This document supports the version of each product listed and
supports all subsequent versions until the document is
replaced by a new edition. To check for more recent editions
of this document, see http://www.vmware.com/support/pubs.
EN-001371-00
vCloud Air Platform Programmer's Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2 VMware, Inc.
Contents
About this Programmer's Guide5
About the vCloud Air Platform APIs7
1
The VMware APIs for Cloud Automation 7
XML Namespace Identifiers 8
Overview of Object Types 8
Link Relationships in the Object Types 9
API Versioning 10
Roles for the APIs for Cloud Automation 11
Authentication and Authorization 11
vCloud Air Platform APIs Schema Reference 12
Java Code Samples for Cloud Automation 12
About the Examples in this Programmer's Guide 13
Hello vCloud Air : A RESTful Workflow15
2
Log in to vCloud Air 15
Create a Session for a Virtual Data Center in a Service 18
Log Out 23
Index25
VMware, Inc. 3
vCloud Air Platform Programmer's Guide
4 VMware, Inc.
About this Programmer's Guide
The vCloud Air Platform Programmer's Guide provides information about version 5.6 of the vCloud Air
Platform APIs.
VMware® provides many different APIs and SDKs for applications and goals. This guide provides
information about the vCloud Air Platform APIs (formerly known as the vCloud Hybrid Service Extensions)
for developers who create RESTful clients for use with vCloud Air subscription services; specifically, the
Dedicated Cloud and Virtual Private Cloud services.
Intended Audience
This guide is intended for software developers who are building interactive clients of vCloud Air. This
guide discusses Representational State Transfer (REST) and RESTful programming conventions, and
vCloud Air technology. You must be familiar with these and other widely deployed technologies such as
XML, HTTP, and the Windows or Linux operating system.
Related Publications
The vCloud Air User's Guide and vCloud API Programmer's Guide contain detailed information about many of
the objects and operations referred to in this guide.
VMware, Inc.
To access the current versions of these and other VMware books, go to
http://www.vmware.com/support/pubs.
5
vCloud Air Platform Programmer's Guide
6 VMware, Inc.
About the vCloud Air Platform APIs1
The vCloud Air Platform APIs provide support for developers who are building interactive clients of
vCloud Air using a RESTful application development style.
vCloud Air clients and vCloud Air servers communicate over HTTP, exchanging representations of
vCloud Air objects. These representations take the form of XML elements. vCloud Air clients make HTTP
requests to the server and retrieve the information the clients need from the server's responses.
This chapter includes the following topics:
“The VMware APIs for Cloud Automation,” on page 7
n
“XML Namespace Identifiers,” on page 8
n
“Overview of Object Types,” on page 8
n
“Link Relationships in the Object Types,” on page 9
n
“API Versioning,” on page 10
n
“Roles for the APIs for Cloud Automation,” on page 11
n
“Authentication and Authorization,” on page 11
n
“vCloud Air Platform APIs Schema Reference,” on page 12
n
“Java Code Samples for Cloud Automation,” on page 12
n
“About the Examples in this Programmer's Guide,” on page 13
n
The VMware APIs for Cloud Automation
Programmatic access to the subscription services of vCloud Air consists of consuming the vCloud Air
Platform APIs and Compute Service accessed through the vCloud API. The combination of these two APIs
provides a single, logical API endpoint for automation of cloud interactions.
The vCloud Air includes calls to log in and get the details of available virtual data centers. The responses to
these calls include vCloud endpoints and the vCloud session token. With those credentials, customers can
call the vCloud API without needing to provide the credentials again. Customers can automate their
workflows without having to store their credentials on disk or in memory.
The obtained vCloud endpoints and session token allow customers to access the vCloud API across all
functional boundaries of the subscribed services in vCloud Air. Subscribed services include compute
resources, such as Dedicated Cloud and Virtual Private Cloud. The API calls return links to virtual data
center objects, which customers can use for virtual machine lifecycle operations and network service
operations.
VMware, Inc.
7
vCloud Air Platform Programmer's Guide
XML Namespace Identifiers
A response typically includes all the XML namespace identifiers that the server uses to validate it, in
addition to other attributes that specify the schema locations searched during validation.
The following fragment shows the attributes and prefixes of the XML namespace identifier that appear in a
typical response for the vCloud Air Platform APIs:
The vCloud Air Platform APIs define a set of objects common to cloud computing environments. An
understanding of these objects is essential to using the APIs.
