VMware Aria Operations

[WRITE] Acknowledge an active alert by taking ownership (does not cancel it). The suite-api has no dedicated "acknowledge" action; this maps to POST /alerts?action=takeownership, assigning the alert to the API user (control state ASSIGNED). The alert remains active until cancelled. Use this when you want to own the alert without closing it; cancel_alert closes it for good. Default confirmed=False returns a preview without making any change. Args: alert_id: The alert UUID to acknowledge. confirmed: Must be True to actually acknowledge. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Cancel (dismiss) an active alert. This WRITE operation permanently closes the alert. Use acknowledge_alert instead if you only want to mark it as seen. Cancelled alerts will not re-trigger unless the underlying condition recurs. Default confirmed=False returns a preview without making any change. Args: alert_id: The alert UUID to cancel. confirmed: Must be True to actually cancel. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Permanently delete an alert definition. Irreversible. This WRITE operation removes the alert definition from Aria Operations. Active alerts generated by this definition will not be affected. Use set_alert_definition_state(enabled=False) instead to silence a definition you may want back. Default confirmed=False returns a preview without making any change. Args: definition_id: Alert definition UUID to delete. confirmed: Must be True to actually delete. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Permanently delete a generated report artifact from Aria Operations. Removes only the generated report instance and its output — the report definition and any schedules remain intact; re-run generate_report to recreate it. Deletion is irreversible and is recorded in the audit log. Returns an error if the report_id does not exist; use list_reports to find valid UUIDs first. Default confirmed=False returns a preview without deleting. Args: report_id: The report UUID to delete (from generate_report or list_reports). confirmed: Must be True to actually delete. Default False = preview only. target: Aria target name from config; default when omitted.

[READ] Look up metric keys before get_resource_metrics or get_top_consumers; do not guess (cpu|demand_average does not exist on VMs). resource_id: keys that resource reports, with name/unit from its kind; definition is found, found_by_instance, not_defined_for_kind (see unjoined_keys) or not_read (definitions_status undetermined: name/unit unknown, not absent). resource_kind: keys the kind defines, not all collected. Paginated envelope with next_offset: pass it back as offset until null. An unreadable key list is an error, never empty. Args: resource_id: Resource UUID (from list_resources). This or resource_kind, not both. resource_kind: Kind key, e.g. VirtualMachine, HostSystem, Datastore. adapter_kind: Adapter kind for resource_kind. Default VMWARE. key_filter: Case-insensitive substring of key or name, e.g. "mem|". limit: Page size, 1-500 (default 100). offset: Rows to skip; the previous next_offset. target: Aria target name from config; default when omitted.

[READ] Current property values Aria holds for one resource: power state, parent host and vCenter (summary|parentHost, summary|parentVcenter), configured CPU/memory, extraConfig flags such as config|extraConfig|mem_hotadd. Use this for configuration facts; use get_resource_metrics for time-series values. Returns a paginated envelope of {name, value} rows sorted by name (value is a string, null when the property carries none), with next_offset — pass it back as offset until null. A failed or unrecognised read is an error, never an empty list; a missing resource is a 404. Args: resource_id: Resource UUID (from list_resources). name_filter: Case-insensitive substring of the property name, e.g. "summary|". limit: Page size, 1-500 (default 100). Out-of-range is rejected. offset: Rows to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[READ] Navigate the inventory: resources related to one resource (VM -> host, datastore, folder; host -> VMs, datacenter). Each row: id, name, kind, adapter_kind, direction (parent, child, both, other). Call again on a returned id to walk further up or down. Returns a paginated envelope with next_offset — pass it back as offset until null. With ALL, direction is null when the PARENT/CHILD labels could not be read, and direction_note says why. A failed or unrecognised read is an error, never an empty list. Args: resource_id: Resource UUID (from list_resources). relationship_type: Exactly ALL, PARENT or CHILD (upper case). Default ALL; ANCESTOR/DESCENDANT are rejected. limit: Page size, 1-500 (default 100). Out-of-range is rejected. offset: Rows to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[WRITE] Create a new alert definition referencing existing symptom definitions. Returns the new definition's id and name. Run list_symptom_definitions first for symptom_definition_ids; to silence an existing definition use set_alert_definition_state rather than creating a variant. Args: name: Alert definition name (must be unique in Aria Operations). description: When and why this alert fires. resource_kind: VirtualMachine, HostSystem, ClusterComputeResource, or Datastore. symptom_definition_ids: Symptom definition UUIDs; any one firing triggers the alert (OR). criticality: Alert severity: INFORMATION, WARNING, IMMEDIATE, CRITICAL. adapter_kind: Adapter kind key. Default VMWARE (vSphere adapter). target: Aria target name from config; default when omitted.

