VMware Aria Operations

[WRITE] Acknowledge an active alert by taking ownership (does not cancel it). The suite-api has no dedicated "acknowledge" action; this maps to POST /alerts?action=takeownership, assigning the alert to the API user (control state ASSIGNED). The alert remains active until cancelled. Use this when you want to own the alert without closing it; cancel_alert closes it for good. Without confirm=True this only previews: it returns blast_radius (alert id, definition, criticality, status, control state, and the resource it is on) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. Refused with confirm=True: a cancelled alert, and an alert whose status or resource cannot be read.

[WRITE] Add a note to an alert to record who is handling it and what was done. Does not change the alert's status or ownership — use acknowledge_alert to take ownership. Not idempotent: calling twice adds two notes. Returns created (the stored note) and confirmation_note — when created is null the appliance did not confirm the note; run list_alert_notes before retrying. There is no undo tool for notes.

[WRITE] Cancel (dismiss) an active alert. This WRITE operation permanently closes the alert. Use acknowledge_alert instead if you only want to mark it as seen. Cancelled alerts will not re-trigger unless the underlying condition recurs. Without confirm=True this only previews: it returns blast_radius (alert id, definition, criticality, status, and the resource it is on) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. An alert already cancelled returns action "noop". Refused with confirm=True: an alert whose status or resource cannot be read.

[WRITE] Create a new alert definition referencing existing symptom definitions. Returns the new definition's id and name. Run list_symptom_definitions first for symptom_definition_ids; to silence an existing definition use set_alert_definition_state rather than creating a variant.

[WRITE] Permanently delete an alert definition. Irreversible. This WRITE operation removes the alert definition from Aria Operations. Active alerts generated by this definition will not be affected. Use set_alert_definition_state(enabled=False) instead to silence a definition you may want back. Without confirm=True this only previews: it returns blast_radius (the definition's id, name, adapter and resource kind, criticality and state count) and deletes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it deletes yet. Refused with confirm=True: a definition that cannot be read.

[WRITE] Permanently delete a generated report artifact from Aria Operations. Removes only the generated report instance and its output — the report definition and any schedules remain intact; re-run generate_report to recreate it. Deletion is irreversible and is recorded in the audit log. Returns an error if the report_id does not exist; use list_reports to find valid UUIDs first. Without confirm=True this only previews: it returns blast_radius (report id, title, status, definition id, completion time, owner) and deletes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it deletes yet. Refused with confirm=True: a report whose status or definition cannot be read.

[WRITE] Take one resource out of maintenance so Aria resumes alerting on it and collecting its data. Without confirm=True this only previews: it reads the resource and returns blast_radius (resource name and kind, each adapter's state, the maintenance mode it is in) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. Refused with confirm=True: a resource known not to be in maintenance (an adapter reports a state such as STARTED or STOPPED — nothing to end), and a resource whose state is unknown (unreadable, or reported as UNKNOWN / NONE) — end that one from the Aria UI or the CLI after checking it. Acting returns the state before and after, confirmed (true / false / null when unknown) and a note. Undo: start_resource_maintenance (re-enters as manual maintenance), recorded only when the resource was known to be in maintenance before.

[READ] List Operations diagnostic findings, optionally filtered. Use this to review current diagnostic findings (misconfigurations, health rule hits) across the environment. Filters are comma-separated strings; omit a filter to match all. Returns finding summaries (rule_uuid, name, severity, category, finding_type, affected_objects_count) in the paginated envelope. Note: these are general operational findings, NOT compliance benchmark results — for hardening/compliance use vmware-harden.

[READ] List certificate status and expiry across the VCF fleet. Use this to spot certificates that are expired or expiring soon across all VCF components managed by Operations 9.1. Returns per-certificate summaries (subject, issuer, valid_to, status, resource, thumbprint) in the family paginated envelope (items/returned/limit/total/truncated/hint). Read-only: it does not renew or replace any certificate. Gotcha: response field names are read defensively — a field absent on your appliance shows as empty rather than failing the call.

