[WRITE] Configure BGP settings on a Tier-0 gateway's locale-service.

Use get_tier0_gateway first to confirm the tier0_id. Sets BGP settings only (local AS, ECMP, inter-SR iBGP); neighbor creation is a separate Policy API object not exposed here, so peering will not come up from this call alone. Returns the updated BGP config dict, else {"error", "hint"}. Then check get_bgp_neighbors for session state.

[WRITE] Create an IP address pool with one static subnet and allocation range.

IP pools supply addresses to NSX consumers such as tunnel endpoints. Run list_ip_pools first to avoid overlapping ranges; start_ip and end_ip must both fall inside cidr. The same pool_id overwrites (PUT). Returns {"created", "pool_id", "subnets_created", "subnets_failed"}. If the subnet failed it also has "error": the pool itself WAS created and needs cleaning up (the error says how). Other failures return {"error", "hint"}. Verify with get_ip_pool_usage; delete_ip_pool is the inverse.

[WRITE] Create a NAT rule on a Tier-1 gateway's USER NAT section.

Run list_tier1_gateways for tier1_id and list_nat_rules to avoid an id clash — the same rule_id overwrites. The gateway must have an edge cluster (see create_tier1_gateway) or NAT cannot be realized, and TIER1_NAT advertisement must be set via update_tier1_gateway for the translated address to be reachable from outside. Returns the created rule dict, else {"error", "hint"}. Then confirm with list_nat_rules; delete_nat_rule is the inverse.

[WRITE] Create an overlay or VLAN-backed NSX network segment.

Run list_transport_zones first for transport_zone_path; it decides whether subnet or vlan_ids applies — the wrong one is rejected. The same segment_id overwrites (PUT). Returns the created segment dict, else {"error", "hint"}. A segment with no gateway is isolated: link it with create_tier1_gateway, then verify with get_segment.

[WRITE] Create a static route on a Tier-0 or Tier-1 gateway via the Policy API.

Use this for destinations not covered by connected or advertised routes, e.g. a VPN or external subnet. Run list_static_routes first to avoid an id clash — the same route_id overwrites (PUT). For the Tier-0 to advertise a Tier-1's static route upstream, the gateway needs TIER1_STATIC_ROUTES advertisement, set via update_tier1_gateway. Returns the created route dict, else {"error", "hint"}. Then confirm with list_static_routes; delete_static_route is the inverse.

[WRITE] Create a Tier-1 gateway to route segments, optionally uplinked to a Tier-0.

Use this before create_segment when the segment needs routing; get tier0_path from list_tier0_gateways and edge_cluster_path from list_edge_clusters first. Without route_advertisement, connected subnets stay unreachable from outside until it is set here or via update_tier1_gateway. The same tier1_id overwrites (PUT). Returns the created gateway dict, else {"error", "hint"}; verify with get_tier1_gateway.

[WRITE] Permanently delete an IP address pool; refuses while IPs are allocated.

Irreversible: consumers such as transport endpoints can no longer allocate. Without confirm=True this only previews: it returns blast_radius (the pool's name, pool_usage, allocation_count, realized_allocation_count and allocated_ips, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet. confirm=True refuses while any IP is still allocated — in Policy ip-allocations or in NSX's pool_usage count, which also covers TEP addresses — or when either count could not be read. Returns {"action": "preview" | "deleted", "blast_radius": ...}, else {"error", "hint", "blast_radius"?}.

[WRITE] Permanently delete a NAT rule from a Tier-1 gateway's USER NAT section.

Irreversible: traffic matched by the rule stops being translated immediately, which can break inbound (DNAT) or outbound (SNAT) connectivity. Without confirm=True this only previews: it returns blast_radius (the gateway, the rule's action, source/destination match and translation, enabled flag, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet. confirm=True refuses when the rule could not be read, and a rule_id not on that gateway is an error. Returns {"action": "preview" | "deleted", "blast_radius": ...}, else {"error", "hint", "blast_radius"?}.

[WRITE] Delete a network segment; refuses while any port is attached.

Irreversible. Without confirm=True this only previews: it returns blast_radius (the segment's name, gateway, subnets, port_count and port_ids, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet.

confirm=True re-measures, then refuses, deleting nothing, while any port (a VM vNIC or router interface) is attached — it never disconnects them for you — or when the ports could not be read. Returns {"action": "preview" | "deleted", "blast_radius": ...}, else {"error", "hint", "blast_radius"?}.

[WRITE] Permanently delete a static route from a Tier-0 or Tier-1 gateway.

Irreversible: traffic to the route's destination CIDR immediately falls back to remaining routes or is dropped. Without confirm=True this only previews: it returns blast_radius (the gateway, the route's network and next hops, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet. gateway_type must match where the route lives; a route_id not on that gateway is an error, and confirm=True refuses when the routes could not be read. Returns {"action": "preview" | "deleted", "blast_radius": ...}, else {"error", "hint", "blast_radius"?}.

