group identifier (e.g. 'mgmt', 'super_smtp', 'guest_access'). payload: setting fields to update.

Discover the schema first by calling get_setting(setting_key): it returns every settable field and its current (valid) value. The controller silently drops any unrecognised field or enum value (HTTP 200, value unchanged), so a guessed value fails invisibly; this tool detects that no-op and raises an error naming the rejected field and pointing you back at get_setting.

List Dynamic DNS provider configurations for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returned verbatim, including plaintext x_password credential fields.

Get a single Dynamic DNS configuration by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returned verbatim, including plaintext x_password credential fields. ddns_id: REQUIRED. Obtain it from list_dynamic_dns (its id field).

Update a Dynamic DNS configuration by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. payload: DDNS configuration fields to update. ddns_id: REQUIRED. Obtain it from list_dynamic_dns (its id field).

List switch port profiles (speed, VLAN, PoE config) for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Get a single switch port profile by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. profile_id: port profile ID.

Update a switch port profile by ID.

WARNING -- SHARED PROFILE, WIDE BLAST RADIUS: this edits a shared Ethernet Port Profile (Classic REST /rest/portconf), NOT one switch or one port. A single write changes STP/PoE/storm-control/VLAN/etc. for EVERY port on EVERY switch that has this profile assigned. It is NOT a per-device or per-port writer and must never be presented or used as a per-port/per-device STP-priority or PoE-mode writer -- for that, no confirmed per-port config route exists via this API. Read the profile's assignments and confirm the intended blast radius before writing.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. profile_id: port profile ID. payload: fields to update (e.g. speed, native_networkconf_id, op_mode, poe_mode). Applies to every port using this profile, not a single port.

Atomically allow (un-exclude) a VLAN network on a switch port profile.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. profile_id: REQUIRED. The port profile id; from list_port_profiles (its _id). network_id: REQUIRED. The networkconf id to allow; from list_networks (its id) or the resolved id fields in list_port_profiles output. confirm: must be True to execute. This is a live PUT to a SHARED port profile (its exclusion list affects every switch port using it); it refuses with an error dict when confirm is False, before any controller call.

This is the D12 auto-exclusion remediation: it fresh-reads the profile, removes network_id from excluded_networkconf_ids, PUTs, and returns {profile, tagged_networks} with the resulting tagged VLAN set rendered with names. Use it on every profile named in a create_network D12_AUTO_EXCLUSION warning.

Atomically exclude (untag) a VLAN network from a switch port profile.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. profile_id: REQUIRED. The port profile id; from list_port_profiles (its _id). network_id: REQUIRED. The networkconf id to exclude; from list_networks (its id). confirm: must be True to execute. This is a live PUT to a SHARED port profile (its exclusion list affects every switch port using it); it refuses with an error dict when confirm is False, before any controller call.

Inverse of allow_network_on_port_profile: fresh-reads the profile, adds network_id to excluded_networkconf_ids, PUTs, and returns {profile, tagged_networks} with names resolved.

List static routing table entries for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

List per-SSID WLAN configurations (security, band steering, rate limits) for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returned verbatim, including plaintext x_passphrase credential fields.

Get a single WLAN (SSID) configuration by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. wlan_id: WLAN config ID. Returned verbatim, including plaintext x_passphrase credential fields.

Update a WLAN (SSID) configuration by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. wlan_id: WLAN config ID. payload: fields to update (e.g. x_passphrase, security, band, enabled).

List WLAN groups for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Get a single WLAN group by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. group_id: WLAN group ID.

Get RF channel assignments and DFS status for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

List neighboring APs detected by the site's radios.

Returns ALL neighboring APs (most will have is_rogue=false and are benign neighbors). Only a small subset with is_rogue=true are confirmed rogue APs. Set rogue_only=true to filter to confirmed rogues only.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returns entries with BSSID, SSID, channel, signal strength, is_rogue flag, and detection time.

List classic L3/L4 firewall rules for a site (distinct from Integration API policies).

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Get a single classic firewall rule by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. rule_id: firewall rule ID.

List firewall groups (IP/port sets referenced by firewall rules) for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Get a single firewall group by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. group_id: firewall group ID.

List local RADIUS user accounts for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. Returned verbatim, including plaintext x_password credential fields.

