[READ] List published application pools: id, name, farm, enabled, executable path. Paginated.

Args: limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[READ] List instant-clone base VMs and snapshots (the golden-image catalog for pool_push_image).

Args: base_vm_id: Optionally scope snapshots to one base VM. target: Horizon target from config.yaml; omit to use the default.

[READ] Resolve AD users/groups by name to their SIDs — needed to entitle a pool (entitlement_add).

Args: name: Name substring to search for. limit: Max principals to return (default 25). target: Horizon target from config.yaml; omit to use the default.

[READ] List the AD users/groups entitled to a desktop pool (who can access it). Paginated.

A wrong pool id returns a teaching 404. Use pool_list for pool ids.

Args: pool_id: The desktop-pool id (from pool_list). limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Grant desktop-pool access to AD user/group SID(s).

Get SIDs from ad_user_search. confirm=False previews; confirm=True grants. Audited.

Args: pool_id: The desktop-pool id (from pool_list). ad_user_or_group_ids: AD SIDs to entitle (from ad_user_search). confirm: False previews; True grants. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Revoke desktop-pool access from AD user/group SID(s).

Get SIDs from entitlement_list. confirm=False previews; confirm=True revokes. Audited.

Args: pool_id: The desktop-pool id (from pool_list). ad_user_or_group_ids: AD SIDs to remove (from entitlement_list). confirm: False previews; True revokes. target: Horizon target from config.yaml; omit to use the default.

[READ] List Horizon RDS farms: id, name, type, enabled, RDS server count. Paginated.

Args: limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[READ] List Horizon desktop machines, filtered by pool id / state. Paginated.

Each item: id, name, pool_id, state (AVAILABLE/CONNECTED/AGENT_UNREACHABLE/PROVISIONING/ ERROR/MAINTENANCE/…), assigned user, agent_version, base_image. Verify pair for the machine write tools.

Args: pool: Filter to one desktop-pool id. state: Filter by machine state (e.g. AGENT_UNREACHABLE, ERROR). limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[READ] Full detail for one Horizon desktop machine by id (teaching 404 on a wrong id).

[WRITE] Hard-reset desktop machine(s) — the user loses unsaved state.

confirm=False previews the blast radius (machine count + assigned users) without acting; confirm=True resets. For a graceful in-guest reboot use vmware-aiops (the vCenter VM). Audited.

Args: machine_ids: Machine ids to reset (from machine_list). confirm: False previews; True resets. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Enter (enabled=True) or exit (False) maintenance mode for machine(s).

Maintenance drains the machine (no new sessions). confirm=False previews; confirm=True applies. Audited.

Args: machine_ids: Machine ids (from machine_list). enabled: True enters maintenance; False exits. confirm: False previews; True applies. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Remove machine(s) from their pool — for instant clones this DELETES the backing VM.

confirm=False previews the blast radius; confirm=True removes. Audited.

Args: machine_ids: Machine ids to remove (from machine_list). confirm: False previews; True removes. target: Horizon target from config.yaml; omit to use the default.

[READ] One-glance Horizon VDI health: session totals by state, problem machines, pool availability.

The first thing to call for "how is VDI right now?". Aggregates sessions, machines, and pools into a compact status. Drill into problems with machine_list --state or session_list.

Args: target: Horizon target from config.yaml; omit to use the default.

[READ] Session statistics: concurrency by state / protocol, current concurrent, busiest pools.

The reporting counterpart to session_list — aggregate numbers, not per-session rows.

Args: target: Horizon target from config.yaml; omit to use the default.

[READ] Per-pool capacity: total / available / in-use / error machines and utilization %.

The "am I running out of desktops?" view, sorted by utilization. Drill in with machine_list --pool.

Args: target: Horizon target from config.yaml; omit to use the default.

[READ] List Horizon audit events (newest first), optionally filtered by severity. Paginated.

Each item: time, severity, type, module, user, machine, message. Use for "what went wrong recently".

