API List VMs

[mvtab]

Hello,

I am having some surprisingly difficult time trying to find an endpoint in the API where I can simply list the running VMs and their configurations.
I noticed that even in proxmoxer, and in it's related ansible module, it is not possible to get the configurations of a VM.

So far I considered:
- nodes/<node>/qemu/<vmid>/config: VMs can run anywhere, and they can change host more times in a minute. This is useless, because I can't nicely automate it.
- pvesh: I need to access the data from outside the Nodes. This is useless without a lot of workarounds.

- if cluster/resources from the API would behave exactly like the pvesh cluster/resources that would be nice. It does not.​

Any other ideas? Kinda makes me wonder how does the graphical interface even get it's data.


Kind regards,
mvtab

 

[aaron]

- if cluster/resources from the API would behave exactly like the pvesh cluster/resources that would be nice. It does not.

how so? If there are discrepancies, we need to look into why.

The way the web UI handles it is to regularly fetch the cluster/resources to know on which node the guests are located at. With that info, it is then possible to send the guest specific requests to the correct nodes.

 

[LnxBil]

- nodes/<node>/qemu/<vmid>/config: VMs can run anywhere, and they can change host more times in a minute. This is useless, because I can't nicely automate it.

Yes, I also wonder about this. An atomic operation yielding this information consistently would be much appreciated. The hypervisors should in general be abstracted and only the VMs should be visible and queriable.

 

[mvtab]

how so? If there are discrepancies, we need to look into why.

When I do a request on /api2/json/cluster/resources I only get a list of the nodes. I tried also -d '{"type": "vm"}' and all variations thereof but it doesn't really change anything. (I get '{"data": []}')
When I run a pvesh get cluster/resources -o json I get a full list of all VMs (if I add --type vm) and their hardware. (Exactly what I need)

At first I thought maybe it's because of permissions, but I even changed my API token permissions to full blown root Administrator and I still get the same results.

If I could get a list of the VMs somewhere I could work with that, because once I know the node and VM ID it's easy, but if I for example do a request on /api2/json/nodes/<node>/qemu I get also '{"data": []}'.

 

[aaron]

Since it is a GET request, the parameter, when using CURL, can be added as ?type=vm
since you don't see the guests without any type parameter, please check that the user/API token you use to authenticate has at least "Audit" privileges on the /vm/ ACL path.

 

[mvtab]

Since it is a GET request, the parameter, when using CURL, can be added as ?type=vm
since you don't see the guests without any type parameter, please check that the user/API token you use to authenticate has at least "Audit" privileges on the /vm/ ACL path.

I tried all variations thereof. -X POST -X PATCH ?type=vm, nothing works, empty data.
The token has no privilege separation and I gave it full Administrator privileges on / (tried first with suggested ones from documentation)

But let me get this right. This is not how the endpoint should act? Should I actually receive there the exact same results from pvesh?

 

[aaron]

GET parameter are added at the end of the URL.

https://proxmox-ve-host:8006/api2/json/cluster/resources?type=vm

Should I actually receive there the exact same results from pvesh?

Yes, if you run pvesh with the --output-format json option, the resulting output should be the same, except maybe some ordering. If you don't, it might be due to missing permissions. If you run pvesh, you most likely do it as the root user. When you interact with the API from another system, it is most likely as a different user or API-token which could be missing the necessary permissions.

 

[mvtab]

So, apparently I misunderstood the privilege separation.

I had unticked the box, and gave full permissions to the API Token. However, those were ignored, and the user permissions were used. (None)
Gave the right permissions to the user instead of the token and it worked.
I wanted to have permissions set only at token level, i.e. user should have by default no permissions, but the token yes. Apparently this is not possible, only the other way around.

Thank you for the assistance.

 

[aaron]

Keep in mind, even if you use privilege separation, the token can never have more privileges than the user it is associated with.

 

[mvtab]

Just a quick note still, the API documentation is a little incomplete:

Here it is said the required permissions for the endpoint are none (all authenticated users). This is kind of correct, as you can get a node list without any permissions, but incomplete, because you can't see any other resources without Audit permissions on /vm (as explained to me by @aaron)

Thank you again and kind regards.