Get a single RADIUS account by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. account_id: RADIUS account ID. Returned verbatim, including plaintext x_password credential fields.

List guest portal billing packages for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Get a single hotspot billing package by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. package_id: hotspot package ID.

List scheduled tasks (firmware upgrade schedules, speed tests) for a site.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID.

Get a single scheduled task by ID.

host: console name, ID, or composite ID (MAC:numericId format). site: site name or ID. task_id: scheduled task ID.

List DPI (Deep Packet Inspection) app categories available for traffic rules.

Categories include Social Media, Streaming Video, Gaming, etc. host: console name, ID, or composite ID (MAC:numericId format). site: ignored — DPI data is host-level, not site-scoped. By default every page is drained and the complete catalogue is returned as {data, totalCount}. Pass offset/limit to fetch a single page manually. A capped drain returns the categories gathered so far with incomplete=true rather than truncating silently.

List DPI applications available for traffic rules.

Companion to list_dpi_categories; use application IDs in traffic rule configurations. host: console name, ID, or composite ID (MAC:numericId format). site: ignored — DPI data is host-level, not site-scoped. By default every page is drained and the complete catalogue is returned as {data, totalCount}. Pass offset/limit to fetch a single page manually. A capped drain returns the applications gathered so far with incomplete=true rather than truncating silently.

Inventory a console's InnerSpace floor-plan project without the full payload.

Returns counts and structure: shape breakdown by type (wall / device / map / scale), per-floor plans with each plan's own scale, product and wall-material / attenuation-type dictionary sizes, and project metadata. Call this before get_innerspace_project when you only need to know what's present. Surfaces the multi-floor caveat: floors do not share a coordinate origin.

host: console name, ID, or composite ID (MAC:numericId format). mode: '3D' (default; device shapes carry real metric mounting heights) or '2D'.

Return the full InnerSpace floor-plan project geometry for a console.

The complete (~66 KB) project document: shapes, plans, products, wall types, and attenuation-object types. Returned verbatim, including device meta.mac / meta.ip and floor-plan image/asset URLs. Prefer get_innerspace_summary first if you only need an inventory — this payload is large.

host: console name, ID, or composite ID (MAC:numericId format). mode: '3D' (default; device shapes carry real metric mounting heights) or '2D' (device shapes flattened to z=0). 3D is the only mode with real heights.

List placed device shapes from a console's InnerSpace floor-plan.

Each mounted device's placement: mount, productId, title, position, and rotation (pov = heading/yaw, base = mount tilt). Returned verbatim, including device meta.mac / meta.ip. Use mode='3D' (default) for real metric mounting heights; mode='2D' flattens positions to z=0.

host: console name, ID, or composite ID (MAC:numericId format). mode: '3D' (default) or '2D'.

List a console's InnerSpace floor plans (documented Integration API).

Each floor plan carries id, name, floor_number, image_url (an asset path — fetch with get_innerspace_asset), ppm (pixels per metre, the scale for interpreting coordinates/heights), width/height (image pixels), origin_x/origin_y, and site_id when filtered. Returned verbatim.

host: console name, ID, or composite ID (MAC:numericId format). site_id: optional UniFi site filter — only floor plans whose product siteId matches.

List placed access points from a console's InnerSpace floor plans (Integration API).

Each AP carries id, name, model (SKU), mac, serial, floor_plan_id, x/y (pixels on the floor-plan image), height (mounting height in metres), azimuth (antenna orientation, 0-360 degrees), mount, and status. Returned verbatim, including mac/serial.

host: console name, ID, or composite ID (MAC:numericId format). site_id: optional UniFi site filter — only APs whose product siteId matches.

List placed switches from a console's InnerSpace floor plans (Integration API).

Each switch carries id, name, model, type (switch), mac, serial, floor_plan_id, x/y (pixels on the floor-plan image), and status. Returned verbatim, including mac/serial.

host: console name, ID, or composite ID (MAC:numericId format). site_id: optional UniFi site filter — only switches whose product siteId matches.

List UNPLACED device inventory for a console's InnerSpace project (Integration API).

Devices known to the project but not yet positioned on a floor plan. Each carries id, name, model, mac, and serial. Returned verbatim, including mac/serial. The response array key is 'devices'.

host: console name, ID, or composite ID (MAC:numericId format). site_id: optional UniFi site filter — only inventory whose product siteId matches.

