An MCP server that connects to Vercel API
Nothing to run from here
UniFi Fabric is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
97/100
trust score
200
tools declared
local
runs on your machine
—
downloads a day
What it does
MCP server for UniFi Fabric: Network, Protect, Site Manager, InnerSpace, Carrier Fabric, Mobility.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --env 'UNIFI_API_KEY=${UNIFI_API_KEY}' --transport stdio unifi-fabric-mcp '--' uvx unifi-fabric-mcp-server
# 2 — ask your agent for something these tools do
# list_hosts, get_host, list_sites and 197 more
It needs UNIFI_API_KEY: this reads it from your environment, so export it first.
UniFi Fabric costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
SWAll 1 server
swkstudios1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts UniFi Fabric as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads UNIFI_API_KEY (UniFi Site Manager API key (unifi.ui.com > API Keys)) from your environment each time it starts the server, so the value stays out of its config: export it in your shell profile (macOS, Linux), or run setx UNIFI_API_KEY … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user --env 'UNIFI_API_KEY=${UNIFI_API_KEY}' --transport stdio unifi-fabric-mcp '--' uvx unifi-fabric-mcp-serverReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it asks of you
It reaches a system of yours, so it needs your own credential rather than the publisher’s: UNIFI_API_KEY — UniFi Site Manager API key (unifi.ui.com > API Keys).. You set it in your own client’s config, on your machine — this marketplace never holds it.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
200 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
List all UniFi consoles (hosts) with firmware, WAN IP, and status.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| page_token | string | no | Raw nextToken string for one verbatim page, or the returned opaque _continuation string preserving physical size when changing page_size. Example: the token from the previous response. |
| page_size | integer | no | Requested host count, gathered across effective pages. Omit both paging arguments to drain every page. Example: 100. |
| key_label | string | no | Configured API-key label from list_configured_api_keys to read one key; required with paging when several keys exist. Example: "primary". |
Get details for a single UniFi console by name or ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). |
List all sites with device/client counts and ISP info.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| page_token | string | no | Raw nextToken string for one verbatim page, or the returned opaque _continuation string preserving physical size when changing page_size. Example: the token from the previous response. |
| page_size | integer | no | Requested site count, gathered across effective pages. Omit both paging arguments to drain every page. Example: 100. |
| key_label | string | no | Configured API-key label from list_configured_api_keys to read one key; required with paging when several keys exist. Example: "primary". |
List all devices across the fleet with status, firmware, and model.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | no | Optional console name or composite id from list_hosts; for example "my-console" from reportedState.hostname or its data[].id. Names are case-insensitive. |
| page_token | string | no | Raw nextToken string for one verbatim page, or the returned opaque _continuation string preserving physical size when changing page_size. Example: the token from the previous response. |
| time | string | no | Optional RFC3339 last-processed timestamp, forwarded unchanged as time; for example "2026-10-26T00:00:00Z". Omitted when unset. |
| page_size | integer | no | Requested wrapper count, gathered across effective pages. Omit both paging arguments to drain all. Example: 100. |
| key_label | string | no | Configured API-key label from list_configured_api_keys; required with paging and no host when several keys exist. Example: "primary". |
Get WAN health metrics (speed, latency, packet loss, uptime).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| interval | string | yes | time bucket for metrics aggregation — '5m' or '1h'. |
| duration | string | no | Optional (query duration): time range ending now — '24h' for 5m metrics, '7d' or '30d' for 1h metrics. Cannot be combined with begin_timestamp/end_timestamp. |
| begin_timestamp | string | no | Optional (query beginTimestamp): earliest time, an RFC3339 string such as "2026-07-23T00:00:00Z". |
| end_timestamp | string | no | Optional (query endTimestamp): latest time, an RFC3339 string. |
Query filtered ISP metrics for one or more scoped sites (via sites, or host+site).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| interval | string | yes | time bucket for metrics aggregation — '5m' or '1h'. |
| host | string | no | Optional. Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). |
| site | string | no | site name or ID — resolves to siteId automatically. |
| sites | array | no | advanced use — list of {hostId, siteId} dicts, optionally with per-entry beginTimestamp/endTimestamp. hostId may be a console name or id (resolved to the id); siteId must be a Site Manager site on tha |
| start_time | string | no | ISO 8601 UTC timestamp STRINGS, e.g. "2026-07-23T00:00:00Z". These are strings, NOT epoch numbers — passing an epoch integer (seconds or milliseconds) is rejected by schema validation with 'Input shou |
| end_time | string | no | ISO 8601 UTC timestamp STRINGS, e.g. "2026-07-23T00:00:00Z". These are strings, NOT epoch numbers — passing an epoch integer (seconds or milliseconds) is rejected by schema validation with 'Input shou |
List Site Magic (SD-WAN) VPN mesh configurations.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| page_token | string | no | Optional pagination cursor (a nextToken if returned by the service) to fetch one page manually. Omit it to drain every page and get the complete list. Example: the nextToken string from a previous r |
| key_label | string | no | Optional configured API-key label (see list_configured_api_keys) to read one key. Omit it to cover every key. With several keys configured, page_token needs it; without it the call fails listing the l |
Get a single SD-WAN configuration by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| config_id | string | yes | SD-WAN configuration id (Site Manager). Get it from list_sdwan_configs (id). |
Get the status of an SD-WAN configuration by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| config_id | string | yes | SD-WAN configuration id (Site Manager). Get it from list_sdwan_configs (id). |
List all sites with aggregated health stats from the /v1/sites/ API.
Takes no parameters.
