GET /api2/tm/rulesets/<set_id>/tools viewer
POST /api2/tm/rulesets/<set_id>/tools user
GET /api2/tm/rulesets/<set_id>/tools/<tool_id> viewer
PUT /api2/tm/rulesets/<set_id>/tools/<tool_id> user
nm_response field with the network module's redeployment result.DELETE /api2/tm/rulesets/<set_id>/tools/<tool_id> userGET /api2/tm/rulesets/<set_id>/tool-groups viewer
POST /api2/tm/rulesets/<set_id>/tool-groups user
GET /api2/tm/rulesets/<set_id>/tool-groups/<group_id> viewer
PUT /api2/tm/rulesets/<set_id>/tool-groups/<group_id> user
nm_response field with the network module's redeployment result.DELETE /api2/tm/rulesets/<set_id>/tool-groups/<group_id> userThe mutation endpoints above accept an optional ?dry_run=true query parameter. With the flag set, the handler runs all the same checks as the non-dry-run call but does not persist to the DAO and does not push to the network module. Error responses (status code and body) are identical to the non-dry-run call. On success the answer is 200 {}, or — when the edit changes what a chain costs — the resource cost report described in Chain Management (rules, chains and total; both arrays are always present).
{
"id": 1,
"set_id": 10,
"name": "tool",
"a_ports": [{"id":1, "type":"INF"}, ...],
"b_ports": [{"id":2, "type":"INF"}, ...],
"is_chained": false,
"is_in_group": false,
"is_online": true
}name: mandatory; does not have to be unique.a_ports: mandatory, at least one port.b_ports: null for out-of-band tools (no traffic output, only input, like IOTA capture devices); otherwise at least one port. Defaults to null when absent.is_chained: read-only, maintained by the daemon; true while a traffic chain reaches the tool — named on its own, or as a member of a tool group the chain goes through. A tool with is_chained: false can still be picked by a chain; one with true cannot. Ignored on create/edit.is_in_group: read-only, maintained by the daemon; true while a tool group holds the tool. A tool with is_in_group: false can still join a group; one with true cannot (a tool belongs to at most one group). Ignored on create/edit.The two flags are facts about relationships, not one combined "pickable" verdict: check is_chained when offering a tool to a chain and is_in_group when offering it to a group. A tool in a group no chain uses reads {"is_chained": false, "is_in_group": true} and may still be picked by a chain directly. When both are true the tool is unavailable for everything either way — the combination does not tell whether the group is the chained party or the tool is chained on its own next to an idle group membership.
is_online: read-only; true when the tool is practically usable: every port of the tool (a_ports and, for inline tools, b_ports) has link up. Whether the tool is the active or the passive one in its group does not matter here. Ignored on create/edit. Only the tools of the active rule set are followed — the tools of every other rule set read false, as none of their ports carries traffic. The field follows the link states within one publish cycle of the network module, and each change also raises a tool_online / tool_offline event (see Event Management). Changing which rule set is active is the exception: the field is then derived again for every tool at once and no event is raised, so the tools have to be read back after activating, deactivating or deleting a rule set. When an enabled chain of the active rule set goes through the tool, the change also redeploys that chain: the traffic is steered around the tool or back into it without any request of yours (see Chain Management).The bypass-on-link-down policy (bypass_enabled) is not a tool attribute: it is configured where the tool is used, per chain entry — see Chain Management.
{
"id": 1,
"set_id": 10,
"name": "tool-group",
"tools": [1, 2],
"group_logic": "active_passive_ha",
"type": "inline",
"active_tool_id": 1
}name: mandatory; does not have to be unique.tools: mandatory list of tool IDs in this group; at least one tool, no duplicates. The array order is the priority order for "active_passive_ha".group_logic: "active_passive_ha" (traffic goes to one tool at a time, based on priority and link state) or "distribution" (traffic is load-balanced across the tools). A chain going through a "distribution" group reaches it over an internal link aggregation of the members' ports on the side the traffic enters them — one per side, managed by the daemon and not listed under LAG Management. The flows are spread over it by the rule set's lb_strategy and lb_hash_mask (see Ruleset TM Configuration); with flow_hash a flow stays on one tool for as long as it lasts. active_tool_id stays null, and a member leaves the aggregation and rejoins it with its own link, without a redeployment.type: mandatory; the type of the tools inside the group, "inline" or "out_of_band". Every tool in the group must match it (a tool is inline when its b_ports is not null).active_tool_id: read-only; the tool currently selected to carry the group's traffic — the first online tool in tools order. null when no tool is online, or always for "distribution" groups (there every tool carries traffic). Ignored on create/edit. Like is_online it is only followed for the active rule set, and each change raises a tool_group_failover event (see Event Management) — with the same exception: changing which rule set is active derives the field again for every group silently. When an enabled chain of the active rule set goes through the group, the change also redeploys that chain onto the new active tool (see Chain Management).