[READ] List the SDDC/workload domains behind one registered VCF integration. Use this to enumerate the domains of a VCF integration registered in Operations. The integration_id is the UUID shown under Administration -> Integrations -> VCF in the Operations UI; the operator supplies it (this skill does not list VCF integrations). Returns domain summaries (id, name, type, status, configuration_state) in the paginated envelope, where configuration_state is configured / not_configured / removed — a removed domain is not a live one. A 404 means the integration_id is wrong — copy the exact UUID from the Operations Integrations page. Gotcha: if the envelope carries a "note", the appliance answered in a shape this tool did not recognise and an empty items list means UNKNOWN, not "no domains" — do not report the fleet as domain-free in that case.

[READ] List managed password-account status across the VCF fleet. Use this to review which fleet accounts Operations manages and their rotation/expiry status. Returns per-account summaries (username, resource, status, expiry, last_rotated) in the paginated envelope. Read-only: this never rotates or sets a password — the rotation endpoint is deliberately not wired into this skill. Gotcha: response field names are read defensively; unknown fields degrade to empty.

[WRITE] Trigger generation of a report from a report definition template. Returns immediately with a report_id and PENDING status; it does not wait for the file. Poll get_report(report_id) until status == COMPLETED, then use download_url.

[READ] Get full details for one alert by UUID, including its contributing (triggered) symptoms. Use this after list_alerts to drill into a single alert; use list_alerts to discover or filter them. Returns one alert object: name, criticality, status, impact, resource_id, start/update/cancel timestamps (epoch ms, and *_time_utc ISO-8601; cancel_time_utc is null when never cancelled), control state, and symptoms (each with the condition that triggered it, and the object it is on: resource_id, resource_name, resource_kind, stat_key — for "vCenter appliance health service is down" that names the service, e.g. mem). resource_lookup says how that was found (not_needed / resolved / not_found / failed / no_symptom_id / instance_names_no_resource); a "symptom_resources_note" key appears when some could not be — an empty resource_id there is unknown, not absent. Cost: on Aria 8.18.7 no symptom carries its resource id, so every call pages GET /symptoms (one request per 1,000 symptoms in the appliance, at most 20, stopping once all are found) plus one batched GET /resources. Gotcha: an empty symptoms list normally means the alert has no triggered symptoms, but if a "symptoms_note" key is present the list is UNKNOWN rather than empty — the response shape was unrecognised or the lookup failed, so do not tell the user the alert fired for no reason. Symptom name and severity come from the symptom definition when the instance carries none; each symptom's definition_lookup says whether that worked (resolved / not_needed / not_found / failed / no_definition_id), and a "symptom_definitions_note" key appears when some did not — an empty name there is unknown, not blank. The Alert model does not carry a resource name — resolve it via get_resource(resource_id), or call investigate_alert to do that correlation in one step. Recommendations hang off the alert definition, not the alert. To act on the alert afterwards, use acknowledge_alert or cancel_alert.

[READ] Get the prioritized recommendations for one alert — what Aria suggests doing about it — by resolving the alert to its alert definition and the recommendation text. Returns alert_id, alert_name, criticality, alert_definition_id, state_severity, status, recommendations (each: id, priority — lower is more important, description, action, lookup) and note. status: "found"; "partial" (some text could not be read — ids and priorities are still listed, description null means unknown, not blank); "none_defined" (the definition defines none — recommendations is []); "unknown" (the definition could not be read — recommendations is null and must NOT be reported as "no recommendations"). An unreadable alert is an error.

[READ] Check Aria Operations platform health, per service, plus its version. Returns assessment: HEALTHY, DEGRADED (some services OK, some ERROR — the platform still answers), DOWN (no service OK) or UNKNOWN (breakdown unreadable). overall_status is the node's own flag: OFFLINE whenever any one service is not running, so OFFLINE alone is not an outage. Also services (name, health, details; null when unreadable), services_not_ok, healthy, system_time_ms, details, and product_version / product_line ("8.x", "9.x") / release_name — check the line before assuming 9.x-only tools (fleet_*, findings_list, promql_query) exist. A 503 is reported, never raised. If HEALTHY but data looks stale, check list_collector_groups.