[WRITE] Enable or disable an existing alert definition. Returns definition_id, enabled, and the action taken. Use this instead of delete_alert_definition when you only want to silence a definition — disabling is reversible, deleting is not. Args: definition_id: Alert definition UUID (from list_alert_definitions). enabled: True to enable the definition, False to disable it. target: Aria target name from config; default when omitted.

[READ] Returns a capacity overview for a cluster — the group-level remaining-capacity percentage (capacity_remaining_pct, which only exists at group level) plus per-dimension (cpu/mem/diskspace) absolute remaining capacity and projected days-until-full, from the OnlineCapacityAnalytics metrics. Values are None while capacity analytics are still warming up on a fresh instance. Start here when assessing overall cluster capacity health; for absolute headroom values use get_remaining_capacity, and for just the exhaustion projections use get_time_remaining. Args: cluster_id: The cluster resource UUID (ClusterComputeResource, from list_resources). target: Aria target name from config; default when omitted.

[READ] Get remaining capacity headroom for a cluster or host — how much more workload fits before hitting limits. Returns the group-level capacity_remaining_pct (only available at group level) plus one entry per capacity dimension (cpu, mem, diskspace) with remaining_value (absolute, unit per dimension e.g. MHz/KB), from the OnlineCapacityAnalytics demand model. Values are None while capacity analytics warm up. Use get_capacity_overview for the combined view, or get_time_remaining for projected days-until-full. Args: resource_id: The resource UUID — a ClusterComputeResource or HostSystem (from list_resources). target: Aria target name from config; default when omitted.

[READ] Predict when a cluster will exhaust its capacity based on usage trends. Returns `time_remaining`: one entry per capacity dimension (cpu, mem, diskspace) with projected days until full. Use get_capacity_overview instead when you also want current headroom — this tool returns only the projections. Days are None while capacity analytics warm up on a fresh instance, and None does not mean unlimited. Args: resource_id: The resource UUID (typically ClusterComputeResource). target: Aria target name from config; default when omitted.

[READ] List VM rightsizing data — recommended CPU/memory/disk size per VM, with units, direction and whether to act. Reads the three OnlineCapacityAnalytics recommendedSize metrics, the only rightsizing signal the public API publishes, on both 8.x and 9.x. Get VM UUIDs from list_resources. One bulk stats call and one bulk properties call cover the whole page. Read `sizing_status` before quoting any number: recommendation — recommended_* carry sizes. reclaimable — the engine publishes 0 for a VM it holds reclaimable. That is NOT a recommendation to size it to zero, and recommended_* are null here. none_published — the VM needs no resizing OR analytics never scored it. The appliance does not distinguish these two; do not report it as either one. Units: recommended_* are raw MHz / KB / GB (see `recommended_units`) — never quote the CPU number as vCPUs. Use `recommended_vcpus` (MHz converted with the VM's own host core speed, rounded up) against `current_vcpus`, and `recommended_memory` against `current_memory_kb`. `cpu_direction` / `memory_direction` are oversized / undersized / right_sized, or null when the current size is not published. Disk has no direction. Powered-off VMs and templates are listed, not dropped: check `power_state`, `is_template` and `actionable` (true only for a powered-on non-template VM whose CPU or memory is off its recommendation), and read `caveats` before recommending a change. Vendor appliances (vCenter, Aria, NSX...) cannot be identified reliably — `product_name` appears only when the VM publishes a vApp product — so every reduction carries a caveat to check the vendor minimum size first. `aria_verdict` is the engine's own summary|oversized / undersized statistics; a caveat flags when it disagrees with recommendedSize. This is not the number the vendor UI's Rightsize page shows — that view presents allocated plus a suggested delta, not the absolute recommended size. Both are correct and they will not match. Before acting on a recommendation, read `recommendation_stable`. Each row carries `recommendation_range` — {window_days: 7, days_with_data, cpu_mhz, memory_kb, diskspace_gb}, each a [daily low, daily high] pair — and `recommendation_stable`: false when CPU or memory moved by more than 5% of its high over the window (the row is then not actionable and a caveat names the range), null when no history came back. Quote `days_with_data` with it: the appliance may hold fewer days than the window. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, properties_note, history_note. Check truncated before calling this the complete set. properties_note is null unless the VM property read failed; then power_state, is_template and current sizes are null because they are UNKNOWN (not unpublished) and no row is actionable. history_note is null unless the history read failed; then recommendation_range and recommendation_stable are null (unknown) and actionable is decided without them. Args: resource_id: Optional VM resource UUID to scope to a single VM. limit: Maximum VMs to evaluate when listing (1–100). Default 50. target: Aria target name from config; default when omitted.