Get a site's health: the Classic /stat/health body, verbatim.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| site | string | yes | Site Manager site name or siteId (list_sites: data[].meta.desc / meta.name, or siteId). A name shared by sites on several consoles is rejected with the matches listed; pass that siteId then. |
Compare health and performance metrics across multiple sites side-by-side.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| sites | array | yes | Site Manager site names or siteIds to compare (list_sites: meta.desc / meta.name, or siteId); a shared name is reported as an error for that entry — pass the siteId. An empty list compares no site: _c |
Search for devices or clients matching a query across all sites.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| query | string | yes | case-insensitive substring matched against a device's name, macAddress, ipAddress or model, or a client's name, macAddress, ipAddress or hostname, e.g. "02:00:5e" or "10.0.2.". An empty or whitespace |
Get full inventory for a site: all devices and connected clients.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| site | string | yes | Site Manager site name or siteId (list_sites: data[].meta.desc / meta.name, or siteId). A name shared by sites on several consoles is rejected with the matches listed; pass that siteId then. |
| device_filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the filter query parameter of the site's device list. Omitted when unset. |
| client_filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the filter query parameter of the site's client list. Omitted when unset. |
Get the UniFi Network application version reported by a console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
List sites managed by one UniFi Network application.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional UniFi Integration API filter expression, forwarded unchanged as the upstream filter query parameter. Omitted entirely when unset. Example: name.eq('Default'). |
List all networks/VLANs for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter (e.g. vlanId.eq(100), name.like('*guest*'), metadata.origin.eq('USER_DEFINED')). |
Create a new network/VLAN on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| network_config | object | yes | Full object to create; spec Create or update Network. Required: enabled, management, name, vlanId. 'management' selects variant: GATEWAY|SWITCH|UNMANAGED. |
Get a single network/VLAN by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| network_id | string | yes | Network/VLAN UUID. Get it from list_networks (data[].id). Network-app UUID — not a Protect id. |
Update an existing network/VLAN.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| network_id | string | yes | Network/VLAN UUID. Get it from list_networks (data[].id). Network-app UUID — not a Protect id. |
| network_config | object | yes | FULL replacement object (PUT; omitted fields reset); spec Create or update Network. Required: enabled, management, name, vlanId. 'management' selects variant: GATEWAY|SWITCH|UNMANAGED. |
Delete a network/VLAN.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| network_id | string | yes | Network/VLAN UUID. Get it from list_networks (data[].id). Network-app UUID — not a Protect id. |
| force | boolean | no | Optional spec query parameter force (boolean, upstream default false); true asks the controller to delete a network that is still referenced. Omitted when unset. |
Get all resources referencing a network — useful before deleting to check dependencies.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| network_id | string | yes | Network/VLAN UUID. Get it from list_networks (data[].id). Network-app UUID — not a Protect id. |
List Link Aggregation Groups (LAGs) on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | optional UniFi Integration API filter expression. Example: metadata.origin.eq('USER_DEFINED'). |
Get one Link Aggregation Group.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| lag_id | string | yes | LAG UUID. Get it from list_lags (data[].id). |
List Multi-Chassis Link Aggregation (MC-LAG) domains on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | optional UniFi Integration API filter expression. Example: metadata.origin.eq('USER_DEFINED'). |
Get one Multi-Chassis Link Aggregation domain.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| mc_lag_domain_id | string | yes | MC-LAG domain UUID. Get it from list_mc_lag_domains (data[].id). |
List switch stacks on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | optional UniFi Integration API filter expression. Example: metadata.origin.eq('USER_DEFINED'). |
Get one switch stack.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| switch_stack_id | string | yes | Switch stack UUID. Get it from list_switch_stacks (data[].id). |
List all WiFi broadcast SSIDs for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. enabled.eq(true), name.like('*Guest*')); omitted en |
Create a new WiFi broadcast SSID on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| broadcast | object | yes | Full object to create; spec Wifi broadcast create or update. 'type' selects variant: IOT_OPTIMIZED|STANDARD. |
Get a single WiFi broadcast SSID by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| broadcast_id | string | yes | WiFi broadcast (SSID) UUID. Get it from list_wifi_broadcasts (data[].id). Network-app UUID — not a Protect id. |
Update an existing WiFi broadcast SSID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| broadcast_id | string | yes | WiFi broadcast (SSID) UUID. Get it from list_wifi_broadcasts (data[].id). Network-app UUID — not a Protect id. |
| broadcast | object | yes | FULL replacement object (PUT; omitted fields reset); spec Wifi broadcast create or update. 'type' selects variant: IOT_OPTIMIZED|STANDARD. |
Delete a WiFi broadcast SSID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| broadcast_id | string | yes | WiFi broadcast (SSID) UUID. Get it from list_wifi_broadcasts (data[].id). Network-app UUID — not a Protect id. |
| force | boolean | no | Optional spec query parameter force (boolean, upstream default false); true asks the controller to delete a broadcast that is still referenced. Omitted when unset. |
List WAN interfaces for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
Update a WAN interface configuration.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| wan_id | string | yes | WAN interface id. Get it from list_wan_interfaces (data[].id); the Classic networkconf _id also works. Network-app UUID — not a Protect id. |
| wan | object | yes | Native Classic networkconf fields to change, e.g. name, wan_type, wan_dns1, wan_load_balance_weight, wan_failover_priority, wan_vlan_enabled. Sent unchanged (empty-string list placeholders dropped); a |
List firewall policies for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset. E |
Create a new firewall policy on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy | object | yes | Full policy, schema "Create or update firewall policy". Required: name, enabled, loggingEnabled, action{type:ALLOW|BLOCK|REJECT}, source{zoneId}, destination{zoneId}, ipProtocolScope{ipVersion}. |
