REST API

delaf

Hello,

We start using the REST API.
As I did not see evolution on it since some months, I would like to know what is the status and what are the plan of this API?

Today the most problematic part I have is the lack of rights in the API : the user must be an admin and have read/write access (even if for now the write access is quite limited as it is only "VDI Import"), and so have access to all ressources.

We are only using Collections for now to get VM list, and VM info (ram, disk, cpu), and so far so good

Regards,

olivierlambert

Hi!

The plan is to add more feature as users ask. So this is user driven, since we can't guess priorities without people asking
What do you expects concretely in terms of features? Can you please provide actual use cases?

delaf

@olivierlambert
For now, we are using the REST API to integrate information about VM into our ERP. We are tracking changes over time and are providing an up to date inventory to our customers.

Next step for us, would be able to create VM directly through the REST API (and not via xo-cli, or xe).
But on the security side, we will need to be able to restrict API users to some objects as the system must not be able to view/modify some objects (mostly do not be able to get/set info for some pools). Even further, we could imagine that each customer has 2 API KEY (one read, the other read/write) that will be restricted to the customer pool or customer VM.

To help people to use the REST API, it would be nice if xo-web can generate the API KEY.

Regards,

olivierlambert

Hi!

For the last point, I invite you stay tuned being read carefully each XO release blog post. It's available in XO 5.72 since last June, see https://xen-orchestra.com/blog/xen-orchestra-5-72/#-rest-api-token-generation

For the REST API, we recently added (but not published in a blog post, will be for November release) GET on snapshots (VM and VDI) + VM templates. So more objects to view from there

However, there's a big gap with POST actions (doing "actions" in short). Since almost all operations are async, like disk or VM creation, REST needs to be tuned for that. I would say it's the "hard" part in REST vs a connected API like xo-cli with websockets and its persistent connection. We will probably use a "queue" system you can request to get the status of the task and the answer. Eg the UUID of the freshly created VM. All in all, it's more complex and can't be done quickly like adding "GET" actions

Finally, the permissions IMHO are even more complex, we need to discuss that with @julien-f

delaf

@olivierlambert said in REST API:

For the last point, I invite you stay tuned being read carefully each XO release blog post. It's available in XO 5.72 since last June, see https://xen-orchestra.com/blog/xen-orchestra-5-72/#-rest-api-token-generation

I forgot it or miss it
Thank you!

@olivierlambert said in REST API:

However, there's a big gap with POST actions (doing "actions" in short). Since almost all operations are async, like disk or VM creation, REST needs to be tuned for that. I would say it's the "hard" part in REST vs a connected API like xo-cli with websockets and its persistent connection. We will probably use a "queue" system you can request to get the status of the task and the answer. Eg the UUID of the freshly created VM. All in all, it's more complex and can't be done quickly like adding "GET" actions

I hope you will find something that it is not too complicated to implement in your side!

@olivierlambert said in REST API:

Finally, the permissions IMHO are even more complex, we need to discuss that with @julien-f

Yes permissions are always a big thing.

r0123456789

Hello guys!

There is a way on rest api to change vms tags?

I tried something like this:

curl -b authenticationToken=MYTOKEN -X POST -d "{"tags":"MYTAG"}" https://ENDPOINT/rest/v0/vms/UUID

and i got this error:

<pre>Cannot POST /rest/v0/vms/UUID</pre>

Thanks!

olivierlambert

There's no POST possible at the moment, only GET to read what you need. However, it's planned to add actions, and tags might be one of the easiest (but before, we need to finish our new task system and create a "queue" for the REST API for all async tasks)

olivierlambert

@marcungeschikts we need to get that in the planning, at least initial POST feature before the end of Q1

marcungeschikts

@olivierlambert