[READ] List available report definition templates in Aria Operations. Pass a returned id to generate_report to run one. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk. Args: name_filter: Substring filter on report name (case-insensitive). limit: Page size, 1–500 (default 100). Out-of-range is rejected. offset: Definitions to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[WRITE] Trigger generation of a report from a report definition template. Returns immediately with a report_id and PENDING status; it does not wait for the file. Poll get_report(report_id) until status == COMPLETED, then use download_url. Args: definition_id: Report definition (template) UUID from list_report_definitions. resource_ids: REQUIRED — at least one resource UUID. The Report API generates against a single root resource (first ID is used); pass a cluster/datacenter UUID to cover its children. Find IDs via list_resources. target: Aria target name from config; default when omitted.

[READ] List generated reports, optionally filtered by report definition. Pass a returned id to get_report for its status and download URLs. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set. This one has no offset — it is bounded by limit alone, so a truncated page cannot be walked past. Args: definition_id: Optional report definition UUID to filter results. limit: Max reports to return (1–200). Default 50. target: Aria target name from config; default when omitted.

[READ] Get status and download URLs for a generated report. Returns id, name (the report's title, fetched from its definition — null if that definition is gone; this endpoint carries no title of its own), description (the definition's explanatory blurb, which is NOT the title), status (PENDING, RUNNING, COMPLETED, FAILED), definition_id, completion_time (the appliance's own rendering, e.g. "Sun Aug 30 04:40:08 UTC 2026"), completion_time_ms (epoch ms, or null when the appliance sent a date string), download_url (PDF) and csv_url. Use this to poll after generate_report. The URLs are always constructed, so a download_url is present even while the report is still PENDING — check status before fetching it. Args: report_id: The report UUID (from generate_report or list_reports). target: Aria target name from config; default when omitted.

[READ] List resources in Aria Operations filtered by kind. Start here: this turns a name or kind into the UUID other resource tools need. Then call get_resource for detail on one row. Each row carries aria_state (Aria's lifecycle state — STARTED even for a powered-off VM, so not a power state) and collection_status (whether data is arriving: DATA_RECEIVING, NO_DATA_RECEIVING, ...; null when Aria did not report one). `status` is kept for existing callers and equals aria_state. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size, or when name_filter / collection_status filtered the rows), truncated, hint, and note when a collection_status filter matched nothing (it names the statuses seen). Check truncated before calling this the complete set. Args: resource_kind: e.g. VirtualMachine, HostSystem, ClusterComputeResource, Datastore, Datacenter — or "all" for every kind (an adapter instance's objects span several kinds). limit: Maximum number of results. Default 100. Paginated automatically, so a larger limit spans more than one page. name_filter: Substring filter on resource name (case-insensitive). collection_status: Keep only rows with this collection_status, case-insensitive. NO_DATA_RECEIVING lists the objects an "Objects are not receiving data from adapter instance" alert is about. target: Aria target name from config; default when omitted.

