Skip to main content

REST APIs for 24.2.20 and 24.2.10

VEN Operations Reference

This topic contains parameters and examples for VEN operations.

VEN Parameters

Parameter

Description

Type

Required

org_id

Organization ID

Integer

Yes

activation_type

The method by which the VEN was activated

String

No

active_pce_fqdn

FQDN of the PCE

String

No

activation_recovery

Return VENs in or not in authentication recovery.

Boolean

No

condition

A specific error condition to filter by

String

No

container_clusters

The array of container cluster URIs, encoded as a JSON string

Object

No

disconnected_before

Return VENs that have been disconnected since the given time.

date/time

No

health

The overall health (condition) of the VEN

String

No

hostname

The hostname of VEN(s) to return. Supports partial matches.

String

No

ip_addressl

IP address of VEN(s) to return. Supports partial matches

String

No

last_goodbye_at

The time (rfc3339 timestamp) of the last goodbye from the VEN.

String, Null

os_platform

OS platform of the host managed by the VEN

String, Null

version

Software version of the VEN.

String

status

The current status of the VEN. Options are:

"active", "suspended", "uninstalled."

String

activation_type

The method in which the VEN was activated. Options are:

"pairing_key", "kerberos", "certificate."

String, Null

No

active_pce_fqdn

The FQDN of the PCE that the VEN last connected to

String, Null

No

target_pce_fqdn

cluster FQDN for target PCE

String, Null

labels

Labels assigned to the host that are managed by the VEN.

Array

interfaces

Network interfaces of the host that are managed by the VEN.

Array

workloads

The only required property is HREF; the others are optional:

name, managed, hostname,

os_id, os_detail, labels,

interfaces, etc.

Array

description

Description of VEN(s) to return. Supports partial matches

String, Null

last_heartbeat_at

The last time (rfc3339 timestamp) a heartbeat was received from this VEN.

String, Null

status

VEN Status:

  • "active"

  • "suspended"

String

ven_type

The ven_type property is introduced through the reference to a common schema ven_type.schema.json:

String

No

VEN Properties

Parameter

Description

Type

Required

ven_type

The type of the release marked as default:

"server", "endpoint"

String

No

default_release_ ven_types

The type of the release marked as default

String

name

Friendly name for the VEN

String, Null

hostname

The hostname of the host managed by the VEN

String, Null

Yes

uid

The unique ID of the host managed by the VEN

String, Null

os_id

OS identifier of the host managed by the VEN

String, Null

os_detail

Additional OS details from the host managed by the VEN

Sring, Null

os_platform

OS platform of the host managed by the VEN

String, Null

version

Software version of the VEN.

String

status

The current status of the VEN. Options are:

"active", "suspended", "uninstalled"

String

activation_type

The method in which the VEN was activated. Options are:

"pairing_key", "kerberos", "certificate"

String, Null

No

active_pce_fqdn

The FQDN of the PCE that the VEN last connected to

String, Null

No

target_pce_fqdn

cluster FQDN for target PCE

String, Null

labels

Labels assigned to the host managed by the VEN.

Array

interfaces

Network interfaces of the host managed by the VEN.

Array

workloads

The only required property is HREF, the others are optional:

name, managed, hostname,

os_id, os_detail, labels,

interfaces, etc.

managed: True if the workload is managed, else false.

Array

container_clusters

The array of container cluster URIs, encoded as a JSON string

Object

No

secure_connect

The issuer name match the criteria for the certificate used when establishing secure connections.

Object, Null

last_heartbeat_at

The last time (rfc3339 timestamp), a heartbeat was received from this VEN.

String, Null

last_goodbye_at

The time (rfc3339 timestamp) of the last goodbye from the VEN.

String, Null

status

VEN Status:

  • "active"

  • "suspended"

String

disconnected_before

Return VENs that have been disconnected since the given time.

date/time

health

The overall health (condition) of the VEN

String

ip_address

IP address of VEN(s) to return. Supports partial matches

String

firewall_restore

The strategy to use to restore the firewall state after the VEN is uninstalled.

The strategy to use to restore the firewall state after the VEN is uninstalled:

Options are: saved, default, and disable.

The default is: default.