The following conventions apply to the objects you access through the APIs:
List types follow these conventions; for example, an object named Obj :
n
Uses ObjListType as the XSD type definition.
n
Contains objlist in the media type.
n
Has Objs as the element name.
n
Top level elements of objects in responses extend from EntityType.
n
The short versions of objects typically are included in other object responses extended from
n
ReferenceType.
The following table describes all the object types in the vCloud Air Platform APIs.
Table 1‑1. Object Type Descriptions
Object TypeDescriptionClass Value
SessionType
ServiceListType
ServiceType
Provides a return type from a login. Contains a link
to retrieve the list of compute services.
Contains a list of services purchased by the
requesting customer account. Entries in the list are
ServiceType.
Represents a reference to service meta data for
vCloud Air. Currently, the ServiceType object
type includes Dedicated Cloud and
Virtual Private Cloud meta data. ServiceType is a
lightweight object, which contains the name, an
href to Compute, the type of service
(compute:dedicatedcloud or compute:vpc), the
serviceId (assigned by VMware when your
vCloud Air account is provisioned) and the
geographical region of the service (for example, "US
- Santa Clara ").
vnd.vmware.vchs.session
vnd.vmware.vchs.servicelist
vnd.vmware.vchs.service
8 VMware, Inc.
Chapter 1 About the vCloud Air Platform APIs
Table 1‑1. Object Type Descriptions (Continued)
Object TypeDescriptionClass Value
ComputeTypeRepresents a reference to a Compute service.
Contains a list of virtual data centers contained in
the Compute service. The Compute service for a
Dedicated Cloud contains zero or more virtual data
centers. The Compute service for
Virtual Private Cloud always contains one virtual
data center.
VdcReferenceType
VCloudSessionType
Represents a reference to a virtual data center
representation on vCloud Air. Contains a link to
retrieve a vCloud session for each virtual data
center.
Represents a reference to a virtual data center on
the vCloud instance. The reference includes the full
URL to the vCloud instance and an authorization
token corresponding to the requesting customer
account. The authorization token must be used to
access objects within the scope of the virtual data
center and the Organization on the vCloud
instance.
vnd.vmware.vchs.compute
vnd.vmware.vchs.vdcref
vnd.vmware.vchs.vcloudsession
Link Relationships in the Object Types
The vCloud Air Platform APIs make extensive use of Link elements to provide references to objects and the
actions that they support. These elements are the primary mechanism by which a server tells a client how to
access and operate on an object.
vCloud Air creates Link elements in a response, which are read-only for the client. If a request includes a
Link element, the server ignores it.
Attributes of a Link Element
In the XML representation of a vCloud object, each Link element has the following form:
LinkType is used for only up and down links; typically, objects do not extend from LinkType.
The media type is represented in the request as the value of the class attribute:
application/xml;class=type;version=5.6
Where type corresponds to the XML structure returned. All class values start with the string
vnd.vmware.vchs.
Elements and References
The vCloud Air object model contains elements and references within those elements.
ElementsReferences
SessionServices
ServiceListService
VMware, Inc. 9
Client
Login
▪ auth token
▪ href
▪ VDC href
VdcLink
VcloudSession
VdcLink
Vcloud VDC
services
service
SessionServiceList
Service
▪ serviceType
▪ serviceId
▪ region
▪ href to content
Compute
▪ serviceType=“compute:dc”
▪ serviceId=<assigned>
VcdRef
VcdRef
▪ name
▪ href
▪ region
▪ link to get vcloudsession
vCloud Air Platform Programmer's Guide
ElementsReferences
ComputeVdcRef
VcloudSession VdcLink
Each reference contains the URL and media type of the referenced object. The following diagram shows
where references provide URLs to other elements (solid black arrow). Additionally, The Compute and
VcloudSession elements contain up links to the ServiceList and Compute elements, respectively.
Figure 1‑1. Link Relationships in the Object Model
When a client creates a session, the client receives a SessionType response, which contains a link to the
services for that vCloud Air account. The client sends a GET request to the service link and receives a list of
services. Each service contains a service type, service ID, region, and an href to the service. When the client
invokes the service href, the client receives a Compute response that contains the type of service, its service
ID, and a list of the virtual data center references. Region refers to a collection of physical data centers that
are located in distinctly separate geographic areas. You select a region or regions when you purchase
compute services. The virtual data center reference contains a link that you can use to log in to vCloud for
the Organization corresponding to the VDCReference.