[READ] Returns one resource object: id, name, kind, adapter kind, identifiers, status states, and the health/risk/efficiency badges (each a color plus 0-100 score, null when Aria has not scored that badge). Use this after list_resources to inspect a single UUID in depth — it does not accept a name, so use list_resources to discover UUIDs by kind or name. For just the badge scores use get_resource_health; for time-series metrics use get_resource_metrics. Args: resource_id: The resource UUID (from list_resources). target: Aria target name from config; default when omitted.

[READ] Fetch time-series metric statistics for a resource. Returns mode ("raw" or "summary"), then metrics (raw: metric key -> list of {timestamp_ms, value} points, only keys with points) or summary (summary=True: per key n, min, max, avg, latest, first/latest timestamps, change_count and change_points — {timestamp_ms, from, to} where the value changed, at most 50, most recent kept), and missing (one entry per requested key with no points: not_collected_for_resource with similar_keys to try, no_data_in_window, resource_reports_no_stat_keys, or undetermined). Never report a missing key as zero. Prefer summary=True for windows over a few hours. For a single current score use get_resource_health instead. Args: resource_id: The resource UUID. metric_keys: Metric keys to fetch, e.g. ["cpu|usage_average", "mem|usage_average", "disk|usage_average", "net|usage_average"]. hours: Number of hours of history to retrieve. Default 1. rollup_type: Aggregation type: AVG, MAX, MIN, SUM, COUNT, LATEST. Default AVG. summary: Return per-metric summaries instead of every point. Default False. target: Aria target name from config; default when omitted.

[READ] Get the health, risk, and efficiency badge scores for a resource. Returns the three scores and their colors, from the resource's badges[] array. Scores are 0–100 (higher = healthier for HEALTH). Use this when the scores are all you need; use get_resource for the whole object, or list_alerts(resource_id=...) for what drove a low score. A score is null (or -1) when Aria has not computed that badge — that does not mean healthy. Badges score the alerts attached to the object, not a service's own state: a down service can show HEALTH GREEN 100. For a service object (kind containing SERVICE, e.g. VCENTER_APPLIANCE_HEALTH_SERVICES) the result also carries service: status (SERVICE|STATUS, e.g. green/orange), availability (latest SERVICE|AVAILABILITY), available (true for 1, false for 0, null when unknown) and read_errors. Read available, not the badge. service is null for other kinds. name and kind are included. Args: resource_id: The resource UUID. target: Aria target name from config; default when omitted.

[READ] Query resources with highest consumption of a given metric. Then call get_resource_metrics on a returned id for its history. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set. Resources with no data for the key are left out, not ranked at zero; excluded_no_data counts the ones the ranking API listed with no points, and hint says how many were left out when that shortened the list. Each item's value is the average over the last hour (the number Aria ranks by) and latest_value the most recent point; items are descending by value. Args: metric_key: Metric to rank by, e.g. cpu|usage_average, mem|usage_average, disk|usage_average. resource_kind: Resource kind to scope the query. Default VirtualMachine. top_n: Number of top consumers to return (max 50). Default 10. target: Aria target name from config; default when omitted.

[READ] Check Aria Operations platform health, per service, plus its version. Returns assessment: HEALTHY, DEGRADED (some services OK, some ERROR — the platform still answers), DOWN (no service OK) or UNKNOWN (breakdown unreadable). overall_status is the node's own flag: OFFLINE whenever any one service is not running, so OFFLINE alone is not an outage. Also services (name, health, details; null when unreadable), services_not_ok, healthy, system_time_ms, details, and product_version / product_line ("8.x", "9.x") / release_name — check the line before assuming 9.x-only tools (fleet_*, findings_list, promql_query) exist. A 503 is reported, never raised. If HEALTHY but data looks stale, check list_collector_groups. Args: target: Aria target name from config; default when omitted.

[READ] List Aria Operations collector groups and their member collector status. Collectors are remote agents that gather metrics from vSphere and other adapters. Check this when resources appear missing from Aria Operations or metrics are stale. Groups list member collector IDs; details (name, state UP/DOWN, local) are enriched via one extra collectors call. A DOWN collector means list_resources and the metric tools see stale or missing data for everything behind it. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set. Args: target: Aria target name from config; default when omitted.

