VCF 9.0.1 — SDDC Manager REST API Handbook

Environment: VCF 9.0.1 Nested Lab — Dell Precision 7920 SDDC Manager: https://sddc-manager.lab.local (192.168.1.241) API Base Path: /v1/ Authentication: Bearer Token (JWT) Date: February 2026

Table of Contents

1. API Architecture Overview
2. Authentication & Token Management
3. System Health & Information
4. Credentials Management
5. NSX-T Cluster Inventory
6. Task Lifecycle & Monitoring
7. Resource Locks & Concurrency
8. Hosts Management
9. Domains & Clusters
10. Bundles & Lifecycle Updates
11. Notifications & Events
12. VCF Services & Depot
13. Complete Endpoint Reference
14. Python Automation Scripts
15. Postman Collection
16. Troubleshooting API Issues
17. Lab-Tested Workflows
18. References

1. API Architecture Overview

How the SDDC Manager API Works

SDDC Manager exposes a REST API under the /v1/ base path. All operations require Bearer token authentication obtained from the /v1/tokens endpoint. The API is primarily asynchronous — most mutating operations (upgrades, deployments, rotations) return a task ID that must be polled for completion.

+------------------------------+
|    VMware Cloud Foundation   |
|        (VCF Platform)        |
+---------------+--------------+
                |
          Exposes REST API
                |
                v
+------------------------------+
|      SDDC Manager API        |
|     Base Path: /v1/          |
+---------------+--------------+
                |
    +-----------+-----------+-----------+-----------+
    |           |           |           |           |
    v           v           v           v           v
+--------+ +----------+ +--------+ +----------+ +--------+
|  Auth  | |  Infra   | |  Tasks | |  Locks   | | Creds  |
| /v1/   | | /v1/     | | /v1/   | | /v1/     | | /v1/   |
| tokens | | hosts    | | tasks  | | resource | | creds  |
|        | | domains  | | {id}   | | -locks   | |        |
+--------+ | clusters | +--------+ +----------+ +--------+
           | nsxt-    |
           | clusters |
           +----------+

API Layers

Key Concepts

• Bearer Token Auth — Every call requires Authorization: Bearer <token> header
• Async Operations — Mutating calls return a task ID; poll /v1/tasks/{id} for status
• Resource Locks — SDDC Manager locks resources during operations to prevent conflicts
• JSON Payloads — All request/response bodies use Content-Type: application/json
• TLS Required — All endpoints are HTTPS only; use -k or --insecure with curl for self-signed certs

2. Authentication & Token Management

Endpoint: POST /v1/tokens

Authenticates a user and returns a JWT Bearer token for all subsequent API calls.

Request:

curl -sk -X POST https://sddc-manager.lab.local/v1/tokens \
  -H "Content-Type: application/json" \
  -d '{
    "username": "administrator@vsphere.local",
    "password": "<password>"
  }'

Response:

{
  "accessToken": "eyJhbGciOi...",
  "refreshToken": {
    "id": "a1b2c3d4-..."
  }
}

Token Details

Token Extraction (Shell Variable)

# One-liner to extract and store the token
TOKEN=$(curl -sk -X POST https://sddc-manager.lab.local/v1/tokens \
  -H "Content-Type: application/json" \
  -d '{"username":"administrator@vsphere.local","password":"<password>"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['accessToken'])")

# Verify it's set
echo "Token: ${TOKEN:0:20}..."

Token Refresh

When the access token expires (HTTP 401), use the refresh token to get a new one without re-authenticating:

curl -sk -X PATCH https://sddc-manager.lab.local/v1/tokens \
  -H "Content-Type: application/json" \
  -d '{"refreshToken":{"id":"<refresh-token-id>"}}'

Token Scope & Permissions

Security Note: Tokens are not invalidated server-side on logout in all versions. Always use HTTPS and protect token values. If a token is compromised, change the associated password immediately.

3. System Health & Information

GET /v1/system

Returns SDDC Manager system information including version and deployment type.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system | python3 -m json.tool

GET /v1/system/health

Returns the overall health status of the VCF platform.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system/health | python3 -m json.tool

Response fields:

GET /v1/system/notifications

Returns active system notifications (warnings, errors, info messages).