Get a single firewall policy by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | Firewall policy UUID. Get it from list_firewall_policies (data[].id). Network-app UUID — not a Protect id. |
Full-replace a firewall policy by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | Firewall policy UUID. Get it from list_firewall_policies (data[].id). Network-app UUID — not a Protect id. |
| policy | object | yes | Complete official firewall policy object. Fetch it with get_firewall_policy; omitted optional fields are cleared by this PUT. |
Partially update a firewall policy by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | Firewall policy UUID. Get it from list_firewall_policies (data[].id). Network-app UUID — not a Protect id. |
| fields | object | yes | Partial update. Spec "Patch firewall policy" defines ONLY loggingEnabled (boolean). For any other change use update_firewall_policy. |
Delete a firewall policy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | Firewall policy UUID. Get it from list_firewall_policies (data[].id). Network-app UUID — not a Protect id. |
Get the ordering of firewall policies for a site filtered by source and destination zone.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| source_zone_id | string | yes | REQUIRED source firewall zone UUID, sent as query param sourceFirewallZoneId. Get it from list_firewall_zones_proxy (data[].id); pick the zone by name case-insensitively (e.g. Internal, External). Net |
| destination_zone_id | string | yes | REQUIRED destination firewall zone UUID, sent as query param destinationFirewallZoneId. Get it from list_firewall_zones_proxy (data[].id); pick the zone by name case-insensitively (e.g. Internal, Exte |
Set the ordering of firewall policies within one source/destination zone pair.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| source_zone_id | string | yes | REQUIRED source firewall zone UUID, sent as query param sourceFirewallZoneId. Get it from list_firewall_zones_proxy (data[].id); pick the zone by name case-insensitively (e.g. Internal, External). Net |
| destination_zone_id | string | yes | REQUIRED destination firewall zone UUID, sent as query param destinationFirewallZoneId. Get it from list_firewall_zones_proxy (data[].id); pick the zone by name case-insensitively (e.g. Internal, Exte |
| ordering | object | yes | Full replacement {"orderedFirewallPolicyIds":{"beforeSystemDefined":[uuid…],"afterSystemDefined":[uuid…]}}; both arrays required. Start from get_firewall_policy_ordering output. |
List all firewall zones for a site via connector proxy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
Create a new firewall zone on a site via connector proxy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| zone | object | yes | Full object to create; spec Create or update firewall zone. Required: name, networkIds. |
Get a single firewall zone by ID via connector proxy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| zone_id | string | yes | Firewall zone UUID. Get it from list_firewall_zones_proxy (data[].id). Network-app UUID — not a Protect id. |
Update a firewall zone by ID via connector proxy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| zone_id | string | yes | Firewall zone UUID. Get it from list_firewall_zones_proxy (data[].id). Network-app UUID — not a Protect id. |
| zone | object | yes | FULL replacement object (PUT; omitted fields reset); spec Create or update firewall zone. Required: name, networkIds. |
Delete a firewall zone via connector proxy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| zone_id | string | yes | Firewall zone UUID. Get it from list_firewall_zones_proxy (data[].id). Network-app UUID — not a Protect id. |
List all ACL rules for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
Create a new ACL rule on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| rule | object | yes | Full object to create; spec ACL rule update. Required: action, enabled, name, type. 'type' selects variant: IPV4|MAC. |
Get a single ACL rule by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| rule_id | string | yes | ACL rule UUID. Get it from list_acl_rules (data[].id). Network-app UUID — not a Protect id. |
Update an existing ACL rule by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| rule_id | string | yes | ACL rule UUID. Get it from list_acl_rules (data[].id). Network-app UUID — not a Protect id. |
| rule | object | yes | FULL replacement object (PUT; omitted fields reset); spec ACL rule update. Required: action, enabled, name, type. 'type' selects variant: IPV4|MAC. |
Delete an ACL rule.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| rule_id | string | yes | ACL rule UUID. Get it from list_acl_rules (data[].id). Network-app UUID — not a Protect id. |
Get the ordering of ACL rules for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
Set the ordering of ACL rules for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| ordering | object | yes | Full replacement {"orderedAclRuleIds":[uuid…]} in evaluation order (schema "ACL rule ordering"). Start from get_acl_rule_ordering; ids from list_acl_rules. |
List all DNS policies for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. domain.like('*example*')). Omitted entirely when unse |
Create a new DNS policy on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy | object | yes | Full object to create; spec Create or update DNS policy. Required: enabled, type. 'type' selects variant: AAAA_RECORD|A_RECORD|CNAME_RECORD|FORWARD_DOMAIN|MX_RECORD|SRV_RECORD|TXT_RECORD. |
Get a single DNS policy by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | DNS policy UUID. Get it from list_dns_policies (data[].id). Network-app UUID — not a Protect id. |
Update a DNS policy by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | DNS policy UUID. Get it from list_dns_policies (data[].id). Network-app UUID — not a Protect id. |
| policy | object | yes | FULL replacement object (PUT; omitted fields reset); spec Create or update DNS policy. Required: enabled, type. |
Delete a DNS policy.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| policy_id | string | yes | DNS policy UUID. Get it from list_dns_policies (data[].id). Network-app UUID — not a Protect id. |
List all traffic matching lists for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
Create a new traffic matching list on a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| traffic_list | object | yes | Full object to create; spec Create or update traffic matching list. Required: name, type. 'type' selects variant: IPV4_ADDRESSES|IPV6_ADDRESSES|PORTS. |
Get a single traffic matching list by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| list_id | string | yes | Traffic matching list UUID. Get it from list_traffic_matching_lists (data[].id). Network-app UUID — not a Protect id. |
Update a traffic matching list by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| list_id | string | yes | Traffic matching list UUID. Get it from list_traffic_matching_lists (data[].id). Network-app UUID — not a Protect id. |