[READ] Memory, swap, heap and watchdog restarts of the Aria Operations node(s) themselves. When: get_aria_health shows a service in ERROR, or the Aria UI/API is slow — this reads Aria's self-monitoring objects (vC-Ops-Node, vC-Ops-Watchdog) to show whether the node is starved of memory. For data that stopped arriving from vCenter or another source, use list_adapters instead. What: per node — memory (mem|total, mem|used, mem|free, mem|actualFree, mem|actualUsed), swap (swap|total, swap|used, swap|free), heap (heap|MaxHeapSize, heap|CurrentHeapSize, heap|CommittedMemory, heap|NodeHeapMemoryRemaining), heap_components (committed heap per component: Analytics, SuiteAPI, Collector, ...) and watchdog_restarts per service. Each value has latest, latest_time_ms, unit (from Aria's own statkey definitions, on 8.18.7: GB for mem/swap, MB for the heap sizes and heap_components, % for heap|NodeHeapMemoryRemaining; null when undefined) and window {min, avg, max, points} over window_hours of 5-minute averages. memory_pressure.level is an indicator, not a diagnosis: HIGH when actual free memory is below 10% of total, ELEVATED below 20%, NORMAL at 20% or more, UNKNOWN when the readings do not settle it; basis shows the numbers. Gotchas: a key with no value is in the node's missing list (reason not_reported, no_data or undetermined) and is never shown as zero. watchdog_restarts null means unknown (see watchdog_note), not zero restarts. nodes null with nodes_error means the node objects were not recognised. units_error, latest_error, window_error and watchdog_error name reads that failed; when set, the affected values are unknown. Args: window_hours: Hours of history for window min/avg/max, 1-720 (default 24). Latest values are read regardless. target: Aria target name from config; default when omitted.

[READ] List Aria Operations adapter instances and when each last collected. When: an alert such as "Objects are not receiving data", or metrics that stopped updating — this shows which adapter instance (vCenter, NSX, the self-monitoring adapter, ...) stopped collecting and since when. For the collector processes behind them use list_collector_groups; for the Aria node's own memory use get_aria_node_resources. What: rows with id, name, adapter_kind, resource_kind, collector_id, collector_group_id (null when none), monitoring_interval_min, resources_collected, metrics_collected, last_collected_ms and last_heartbeat_ms with their ages in seconds, message (the adapter's own status text) and stale / stale_basis. stale is true when lastCollected is older than 3 of the adapter's monitoring intervals and at least 15 minutes, false when within that, null when the fields cannot support a verdict. Ages use the appliance clock (reference_clock "appliance") when node status carries it, otherwise this machine's ("local"). The envelope also names stale_adapters and staleness_unknown for the filtered set, and adapter_kinds_present. Returns a paginated envelope: items, returned, limit, total, truncated, hint, next_offset. GET /adapters is unpaged, so total is exact; pass next_offset back as offset and stop when it is null. Gotchas: last_collected being recent does not prove every object behind the adapter receives data — it is the instance's last collection cycle. An unrecognised or empty answer is returned as an error, never as no adapters. Args: adapter_kind: Case-insensitive exact adapter kind key, e.g. "VMWARE" for vCenter. Omit for all. limit: Page size, 1-500 (default 100). Out-of-range is rejected. offset: Rows to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[READ] List the notes on one alert — who is handling it and what was done. Each row: id, note text, type (USER or SYSTEM), user_name, user_id, created_time_ms. Use add_alert_note to record a new one. An unknown alert id is an error (HTTP 404), not an empty list. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset, and notes_note — null when the answer was read; otherwise items is UNKNOWN, not empty, and must not be reported as "no notes". Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated. Args: alert_id: The alert UUID from list_alerts (not the resource UUID). limit: Page size, 1-500 (default 100). Out-of-range is rejected. offset: Notes to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[WRITE] Add a note to an alert to record who is handling it and what was done. Does not change the alert's status or ownership — use acknowledge_alert to take ownership. Not idempotent: calling twice adds two notes. Returns created (the stored note) and confirmation_note — when created is null the appliance did not confirm the note; run list_alert_notes before retrying. There is no undo tool for notes. Args: alert_id: The alert UUID from list_alerts (not the resource UUID). note: Note text, e.g. "Taking this: rebooting esx-03". Empty is rejected. target: Aria target name from config; default when omitted.