[READ] Memory, swap, heap and watchdog restarts of the Aria Operations node(s) themselves. When: get_aria_health shows a service in ERROR, or the Aria UI/API is slow — this reads Aria's self-monitoring objects (vC-Ops-Node, vC-Ops-Watchdog) to show whether the node is starved of memory. For data that stopped arriving from vCenter or another source, use list_adapters instead. What: per node — memory (mem|total, mem|used, mem|free, mem|actualFree, mem|actualUsed), swap (swap|total, swap|used, swap|free), heap (heap|MaxHeapSize, heap|CurrentHeapSize, heap|CommittedMemory, heap|NodeHeapMemoryRemaining), heap_components (committed heap per component: Analytics, SuiteAPI, Collector, ...) and watchdog_restarts per service. Each value has latest, latest_time_ms, unit (from Aria's own statkey definitions, on 8.18.7: GB for mem/swap, MB for the heap sizes and heap_components, % for heap|NodeHeapMemoryRemaining; null when undefined) and window {min, avg, max, points} over window_hours of 5-minute averages. memory_pressure.level is an indicator, not a diagnosis: HIGH when actual free memory is below 10% of total, ELEVATED below 20%, NORMAL at 20% or more, UNKNOWN when the readings do not settle it; basis shows the numbers. Gotchas: a key with no value is in the node's missing list (reason not_reported, no_data or undetermined) and is never shown as zero. watchdog_restarts null means unknown (see watchdog_note), not zero restarts. nodes null with nodes_error means the node objects were not recognised. units_error, latest_error, window_error and watchdog_error name reads that failed; when set, the affected values are unknown.

[READ] Returns a capacity overview for a cluster — the group-level remaining-capacity percentage (capacity_remaining_pct, which only exists at group level) plus per-dimension (cpu/mem/diskspace) absolute remaining capacity and projected days-until-full, from the OnlineCapacityAnalytics metrics. Values are None while capacity analytics are still warming up on a fresh instance. Start here when assessing overall cluster capacity health; for absolute headroom values use get_remaining_capacity, and for just the exhaustion projections use get_time_remaining.

[READ] Get remaining capacity headroom for a cluster or host — how much more workload fits before hitting limits. Returns the group-level capacity_remaining_pct (only available at group level) plus one entry per capacity dimension (cpu, mem, diskspace) with remaining_value (absolute, unit per dimension e.g. MHz/KB), from the OnlineCapacityAnalytics demand model. Values are None while capacity analytics warm up. Use get_capacity_overview for the combined view, or get_time_remaining for projected days-until-full.

[READ] Get status and download URLs for a generated report. Returns id, name (the report's title, fetched from its definition — null if that definition is gone; this endpoint carries no title of its own), description (the definition's explanatory blurb, which is NOT the title), status (PENDING, RUNNING, COMPLETED, FAILED), definition_id, completion_time (the appliance's own rendering, e.g. "Sun Aug 30 04:40:08 UTC 2026"), completion_time_ms (epoch ms, or null when the appliance sent a date string), download_url (PDF) and csv_url. Use this to poll after generate_report. The URLs are always constructed, so a download_url is present even while the report is still PENDING — check status before fetching it.

[READ] Returns one resource object: id, name, kind, adapter kind, identifiers, status states, and the health/risk/efficiency badges (each a color plus 0-100 score, null when Aria has not scored that badge). Use this after list_resources to inspect a single UUID in depth — it does not accept a name, so use list_resources to discover UUIDs by kind or name. For just the badge scores use get_resource_health; for time-series metrics use get_resource_metrics.

[READ] Get the health, risk, and efficiency badge scores for a resource. Returns the three scores and their colors, from the resource's badges[] array. Scores are 0–100 (higher = healthier for HEALTH). Use this when the scores are all you need; use get_resource for the whole object, or list_alerts(resource_id=...) for what drove a low score. A score is null (or -1) when Aria has not computed that badge — that does not mean healthy. Badges score the alerts attached to the object, not a service's own state: a down service can show HEALTH GREEN 100. For a service object (kind containing SERVICE, e.g. VCENTER_APPLIANCE_HEALTH_SERVICES) the result also carries service: status (SERVICE|STATUS, e.g. green/orange), availability (latest SERVICE|AVAILABILITY), available (true for 1, false for 0, null when unknown) and read_errors. Read available, not the badge. service is null for other kinds. name and kind are included.