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system/notifications | python3 -c \
  "import sys,json; [print(f'{n[\"severity\"]}: {n[\"message\"]}') for n in json.load(sys.stdin).get('elements',[])]"

Lab Note: After a credential cascade failure, stale notifications may persist even after the fix. These clear after the operationsmanager service is restarted and the next health check cycle completes.

4. Credentials Management

Overview

The /v1/credentials endpoint manages all credentials stored inside SDDC Manager, including passwords for vCenter, NSX, ESXi hosts, and service accounts. This is a high-privilege endpoint that returns sensitive data.

GET /v1/credentials

Lists all stored credentials.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/credentials | python3 -c "
import sys, json
data = json.load(sys.stdin)
for c in data.get('elements', []):
    print(f'{c[\"credentialType\"]:20s} {c[\"resource\"][\"resourceName\"]:30s} {c[\"resource\"][\"resourceType\"]:15s} {c.get(\"accountType\",\"\")}')
"

Credential Types

Resource Types

PUT /v1/credentials — Update Password

Updates a credential to match the current password on the target component (when SDDC Manager's stored password is out of sync).

curl -sk -X PUT https://sddc-manager.lab.local/v1/credentials \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operationType": "UPDATE",
    "elements": [{
      "resourceName": "nsx-vip.lab.local",
      "resourceType": "NSX_MANAGER",
      "credentials": [{
        "credentialType": "API",
        "username": "admin",
        "password": "<current-password-on-nsx>"
      }]
    }]
  }'

Returns a task ID — poll /v1/tasks/{id} to monitor progress.

PUT /v1/credentials — Rotate Password

Generates a new password and pushes it to both SDDC Manager's store and the target component.

curl -sk -X PUT https://sddc-manager.lab.local/v1/credentials \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operationType": "ROTATE",
    "elements": [{
      "resourceName": "nsx-vip.lab.local",
      "resourceType": "NSX_MANAGER",
      "credentials": [{
        "credentialType": "API",
        "username": "admin"
      }]
    }]
  }'

5. NSX-T Cluster Inventory

Overview

The /v1/nsxt-clusters endpoint retrieves information about NSX-T clusters managed by VCF, including health state, version, connection status, and cluster members.

GET /v1/nsxt-clusters

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/nsxt-clusters | python3 -m json.tool

Key response fields:

Checking NSX Status (One-Liner)

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/nsxt-clusters | python3 -c "
import sys, json
data = json.load(sys.stdin)
for c in data.get('elements', []):
    print(f'Cluster: {c[\"id\"]}')
    print(f'  Status: {c[\"status\"]}')
    print(f'  VIP: {c.get(\"vipFqdn\",\"?\")} ({c.get(\"vip\",\"?\")})')
    for n in c.get('nodes', []):
        print(f'  Node: {n.get(\"fqdn\",\"?\")} - {n.get(\"status\",\"?\")}')
"

Lab Insight: When status shows ACTIVATING or ERROR instead of ACTIVE, credential operations will fail. This is the first thing to check when credential remediation fails. If the status is stuck, direct PostgreSQL repair is required (see Section 7.2.6 of the Master Bible).

6. Task Lifecycle & Monitoring

Overview

SDDC Manager's API is asynchronous — most mutating operations (upgrades, credential rotations, deployments, domain creation) return a task ID. You must poll the task endpoint to determine success or failure.

GET /v1/tasks

Lists all tasks, optionally filtered by status.

# All tasks
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/tasks | python3 -m json.tool

# Only IN_PROGRESS tasks
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://sddc-manager.lab.local/v1/tasks?status=IN_PROGRESS" | python3 -c "
import sys, json
data = json.load(sys.stdin)
print(f'IN_PROGRESS tasks: {len(data.get(\"elements\",[]))}')
for t in data.get('elements', []):
    print(f'  {t[\"id\"][:8]}... {t[\"name\"]} ({t[\"status\"]})')
"

# Failed tasks
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://sddc-manager.lab.local/v1/tasks?status=FAILED"

GET /v1/tasks/{id}

Returns detailed status of a specific task, including sub-tasks and error messages.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/tasks/<task-id> | python3 -c "
import sys, json
t = json.load(sys.stdin)
print(f'Task: {t[\"name\"]}')
print(f'Status: {t[\"status\"]}')
print(f'Created: {t.get(\"creationTimestamp\",\"?\")}')
for sub in t.get('subTasks', []):
    print(f'  Sub: {sub[\"name\"]} -> {sub[\"status\"]}')
    if sub.get('errors'):
        for e in sub['errors']:
            print(f'    ERROR: {e.get(\"message\",\"\")}')
"