[READ] Get the prioritized recommendations for one alert — what Aria suggests doing about it — by resolving the alert to its alert definition and the recommendation text. Returns alert_id, alert_name, criticality, alert_definition_id, state_severity, status, recommendations (each: id, priority — lower is more important, description, action, lookup) and note. status: "found"; "partial" (some text could not be read — ids and priorities are still listed, description null means unknown, not blank); "none_defined" (the definition defines none — recommendations is []); "unknown" (the definition could not be read — recommendations is null and must NOT be reported as "no recommendations"). An unreadable alert is an error. Args: alert_id: The alert UUID from list_alerts (not the resource UUID). target: Aria target name from config; default when omitted.

[WRITE] Put one resource in maintenance so Aria stops alerting on it and collecting its data — use before planned work such as powering a VM or host off. Pass duration_minutes OR end_time_ms for a timed window (state MAINTAINED; the resource returns to its prior state when it expires). Pass neither for manual maintenance (MAINTAINED_MANUAL) that lasts until end_resource_maintenance — easy to forget, so prefer a window. Returns the state before and after, confirmed (true / false / null when the after-state could not be read — null is unknown, not failure) and a note. Default confirmed=False returns a preview without connecting. Undo: end_resource_maintenance, recorded only when the resource was known not to be in maintenance before. Args: resource_id: Resource UUID from list_resources (not the resource name). duration_minutes: Window length in whole minutes, 1-525600. Not with end_time_ms. end_time_ms: Window end as epoch MILLISECONDS in the future. Not with duration_minutes. confirmed: Must be True to actually start maintenance. Default False = preview only. target: Aria target name from config; default when omitted.

[WRITE] Take one resource out of maintenance so Aria resumes alerting on it and collecting its data. Refuses only a resource known not to be in maintenance (an adapter reports a state such as STARTED or STOPPED — nothing to end). When the state is unknown (unreadable, or reported as UNKNOWN / NONE) it proceeds and before.in_maintenance is null. Returns the state before and after, confirmed (true / false / null when unknown) and a note. Default confirmed=False returns a preview without connecting. Undo: start_resource_maintenance (re-enters as manual maintenance), recorded only when the resource was known to be in maintenance before. Args: resource_id: Resource UUID from list_resources (not the resource name). confirmed: Must be True to actually end maintenance. Default False = preview only. target: Aria target name from config; default when omitted.

[READ] List recurring maintenance schedules: name, schedule type (ONCE/DAILY/WEEKLY/MONTHLY/YEARLY), recurrence, start hour/minute, duration in minutes, time zone, start and expiry. A schedule does not list the resources it applies to — pass resource_id to see only the schedules for one resource. To put a resource in maintenance now, use start_resource_maintenance. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset, and schedules_note — null when the answer was read; otherwise items is UNKNOWN, not empty, and must not be reported as "no schedules". Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated. Args: resource_id: Only schedules that apply to this resource UUID. limit: Page size, 1-500 (default 100). Out-of-range is rejected. offset: Schedules to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[READ] List certificate status and expiry across the VCF fleet. Use this to spot certificates that are expired or expiring soon across all VCF components managed by Operations 9.1. Returns per-certificate summaries (subject, issuer, valid_to, status, resource, thumbprint) in the family paginated envelope (items/returned/limit/total/truncated/hint). Read-only: it does not renew or replace any certificate. Gotcha: response field names are read defensively — a field absent on your appliance shows as empty rather than failing the call. Args: limit: Max certificates to return (default 50; None returns all). target: Aria/VCF Operations target name from config; default when omitted.

[READ] List managed password-account status across the VCF fleet. Use this to review which fleet accounts Operations manages and their rotation/expiry status. Returns per-account summaries (username, resource, status, expiry, last_rotated) in the paginated envelope. Read-only: this never rotates or sets a password — the rotation endpoint is deliberately not wired into this skill. Gotcha: response field names are read defensively; unknown fields degrade to empty. Args: limit: Max accounts to return (default 50; None returns all). target: Aria/VCF Operations target name from config; default when omitted.