| traffic_list | object | yes | FULL replacement object (PUT; omitted fields reset); spec Create or update traffic matching list. Required: name, type. 'type' selects variant: IPV4_ADDRESSES|IPV6_ADDRESSES|PORTS. |
Delete a traffic matching list.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| list_id | string | yes | Traffic matching list UUID. Get it from list_traffic_matching_lists (data[].id). Network-app UUID — not a Protect id. |
List VPN servers for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
List site-to-site VPN tunnels for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
List RADIUS profiles for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
List all hotspot/guest vouchers for a site (there is no list_vouchers — this is it).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 1000; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page t |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
Generate hotspot vouchers for a site.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| voucher_config | object | yes | Full object to create; spec Hotspot voucher creation request. Required: name, timeLimitMinutes. |
Get a single hotspot voucher by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| voucher_id | string | yes | Hotspot voucher UUID. Get it from list_hotspot_vouchers (data[].id). Network-app UUID — not a Protect id. |
Delete a single hotspot voucher.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| voucher_id | string | yes | Hotspot voucher UUID. Get it from list_hotspot_vouchers (data[].id). Network-app UUID — not a Protect id. |
Bulk delete hotspot vouchers matching filter criteria.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
| filter_params | object | yes | Query parameters sent with the DELETE; must contain filter, which selects the vouchers to delete (Network 10.6.106 DELETE /v1/sites/{siteId}/hotspot/vouchers), e.g. {"filter": "name.eq('Conference') |
| confirm | boolean | no | Ignored; accepted for backward compatibility. The call executes immediately when made unless the operator opted in to UNIFI_DRY_RUN (then nothing is sent upstream and a preview of the request is retur |
List all device tags defined in a site (the tags the Network UI shows).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| site | string | yes | Network site name or UUID; resolved server-side. Get it from list_local_sites (name or id). Names like "Default" work. |
List all countries with ISO codes available on a console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| offset | integer | no | Optional zero-based starting record; alone, fetch one page manually. Example: 25. |
| limit | integer | no | Without offset, the record count gathered from the start in pages of at most 200; fewer only when the collection ends. With offset, limit is sent unchanged as one page. The console clamps that page to |
| filter | string | no | Optional Network Integration API filter expression, forwarded unchanged as the upstream filter query parameter for server-side filtering (e.g. name.like('*guest*')). Omitted entirely when unset; a |
List all cameras on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get details for a single Protect camera by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
Update settings for a Protect camera (name, OSD, LED, LCD message, mic volume, video mode, HDR, smart detection).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/cameras/{id} body. Keys: name, osdSettings, ledSettings, lcdMessage, micVolume (number 1-100), videoMode, hdrType, smartD |
Enable a bearer share link that exposes a camera livestream to anyone with the link.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id from list_hosts, e.g. "my-console"; resolved to its owning Fabric API key and console id before the camera request. |
| camera_id | string | yes | Protect camera id from list_cameras, e.g. "66d025b301ebc903e80003ea"; pass the full id, not a camera name or Network device UUID. |
Read a camera's current livestream share link and status.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id from list_hosts, e.g. "my-console"; resolved to its owning Fabric API key and console id before the camera request. |
| camera_id | string | yes | Protect camera id from list_cameras, e.g. "66d025b301ebc903e80003ea"; pass the full id, not a camera name or Network device UUID. |
Disable a camera's livestream share link, revoking public viewing access.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id from list_hosts, e.g. "my-console"; resolved to its owning Fabric API key and console id before the camera request. |
| camera_id | string | yes | Protect camera id from list_cameras, e.g. "66d025b301ebc903e80003ea"; pass the full id, not a camera name or Network device UUID. |
Get a snapshot from a Protect camera. Returns MCP ImageContent plus image metadata.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| channel | string | no | Optional camera channel (query channel): 'main', or 'package' for the package camera of a camera whose hasPackageCamera is true. Sent verbatim; omit for the controller default. |
| high_quality | boolean | no | Optional (query highQuality): true forces a 1080p-or-higher snapshot, false does not. Omit for the controller default. |
| ts | integer | no | Optional moment to snapshot, sent as query ts to the private route cameras/{id}/recording-snapshot instead of the live snapshot. Provenance: probed on a live console 2026-10-17 (Protect 5.3.18), where |
Get existing RTSPS stream URLs for a Protect camera.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
Create an RTSPS stream for a Protect camera.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| qualities | array | yes | Channels to enable (at least one; an empty list fails before any request, spec minItems 1); spec enum channelQuality: high|medium|low|package (package only on cameras with a package lens). |
Delete an RTSPS stream for a Protect camera.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| qualities | string/array | yes | Channel to delete ('high'), or a list of channels (at least one; an empty list fails before any request); spec enum channelQuality: high|medium|low|package. Shape: 'high'|'medium'|'low'|'package'|('hi |
Start a talkback audio session on a Protect camera.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| confirm | boolean | no | Ignored. The call runs when made; there is no confirmation step. |
Permanently disable the microphone on a Protect camera. This cannot be undone.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| confirm | boolean | no | Ignored. The call runs when made; there is no confirmation step. |
Move a PTZ camera to a preset position slot.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| slot | integer | yes | PTZ preset slot to move to (path param slot): -1 is the home preset, 0 or more the other presets (spec); a smaller value is refused before any request. |
| confirm | boolean | no | Ignored. The call runs when made; there is no confirmation step. |
Start a PTZ patrol: the patrol saved in patrol slot 0-4 (not a preset slot).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| slot | integer | yes | PTZ patrol slot number 0-4 (path param slot). |