[READ] Fetch time-series metric statistics for a resource. Returns mode ("raw" or "summary"), then metrics (raw: metric key -> list of {timestamp_ms, value} points, only keys with points) or summary (summary=True: per key n, min, max, avg, latest, first/latest timestamps, change_count and change_points — {timestamp_ms, from, to} where the value changed, at most 50, most recent kept), and missing (one entry per requested key with no points: not_collected_for_resource with similar_keys to try, no_data_in_window, resource_reports_no_stat_keys, or undetermined). Never report a missing key as zero. Prefer summary=True for windows over a few hours. For a single current score use get_resource_health instead.

[READ] Current property values Aria holds for one resource: power state, parent host and vCenter (summary|parentHost, summary|parentVcenter), configured CPU/memory, extraConfig flags such as config|extraConfig|mem_hotadd. Use this for configuration facts; use get_resource_metrics for time-series values. Returns a paginated envelope of {name, value} rows sorted by name (value is a string, null when the property carries none), with next_offset — pass it back as offset until null. A failed or unrecognised read is an error, never an empty list; a missing resource is a 404.

[READ] Navigate the inventory: resources related to one resource (VM -> host, datastore, folder; host -> VMs, datacenter). Each row: id, name, kind, adapter_kind, direction (parent, child, both, other). Call again on a returned id to walk further up or down. Returns a paginated envelope with next_offset — pass it back as offset until null. With ALL, direction is null when the PARENT/CHILD labels could not be read, and direction_note says why. A failed or unrecognised read is an error, never an empty list.

[READ] Get the risk badge score for a resource (0–100, higher = more risk of future problems). The risk badge predicts likelihood of performance degradation or availability issues based on current trends and workload patterns. Returns `risk_score` and `risk_color` for the one resource. Use this when the risk number is all you want; get_resource_health returns health and efficiency alongside it. The score is null when Aria has not computed a risk badge, and the badge does not say what is wrong — use list_alerts(resource_id=...) for the contributing alerts.

[READ] Predict when a cluster will exhaust its capacity based on usage trends. Returns `time_remaining`: one entry per capacity dimension (cpu, mem, diskspace) with projected days until full. Use get_capacity_overview instead when you also want current headroom — this tool returns only the projections. Days are None while capacity analytics warm up on a fresh instance, and None does not mean unlimited.

[READ] Query resources with highest consumption of a given metric. Then call get_resource_metrics on a returned id for its history. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set. Resources with no data for the key are left out, not ranked at zero; excluded_no_data counts the ones the ranking API listed with no points, and hint says how many were left out when that shortened the list. Each item's value is the average over the last hour (the number Aria ranks by) and latest_value the most recent point; items are descending by value.

[READ] Resolve one alert to its affected resource in a single call — use this instead of chaining get_alert then get_resource by hand. Does the whole alert-to-object correlation server-side: fetches the alert, reads its resourceId, fetches that resource, and confirms the resource name and kind before suggesting anything downstream. Returns five always-present keys: alert (Aria's values verbatim, with its contributing symptoms named as in get_alert, including the object each is on and get_alert's GET /symptoms cost — check each symptom's definition_lookup and symptom_definitions_note), resource (or null), correlation (both UUIDs labelled, plus confirmed name, kind and a confirmed flag), next_step (which vmware-monitor tool to call next, or null), and warnings (empty on success). Gotchas: alert_id is the alert UUID from list_alerts, NOT the resource UUID — mixing them up is the most common error here; the correlation block labels each. An unresolvable resource degrades to a warning plus nulls rather than an error, so the alert is never lost. Never match the resource against vCenter inventory unless correlation.confirmed is true.

[READ] List Aria Operations adapter instances and when each last collected. When: an alert such as "Objects are not receiving data", or metrics that stopped updating — this shows which adapter instance (vCenter, NSX, the self-monitoring adapter, ...) stopped collecting and since when. For the collector processes behind them use list_collector_groups; for the Aria node's own memory use get_aria_node_resources. What: rows with id, name, adapter_kind, resource_kind, collector_id, collector_group_id (null when none), monitoring_interval_min, resources_collected, metrics_collected, last_collected_ms and last_heartbeat_ms with their ages in seconds, message (the adapter's own status text) and stale / stale_basis. stale is true when lastCollected is older than 3 of the adapter's monitoring intervals and at least 15 minutes, false when within that, null when the fields cannot support a verdict. Ages use the appliance clock (reference_clock "appliance") when node status carries it, otherwise this machine's ("local"). The envelope also names stale_adapters and staleness_unknown for the filtered set, and adapter_kinds_present. Returns a paginated envelope: items, returned, limit, total, truncated, hint, next_offset. GET /adapters is unpaged, so total is exact; pass next_offset back as offset and stop when it is null. Gotchas: last_collected being recent does not prove every object behind the adapter receives data — it is the instance's last collection cycle. An unrecognised or empty answer is returned as an error, never as no adapters.