[READ] List the SDDC/workload domains behind one registered VCF integration. Use this to enumerate the domains of a VCF integration registered in Operations. The integration_id is the UUID shown under Administration -> Integrations -> VCF in the Operations UI; the operator supplies it (this skill does not list VCF integrations). Returns domain summaries (id, name, type, status, configuration_state) in the paginated envelope, where configuration_state is configured / not_configured / removed — a removed domain is not a live one. A 404 means the integration_id is wrong — copy the exact UUID from the Operations Integrations page. Gotcha: if the envelope carries a "note", the appliance answered in a shape this tool did not recognise and an empty items list means UNKNOWN, not "no domains" — do not report the fleet as domain-free in that case. Args: integration_id: UUID of the registered VCF integration. limit: Max domains to return (default 50; None returns all). target: Aria/VCF Operations target name from config; default when omitted.

[READ] List Operations diagnostic findings, optionally filtered. Use this to review current diagnostic findings (misconfigurations, health rule hits) across the environment. Filters are comma-separated strings; omit a filter to match all. Returns finding summaries (rule_uuid, name, severity, category, finding_type, affected_objects_count) in the paginated envelope. Note: these are general operational findings, NOT compliance benchmark results — for hardening/compliance use vmware-harden. Args: severities: Comma-separated severity filter, e.g. "CRITICAL,WARNING". categories: Comma-separated category filter. finding_types: Comma-separated findingType filter. limit: Max findings to return (default 50; None returns all). target: Aria/VCF Operations target name from config; default when omitted.

[READ] Run a real-time PromQL instant query (VCF Operations 9.1 VODAP service). Use this for near-real-time (~2s) metrics via a Prometheus-compatible instant query, complementing the historical rollups from get_resource_metrics. Requires the real-time metrics (VODAP) integration to be registered; if it is not, the tool returns an actionable error. Returns result series (labels, timestamp, value) in the paginated envelope plus result_type/status. Gotcha: the query reaches a sibling service whose base path (/data-query-service) is INFERRED — every result carries base_path_confirmed=False until confirmed against a live appliance. Args: query: PromQL expression (required), e.g. "cpu_usage_average{}". time: Optional evaluation timestamp (RFC3339 or Unix seconds). source_id: Optional data-source id to scope the query. limit: Max result series to return (default 50; None returns all). target: Aria/VCF Operations target name from config; default when omitted.

[READ] List alerts from Aria Operations. Returns alert summaries: name, criticality, status, impact, resource_id, resource_name, resource_kind, timestamps (start/update *_time_ms, and start_time_utc / update_time_utc in ISO-8601 UTC), and control state. resource_name and resource_kind are resolved in one batched lookup per page; they are null when that failed, the resource no longer exists, or Aria holds no name for it, and the envelope's resource_names_note (null when every name resolved) then says which — null means unknown, not "no resource". Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk. Args: active_only: Return only active (non-cancelled) alerts. Default True. criticality: Filter by criticality: INFORMATION, WARNING, IMMEDIATE, CRITICAL. resource_id: Scope alerts to a specific resource UUID. limit: Page size, 1–500 (default 100). Out-of-range is rejected. offset: Alerts to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[READ] Get full details for one alert by UUID, including its contributing (triggered) symptoms. Use this after list_alerts to drill into a single alert; use list_alerts to discover or filter them. Returns one alert object: name, criticality, status, impact, resource_id, start/update/cancel timestamps (epoch ms, and *_time_utc ISO-8601; cancel_time_utc is null when never cancelled), control state, and symptoms (each with the condition that triggered it, and the object it is on: resource_id, resource_name, resource_kind, stat_key — for "vCenter appliance health service is down" that names the service, e.g. mem). resource_lookup says how that was found (not_needed / resolved / not_found / failed / no_symptom_id / instance_names_no_resource); a "symptom_resources_note" key appears when some could not be — an empty resource_id there is unknown, not absent. Cost: on Aria 8.18.7 no symptom carries its resource id, so every call pages GET /symptoms (one request per 1,000 symptoms in the appliance, at most 20, stopping once all are found) plus one batched GET /resources. Gotcha: an empty symptoms list normally means the alert has no triggered symptoms, but if a "symptoms_note" key is present the list is UNKNOWN rather than empty — the response shape was unrecognised or the lookup failed, so do not tell the user the alert fired for no reason. Symptom name and severity come from the symptom definition when the instance carries none; each symptom's definition_lookup says whether that worked (resolved / not_needed / not_found / failed / no_definition_id), and a "symptom_definitions_note" key appears when some did not — an empty name there is unknown, not blank. The Alert model does not carry a resource name — resolve it via get_resource(resource_id), or call investigate_alert to do that correlation in one step. Recommendations hang off the alert definition, not the alert. To act on the alert afterwards, use acknowledge_alert or cancel_alert. Args: alert_id: The alert UUID (from list_alerts). target: Aria target name from config; default when omitted.