| confirm | boolean | no | Ignored. The call runs when made; there is no confirmation step. |
Stop the current PTZ patrol on a camera.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| camera_id | string | yes | Protect camera id. Get it from list_cameras (id). Protect id (24-hex) — not a Network device UUID. |
| confirm | boolean | no | Ignored. The call runs when made; there is no confirmation step. |
List all sensors on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get details for a single Protect sensor by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| sensor_id | string | yes | Protect sensor id. Get it from list_sensors (id). Protect id (24-hex) — not a Network device UUID. |
Update settings for a Protect sensor.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| sensor_id | string | yes | Protect sensor id. Get it from list_sensors (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/sensors/{id} body. |
Query historical Protect events via private /proxy/protect/api/events; the official Integration events endpoint is WebSocket-only.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| start | integer | yes | REQUIRED. Epoch SECONDS (UTC) as integers, converted to milliseconds internally. Ranges are inclusive on both ends. History depth is bounded by the NVR's retention. (Contrast query_isp_metrics, which |
| end | integer | yes | REQUIRED. Epoch SECONDS (UTC) as integers, converted to milliseconds internally. Ranges are inclusive on both ends. History depth is bounded by the NVR's retention. (Contrast query_isp_metrics, which |
| types | string/array | no | Filter by event TYPE; single value or a list. Verified-present values: motion, smartDetectZone, smartAudioDetect, sensorOpened, sensorClosed, access. Smart-detect subtypes (person, face, animal, alrmS |
| cameras | string/array | no | filter by camera NAME or ID; single value or list. Names resolve to IDs: an exact match first, then Unicode-normalized (NFC) and case-insensitive, then ignoring surrounding whitespace (case kept befor |
| limit | integer | no | Without offset, the event count gathered from the beginning across pages; fewer only when the window ends. With offset, limit is sent unchanged as one page. No size clamp is measured on this feed. _pa |
| offset | integer | no | Zero-based starting record. Fetches one page: with limit, limit is sent unchanged as that page size (not collected across pages). Omit both to drain every event for the window. The opt-in UNIFI_PAGINA |
| order_direction | string | no | Optional sort order sent as orderDirection: "ASC" (oldest-first) or "DESC" (newest-first). Omitted (default): no orderDirection is sent and the upstream's own order applies. |
| smart_detect_types | string/array | no | filter by the smart-detect SUBTYPE — person, vehicle, animal, package, face, licensePlate (on smartDetectZone events) and the audio alarms alrmSpeak, alrmSiren, alrmBark, alrmCarHorn (on smartAudioDet |
| categories | string/array | no | filter by event category; single value or list. Verified values: motion, smart, iot, admin. Unknown values are silently ignored by the upstream API. Shape: string|string[] |
| without_descriptions | boolean | no | when true, ask the API to omit each event's description block (~16% smaller payload). Opt-in only — full-fidelity records are the default and descriptions are never dropped automatically. |
Collect Protect events over a bounded polling window (live-feed stand-in).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| poll_count | integer | no | positive integer number of complete polls in the bounded polling window (default 6). An active poll is never interrupted by elapsed time; lifecycle cancellation remains available. |
| max_events | integer | no | Optional early stop: once this many distinct events are collected, stop and flag _truncated=true. Default None (omit it): no limit, all requested polls complete. A single poll is never truncated mid |
| since | integer | no | optional epoch SECONDS lower bound; defaults to the moment the call starts, so only events at/after the call are collected. A negative or millisecond-magnitude value (>= 1e11) is sent as given and the |
| types | string/array | no | same filters and validation as list_protect_events (camera names resolve to IDs; smart_detect_types without types is sent with a _warnings entry). Shape: string|string[] |
| cameras | string/array | no | same filters and validation as list_protect_events (camera names resolve to IDs; smart_detect_types without types is sent with a _warnings entry). Shape: string|string[] |
| smart_detect_types | string/array | no | same filters and validation as list_protect_events (camera names resolve to IDs; smart_detect_types without types is sent with a _warnings entry). Shape: string|string[] |
| poll_interval_seconds | number | no | pacing delay between completed polls (default 2). This never bounds request duration or cancels active work. Zero means no timed delay; the event loop still yields. Small values may hit the shared 429 |
| order_direction | string | no | Optional sort order sent on every poll as orderDirection: "ASC" (oldest-first) or "DESC" (newest-first). Omitted (default): no orderDirection is sent and the upstream's own order applies. |
Collect Protect device add/remove/modify changes by polling every device family for poll_count complete snapshots. The WebSocket subscription is unavailable through Fabric;
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| poll_count | integer | no | positive integer number of complete snapshots (default 6). At least two polls detect changes; elapsed time never interrupts an active snapshot. |
| max_changes | integer | no | Optional early stop: once this many change records accumulate, stop and flag _truncated=true. Default None (omit it): no limit, all requested polls complete. |
| poll_interval_seconds | number | no | pacing delay between completed polls (default 2). This never bounds request duration or cancels active work. Zero means no timed delay; the event loop still yields. Small values may hit the shared 429 |
List recognition groups (enrolled faces or vehicles) on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console reportedState.hostname or data[].id from list_hosts, for example "my-console"; names match reportedState.hostname/name case-insensitively. |
| type | string | yes | Recognition type, normally 'face' or 'vehicle' (singular). Forwarded unchanged; plural forms return HTTP 400 from upstream. |
| has_name | boolean | no | When true, return named groups only. Example: true. |
| page_size | integer | no | N returns records [(page-1)*N, page*N): exactly N when that many exist, fewer only at the end, never more; resume from _nextPage with the same page_size. Example: 100. |
| order_by | string | no | Sort field: name, createdAt, lastDetectedAt or detectionsCount. Example: 'name'. With no order_direction, upstream defaults to descending. |
| order_direction | string | no | 'asc' or 'desc', case-insensitive; effective only with order_by. Unknown values return upstream HTTP 400. Example: 'asc'. |