API Versioning
The schema version of the vCloud Air Platform APIs appears in the values of the xmlns attribute in a
response.
The version format contains the major and minor versions of the release. For example, a response that used
schema version 5.6 would include the following attributes:
All requests must include an HTTP Accept header that designates the API version that the client supports.
The header indicates that the request is for version 5.6 of the vCloud Air Platform APIs to use with the
vCloud API. The following formats are valid for the version:
Additionally, the combination of the vCloud Air Platform APIs and the vCloud API require that a client
obtain the version of the vCloud instance and its API version. Specifically, the client must obtain which
version of vCloud is supported by a given vCloud instance. vCloud Air might be deployed with more than
one version of the vCloud instance.
vCloud Air can support multiple versions of the vCloud instance. A client can access the vCloud instance
deployed with vCloud Air regardless of its version. When a client sends a GET Compute request, the client
receives a response containing a VCloudSession element, which includes a VdcRef reference. The VdcRef
reference includes an href to the virtual data center.
Roles for the APIs for Cloud Automation
vCloud Air includes predefined roles. Each of these roles includes a set of default rights.
For information about the rights available for each predefined role invCloud Air, see User Privileges by
Role.
The following roles have access to the vCloud Air Platform API:
Virtual infrastructure administrator – allows management of virtual data centers, virtual machines, and
n
backup settings
Read-Only administrator – read access to all administration objects
n
End User role – read write access
n
Chapter 1 About the vCloud Air Platform APIs
These vCloud Air roles map the following roles in vCloud API as follows:
Table 1‑2. vCloud Air Roles Mapped to vCloud API Roles
vCloud AirvCloud API – Dedicated CloudvCloud API – Virtual Private Cloud
Each of the vCloud API roles—Dedicated VPC Administrator, Read-Only VPC Administrator, and VPC
User—provide access to vCloud functionality. See the following VMware Knowledgebase article for the
access list for each of the vCloud API roles:
Understanding user roles within VMware vCloud Air (2053484)
Authentication and Authorization
Users authenticate with vCloud Air by supplying credentials established when the vCloud Air user was
created. User credentials are authenticated by the identity management system for vCloud Air.
Authenticating with vCloud Air returns a vCloud Air authorization token that the client can use to receive
an authorization token from vCloud. The client only needs to present authentication credentials once to
access each functional boundary (vCloud Air and vCloud) surfaced by the API.
Authentication with vCloud Air
HTTP communications between a vCloud Air client and server are secured with SSL. vCloud Air
implements Basic HTTP authentication, as defined by RFC 2617, which enables a client to authenticate by
including an Authorization header in the request. The Authorization header contains the basic credentials
in Base64 encoding containing a user name and password.
The authentication for this exchange uses the following format:
VMware, Inc. 11
vCloud Air Platform Programmer's Guide
Request:
POST https://vchs.vmware.com/api/vchs/sessions
Authorization: Basic UserName@domain.com:password
Accept: application/xml;version=5.6
Wherein UserName@domain.com:password is encoded.
Response:
201 Created
x-vchs-authorization:vchs-auth-token
Authorization with vCloud Air and vCloud
All requests from authenticated clients must include an Authorization header. The response code indicates
whether the request succeeded or how it failed. If the request is successful, the server returns HTTP
response code 201 Created because logging in to the API requires a POST call. If the Authentication header
is missing, the server returns HTTP response code 403. If the credentials supplied in the Authentication
header are invalid, or if the token has expired, the server returns HTTP response code 401.
After the client authenticates, vCloud Air retrieves a session token from SAML and authenticates with the
vCloud instance.
vCloud Air Platform APIs Schema Reference
The schema reference includes detailed information about the XML representations of all vCloud Air API
objects and HTTP requests that operate on those objects.
The API represents objects in a cloud as XML documents in which object properties are contained in
elements and attributes that have typed values, and an explicit object hierarchy defined by an XML schema.
The schema reference includes reference material for all elements, types, and operations in vCloud Air.
Clients of RESTful Web services must be able to request object representations from the server, parse the
server's responses to extract the information contained in the responses, and compose requests that are
based on the information extracted from the responses.
vCloud Air uses a validating XML parser that requires elements in XML documents to agree in order and
number with the schema. Required elements must appear in requests. All elements that appear in requests
must appear in the order established by the schema, and with content that conforms to the type constraint
specified in the schema.