Task Statuses

PATCH /v1/tasks/{id} — Cancel a Task

Attempts to cancel a running task. This often fails for stuck tasks.

curl -sk -X PATCH https://sddc-manager.lab.local/v1/tasks/<task-id> \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status":"CANCELLED"}'

Lab Discovery: The API returns TA_TASK_CAN_NOT_BE_RETRIED for stuck tasks. DELETE /v1/tasks/{id} returns HTTP 500. When the API cannot cancel stuck tasks, direct PostgreSQL database repair is the only option — mark task_metadata.resolved = true in the platform database.

Task Polling Pattern

# Poll a task every 30 seconds until completion
TASK_ID="<task-id>"
while true; do
  STATUS=$(curl -sk -H "Authorization: Bearer $TOKEN" \
    https://sddc-manager.lab.local/v1/tasks/$TASK_ID \
    | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
  echo "$(date +%H:%M:%S) - $STATUS"
  [ "$STATUS" = "SUCCESSFUL" ] || [ "$STATUS" = "FAILED" ] && break
  sleep 30
done

7. Resource Locks & Concurrency

Overview

SDDC Manager uses exclusive resource locks to prevent conflicting operations on the same component. When a workflow starts, it acquires locks on the involved resources. If a workflow fails without releasing its locks, subsequent operations are blocked.

GET /v1/resource-locks

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/resource-locks | python3 -m json.tool

Response example:

{
  "elements": [
    {
      "resource": "domain-1",
      "lockedBy": "task-12345",
      "lockType": "EXCLUSIVE"
    }
  ]
}

Lock Types

Lockable Resources

Diagnosing Lock Issues

# Check if any resources are locked
LOCKS=$(curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/resource-locks | python3 -c \
  "import sys,json; print(len(json.load(sys.stdin).get('elements',[])))")
echo "Active locks: $LOCKS"

Key Insight: Stale locks from failed operations are stored in the platform.lock PostgreSQL table. The API provides no way to force-release locks. When the API shows locks but no running tasks, direct database cleanup (DELETE FROM lock) is required.

8. Hosts Management

GET /v1/hosts

Lists all ESXi hosts managed by SDDC Manager.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/hosts | python3 -c "
import sys, json
for h in json.load(sys.stdin).get('elements', []):
    print(f'{h[\"fqdn\"]:30s} {h[\"status\"]:12s} {h.get(\"hardwareModel\",\"\")}')
"

POST /v1/hosts — Commission a Host

Adds a new ESXi host to SDDC Manager's inventory.

curl -sk -X POST https://sddc-manager.lab.local/v1/hosts \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '[{
    "fqdn": "esxi05.lab.local",
    "username": "root",
    "password": "<password>",
    "networkPoolId": "<pool-id>",
    "storageType": "VSAN"
  }]'

DELETE /v1/hosts/{id} — Decommission a Host

Removes an ESXi host from SDDC Manager's inventory.

curl -sk -X DELETE -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/hosts/<host-id>

Host Statuses

9. Domains & Clusters

GET /v1/domains

Lists all workload domains.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/domains | python3 -c "
import sys, json
for d in json.load(sys.stdin).get('elements', []):
    print(f'{d[\"name\"]:25s} {d[\"type\"]:15s} {d[\"status\"]}')
"

GET /v1/clusters

Lists all vSphere clusters across all domains.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/clusters | python3 -c "
import sys, json
for c in json.load(sys.stdin).get('elements', []):
    print(f'{c[\"name\"]:25s} hosts={len(c.get(\"hosts\",[]))} {c[\"status\"]}')
"

GET /v1/vcenters

Lists all vCenter Server instances managed by VCF.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/vcenters | python3 -m json.tool

10. Bundles & Lifecycle Updates

GET /v1/bundles

Lists all available update bundles (downloaded or available for download).