[READ] List alert definitions (templates that generate alerts when triggered). criticality is the max severity across the definition's states[] (the AlertDefinition model has no top-level criticality or enabled field). Pass a returned id to set_alert_definition_state to enable or disable it. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

[READ] List the notes on one alert — who is handling it and what was done. Each row: id, note text, type (USER or SYSTEM), user_name, user_id, created_time_ms. Use add_alert_note to record a new one. An unknown alert id is an error (HTTP 404), not an empty list. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset, and notes_note — null when the answer was read; otherwise items is UNKNOWN, not empty, and must not be reported as "no notes". Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated.

[READ] List alerts from Aria Operations. Returns alert summaries: name, criticality, status, impact, resource_id, resource_name, resource_kind, timestamps (start/update *_time_ms, and start_time_utc / update_time_utc in ISO-8601 UTC), and control state. resource_name and resource_kind are resolved in one batched lookup per page; they are null when that failed, the resource no longer exists, or Aria holds no name for it, and the envelope's resource_names_note (null when every name resolved) then says which — null means unknown, not "no resource". Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

[READ] Report per-resource anomaly counts (System Attributes|total_alarms metric). The suite-api does not expose the UI's anomalous-metrics list; this is the Total Anomalies metric — active symptoms, events and DT violations on the object and its children. With resource_id: that resource's count. Without: ranks every VM in the environment and returns the worst `limit` of them. For root cause, follow up with list_alerts(resource_id=...). `limit` bounds the answer, not the scan — raising it does not widen the search, and lowering it does not hide worse objects. The whole inventory is read either way, in bulk pages, because the ranking metric is not a field the appliance can sort on. Returns a paginated envelope: flagged rows worst-first under items, plus returned, limit, total, truncated, hint, scanned (objects examined), vm_total and scan_complete. Only flagged VMs are returned, so a short list is not by itself proof the environment is clean. When scan_complete is true, total is the number of anomalous objects found and truncated is exact; when it is false the scan hit its cap, total is the environment's VM count, and a note says the ranking is partial — an unexamined object could outrank every row shown.

[READ] List Aria Operations collector groups and their member collector status. Collectors are remote agents that gather metrics from vSphere and other adapters. Check this when resources appear missing from Aria Operations or metrics are stale. Groups list member collector IDs; details (name, state UP/DOWN, local) are enriched via one extra collectors call. A DOWN collector means list_resources and the metric tools see stale or missing data for everything behind it. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set.

[READ] List recurring maintenance schedules: name, schedule type (ONCE/DAILY/WEEKLY/MONTHLY/YEARLY), recurrence, start hour/minute, duration in minutes, time zone, start and expiry. A schedule does not list the resources it applies to — pass resource_id to see only the schedules for one resource. To put a resource in maintenance now, use start_resource_maintenance. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset, and schedules_note — null when the answer was read; otherwise items is UNKNOWN, not empty, and must not be reported as "no schedules". Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated.

[READ] Look up metric keys before get_resource_metrics or get_top_consumers; do not guess (cpu|demand_average does not exist on VMs). resource_id: keys that resource reports, with name/unit from its kind; definition is found, found_by_instance, not_defined_for_kind (see unjoined_keys) or not_read (definitions_status undetermined: name/unit unknown, not absent). resource_kind: keys the kind defines, not all collected. Paginated envelope with next_offset: pass it back as offset until null. An unreadable key list is an error, never empty.

[READ] List available report definition templates in Aria Operations. Pass a returned id to generate_report to run one. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

[READ] List generated reports, optionally filtered by report definition. Pass a returned id to get_report for its status and download URLs. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint. Check truncated before calling this the complete set. This one has no offset — it is bounded by limit alone, so a truncated page cannot be walked past.

