Accessing the VCF Operations 9.1 API using vIDB Tokens

We've discussed authenticating with the VCF Operations API a couple times before:

• Authenticating with the Aria Operations API

• Authenticating to the VCF Operations API using vIDM Credentials

This blog will discuss how to authenticate with the VCF Operations 9.1 API using vIDB Tokens, assuming you're running an integrated instance of vIDB.

First, log into VCF Operations and go to Manage - Fleet Management - Identity & Access - VCF Overview and select our Identity Broker.

From there go to the API Access tab and create an API Client, click CREATE from the API CLIENTS tab.

Give your API Client a name and add the Roles, Scopes, and Expirations you'd like. Mine looks like this.

Once done click CREATE API Client then SAVE. Back at the API Clients menu you can then generate an API Token by clicking the 3 dots.

Give it a name, TTL, and Description.

Click GENERATE TOKEN which will generate your token.

Documentation on creating an API Client and Token in VCF Operations 9.1 can be found here.

You now have your token, OIDC Issuer URL, and Token Endpoint URL, which you will need to exchange the token you've already generated for a Bearer Token to be used with the Operations API. In my case, the command to do that looks like this.

curl -k --request POST \

  --url https://vc-mgmt-a.site-a.vcf.lab/acs/t/CUSTOMER/token \

  --header 'content-type: application/x-www-form-urlencoded' \

  --data grant_type=urn:custom:vcf:params:oauth:grant-type:api-token \

  --data api_token=your_vidb_token_goes_here

The output of which will be a Bearer Token to be used with the VCF Operations API. My output looked something like this:

{"scope":"user","access_token":"your_token_will_be_here","token_type":"Bearer","expires_in":1799}

You can now use this Bearer Token to authenticate with the VCF Operations API:

Note: you must prepend your Token value with the string Bearer. Click authorize and you are now able to run calls against any Operations endpoint via the Swagger UI.

You can also use this Bearer Token to run curl/Postman/etc calls against the VCF Operations API, here's an example of a GET /api/resources:

curl -X 'GET' \ 'https://your_ops_fqdn_goes_here/suite-api/api/resources?page=0&pageSize=1000&_no_links=true' \ -H 'accept: application/json' \ -H 'Authorization: Bearer your_bearer_token_goes_here'

This is a bit different than the way we used to authenticate with the VCF Operations API (using local accounts or vIDM accounts), hope it was helpful!