[READ] List alert definitions (templates that generate alerts when triggered). criticality is the max severity across the definition's states[] (the AlertDefinition model has no top-level criticality or enabled field). Pass a returned id to set_alert_definition_state to enable or disable it. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk. Args: name_filter: Substring filter on definition name (case-insensitive). limit: Page size, 1–500 (default 100). Out-of-range is rejected. offset: Definitions to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[READ] List symptom definitions — use the returned IDs when calling create_alert_definition. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk. Args: name_filter: Substring filter on symptom name (case-insensitive). resource_kind: Optional resource kind filter, e.g. VirtualMachine, HostSystem. limit: Page size, 1–500 (default 100). Out-of-range is rejected. offset: Definitions to skip; pass the previous response's next_offset. target: Aria target name from config; default when omitted.

[READ] Resolve one alert to its affected resource in a single call — use this instead of chaining get_alert then get_resource by hand. Does the whole alert-to-object correlation server-side: fetches the alert, reads its resourceId, fetches that resource, and confirms the resource name and kind before suggesting anything downstream. Returns five always-present keys: alert (Aria's values verbatim, with its contributing symptoms named as in get_alert, including the object each is on and get_alert's GET /symptoms cost — check each symptom's definition_lookup and symptom_definitions_note), resource (or null), correlation (both UUIDs labelled, plus confirmed name, kind and a confirmed flag), next_step (which vmware-monitor tool to call next, or null), and warnings (empty on success). Gotchas: alert_id is the alert UUID from list_alerts, NOT the resource UUID — mixing them up is the most common error here; the correlation block labels each. An unresolvable resource degrades to a warning plus nulls rather than an error, so the alert is never lost. Never match the resource against vCenter inventory unless correlation.confirmed is true. Args: alert_id: The alert UUID from list_alerts (not the resource UUID). target: Aria target name from config; default when omitted.

[READ] Report per-resource anomaly counts (System Attributes|total_alarms metric). The suite-api does not expose the UI's anomalous-metrics list; this is the Total Anomalies metric — active symptoms, events and DT violations on the object and its children. With resource_id: that resource's count. Without: ranks every VM in the environment and returns the worst `limit` of them. For root cause, follow up with list_alerts(resource_id=...). `limit` bounds the answer, not the scan — raising it does not widen the search, and lowering it does not hide worse objects. The whole inventory is read either way, in bulk pages, because the ranking metric is not a field the appliance can sort on. Returns a paginated envelope: flagged rows worst-first under items, plus returned, limit, total, truncated, hint, scanned (objects examined), vm_total and scan_complete. Only flagged VMs are returned, so a short list is not by itself proof the environment is clean. When scan_complete is true, total is the number of anomalous objects found and truncated is exact; when it is false the scan hit its cap, total is the environment's VM count, and a note says the ranking is partial — an unexamined object could outrank every row shown. Args: resource_id: Optional resource UUID to scope to a single resource. limit: Maximum ranked rows to return (1–500). Default 50. Rejected, not clamped, when out of range. target: Aria target name from config; default when omitted.

[READ] Get the risk badge score for a resource (0–100, higher = more risk of future problems). The risk badge predicts likelihood of performance degradation or availability issues based on current trends and workload patterns. Returns `risk_score` and `risk_color` for the one resource. Use this when the risk number is all you want; get_resource_health returns health and efficiency alongside it. The score is null when Aria has not computed a risk badge, and the badge does not say what is wrong — use list_alerts(resource_id=...) for the contributing alerts. Args: resource_id: The resource UUID. target: Aria target name from config; default when omitted.