[READ] List resources in Aria Operations filtered by kind. Start here: this turns a name or kind into the UUID other resource tools need. Then call get_resource for detail on one row. Each row carries aria_state (Aria's lifecycle state — STARTED even for a powered-off VM, so not a power state) and collection_status (whether data is arriving: DATA_RECEIVING, NO_DATA_RECEIVING, ...; null when Aria did not report one). `status` is kept for existing callers and equals aria_state. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size, or when name_filter / collection_status filtered the rows), truncated, hint, and note when a collection_status filter matched nothing (it names the statuses seen). Check truncated before calling this the complete set.

[READ] List VM rightsizing data — recommended CPU/memory/disk size per VM, with units, direction and whether to act. Reads the three OnlineCapacityAnalytics recommendedSize metrics, the only rightsizing signal the public API publishes, on both 8.x and 9.x. Get VM UUIDs from list_resources. One bulk stats call and one bulk properties call cover the whole page. Read `sizing_status` before quoting any number: recommendation — recommended_* carry sizes. reclaimable — the engine publishes 0 for a VM it holds reclaimable. That is NOT a recommendation to size it to zero, and recommended_* are null here. none_published — the VM needs no resizing OR analytics never scored it. The appliance does not distinguish these two; do not report it as either one. Units: recommended_* are raw MHz / KB / GB (see `recommended_units`) — never quote the CPU number as vCPUs. Use `recommended_vcpus` (MHz converted with the VM's own host core speed, rounded up) against `current_vcpus`, and `recommended_memory` against `current_memory_kb`. `cpu_direction` / `memory_direction` are oversized / undersized / right_sized, or null when the current size is not published. Disk has no direction. Powered-off VMs and templates are listed, not dropped: check `power_state`, `is_template` and `actionable` (true only for a powered-on non-template VM whose CPU or memory is off its recommendation), and read `caveats` before recommending a change. Vendor appliances (vCenter, Aria, NSX...) cannot be identified reliably — `product_name` appears only when the VM publishes a vApp product — so every reduction carries a caveat to check the vendor minimum size first. `aria_verdict` is the engine's own summary|oversized / undersized statistics; a caveat flags when it disagrees with recommendedSize. This is not the number the vendor UI's Rightsize page shows — that view presents allocated plus a suggested delta, not the abso…

[READ] List symptom definitions — use the returned IDs when calling create_alert_definition. Returns a paginated envelope: items, returned, limit, total (null when the API reports no size), truncated, hint, next_offset. Check truncated before calling this the complete set. Page it: limit is the page size (1-500; 0, negatives and anything above 500 are rejected, not clamped), offset is how many rows to skip, and next_offset is the offset of the next page — pass it back as offset and stop when it is null. Do not loop on truncated: that says this page is not the whole collection, so it stays true on the last page of a walk.

[READ] Run a real-time PromQL instant query (VCF Operations 9.1 VODAP service). Use this for near-real-time (~2s) metrics via a Prometheus-compatible instant query, complementing the historical rollups from get_resource_metrics. Requires the real-time metrics (VODAP) integration to be registered; if it is not, the tool returns an actionable error. Returns result series (labels, timestamp, value) in the paginated envelope plus result_type/status. Gotcha: the query reaches a sibling service whose base path (/data-query-service) is INFERRED — every result carries base_path_confirmed=False until confirmed against a live appliance.

[WRITE] Enable or disable an existing alert definition. Returns definition_id, enabled, and the action taken. Use this instead of delete_alert_definition when you only want to silence a definition — disabling is reversible, deleting is not.

[WRITE] Put one resource in maintenance so Aria stops alerting on it and collecting its data — use before planned work such as powering a VM or host off. Pass duration_minutes OR end_time_ms for a timed window (state MAINTAINED; the resource returns to its prior state when it expires). Pass neither for manual maintenance (MAINTAINED_MANUAL) that lasts until end_resource_maintenance — easy to forget, so prefer a window. Without confirm=True this only previews: it reads the resource and returns blast_radius (resource name and kind, each adapter's state, whether it is in maintenance now, and the requested window) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen what it changes yet. Refused with confirm=True: a resource already in maintenance (starting again would replace that window) and a resource whose state cannot be read. Acting returns the state before and after, confirmed (true / false / null when the after-state could not be read — null is unknown, not failure) and a note. Undo: end_resource_maintenance, recorded only when the resource was known not to be in maintenance before.