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/bundles | python3 -c "
import sys, json
for b in json.load(sys.stdin).get('elements', []):
    print(f'{b.get(\"bundleType\",\"?\":15s} {b.get(\"version\",\"?\":12s} {b.get(\"downloadStatus\",\"?\")}')
"

GET /v1/upgradables

Lists components that have available upgrades.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/upgradables | python3 -m json.tool

POST /v1/upgrades — Start an Upgrade

Initiates an upgrade for a specific component. Returns a task ID.

curl -sk -X POST https://sddc-manager.lab.local/v1/upgrades \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "bundleId": "<bundle-uuid>",
    "resourceType": "DOMAIN",
    "resourceUpgradeSpecs": [{
      "resourceId": "<domain-id>",
      "scheduledTimestamp": ""
    }]
  }'

Upgrade Order (Always Follow This Sequence)

11. Notifications & Events

GET /v1/system/notifications

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system/notifications | python3 -c "
import sys, json
data = json.load(sys.stdin)
for n in data.get('elements', []):
    print(f'[{n[\"severity\"]}] {n[\"message\"][:100]}')
"

Notification Severities

12. VCF Services & Depot

GET /v1/services

Lists VCF services and their status.

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/services | python3 -m json.tool

Network Pools

# List network pools
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/network-pools | python3 -m json.tool

Personalities (vLCM Images)

# List available personalities
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/personalities | python3 -m json.tool

13. Complete Endpoint Reference

Authentication

System

Infrastructure Inventory

Credentials

Tasks & Locks

Lifecycle & Bundles

Networking & Pools

Services

14. Python Automation Scripts

Full API Client Script

#!/usr/bin/env python3
"""VCF SDDC Manager API client — query all key endpoints."""
import requests, json, sys, io, urllib3

urllib3.disable_warnings()
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

SDDC = "https://sddc-manager.lab.local"
USER = "administrator@vsphere.local"
PASS = "Success01!0909!!"

# Authenticate
resp = requests.post(f"{SDDC}/v1/tokens",
    json={"username": USER, "password": PASS}, verify=False)
token = resp.json()["accessToken"]
headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

def get(endpoint, label=""):
    url = f"{SDDC}{endpoint}"
    r = requests.get(url, headers=headers, verify=False)
    print(f"\n{'='*60}")
    print(f"GET {endpoint}  [{r.status_code}]  {label}")
    print('='*60)
    if r.status_code == 200:
        print(json.dumps(r.json(), indent=2)[:2000])
    else:
        print(f"Error: {r.text[:500]}")

# Query all key endpoints
get("/v1/system", "System Info")
get("/v1/system/health", "Platform Health")
get("/v1/credentials", "Credential Inventory")
get("/v1/nsxt-clusters", "NSX-T Clusters")
get("/v1/resource-locks", "Resource Locks")
get("/v1/tasks?status=IN_PROGRESS", "In-Progress Tasks")
get("/v1/hosts", "ESXi Hosts")
get("/v1/domains", "Workload Domains")
get("/v1/clusters", "vSphere Clusters")
get("/v1/system/notifications", "Notifications")

Credential Status Checker

#!/usr/bin/env python3
"""Check credential status for all VCF components."""
import requests, json, sys, io, urllib3

urllib3.disable_warnings()
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

SDDC = "https://sddc-manager.lab.local"
USER = "administrator@vsphere.local"
PASS = "Success01!0909!!"

resp = requests.post(f"{SDDC}/v1/tokens",
    json={"username": USER, "password": PASS}, verify=False)
token = resp.json()["accessToken"]
headers = {"Authorization": f"Bearer {token}"}

# Get credentials
r = requests.get(f"{SDDC}/v1/credentials", headers=headers, verify=False)
creds = r.json().get("elements", [])

print(f"{'Type':<12} {'Resource':<30} {'ResourceType':<18} {'Account':<25} {'Status'}")
print("-" * 100)
for c in creds:
    print(f'{c["credentialType"]:<12} '
          f'{c["resource"]["resourceName"]:<30} '
          f'{c["resource"]["resourceType"]:<18} '
          f'{c.get("username",""):<25} '
          f'{c.get("status","?")}')

