[WRITE] Create a new alert definition referencing existing symptom definitions.

Returns the new definition's id and name. Run list_symptom_definitions first for symptom_definition_ids; to silence an existing definition use set_alert_definition_state rather than creating a variant.

Args: name: Alert definition name (must be unique in Aria Operations). description: When and why this alert fires. resource_kind: VirtualMachine, HostSystem, ClusterComputeResource, or Datastore. symptom_definition_ids: Symptom definition UUIDs; any one firing triggers the alert (OR). criticality: Alert severity: INFORMATION, WARNING, IMMEDIATE, CRITICAL. adapter_kind: Adapter kind key. Default VMWARE (vSphere adapter). target: Aria target name from config; default when omitted.

[WRITE] Enable or disable an existing alert definition.

Returns definition_id, enabled, and the action taken. Use this instead of delete_alert_definition when you only want to silence a definition — disabling is reversible, deleting is not.

Args: definition_id: Alert definition UUID (from list_alert_definitions). enabled: True to enable the definition, False to disable it. target: Aria target name from config; default when omitted.

[READ] List alerts from Aria Operations.

Returns alert summaries: name, criticality, status, impact, resource_id, timestamps, and control state. The Alert model does not carry a resource name — resolve it via get_resource(resource_id).

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: active_only: Return only active (non-cancelled) alerts. Default True. criticality: Filter by criticality: INFORMATION, WARNING, IMMEDIATE, CRITICAL. resource_id: Scope alerts to a specific resource UUID. limit: Max alerts to return (1–500). Default 100. target: Aria target name from config; default when omitted.

[READ] Get full details for one alert by UUID, including its contributing (triggered) symptoms. Use this after list_alerts to drill into a single alert; use list_alerts to discover or filter them. Returns one alert object: name, criticality, status, impact, resource_id, start/update/cancel timestamps, control state, and symptoms. The Alert model does not carry a resource name — resolve it via get_resource(resource_id), or call investigate_alert to do that correlation in one step. Recommendations hang off the alert definition, not the alert. To act on the alert afterwards, use acknowledge_alert or cancel_alert.

Args: alert_id: The alert UUID (from list_alerts). target: Aria target name from config; default when omitted.

[READ] List alert definitions (templates that generate alerts when triggered).

criticality is the max severity across the definition's states[] (the AlertDefinition model has no top-level criticality or enabled field). Pass a returned id to set_alert_definition_state to enable or disable it.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: name_filter: Substring filter on definition name (case-insensitive). limit: Max definitions to return (1–500). Default 100. target: Aria target name from config; default when omitted.

[READ] List symptom definitions — use the returned IDs when calling create_alert_definition.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: name_filter: Substring filter on symptom name (case-insensitive). resource_kind: Optional resource kind filter, e.g. VirtualMachine, HostSystem. limit: Max symptom definitions to return (1–500). Default 100. target: Aria target name from config; default when omitted.

[READ] Resolve one alert to its affected resource in a single call — use this instead of chaining get_alert then get_resource by hand.

Does the whole alert-to-object correlation server-side: fetches the alert, reads its resourceId, fetches that resource, and confirms the resource name and kind before suggesting anything downstream.

Returns five always-present keys: alert (Aria's values verbatim), resource (or null), correlation (both UUIDs labelled, plus confirmed name, kind and a confirmed flag), next_step (which vmware-monitor tool to call next, or null), and warnings (empty on success).

Gotchas: alert_id is the alert UUID from list_alerts, NOT the resource UUID — mixing them up is the most common error here; the correlation block labels each. An unresolvable resource degrades to a warning plus nulls rather than an error, so the alert is never lost. Never match the resource against vCenter inventory unless correlation.confirmed is true.

Args: alert_id: The alert UUID from list_alerts (not the resource UUID). target: Aria target name from config; default when omitted.

[READ] Report per-resource anomaly counts (System Attributes|total_alarms metric).

The suite-api does not expose the UI's anomalous-metrics list; this is the Total Anomalies metric — active symptoms, events and DT violations on the object and its children. With resource_id: that resource's count. Without: scans up to limit VMs and returns those with non-zero counts, sorted descending. For root cause, follow up with list_alerts(resource_id=...). One stats call per VM when listing — keep limit modest.

Returns a paginated envelope: flagged rows under items, plus returned, limit, total, truncated, hint, and scanned (how many VMs were examined). A short list is not proof the environment is clean — truncated is true whenever VMs went unscanned.

Args: resource_id: Optional resource UUID to scope to a single resource. limit: Maximum VMs to scan when listing (1–100). Default 50. target: Aria target name from config; default when omitted.