Download a floor-plan asset (image) from a console's InnerSpace project.

Fetches the binary asset from the documented …/integration/v1/assets/{planId}/ {filename} endpoint (a floor plan's image_url resolves here). Bytes are returned base64-encoded inline under image_base64 when at or below the 10 MiB inline cap; a larger asset returns metadata only (image_base64=null) plus a note and the connector path to fetch it out-of-band. content_type is the upstream media type (typically image/jpeg or image/png).

host: console name, ID, or composite ID (MAC:numericId format). plan_id: the id in the {planId} segment of the floor plan's image_url -- i.e. the value between '/assets/' and the trailing '/{filename}'. This is the asset-group UUID and is NOT the floor plan's own 'id' field (they differ); passing the plan 'id' returns HTTP 404. Parse both plan_id and filename from image_url (from list_innerspace_floor_plans) rather than constructing them from the plan id. filename: the asset filename as published in the floor plan's image_url.

List Carrier / ISP Fabric subscribers visible to the authenticated ISP key.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only — the Carrier Fabric is not deployed here. Cursor-paginated by the API; every page is drained and the complete list is returned under subscribers.

plan_id: optional service-plan UUID filter. suspended: optional boolean filter. sort: optional createdAt/-createdAt/name/-name/subscriberNumber/-subscriberNumber. key_label: optional configured API-key label to route on a specific key.

Get one Carrier / ISP Fabric subscriber by ID.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. Returns the full Subscriber object verbatim under subscriber; an unknown id surfaces the upstream subscriber_not_found (404) verbatim.

subscriber_id: the subscriber UUID from list_carrier_subscribers. key_label: optional configured API-key label to route on a specific key.

List the Carrier / ISP Fabric service plans for the authenticated organization.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. Not query- paginated by the API; the full set is returned under service_plans.

key_label: optional configured API-key label to route on a specific key.

Get one Carrier / ISP Fabric service plan by ID.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. An unknown id surfaces the upstream service_plan_not_found (404) verbatim.

plan_id: the service-plan UUID from list_carrier_service_plans. key_label: optional configured API-key label to route on a specific key.

Create a Carrier / ISP Fabric subscriber (POST /v1/carrier/subscribers). Guarded write.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only; a live create is impossible here. subscriber_number is required (1-32 chars). Optional name (<=128), email (<=255), notes (<=4096), service_address (<=1024), plan_id (UUID), metadata (object). Requires confirm=true and the UNIFI_ENABLE_CARRIER_FABRIC_WRITE gate.

subscriber_number: unique subscriber number (1-32 characters). name/email/notes/service_address/plan_id/metadata: optional profile fields. confirm: must be true to apply the create. key_label: optional configured API-key label to route on a specific key.

Update a Carrier / ISP Fabric subscriber (PATCH .../subscribers/{id}). Guarded write.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. Documented partial update: only the fields you pass are sent; omitted fields are left unchanged; pass at least one. subscriber_number is 1-32 chars when provided. Guarded: read-before, no-op when all provided fields already match, confirm=true, write kill-switch, read-after. NOTE: unlike the module function, omitting a field here (None) leaves it unchanged — MCP cannot express an explicit-null "clear" through this wrapper.

subscriber_id: the subscriber UUID from list_carrier_subscribers. subscriber_number/name/email/notes/service_address/plan_id/metadata: optional new values. confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Attach or re-link a subscriber's gateway host (PUT .../subscribers/{id}/host). Guarded.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. host_id must be a host in the same ISP organization. Guarded: read-before, no-op when already linked, confirm=true, write kill-switch, read-after (reports prev_host_id).

subscriber_id: the subscriber UUID from list_carrier_subscribers. host_id: the gateway host id to link. confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Detach a subscriber's gateway host (DELETE .../subscribers/{id}/host). Guarded write.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. Guarded: read-before, no-op when no host is attached, confirm=true, write kill-switch, read-after (reports the just-detached prev_host_id).

subscriber_id: the subscriber UUID from list_carrier_subscribers. confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Assign a service plan to a subscriber (PUT .../subscribers/{id}/plan). Guarded write.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. An archived or unknown plan is rejected upstream. Guarded: read-before, no-op when already on this plan, confirm=true, write kill-switch, read-after.