[WRITE] Delete a Tier-1 gateway; refuses while anything still depends on it.

Irreversible. Without confirm=True this only previews: it returns blast_radius (name, tier0_path, the "default" locale-service and edge cluster the delete removes, dependents by kind, blockers, unmeasured) and deletes nothing. Show that to the user and get their decision. Do not set confirm=True on your own because the user asked to delete earlier: they have not seen the blast radius yet.

confirm=True re-measures (read-only) and refuses, deleting nothing, while any remain: attached segments or Tier-1-scoped segments, NAT rules, static routes, service interfaces, extra locale-services, IPsec/L2 VPN services, a DNS forwarder, or a load balancer service attached to it — or when any of them could not be read. It never removes them for you. When clear, deletes the "default" locale-service, then the gateway. Returns {"action": "preview" | "deleted", "blast_radius": ...}, else {"error", "hint", "blast_radius"?}.

[READ] Get BGP configuration and neighbor status for a Tier-0 gateway.

Use this to verify dynamic routing after configure_tier0_bgp, or when troubleshooting north-south connectivity. Returns one dict (not the list envelope): tier0_id, locale-service info, BGP config (local AS, enabled, ECMP), neighbors (peer IP, remote ASN, timers) and realized session status (connection_state, in/out prefix counts). Only the gateway's FIRST locale-service is read; a gateway with none returns a hint, not an error.

If sessions are down, check get_edge_cluster_status — BGP runs on the edge members. Static routes are listed separately by list_static_routes.

[READ] Check status of an edge cluster (member health, overall status).

Use this after list_edge_clusters when north-south traffic, NAT or BGP looks broken — Tier-0/Tier-1 stateful services run on these members. Returns one dict (not the list envelope): cluster_id, edge_cluster_status, member_count and members (transport_node_id, transport_node_name, status). Member status only — why a member is degraded comes from get_transport_node_status.

[READ] Get current IP allocations for one IP address pool.

Use this after list_ip_pools to see how much of a pool is consumed — e.g. diagnosing TEP address exhaustion, or before delete_ip_pool, which cannot proceed while allocations remain. Returns a single dict (not the list envelope): pool_id, allocation_count and allocations (id, display_name, allocation_ip). An empty allocations list means the pool is unused, not that the query failed. On failure returns {"error", "hint"}.

[READ] Check realized state of all ports on a segment (first 50 ports).

Use this after get_segment_port_for_vm has told you which segment a VM sits on, or before delete_segment to see whether ports are still attached. Returns per-port admin_state, attachment (type/id) and realized state: attached, realized_bindings_count, transport_node_ids. NSX does not expose a single UP/DOWN flag per segment port — an attached port with realized bindings on at least one transport node is healthy. Only the first 50 ports are returned.

If bindings are missing everywhere, check get_transport_node_status.

[READ] Get NSX Manager cluster status (node health, control/management plane).

Start any NSX health check here: if the manager cluster is degraded, every other reading is suspect. Returns one dict (not the list envelope): cluster_id, overall_status, control_cluster_status, mgmt_cluster_status, online_node_count and nodes. Only online nodes are listed, so a node missing from nodes is down rather than absent. Then list_nsx_alarms for what is actually firing.

[READ] Get full details for one network segment, including its attached ports.

Use after list_segments to inspect one segment. Returns one dict (not the list envelope): id, display_name, type, admin_state, subnets, transport_zone_path, connectivity_path (linked gateway), vlan_ids, port_count, and the first 50 ports only. A segment with attached ports cannot be deleted — check port_count before calling delete_segment. For per-port realized state use get_logical_port_status; to change the segment use update_segment.

[READ] Find which segment(s) a VM is attached to via its VIF attachments.

Start here for "why can this VM not reach the network?" — it is the only tool mapping a VM name onto NSX topology. Looks the VM up in the fabric inventory, fetches its VIFs, and matches segment ports by lport_attachment_id. Returns one dict (not the list envelope): VM info (external_id, host, power state) and matched_ports (segment id/name, port id/name). Matching is on exact display name, and empty matched_ports means no VIF is attached, not that the VM is missing.

Then get_logical_port_status on the segment it names. VM power and placement are not managed here — use vmware-aiops.

[READ] Get configuration details for one Tier-0 gateway (north-south edge router).

Use after list_tier0_gateways to inspect HA configuration, or to build the tier0_path ("/infra/tier-0s/") that create_tier1_gateway needs. For BGP peering state use get_bgp_neighbors instead. Returns one dict (not the list envelope): id, display_name, ha_mode, failover_mode, transit_subnets, internal_transit_subnets, rd_admin_field. Static config only — it does not say whether the gateway is currently forwarding.

[READ] Get detailed info for one Tier-1 gateway.

Use after list_tier1_gateways, and always before update_tier1_gateway — update is a PATCH, so you need the current values to know what you are changing. Returns a single detail dict (not the list envelope): id, display_name, tier0_path, failover_mode, route_advertisement_types, type. Attached segments are not listed here — use list_segments for those.