| page | integer | no | 1-based window number counted in units of page_size (default 1); without page_size, returns one native console page; resume from _nextPage with the same page_size. Example: 2. |
Get aggregate recognition-group counts for a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| type | string | yes | recognition type. Use 'face' or 'vehicle' (singular — plural forms return HTTP 400 from upstream). Forwarded to the API as-is. |
Get a recognition group's reference crop. Returns MCP ImageContent plus image metadata.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| type | string | yes | 'face' or 'vehicle' (singular; plural returns HTTP 400). |
| group_id | string | yes | Recognition group id, e.g. 'face_90'. Get it from list_recognition_groups (id). Protect recognition id. |
List one enrolled recognition group's detections (sightings) on Protect.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console reportedState.hostname or data[].id from list_hosts, for example "my-console"; names match reportedState.hostname/name case-insensitively. |
| type | string | yes | 'face' or 'vehicle' (singular); plural forms return HTTP 400 upstream. |
| group_id | string | yes | Group id from list_recognition_groups, for example 'face_90'. |
| page_size | integer | no | N returns records [(page-1)*N, page*N): exactly N when that many exist, fewer only at the end, never more; resume from _nextPage with the same page_size. Example: 100. |
| start | integer | no | Optional UTC epoch seconds start, converted to milliseconds. Negative or millisecond-magnitude values add _warnings. Example: 1792972800. |
| end | integer | no | Optional UTC epoch seconds end, converted to milliseconds; omit both for all detections. The same magnitude warnings apply. Example: 1793059200. |
| page | integer | no | 1-based window number counted in units of page_size (default 1); without page_size, returns one native console page; resume from _nextPage with the same page_size. Example: 2. |
Get a detection thumbnail crop. Returns MCP ImageContent plus image metadata.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| thumbnail_id | string | yes | Detection thumbnail id. Get it from list_recognition_detections (detections[].thumbnailId). |
List all lights on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get details for a single Protect light by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| light_id | string | yes | Protect light id. Get it from list_lights (id). Protect id (24-hex) — not a Network device UUID. |
Update settings for a Protect light (brightness, sensitivity, etc.).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| light_id | string | yes | Protect light id. Get it from list_lights (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/lights/{id} body. Keys: name, isLightForceEnabled, lightModeSettings, lightDeviceSettings. |
List all chimes on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get details for a single Protect chime by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| chime_id | string | yes | Protect chime id. Get it from list_chimes (id). Protect id (24-hex) — not a Network device UUID. |
Update settings for a Protect chime (volume, ringtone, etc.).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| chime_id | string | yes | Protect chime id. Get it from list_chimes (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/chimes/{id} body. Keys: name, cameraIds, ringSettings. |
List all viewers on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get details for a single Protect viewer by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| viewer_id | string | yes | Protect viewer id. Get it from list_viewers (id). Protect id (24-hex) — not a Network device UUID. |
Update settings for a Protect viewer (liveview assignment, etc.).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| viewer_id | string | yes | Protect viewer id. Get it from list_viewers (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/viewers/{id} body. Keys: name, liveview. |
List all liveviews on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get details for a single Protect liveview by ID.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| liveview_id | string | yes | Protect liveview id. Get it from list_liveviews (id). Protect id (24-hex) — not a Network device UUID. |
Create a liveview on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| name | string | yes | Liveview display name (body field name). |
| settings | object | no | Rest of the body (Protect 7.3.70 POST /v1/liveviews), merged with name. Provide layout, slots, id, modelKey, isDefault, isGlobal and owner, all required by the published schema. Leave name out; it com |
Update a liveview on a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| liveview_id | string | yes | Protect liveview id. Get it from list_liveviews (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/liveviews/{id} body. Required: id, modelKey, name, isDefault, isGlobal, owner, layout, slots. Spec list, not checked here |
Get NVR details from a Protect console.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
List Protect device asset files of a given type.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| file_type | string | yes | Protect asset category (path fileType). Protect 7.3.70 documents one value, 'animations'; the value is passed through as given. The GET endpoint does NOT validate this value — an unrecognised category |
Upload a Protect device asset file. WARNING: Uploads asset file to NVR storage.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| file_type | string | yes | Protect asset category (path fileType); Protect 7.3.70 documents one value, 'animations'. Letters, digits, '-' and '_' only; anything else is rejected before any request. |
| filename | string | yes | Filename for the uploaded asset; its extension selects the part's Content-Type unless content_type is given. |
| file_content_base64 | string | yes | File bytes, standard base64 (padded). Line-wrapped base64 (MIME/PEM line breaks) is accepted; a data: URL prefix is not. |
| content_type | string | no | Optional MIME type of the file part (e.g. "audio/wave"), sent as given; omit it to derive the type from the filename extension. |
Trigger an alarm manager webhook by ID. WARNING: triggers physical alarm hardware.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| webhook_id | string | yes | Alarm Manager webhook id (from the Protect Alarm Manager webhook trigger; the spec alarmTriggerId, a user-defined string). Any non-empty string without a control character is accepted and percent-enco |
| confirm | boolean | no | Ignored. The call runs when made; there is no confirmation step. |
List arm profiles on a Protect console (GET /v1/arm-profiles via Fabric proxy).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
Get one arm profile by id (filters GET /v1/arm-profiles; no GET-by-id exists upstream).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| arm_profile_id | string | yes | Protect arm profile id. Get it from list_arm_profiles (id). Protect id (24-hex) — not a Network device UUID. |
Create an arm profile (POST /v1/arm-profiles via Fabric proxy).