The schema reference is available in HTML format in the vCloud Air Documentation Center. See vCloud
Air Platform REST APIs Schema Reference.
The schema reference includes the schema definition files. To download the complete set of schemas for the
vCloud Air Platform APIs, see Download an Archive in the vCloud Air Documentation Center.
Java Code Samples for Cloud Automation
In addition to this programmer's guide and the schema reference, VMware provides code samples written
in Java that client application developers can use as a model for the common workflows in the automation
of cloud interactions.
At a high-level, the code samples provide workflows to write a client that programmatically logs in to
vCloud Air and establishes a session with vCloud to manage compute services and virtual resources.
VMware provides code samples for three sample client applications:
Queries all existing virtual data centers across all regions in both a customer's Dedicated Cloud and
n
Virtual Private Cloud. To run this code sample, you must log in as a user assigned to one or more of the
following roles: Virtual infrastructure administrator, Read-Only administrator, or End User.
12 VMware, Inc.
Creates a virtual machine by using a template, powers on the virtual machine, and obtain its IP address
n
for subsequent connections. Then, runs a Web service on that virtual machine. To run this code sample,
you must log in as a user assigned to one or more of the following roles: Virtual infrastructure
administrator or End User.
Adds a NAT rule to enable external HTTPS requests to a Web service running on a virtual machine in
n
the virtual data center and adds a firewall rule to prevent all other access. To run this code sample, you
must log in as a user assigned to the Virtual infrastructure administrator role.
The code samples support the standard use case wherein a company purchases by logging in to
My VMware both Virtual Private Cloud and Dedicated Cloud capacity in different regions of vCloud Air. A
vCloud Air Account Administrator logs in to the vCloud Air Web UI to create a user and assign that user to
an appropriate access role.
Additionally, the code samples illustrate how to establish a vCloud session, request the vCloud instance
version, and set the correct version header.
The code samples are available for download from the VMware Community > VMware Technology
Network (VMTN) Forums > VMware Developer > Sample Code at
The examples in this guide of HTTP requests and responses illustrate the workflow and content that is
associated with automating login to vCloud Air and session set up for vCloud to obtain virtual data center
information.
Chapter 1 About the vCloud Air Platform APIs
Example request headers follow these conventions:
Header names and values are case-insensitive, and can be submitted or returned in any character case.
n
Other HTTP headers, such as date, content-length, and server, are omitted because they are not relevant
n
to the specifics of any example.
The XML version and encoding header <?xml version="1.0" encoding="UTF-8"?> is omitted in
n
example requests.
Example responses follow these conventions:
Responses show only those elements and attributes that are relevant to the operation being explained.
n
Ellipses (…) indicate omitted content within responses.
The XML version and encoding header <?xml version="1.0" encoding="UTF-8"?> is omitted in
n
example responses.
Object IDs shown in href attribute values appear as small integers, for example vchs-2 for compute-uuid
n
or vdc-7 for vdc-uuid. In the API, object IDs are universal unique identifiers (UUIDs) as defined by RFC
4122, for example f5e185a4-7c00-41f1-8b91-0e552d538101.
VMware, Inc. 13
vCloud Air Platform Programmer's Guide
14 VMware, Inc.
Hello vCloud Air : A RESTful
Workflow2
vCloud Air clients and servers communicate over HTTPS, exchanging XML representations of vCloud API
objects. This simplified example of a RESTful workflow includes logging in to vCloud Air, requesting
service details from vCloud, and creating a vCloud session to obtain the list of virtual data centers for that
compute service.
These examples assume that you have you have subscribed to vCloud Air, have created a user account, and
have at least one virtual data center in the Compute Service.
1Log in to vCloud Air on page 15
vCloud Air requires login requests to be authenticated. Begin the workflow with a login request that
supplies user credentials in the MIME Base64 encoding format as specified in RFC 1421.
2Create a Session for a Virtual Data Center in a Service on page 18
When you log in to vCloud Air, you retrieve the Services element, which contains elements for each
Compute Service your company has purchased for vCloud Air. Each Service element in the list
contains a reference to the service.
3Log Out on page 23
To log out and end a vCloud Air session, delete the session you created when you logged in. The
logout request, like all other authenticated requests, must include the Authorization header.