Task Monitor

#!/usr/bin/env python3
"""Monitor a VCF task until completion."""
import requests, json, sys, io, time, urllib3

urllib3.disable_warnings()
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

SDDC = "https://sddc-manager.lab.local"
USER = "administrator@vsphere.local"
PASS = "Success01!0909!!"
TASK_ID = sys.argv[1] if len(sys.argv) > 1 else input("Task ID: ")

resp = requests.post(f"{SDDC}/v1/tokens",
    json={"username": USER, "password": PASS}, verify=False)
token = resp.json()["accessToken"]
headers = {"Authorization": f"Bearer {token}"}

while True:
    r = requests.get(f"{SDDC}/v1/tasks/{TASK_ID}", headers=headers, verify=False)
    task = r.json()
    status = task["status"]
    name = task.get("name", "Unknown")
    print(f"[{time.strftime('%H:%M:%S')}] {name}: {status}")

    if status in ("SUCCESSFUL", "FAILED", "CANCELLED"):
        if status == "FAILED":
            for sub in task.get("subTasks", []):
                if sub.get("errors"):
                    for e in sub["errors"]:
                        print(f"  ERROR: {e.get('message','')}")
        break
    time.sleep(30)

15. Postman Collection

Save the following as VCF_API_Collection.json and import into Postman:

{
  "info": {
    "name": "VMware Cloud Foundation (VCF) - SDDC Manager API",
    "description": "REST API collection for VCF /v1/ endpoints",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "1 - Authenticate (Get Token)",
      "request": {
        "method": "POST",
        "header": [{"key": "Content-Type", "value": "application/json"}],
        "body": {
          "mode": "raw",
          "raw": "{\n  \"username\": \"administrator@vsphere.local\",\n  \"password\": \"YOUR_PASSWORD\"\n}"
        },
        "url": "https://sddc-manager.lab.local/v1/tokens"
      }
    },
    {
      "name": "2 - System Health",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/system/health"
      }
    },
    {
      "name": "3 - Credentials Inventory",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/credentials"
      }
    },
    {
      "name": "4 - NSX-T Clusters",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/nsxt-clusters"
      }
    },
    {
      "name": "5 - All Tasks",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/tasks"
      }
    },
    {
      "name": "6 - IN_PROGRESS Tasks",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/tasks?status=IN_PROGRESS"
      }
    },
    {
      "name": "7 - Resource Locks",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/resource-locks"
      }
    },
    {
      "name": "8 - Hosts",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/hosts"
      }
    },
    {
      "name": "9 - Domains",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/domains"
      }
    },
    {
      "name": "10 - Clusters",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/clusters"
      }
    },
    {
      "name": "11 - Notifications",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/system/notifications"
      }
    },
    {
      "name": "12 - Bundles",
      "request": {
        "method": "GET",
        "header": [{"key": "Authorization", "value": "Bearer {{token}}"}],
        "url": "https://sddc-manager.lab.local/v1/bundles"
      }
    }
  ],
  "variable": [
    {"key": "token", "value": ""},
    {"key": "task_id", "value": ""}
  ]
}

How to use:

1. Import JSON into Postman
2. Run "1 - Authenticate" — copy accessToken from response
3. Set the token variable in Postman's Collection Variables
4. Call all other endpoints

16. Troubleshooting API Issues

Common HTTP Status Codes

Common API Errors

Debugging API Calls

# Verbose curl output (shows headers and TLS handshake)
curl -svk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system/health 2>&1

# Check if SDDC Manager is reachable
curl -sk -o /dev/null -w "%{http_code}" \
  https://sddc-manager.lab.local/v1/system

# Test token validity
curl -sk -o /dev/null -w "%{http_code}" \
  -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system
# 200 = token valid, 401 = token expired

SDDC Manager API Log Locations

# SSH to SDDC Manager as vcf, su - to root
/var/log/vmware/vcf/operationsmanager/operationsmanager.log  # Credential ops
/var/log/vmware/vcf/domainmanager/domainmanager.log          # Domain/cluster ops
/var/log/vmware/vcf/lcm/lcm.log                             # Lifecycle/upgrade ops
/var/log/vmware/vcf/commonsvcs/commonsvcs.log                # Auth/token issues

17. Lab-Tested Workflows

Workflow 1: Full Health Check

# 1. Authenticate
TOKEN=$(curl -sk -X POST https://sddc-manager.lab.local/v1/tokens \
  -H "Content-Type: application/json" \
  -d '{"username":"administrator@vsphere.local","password":"<pass>"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['accessToken'])")

# 2. System health
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system/health

# 3. NSX status
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/nsxt-clusters

# 4. Check for stuck tasks
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://sddc-manager.lab.local/v1/tasks?status=IN_PROGRESS"