subscriber_id: the subscriber UUID from list_carrier_subscribers. plan_id: the service-plan UUID to assign (from list_carrier_service_plans). confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Suspend a subscriber's service (POST .../subscribers/{id}/suspend). Guarded write.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. Guarded: read-before, no-op when already suspended, confirm=true, write kill-switch, read-after. An optional reason is recorded on the subscriber.

subscriber_id: the subscriber UUID from list_carrier_subscribers. reason: optional free-text suspension reason. confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Resume a suspended subscriber's service (POST .../subscribers/{id}/resume). Guarded.

Not testable against the maintainer's live hardware; hermetic/spec-conformance tested only. Guarded: read-before, no-op when not currently suspended, confirm=true, write kill-switch, read-after.

subscriber_id: the subscriber UUID from list_carrier_subscribers. confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Relay a GET through the official Fabric connector to a console's /proxy/.

The escape hatch for a controller-supported route that has no typed tool yet. Always available — GET needs no confirm. A 4xx/5xx is returned as status (not raised), so a probe of an unknown route surfaces its own reachability status.

host: console name or ID (resolved to the owning API key + host id via the Registry). path: the relay-relative application path AFTER /proxy/ — e.g. network/integration/v1/sites or network/api/s/{site}/stat/device. Use the {site} (slug) or {site_id} (UUID) placeholder for the site segment; the server resolves and substitutes it (raw host/site ids and API keys never appear on the tool surface). Only approved UniFi application namespaces are allowed (Network integration/classic/v2, Protect integration/private, InnerSpace integration/legacy, Access); .., %-encoding, and control characters are rejected. site: site name or UUID — REQUIRED only when path contains a site placeholder. params: optional query-string parameters. scope: optional 'device' / 'site' / 'global' — cross-checked against the path so a device route cannot be confused with a site-global setting route. Returns {method, routeClass, path, resolvedPath, status, body} (body credential-redacted).

Relay a POST (create/command) through the Fabric connector. MUTATION — GATED.

Refused unless BOTH confirm=true AND the server's UNIFI_ENABLE_CONNECTOR_WRITE flag are set (fail-closed; gating is checked before any network call). POST targets a collection or command route (e.g. network/api/s/{site}/cmd/...); it has no GET twin, so no read-before/after is performed. The upstream status/body (redacted) and routeClass are returned; a 4xx/5xx is reported, not raised.

See fabric_connector_get for host/path/site/scope semantics. body: the JSON request body. Every attempt is written to the structured audit log (never the API key value).

Relay a PUT (full replace) through the Fabric connector. MUTATION — GATED.

Refused unless BOTH confirm=true AND UNIFI_ENABLE_CONNECTOR_WRITE are set. PUT has a GET twin at the same resource path, so the resource is read BEFORE and AFTER the write and the result carries readBefore / readAfter / noOp (diff-based: a same-value write is flagged noOp=true). Use this for reversible per-device config probes (e.g. Classic REST network/api/s/{site}/rest/device/{id}); scope='device' guards against selecting a site-global setting route. EXPERIMENTAL for undocumented legacy routes until persistence and rollback are proven live.

See fabric_connector_get for host/path/site/scope semantics. body: the JSON request body.

Relay a PATCH (partial update) through the Fabric connector. MUTATION — GATED.

Refused unless BOTH confirm=true AND UNIFI_ENABLE_CONNECTOR_WRITE are set. PATCH has a GET twin, so read-before/write/read-after with noOp detection applies (see fabric_connector_put). The candidate legacy InnerSpace save route (innerspace/api/shapes/{id}) is a PATCH; probe it with a nonexistent shape ID and an empty/invalid body first — a 4xx is reachability evidence, and a 200/204 on such a probe is a stop condition, not a success. EXPERIMENTAL until persistence/rollback are proven.

See fabric_connector_get for host/path/site/scope semantics. body: the JSON request body.

Relay a DELETE through the Fabric connector. MUTATION — GATED, IRREVERSIBLE.

Refused unless BOTH confirm=true AND UNIFI_ENABLE_CONNECTOR_WRITE are set. DELETE has a GET twin, so the resource is read before and after; a successful delete makes the read-after return a 4xx, which the result records. There is no undo — confirm the exact resource path before enabling.