Log in to vCloud Air
vCloud Air requires login requests to be authenticated. Begin the workflow with a login request that
supplies user credentials in the MIME Base64 encoding format as specified in RFC 1421.
Prerequisites
Your company has purchased Virtual Private Cloud or Dedicated Cloud capacity in different regions of
n
vCloud Air via My VMware and obtained an Account Administrator login on vCloud Air (procured
directly through My VMware).
Your Account Administrator has created at least one user account with credentials in the vCloud Air.
n
You are a user assigned to a role that can access the API.
n
You are a user assigned to a role that can access your compute services.
n
As a vCloud Air client, you present your credentials one time to log in and view the list of your subscribed
compute services in vCloud Air.
VMware, Inc.
15
vCloud Air Platform Programmer's Guide
The Session element, which the API returns from a successful login, contains a link to the services for that
vCloud Air account. The client invokes the service link and receives a list of services. Each service contains a
serviceType, serviceId, and an href to the content for that service. The compute serviceType has the
following values:
compute:dedicatedcloud
n
compute:vpc
n
The vCloud Air automated subscription system assigns the value of the serviceId attribute.
Procedure
1POST a request to this URL that includes your user name and password in a MIME Base64 encoding:
POST https://vchs.vmware.com/api/vchs/sessions
The initial POST requires that you enter the Authorization header with an encoded Base64
username:password value as shown:
Example: Requests and Responses to Log in to Your Services
This example shows the two parts that are required for logging in to the Compute Service that you have
subscribed to with vCloud Air. The first part of the example shows the request and response for HelloUser
to log in to vCloud Air at the URL https://vchs.vmware.com/api/vchs/sessions In Request 1, the initial
POST requires you enter the Authorization header with an encoded Base64 username:password value.
The second part shows the request and response for HelloUser to pass the authorization token to obtain the
compute service list purchased for the user's company account. The service list contains one service for a
Dedicated Cloud subscription.
Request 1:
POST https://vchs.vmware.com/api/vchs/sessions
Authorization: Basic Vk13YXJlMTIzIQ==
Accept: application/xml;version=5.6
Create a Session for a Virtual Data Center in a Service
When you log in to vCloud Air, you retrieve the Services element, which contains elements for each
Compute Service your company has purchased for vCloud Air. Each Service element in the list contains a
reference to the service.
Prerequisites
Verify that you are logged in to vCloud Air and assigned to a user role that can access the API.
Invoking the URL for a service reference returns a Compute element. The Compute element includes an
attribute for the serviceType and references to all the virtual data centers created within that service.
When the serviceType is a compute:dedicatedcloud, the Compute element has zero or more virtual data
centers. When the serviceType is compute:vpc, the Compute element has one virtual data center.
The reference for each virtual data center (VdcRef) contains the virtual data center name and a link to that
virtual data center. Each VdcRef also contains a link to retrieve the vCloud session for that virtual data
center.
Procedure
1Using the Service element returned from the request for the service list, issue a GET request to the URL
for the service:
GET https://vchs.vmware.com/api/vchs/compute/compute-uuid
The returned Compute element contains references to the virtual data centers provisioned for that
service.
The returned response includes the details for the virtual data center. See Response 5 below.
VMware, Inc. 19
vCloud Air Platform Programmer's Guide
Example: Requests and Responses to Create a Session for a Virtual Data
Center
This example shows the five parts (requests and responses) that are required to create a session for a virtual
data center located in a vCloud instance.
This example shows a request and response for a Dedicated Cloud service, with the auto assigned ID
3786bb05-dc9a-471b-91cd-554499d45629, that contains a reference to one virtual data center named 0001example-vdc-1-public-api. The compute service has UUID vchs-2 and the virtual data center has the UUID
vdc-7.
Request 1:
GET https://vchs.vmware.com/api/vchs/compute/vchs-2
Accept: application/xml;version=5.6
To log out and end a vCloud Air session, delete the session you created when you logged in. The logout
request, like all other authenticated requests, must include the Authorization header.
Prerequisites
Verify that you are logged in.
Procedure
Chapter 2 Hello vCloud Air : A RESTful Workflow
Send a DELETE request specifying the href of the current Session object.
u
Example: Logout Request and Response
This example deletes the current user's session, which logs the user out.
Request:
DELETE https://vchs.vmware.com/api/vchs/session
Type None