[READ] Get realized runtime status of one transport node (ESXi host or Edge node).

Use after list_transport_nodes when a node looks degraded or overlay tunnels are suspect; for cluster-wide edge health use get_edge_cluster_status instead. Returns one dict (not the list envelope): node_id, status (UP, DEGRADED, DOWN, UNKNOWN), control_connection_status, mgmt_connection_status, tunnel_status (up/down/degraded counts, BFD counters) and pnic_status. Point-in-time only — no history.

If tunnels are down on one segment only, follow up with get_logical_port_status rather than blaming the node.

[READ] List all edge clusters with member count and deployment type.

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first to resolve a cluster_id, then get_edge_cluster_status for member health. The id is also what create_tier1_gateway's edge_cluster_path is built from — a Tier-1 without an edge cluster cannot run NAT.

[READ] List all IP address pools with subnets and usage summary.

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first to resolve a pool_id, then get_ip_pool_usage for the actual allocations — the summary here does not tell you which addresses are taken. Run it before create_ip_pool to avoid overlapping ranges.

[READ] List NAT rules on a Tier-1 gateway (USER section).

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Get tier1_id from list_tier1_gateways first. Use this before create_nat_rule to avoid an id clash, and before delete_nat_rule to confirm what a rule does. Only the USER section is listed — NSX-internal NAT is not shown.

[READ] Get active NSX alarms at one severity, with feature, description, and entity.

Returns the result envelope; check truncated before calling it complete. Note: the NSX severity filter is an EXACT match — "MEDIUM" returns only MEDIUM alarms, not MEDIUM-and-above, so call it once per severity to build a full picture.

Page it: limit is the page size (1-1000, 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole set, so it stays true on the last page of a walk. Unlike the other list tools this one defaults to the full 1000, because a health sweep that silently showed the first fifty alarms would be worse than a long one.

Start a health check at get_nsx_manager_status, then come here, then drill into the entity the alarm names with get_transport_node_status or get_edge_cluster_status.

[READ] List all NSX network segments with type, subnet, admin state, and port count.

Returns the result envelope: rows under items, plus returned, limit, total (the collection's result_count, null when the API omits it), truncated and hint. Check truncated before calling this the complete set — when true, more rows exist. Every list tool here returns that shape.

Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first to resolve a segment_id, then get_segment for its ports and linked gateway, or get_logical_port_status for realized state. Distributed firewall rules are not here — use vmware-nsx-security.

[READ] List static routes on a Tier-0 or Tier-1 gateway.

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this before create_static_route to avoid an id clash, and before delete_static_route to confirm the destination and next hops. gateway_type must match where the route actually lives — querying the wrong tier returns an empty list, not an error. BGP-learned routes are not here; use get_bgp_neighbors.

[READ] List all Tier-0 gateways with HA mode and transit subnets.

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first to resolve a tier0_id, then get_tier0_gateway for HA detail and the tier0_path that create_tier1_gateway needs, or get_bgp_neighbors for peering state. Tier-0s are not created by this skill — only Tier-1s are.

[READ] List all Tier-1 gateways with linked Tier-0 path and route advertisement.

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first to resolve a tier1_id — create_nat_rule, create_static_route, list_nat_rules and update_tier1_gateway all take one. A row with an empty tier0_path is standalone and cannot reach north-south. Then get_tier1_gateway for detail.

[READ] List all transport nodes (ESXi hosts and Edge nodes) with type and status.

Returns the result envelope; check truncated before calling it complete. Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first to resolve a node_id, then get_transport_node_status for that node's tunnels, controller connectivity and pNICs — the summary status here does not explain why a node is degraded.

[READ] List all NSX transport zones — the overlay/VLAN boundaries segments attach to.

Page it: limit is the page size (1-1000, default 50; 0 or negative is rejected), offset is how many rows to skip, and the response carries next_offset — pass that back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

Use this first when building a segment: create_segment requires a transport_zone_path of "/infra/sites/default/enforcement-points/default/transport-zones/" built from the id returned here. Returns the result envelope; each row has id, display_name and transport_type (OVERLAY_STANDARD, VLAN_BACKED, …). A VLAN-backed zone needs create_segment's vlan_ids, an overlay zone needs its subnet — passing the wrong one is rejected.

[WRITE] Update an existing network segment (partial update via PATCH).

Only the fields you pass change. Use get_segment first, and prefer this over create_segment for an existing segment: create is a PUT and overwrites everything. Changing subnet re-addresses the gateway and can drop traffic for attached VMs, so check port_count first. Returns the updated segment dict, else {"error", "hint"}.

[WRITE] Partially update an existing Tier-1 gateway via PATCH.

Only the fields you pass change. Use get_tier1_gateway first — route_advertisement is sent as a whole list, so include every type you want kept. Prefer this over create_tier1_gateway for an existing gateway: create is a PUT and overwrites everything. Re-applying identical values is harmless. Returns the updated gateway dict, else {"error", "hint"}.