[READ] Get the risk badge score for a resource (0–100, higher = more risk of future problems).

The risk badge predicts likelihood of performance degradation or availability issues based on current trends and workload patterns. Returns risk_score and risk_color for the one resource. Use this when the risk number is all you want; get_resource_health returns health and efficiency alongside it. The score is null when Aria has not computed a risk badge, and the badge does not say what is wrong — use list_alerts(resource_id=...) for the contributing alerts.

Args: resource_id: The resource UUID. target: Aria target name from config; default when omitted.

[READ] Returns a capacity overview for a cluster — the group-level remaining-capacity percentage (capacity_remaining_pct, which only exists at group level) plus per-dimension (cpu/mem/diskspace) absolute remaining capacity and projected days-until-full, from the OnlineCapacityAnalytics metrics. Values are None while capacity analytics are still warming up on a fresh instance. Start here when assessing overall cluster capacity health; for absolute headroom values use get_remaining_capacity, and for just the exhaustion projections use get_time_remaining.

Args: cluster_id: The cluster resource UUID (ClusterComputeResource, from list_resources). target: Aria target name from config; default when omitted.

[READ] Get remaining capacity headroom for a cluster or host — how much more workload fits before hitting limits. Returns the group-level capacity_remaining_pct (only available at group level) plus one entry per capacity dimension (cpu, mem, diskspace) with remaining_value (absolute, unit per dimension e.g. MHz/KB), from the OnlineCapacityAnalytics demand model. Values are None while capacity analytics warm up. Use get_capacity_overview for the combined view, or get_time_remaining for projected days-until-full.

Args: resource_id: The resource UUID — a ClusterComputeResource or HostSystem (from list_resources). target: Aria target name from config; default when omitted.

[READ] Predict when a cluster will exhaust its capacity based on usage trends.

Returns time_remaining: one entry per capacity dimension (cpu, mem, diskspace) with projected days until full. Use get_capacity_overview instead when you also want current headroom — this tool returns only the projections. Days are None while capacity analytics warm up on a fresh instance, and None does not mean unlimited.

Args: resource_id: The resource UUID (typically ClusterComputeResource). target: Aria target name from config; default when omitted.

[READ] List VM rightsizing data — recommended CPU/memory size per VM.

Reads the OnlineCapacityAnalytics recommendedSize metrics (the public API's rightsizing signal; the UI Rightsize page uses internal APIs). Compare against the VM's provisioned size to find over/under-provisioning. Values are None while capacity analytics warm up. One stats call per VM — keep limit modest. Get VM UUIDs from list_resources.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: resource_id: Optional VM resource UUID to scope to a single VM. limit: Maximum VMs to evaluate when listing (1–100). Default 50. target: Aria target name from config; default when omitted.

[READ] Check Aria Operations platform node status (ONLINE/OFFLINE).

Returns overall_status ("ONLINE" when all internal services run, else "OFFLINE" — the endpoint itself answers 503 when offline), healthy bool, system_time_ms, and details. Use this to verify Aria Operations is functioning before investigating monitoring blind spots; per-service breakdown is not exposed by the public API. A 503 from the platform is reported as OFFLINE and never raised, so this answers even while Aria is down. When status is ONLINE but data looks stale, check list_collector_groups next.

Args: target: Aria target name from config; default when omitted.

[READ] List Aria Operations collector groups and their member collector status.

Collectors are remote agents that gather metrics from vSphere and other adapters. Check this when resources appear missing from Aria Operations or metrics are stale. Groups list member collector IDs; details (name, state UP/DOWN, local) are enriched via one extra collectors call. A DOWN collector means list_resources and the metric tools see stale or missing data for everything behind it.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: target: Aria target name from config; default when omitted.

[READ] List available report definition templates in Aria Operations. Pass a returned id to generate_report to run one.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: name_filter: Substring filter on report name (case-insensitive). limit: Max definitions to return (1–500). Default 100. target: Aria target name from config; default when omitted.

[WRITE] Trigger generation of a report from a report definition template.

Returns immediately with a report_id and PENDING status; it does not wait for the file. Poll get_report(report_id) until status == COMPLETED, then use download_url.

Args: definition_id: Report definition (template) UUID from list_report_definitions. resource_ids: REQUIRED — at least one resource UUID. The Report API generates against a single root resource (first ID is used); pass a cluster/datacenter UUID to cover its children. Find IDs via list_resources. target: Aria target name from config; default when omitted.

[READ] List generated reports, optionally filtered by report definition. Pass a returned id to get_report for its status and download URLs.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: definition_id: Optional report definition UUID to filter results. limit: Max reports to return (1–200). Default 50. target: Aria target name from config; default when omitted.