See fabric_connector_get for host/path/site/scope semantics. body: optional JSON body.

List UniFi Mobility workspaces visible to the authenticated API key.

A workspace is a mobility "cloud site" (workspace_id, workspace_name, is_owner, status). Returned verbatim. Not query-paginated by the API. Mobility identity is workspace-based and independent of the console host/site model.

key_label: optional configured API-key label to route the request on a specific key (multi-key deployments). Omit to use the default key.

List the admins of a Mobility workspace (mobility permissions only).

Each admin carries name, email, status, is_owner and a permissions object exposing the umr (Mobile Routing) level (ALL/VIEW_ONLY/NONE); permissions is null for a pending invite. Returned verbatim.

workspace_id: the workspace UUID from list_mobility_workspaces. key_label: optional configured API-key label to route on a specific key.

List the UMR devices in a Mobility workspace.

Each device is the lightweight summary (id, name, model, state, firmware_version, mac_address). Offset-paginated by the API (limit/offset, 200 max); every page is drained.

workspace_id: the workspace UUID from list_mobility_workspaces. key_label: optional configured API-key label to route on a specific key.

Get full detail for one UMR device in a Mobility workspace.

Returns the complete DeviceDetail (WAN/cellular/WiFi/VPN/subscription/GPS, counts, and the summary fields) verbatim under device.

workspace_id: the workspace UUID from list_mobility_workspaces. device_id: the device UUID from list_mobility_devices. key_label: optional configured API-key label to route on a specific key.

List the clients associated with a UMR device.

Each client carries mac, name, type (WIRED/WIRELESS), connection_status, ip_address, is_blocked and (wireless only) a wifi_experience score. Offset-paginated by the API (limit/offset, 200 max); every page is drained.

workspace_id: the workspace UUID from list_mobility_workspaces. device_id: the device UUID from list_mobility_devices. key_label: optional configured API-key label to route on a specific key.

Rename a UMR device (guarded write). WARNING: mutates live device config.

Sends the full documented body {"name": name} (1-32 chars). Read-before, no-op detection (returns status="no_op" when already named this), confirm=true guard (returns a current-vs-proposed preview otherwise), an environment kill-switch (UNIFI_ENABLE_MOBILITY_WRITE, gated OFF by default pending issue #186 semantics verification), and a read-after verification.

workspace_id: the workspace UUID from list_mobility_workspaces. device_id: the device UUID from list_mobility_devices. name: the new device name (1-32 characters). confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Update a UMR device's LAN / DHCP settings (guarded write). Mutates live config.

DOCUMENTED partial update: only provided fields are applied (WAN/IPv6/ InternetSource are not configurable here). At least one field is required. WARNING: docs conflict on full-replacement vs partial-merge PUT semantics, so writes are gated OFF by default pending live verification (issue #186). dhcp_mode is 'dhcp' (enabled) or 'none' (disabled); IPs must be IPv4; dhcp_lease_time is seconds (0 = infinite). Read-before, no-op detection on the observable host_address, confirm=true guard, kill-switch, read-after.

workspace_id: the workspace UUID from list_mobility_workspaces. device_id: the device UUID from list_mobility_devices. host_address: optional new LAN gateway IPv4. dhcp_mode: optional 'dhcp' or 'none'. dhcp_range_start: optional DHCP pool start IPv4. dhcp_range_stop: optional DHCP pool end IPv4. dhcp_lease_time: optional DHCP lease seconds (>=0; 0 = infinite). confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.

Update a UMR device's WiFi SSID + password (guarded write). Mutates live config.

Both fields are required by the API (channel/TX power/security protocol are not configurable here). ssid is 1-32 chars; password is a WPA2-PSK secret of 8-63 chars. Read-before, confirm=true guard, kill-switch, read-after. There is no no-op short-circuit (the password is not observable, so an unchanged config cannot be proven). The supplied password is not echoed back in the result.

workspace_id: the workspace UUID from list_mobility_workspaces. device_id: the device UUID from list_mobility_devices. ssid: the new WiFi SSID (1-32 characters). password: the new WPA2-PSK password (8-63 characters). confirm: must be true to apply the change. key_label: optional configured API-key label to route on a specific key.