Works with vens_unpair_put.

String

ven_id

VEN ID (works with GET /api/v2/orgs/{org_id}/vens/{ven_id})

String

vens

VENs to unpair (works with PUT /api/v2/orgs/{org_id}/vens/unpair)

Required property: href

Array

Yes

secure_connect

Property: matching_issuer_name.

Issuer name match criteria for certificate used during establishing secure connections.

matching_issuer_name: Issuer name match criteria for certificate used while establishing secure connections.

Object

String

security_policy_ applied_at

Last reported time when policy was applied to the workload (UTC),

only present in expanded representations.

date-time

security_policy_ received_at

Last reported time when policy was received by the workload (UTC),

only present in expanded representations.

date-time

Null

enforcement_mode

Policy enforcement mode, only present in expanded representations.

Options are: "idle", "visibility_only", "full", "selective"

String

visibility_level

The amount of data the VEN collects and reports to the PCE from a resource demands on workloads.

The higher levels of detail are useful for visualizing traffic flows in the Illumination map inside the PCE web console.

If this parameter is not set, then VEN visibility level is set to flow_summary.

  • flow_summary: (“High Detail” in the PCE web console)

    The VEN collects traffic connection details (source IP, destination IP, protocol, and source and destination port) for both allowed and blocked connections. This option creates traffic links in the Illumination map and is typically used during your security policy's building and testing phase.

  • flow_drops: (“Less Detail” in the PCE web console.)

    The VEN only collects traffic connection details (source IP, destination IP, protocol, and source and destination port) for blocked connections. This option provides less detail for Illumination but demands fewer system resources from a workload and is typically used for policy enforcement.

  • flow_off: (“No Detail” in the PCE web console.)

    The VEN does not collect any details about traffic connections.

    This option provides no Illumination detail and demands the least resources from workloads. This mode is useful when you are satisfied with the rules that have been created and do not need additional overhead from observing workload communication.

String

upgrade_pending

Only return VENs with/without a pending upgrade.

Boolean

No

ven_type

The ven_type property is introduced through the reference to a common schema ven_type.schema.json:

String

No

upgrade_expires_at

The time (rfc3339 timestamp) at which the PCE stops attempting VEN upgrade

String. Null

No

upgrade_target_ version

The software release to upgrade to

String, Null

No

upgrade_timeout_ seconds

Number of seconds during which the PCE tries to trigger the agent upgrade:

"minimum": 900,

"maximum": 15552000

Integer

Curl Command to Get VENs with a Specific Label

curl -i -X GET https://pce.my-company.com:8443/api/v2/orgs/2/vens?labels="[[/orgs/2/labels/1642]]" -H "Accept: application/json" -u $KEY:$TOKEN

To restrict the type of VENs you want to be returned and set a limit on how many results you want to be returned, use the relevant query parameters. For example, you might want to get a collection of no more than 50 VENs running CentOS 6.3 with active status.

Curl Command to Get VENs using other Query Parameters

curl -i -X GET https://pce.my-company.com:8443/api/v2/orgs/2/vens?os_id=centos-x86_64-6.3&max_results=50&status=active -H "Accept: application/json"-u $KEY:$TOKEN
Unpairing and Suspending VENs

Instead of unpairing and suspending workloads, use the new VEN APIs to unpair and suspend VENs.

Note

The endpoint workloads/unpair is DEPRECATED. Use /vens/unpair instead.

Curl Command for Unpairing VENs

curl -i -X PUT https://pce.my-company.com/api/v2/orgs/3/vens/unpair -H "Content -Type:application/json" -u $KEY:$TOKEN -d '{"vens": [{"href": "/orgs/7/vens/xxxxxxxx-9611-44aa-ae06-fXXX8903db65"}, {"href": "/orgs/7/vens/xxxxxxxx-9611-xxxx-ae06-f7bXXX03db71"}], "firewall_restore": "default"}'

Curl Command to Mark VEN as Suspended

curl -i -X PUT https://pce.my-company.com/api/v2/orgs/3/vens/xxxxxxxx-9611-xxxx-ae06-f7bXXX03db71 -H "Content-Type:application/json" -u $KEY:$TOKEN -d'{"status":"suspended"}'