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| name | string | yes | REQUIRED profile name (1-255 chars), sent as the body field name. Do not repeat it inside settings; a settings['name'] that differs from this value is rejected with a clear error. |
| settings | object | yes | Rest of the body (Protect 7.3.70 POST /v1/arm-profiles). Required: automations, schedules, recordEverything, activationDelay (0|60000|300000|600000). Leave name out; it comes from the name argument. |
Update an arm profile (PATCH /v1/arm-profiles/{id}) with read-before/no-op/read-after.
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | Console name or id: the short name from list_hosts (data[].reportedState.hostname or reportedState.name, case-insensitive, e.g. "my-console") or the long data[].id (MAC:numericId composite). One conso |
| arm_profile_id | string | yes | Protect arm profile id. Get it from list_arm_profiles (id). Protect id (24-hex) — not a Network device UUID. |
| settings | object | yes | Partial update (PATCH; only listed keys change); spec Protect 7.3.70 PATCH /v1/arm-profiles/{id} body. Keys: name, automations, schedules, recordEverything, activationDelay. |
| Parameter | Type | Required | Notes |
|---|---|---|---|
| host | string | yes | — |
| arm_profile_id | string | yes | — |
| confirm | boolean | no | — |
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install UniFi Fabric or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 97 / 100
Release 0.7.0 · scanned 3 Nov 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score97
Findings1 threat · 20 capability
Capabilitymoderate
Coveragesource
Verificationsource
Surface digest7993c3e24df215b107b57899dba83254f86862a1eb820edf9f5485730c50263f
Score vectorthreat 100 → client 97
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | moderate | capability blast radius (moderate) — client exposure if the model is manipulated | −3 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Tool recovery stopped early in src/unifi_fabric/tools/aggregation.py, src/unifi_fabric/tools/client_records.py, src/unifi_fabric/tools/clients.py and 35 more — the file registers more tools than the scanner reads in one file, so some may be missing from this surface.
The source has registrations with unknown names: the tools registered at src/unifi_fabric/discovery.py:421 get their names only at run time (a loop over a list the code builds, a name it computes), so they are not in this surface and were not analysed. To see them, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| list_hosts | no tags | |
| get_host | no tags | |
| list_sites | no tags | |
| list_devices | no tags | |
| get_isp_metrics | untrusted-input | untrusted-input: keyword "download" |
| query_isp_metrics | no tags | |
| list_sdwan_configs | untrusted-input | untrusted-input: keyword "fetch" |
| get_sdwan_config | no tags | |
| get_sdwan_config_status | no tags | |
| list_all_sites_aggregated | no tags | |
| get_site_health_summary | no tags | |
| compare_site_performance | no tags | |
| search_across_sites | untrusted-input | untrusted-input: keyword "fetch" |
| get_site_inventory | no tags | |
| get_network_application_info | no tags | |
| list_local_sites | untrusted-input | untrusted-input: keyword "fetch" |
| list_networks | untrusted-input | untrusted-input: keyword "fetch" |
| create_network | no tags | |
| get_network | no tags | |
| update_network | no tags | |
| delete_network | no tags | |
| get_network_references | no tags | |
| list_lags | untrusted-input | untrusted-input: keyword "fetch" |
| get_lag | no tags | |
| list_mc_lag_domains | untrusted-input | untrusted-input: keyword "fetch" |
| get_mc_lag_domain | no tags | |
| list_switch_stacks | untrusted-input | untrusted-input: keyword "fetch" |
| get_switch_stack | no tags | |
| list_wifi_broadcasts | untrusted-input | untrusted-input: keyword "fetch" |
| create_wifi_broadcast | no tags | |
| get_wifi_broadcast | no tags | |
| update_wifi_broadcast | no tags | |
| delete_wifi_broadcast | no tags | |
| list_wan_interfaces | untrusted-input | untrusted-input: keyword "fetch" |
| update_wan_interface | no tags | |
| list_firewall_policies | untrusted-input | untrusted-input: keyword "fetch" |
| create_firewall_policy | no tags | |
| get_firewall_policy | no tags | |
| update_firewall_policy | untrusted-input | untrusted-input: keyword "fetch" |
| patch_firewall_policy | no tags | |
| delete_firewall_policy | no tags | |
| get_firewall_policy_ordering | no tags | |
| set_firewall_policy_ordering | no tags | |
| list_firewall_zones_proxy | untrusted-input | untrusted-input: keyword "fetch" |
| create_firewall_zone_proxy | no tags | |
| get_firewall_zone_proxy | no tags | |
| update_firewall_zone_proxy | no tags | |
| delete_firewall_zone_proxy | no tags | |
| list_acl_rules | untrusted-input | untrusted-input: keyword "fetch" |
| create_acl_rule | no tags | |
| get_acl_rule | no tags | |
| update_acl_rule | no tags | |
| delete_acl_rule | no tags | |
| get_acl_rule_ordering | no tags | |
| set_acl_rule_ordering | no tags | |
| list_dns_policies | untrusted-input | untrusted-input: keyword "fetch" |
| create_dns_policy | no tags | |
| get_dns_policy | no tags | |
| update_dns_policy | no tags | |
| delete_dns_policy | no tags | |
| list_traffic_matching_lists | untrusted-input | untrusted-input: keyword "fetch" |