Args: severity: Filter by severity (e.g. ERROR, WARNING, AUDIT_FAIL). limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[READ] List Horizon desktop pools: id, name, type (AUTOMATED/MANUAL/RDS), enabled, assignment.

The verify pair for pool_set_enabled and pool_push_image. Paginated envelope.

Args: limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[READ] Full detail for one desktop pool by id (teaching 404 on a wrong id).

[WRITE] Enable or disable a desktop pool — disabling stops NEW sessions (existing keep running).

Idempotent (matching state returns a noop). confirm=False previews; confirm=True applies. Audited.

Args: pool_id: The pool id (from pool_list). enabled: True enables; False disables. confirm: False previews; True applies. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Apply the pending image to an instant-clone pool — RECREATES EVERY DESKTOP in it.

Highest blast radius in the family: the preview states affected-desktop and in-session-user counts before you confirm. confirm=True schedules the apply. Audited.

Args: pool_id: The pool id (from pool_list). stop_on_error: Halt the rolling push on the first machine error (default True). logoff_policy: WAIT_FOR_LOGOFF (default) or FORCE_LOGOFF. confirm: False previews the blast radius; True schedules the push. target: Horizon target from config.yaml; omit to use the default.

[READ] List Horizon VDI sessions, filtered by user / pool id / state. Paginated.

Returns a {items, returned, limit, total, truncated, hint} envelope; each item has id, user, type (DESKTOP/APPLICATION), state (CONNECTED/DISCONNECTED/PENDING), protocol (BLAST/PCOIP/RDP), pool_id, machine_id, start_time. This is the verify pair for logoff/disconnect — get a session id or confirm a user's sessions here first.

Args: user: Substring-match the AD user name. pool: Exact desktop-pool / farm id. state: CONNECTED, DISCONNECTED, or PENDING. limit: Page size (default 50). offset: Page offset. target: Horizon target from config.yaml; omit to use the default.

[READ] Full detail for one Horizon session by id.

A wrong id returns a teaching error ("run session_list for current ids"), not a traceback. Use session_list to discover ids.

Args: session_id: The session id (from session_list). target: Horizon target from config.yaml; omit to use the default.

[WRITE] Force-logoff Horizon session(s) — kicks the user, triggers profile write-back.

Identify targets by explicit session_ids OR by user (all of that user's sessions). confirm=False (default) returns a preview stating the blast radius — session count and affected user names — without acting; re-run with confirm=True to apply. Audited.

Args: session_ids: Session ids to log off (from session_list). user: Log off all sessions of this AD user (substring match); refuses if none match. confirm: False previews; True logs off. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Disconnect Horizon session(s) — state preserved, the user can reconnect.

Less disruptive than logoff. Identify by session_ids OR user. confirm=False previews the blast radius; confirm=True applies. Audited.

Args: session_ids: Session ids to disconnect. user: Disconnect all sessions of this AD user (substring match). confirm: False previews; True disconnects. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Send a message to Horizon session(s) — e.g. "save your work, maintenance in 10 min".

Low blast radius (informational only, no session disruption), so no confirm gate. Identify by session_ids OR user. Audited.

Args: message: The text to display to the user(s). session_ids: Session ids to message. user: Message all sessions of this AD user (substring match). message_type: INFO, WARNING, or ERROR. target: Horizon target from config.yaml; omit to use the default.

[READ] Status of a pool's long task (image push / provisioning), or all tasks for the pool.

Horizon tasks are pool-scoped. Give task_id (from pool_push_image or a prior task_status) for one task; omit it to list all tasks for the pool.

Args: pool_id: The desktop-pool id. task_id: A specific task id; omit to list all tasks for the pool. target: Horizon target from config.yaml; omit to use the default.

[WRITE] Cancel a running pool task (e.g. an in-progress image push).

confirm=False previews; confirm=True cancels. Work already applied is not rolled back. Audited.

Args: pool_id: The desktop-pool id. task_id: The task id (from task_status). confirm: False previews; True cancels. target: Horizon target from config.yaml; omit to use the default.