# 5. Check for stale locks
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/resource-locks

# 6. Check notifications
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/system/notifications

Workflow 2: Credential Update for NSX

# 1. Authenticate
TOKEN=$(curl -sk -X POST https://sddc-manager.lab.local/v1/tokens \
  -H "Content-Type: application/json" \
  -d '{"username":"administrator@vsphere.local","password":"<pass>"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['accessToken'])")

# 2. Verify NSX is ACTIVE first
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/nsxt-clusters | python3 -c \
  "import sys,json; [print(c['status']) for c in json.load(sys.stdin).get('elements',[])]"
# MUST show ACTIVE before proceeding

# 3. Verify no stale locks
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/resource-locks

# 4. Submit credential update
TASK=$(curl -sk -X PUT https://sddc-manager.lab.local/v1/credentials \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operationType": "UPDATE",
    "elements": [{
      "resourceName": "nsx-vip.lab.local",
      "resourceType": "NSX_MANAGER",
      "credentials": [{
        "credentialType": "API",
        "username": "admin",
        "password": "<current-nsx-password>"
      }]
    }]
  }' | python3 -c "import sys,json; print(json.load(sys.stdin).get('id','?'))")

echo "Task: $TASK"

# 5. Poll task status
while true; do
  S=$(curl -sk -H "Authorization: Bearer $TOKEN" \
    https://sddc-manager.lab.local/v1/tasks/$TASK \
    | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
  echo "$(date +%H:%M:%S) $S"
  [ "$S" = "SUCCESSFUL" ] || [ "$S" = "FAILED" ] && break
  sleep 15
done

Workflow 3: Diagnose Credential Cascade Failure

# 1. Authenticate
TOKEN=$(curl -sk -X POST https://sddc-manager.lab.local/v1/tokens \
  -H "Content-Type: application/json" \
  -d '{"username":"administrator@vsphere.local","password":"<pass>"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['accessToken'])")

# 2. Check NSX status (ACTIVATING/ERROR = problem)
echo "=== NSX Status ==="
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/nsxt-clusters | python3 -c \
  "import sys,json; [print(f'  {c[\"id\"][:8]}... status={c[\"status\"]}') for c in json.load(sys.stdin).get('elements',[])]"

# 3. Check resource locks (stale locks = problem)
echo "=== Resource Locks ==="
curl -sk -H "Authorization: Bearer $TOKEN" \
  https://sddc-manager.lab.local/v1/resource-locks | python3 -c \
  "import sys,json; d=json.load(sys.stdin).get('elements',[]); print(f'  Locks: {len(d)}'); [print(f'  {l}') for l in d[:5]]"

# 4. Check stuck tasks (dozens = cascade failure)
echo "=== Stuck Tasks ==="
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://sddc-manager.lab.local/v1/tasks?status=IN_PROGRESS" | python3 -c \
  "import sys,json; d=json.load(sys.stdin).get('elements',[]); print(f'  IN_PROGRESS: {len(d)}')"

# 5. Check latest failed tasks
echo "=== Recent Failed Tasks ==="
curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://sddc-manager.lab.local/v1/tasks?status=FAILED" | python3 -c "
import sys, json
tasks = json.load(sys.stdin).get('elements', [])[:3]
for t in tasks:
    print(f'  {t[\"name\"]}: {t[\"status\"]}')
    for sub in t.get('subTasks', []):
        if sub.get('errors'):
            for e in sub['errors']:
                print(f'    ERROR: {e.get(\"message\",\"\")[:100]}')
"

# 6. Verify actual NSX health (bypass SDDC Manager)
echo "=== Direct NSX VIP Check ==="
curl -sk -u admin:'<pass>' --connect-timeout 10 \
  https://nsx-vip.lab.local/api/v1/cluster/status | python3 -c \
  "import sys,json; d=json.load(sys.stdin); print(f'  Overall: {d.get(\"detailed_cluster_status\",{}).get(\"overall_status\",\"?\")}')" 2>/dev/null || echo "  VIP unreachable"

18. References

Document Information

This handbook documents the SDDC Manager REST API as tested in a VCF 9.0.1 nested lab environment. API behavior may vary in production deployments. Always consult the official Broadcom API reference for the latest endpoint specifications.

(c) 2026 Virtual Control LLC. All rights reserved.