[READ] Get status and download URLs for a generated report.

Returns id, name, status (PENDING, RUNNING, COMPLETED, FAILED), definition_id, completion_time_ms, download_url (PDF) and csv_url. Use this to poll after generate_report. The URLs are always constructed, so a download_url is present even while the report is still PENDING — check status before fetching it.

Args: report_id: The report UUID (from generate_report or list_reports). target: Aria target name from config; default when omitted.

[READ] List resources in Aria Operations filtered by kind. Start here: this turns a name or kind into the UUID other resource tools need. Then call get_resource for detail on one row.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: resource_kind: e.g. VirtualMachine, HostSystem, ClusterComputeResource, Datastore, Datacenter. limit: Maximum number of results. Default 100. Paginated automatically, so a larger limit spans more than one page. name_filter: Substring filter on resource name (case-insensitive). target: Aria target name from config; default when omitted.

[READ] Returns one resource object: id, name, kind, adapter kind, identifiers, status states, and the health/risk/efficiency badges (each a color plus 0-100 score, null when Aria has not scored that badge). Use this after list_resources to inspect a single UUID in depth — it does not accept a name, so use list_resources to discover UUIDs by kind or name. For just the badge scores use get_resource_health; for time-series metrics use get_resource_metrics.

Args: resource_id: The resource UUID (from list_resources). target: Aria target name from config; default when omitted.

[READ] Fetch time-series metric statistics for a resource.

Returns a dict keyed by metric key, each mapping to a list of {timestamp_ms, value} points — not an envelope. Use this for history; for a single current score use get_resource_health instead. A key the API has no data for does not appear in the result at all, so check which keys came back before reporting a metric as zero.

Args: resource_id: The resource UUID. metric_keys: Metric keys to fetch, e.g. ["cpu|usage_average", "mem|usage_average", "disk|usage_average", "net|usage_average"]. hours: Number of hours of history to retrieve. Default 1. rollup_type: Aggregation type: AVG, MAX, MIN, SUM, COUNT, LATEST. Default AVG. target: Aria target name from config; default when omitted.

[READ] Get the health, risk, and efficiency badge scores for a resource.

Returns the three scores and their colors, from the resource's badges[] array. Scores are 0–100 (higher = healthier for HEALTH). Use this when the scores are all you need; use get_resource for the whole object, or list_alerts(resource_id=...) for what drove a low score. A score is null (or -1) when Aria has not computed that badge — that does not mean healthy.

Args: resource_id: The resource UUID. target: Aria target name from config; default when omitted.

[READ] Query resources with highest consumption of a given metric. Then call get_resource_metrics on a returned id for its history.

Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

Args: metric_key: Metric to rank by, e.g. cpu|usage_average, mem|usage_average, disk|usage_average. resource_kind: Resource kind to scope the query. Default VirtualMachine. top_n: Number of top consumers to return (max 50). Default 10. target: Aria target name from config; default when omitted.

[WRITE] Acknowledge an active alert by taking ownership (does not cancel it).

The suite-api has no dedicated "acknowledge" action; this maps to POST /alerts?action=takeownership, assigning the alert to the API user (control state ASSIGNED). The alert remains active until cancelled. Use this when you want to own the alert without closing it; cancel_alert closes it for good. Default confirmed=False returns a preview without making any change.

Args: alert_id: The alert UUID to acknowledge. confirmed: Must be True to actually acknowledge. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Cancel (dismiss) an active alert. This WRITE operation permanently closes the alert.

Use acknowledge_alert instead if you only want to mark it as seen. Cancelled alerts will not re-trigger unless the underlying condition recurs. Default confirmed=False returns a preview without making any change.

Args: alert_id: The alert UUID to cancel. confirmed: Must be True to actually cancel. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Permanently delete an alert definition. Irreversible.

This WRITE operation removes the alert definition from Aria Operations. Active alerts generated by this definition will not be affected. Use set_alert_definition_state(enabled=False) instead to silence a definition you may want back. Default confirmed=False returns a preview without making any change.

Args: definition_id: Alert definition UUID to delete. confirmed: Must be True to actually delete. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Permanently delete a generated report artifact from Aria Operations. Removes only the generated report instance and its output — the report definition and any schedules remain intact; re-run generate_report to recreate it. Deletion is irreversible and is recorded in the audit log. Returns an error if the report_id does not exist; use list_reports to find valid UUIDs first. Default confirmed=False returns a preview without deleting.

Args: report_id: The report UUID to delete (from generate_report or list_reports). confirmed: Must be True to actually delete. Default False = preview only. target: Aria target name from config; default when omitted.