| create_traffic_matching_list | no tags | |
| get_traffic_matching_list | no tags | |
| update_traffic_matching_list | no tags | |
| delete_traffic_matching_list | no tags | |
| list_vpn_servers | untrusted-input | untrusted-input: keyword "fetch" |
| list_site_to_site_tunnels | untrusted-input | untrusted-input: keyword "fetch" |
| list_radius_profiles | untrusted-input | untrusted-input: keyword "fetch" |
| list_hotspot_vouchers | untrusted-input | untrusted-input: keyword "fetch" |
| create_hotspot_vouchers | no tags | |
| get_hotspot_voucher | no tags | |
| delete_hotspot_voucher | no tags | |
| bulk_delete_hotspot_vouchers | no tags | |
| list_device_tags | no tags | |
| list_countries | untrusted-input | untrusted-input: keyword "fetch" |
| list_cameras | no tags | |
| get_camera | no tags | |
| update_camera | no tags | |
| enable_camera_share_link | no tags | |
| get_camera_share_link | no tags | |
| disable_camera_share_link | no tags | |
| get_camera_snapshot | no tags | |
| get_rtsps_stream | no tags | |
| create_rtsps_stream | no tags | |
| delete_rtsps_stream | no tags | |
| start_talkback_session | no tags | |
| disable_camera_mic_permanently | no tags | |
| ptz_goto_preset | no tags | |
| ptz_patrol_start | no tags | |
| ptz_patrol_stop | no tags | |
| list_sensors | no tags | |
| get_sensor | no tags | |
| update_sensor | no tags | |
| list_protect_events | no tags | |
| collect_protect_events | no tags | |
| collect_protect_device_changes | no tags | |
| list_recognition_groups | no tags | |
| get_recognition_group_counts | no tags | |
| get_recognition_group_image | no tags | |
| list_recognition_detections | no tags | |
| get_thumbnail | no tags | |
| list_lights | no tags | |
| get_light | no tags | |
| update_light | no tags | |
| list_chimes | no tags | |
| get_chime | no tags | |
| update_chime | no tags | |
| list_viewers | no tags | |
| get_viewer | no tags | |
| update_viewer | no tags | |
| list_liveviews | no tags | |
| get_liveview | no tags | |
| create_liveview | no tags | |
| update_liveview | no tags | |
| get_nvr | no tags | |
| list_protect_files | no tags | |
| upload_protect_file | no tags | |
| trigger_alarm_webhook | external-sink | external-sink: keyword "webhook", parameter "webhook" |
| list_arm_profiles | no tags | |
| get_arm_profile | no tags | |
| create_arm_profile | no tags | |
| update_arm_profile | no tags | |
| delete_arm_profile | no tags | |
| update_arm_profile_settings | no tags | |
| enable_arm | no tags | |
| disable_arm | no tags | |
| list_sirens | no tags | |
| get_siren | no tags | |
| update_siren | no tags | |
| siren_play | no tags | |
| siren_stop | no tags | |
| siren_test_sound | no tags | |
| list_fobs | no tags | |
| get_fob | no tags | |
| update_fob | no tags | |
| list_relays | no tags | |
| get_relay | no tags | |
| update_relay | no tags | |
| relay_activate_output | no tags | |
| list_speakers | no tags | |
| get_speaker | no tags | |
| update_speaker | no tags | |
| speaker_test_sound | no tags | |
| list_bridges | no tags | |
| get_bridge | no tags | |
| update_bridge | no tags | |
| list_link_stations | no tags | |
| get_link_station | no tags | |
| update_link_station | no tags | |
| list_alarm_hubs | no tags | |
| get_alarm_hub | no tags | |
| update_alarm_hub | no tags | |
| alarm_hub_trigger_output | no tags | |
| list_protect_users | no tags | |
| get_protect_user | no tags | |
| get_protect_application_info | no tags | |
| list_ulp_users | no tags | |
| get_ulp_user | no tags | |
| pos_ingest_transaction | no tags | |
| list_port_forwards | no tags | |
| create_port_forward | no tags | |
| update_port_forward | no tags | |
| delete_port_forward | no tags | |
| list_traffic_rules | no tags | |
| create_traffic_rule | no tags | |
| update_traffic_rule | no tags | |
| delete_traffic_rule | no tags | |
| list_users | no tags | |
| get_user | no tags | |
| update_user | no tags | |
| list_traffic_routes | no tags | |
| create_traffic_route | no tags | |
| get_traffic_route | no tags | |
| update_traffic_route | no tags | |
| delete_traffic_route | no tags | |
| list_settings | no tags | |
| get_setting | no tags | |
| update_setting | no tags | |
| list_dynamic_dns | no tags | |
| get_dynamic_dns | no tags | |
| update_dynamic_dns | no tags | |
| list_port_profiles | no tags | |
| get_port_profile | no tags | |
| update_port_profile | no tags | |
| allow_network_on_port_profile | no tags | |
| exclude_network_on_port_profile | no tags | |
| list_routing_entries | no tags | |
| list_wlan_configs | no tags | |
| get_wlan_config | no tags | |
| update_wlan_config | no tags | |
| list_wlan_groups | no tags | |
| get_wlan_group | no tags | |
| get_channel_plan | no tags | |
| list_rogue_aps | no tags | |
| list_firewall_rules | no tags | |
| get_firewall_rule | no tags | |
| list_firewall_groups | no tags | |
| get_firewall_group | no tags | |
| list_accounts | no tags | |
| get_account | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest7993c3e24df215b1
Scanned2026-11-03
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.7.0. Pin a release below and the command asks for exactly that one.
0.7.0
undated
latestNo release note was published with this version.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish UniFi Fabric can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.