Tool Reference

Tools are grouped by operating domain. Each tool carries an MCP annotation hint indicating its effect category:

• Read-only discovery (readOnlyHint: true) — list, get, preflight, and diff tools. Safe for discovery; do not write local files or mutate live state. (get-workflow-execution-logs is read-only by default; it writes a local file only when the optional fileName is provided.)
• Local artifact write (readOnlyHint: false, no confirm) — export, scaffold, and snapshot tools. Write files under configured artifact directories; overwrite defaults to false. Do not mutate live VCFA/vRO state.
• Live mutation (readOnlyHint: false, confirm: true) — create, update, import, run, and delete tools. Mutate live VCFA/vRO state and require explicit confirmation. Tools that overwrite or delete live state — import, update, run, and delete tools, plus rebuild-project-package — additionally set destructiveHint: true so hosts can require heightened approval; additive creates and add-*-to-project-package tools do not.

Each tool lists its input schema in a collapsible parameters section. Required confirmation fields such as confirm must be set to true before the tool performs the write or destructive operation.

Discovery list tools automatically follow server-side pagination for both vRO /vco/api list responses and VCF Automation service pages. Callers do not need page cursors. A listing stopped by the pagination request cap carries truncated and a visible warning; context snapshots also record a per-domain warning.

Optional Inventory Limits

All 13 flat inventory tools accept an optional integer limit from 1 to 1000: list-workflows, list-actions, list-configurations, list-categories, list-resource-elements, list-packages, list-plugins, list-catalog-items, list-projects, list-deployments, list-templates, list-event-topics, and list-subscriptions. The limit applies after any supported filters/search, preserving the existing result order. Event topics have no filter/search parameter. Omit limit for the full inventory; snapshots, promotion and internal discovery continue using unlimited calls. list-deployment-requests takes the same limit with the same semantics but is not one of them: it is scoped to a single deployment rather than being a flat inventory. The separately scoped list-workflows-by-category, list-workflow-executions, and list-deployment-actions retain their existing controls.

Both pagers request a fixed page size of min(pageSize, limit) (pageSize defaults to 100), using vRO maxResult or Automation size, unless a client-side filter is active. Local filtering retains the configured page size independently of the result limit so sparse matches do not consume the request cap one raw row at a time. Once enough matches are collected, pagination stops if the matching total is known. An unknown total may require another page, or several pages with sparse local matches, to distinguish an exact boundary from additional matches. Automation page size stays fixed to avoid shifting page offsets; repeated-page detection and the request cap remain active.

Client results carry limited only when the caller's limit withholds proven additional matches. Tool output then says how many are shown, with the matching total only when known. An unknown total from an incomplete limited call is omitted, not estimated from prefetched rows. numberOfElements counts returned rows. truncated still means the page-request cap, not the item limit; both flags can occur when a truncated category traversal is subsequently sliced. Empty capped searches retain a warning rather than claiming the entire inventory has no matches.

Limits reduce requests where the API supports pagination, but cannot guarantee a bounded fetch cost for every path. Actions, flat plugin descriptors, packages, categories, flat configuration elements and resource elements filter locally; project search falls back to local matching when the service rejects its OData filter with HTTP 400. These paths count matches during pagination, not raw rows. Some action endpoints ignore maxResult and return the full list anyway. Configuration listing by category reads one category response and selects/filters its relations before slicing. A limited workflow listing also uses the category fallback if returned names do not match the requested filter, even when early stopping prevents repeated-page detection. The workflow category fallback still traverses fully, deduplicates and sorts before applying the limit, preserving its globally sorted results.

Name filters on list-packages, list-categories, list-configurations (without categoryId) and list-resource-elements are matched client-side as case-insensitive substrings, because the vRO embedded in vRA 8 ignores the conditions query these endpoints are sent and answers with the full inventory. The query is still sent, so a server that honors it returns the same rows over a smaller payload; only the requested page size differs, staying at the configured 100 rather than clamping to the limit. total then reports the number of matches, never the unfiltered inventory count, so a limit notice reads against matching rows; it is omitted only when a limit stopped the walk before the matching total was proven. list-configurations scoped with categoryId already matched locally and is unchanged: it reads one category response, so its matching total is always known. Listings called without a filter are unaffected.

search on list-templates, list-deployments and list-catalog-items is matched the same way, against name and description, because VCF Automation 9.1 accepts the $search these endpoints are sent with a 200 and ignores it, answering with the full inventory. A needle matching nothing therefore used to return everything, which reads as a match. The query is still sent, so a service that honors it returns the same rows over a smaller payload, and the same page-size and total rules above apply — under a limit these listings now request size=100 and walk until enough matches are collected, rather than requesting a single short page. list-projects is not in this group: its search becomes an OData $filter that the project service does apply, with a client-side fallback if the service rejects it. Because $search is opaque, a service that honored it over fields this match does not read would have those rows dropped; no platform is known to honor it on these three routes.

Omitted-limit output and defaults are unchanged except for the negative-total correctness fix: total: -1 / totalElements: -1 means unknown, so discovery now continues instead of incorrectly stopping after the first page. Complete traversal reports the collected count. This fix also applies to full-inventory consumers.

Two-Phase Confirmation Fields

High-risk live mutation tools support optional expected target fields. These fields are backward-compatible: omitted fields do not change existing confirm: true behavior. When supplied, the handler performs read-only discovery first and refuses before mutation if the live target does not match.

Common expected fields:

Field	Used by	Purpose
expectedName	delete/update tools for workflows, actions, configurations, resources, packages, templates, deployments, and subscriptions	Verify the live display name or package name before mutation.
expectedWorkflowName, expectedInputNames	run-workflow, run-workflow-and-wait	Bind execution to a discovered workflow name and input contract.
expectedCategoryId, expectedCategoryName	direct workflow, action, configuration, and resource imports	Verify the intended import category.
expectedPackageName	import-package, import-project-package	Verify the package identity from package import details.
expectedDeploymentName, expectedActionName	run-deployment-action	Verify the deployment and day-2 action discovered immediately before submission.
expectedProjectId, expectedProjectName, expectedStatus	deployment and template deletes, deployment actions	Verify project/status context before the live change.
expectedEventTopicId, expectedRunnableId	subscription update/delete	Verify subscription wiring before the live change.

Direct imports still preserve their existing overwrite defaults for compatibility. When overwrite is omitted on workflow and package imports, it resolves to true; pass it explicitly and prefer prepare-artifact-promotion for reusable content.

Context Snapshots

collect-context-snapshot

Collect reusable VCF Automation/vRO environment context and persist deterministic Markdown and JSON snapshots for future agents. Secrets, scripts, template YAML, and binary content are omitted by default. When the MCP client exposes workspace roots and VCFA_CONTEXT_DIR is not set, snapshots are written under the current workspace's artifacts/context/ directory.

Parameters

Parameter	Type	Required	Default	Description
fileBaseName	string	No	vcfa-context	Base file name for the generated .json and .md files under the configured context directory. Use a plain name only, without path separators or extensions.
overwrite	boolean	No	false	Replace existing snapshot files with the same generated names.
domains	string[]	No	core domains	Domains to collect. Core domains are workflows, actions, configurations, resources, and categories; optional domains are templates, catalogItems, eventTopics, subscriptions, packages, and plugins.
includeOptionalDomains	boolean	No	false	Also collect templates, catalog items, event topics, subscriptions, packages, and plugins.
maxItemsPerDomain	integer	No	100	Maximum items to collect per domain. Increase this when an environment has more than 100 items in a domain and full coverage is needed.
profile	enum	No	default	Snapshot profile. Use vcfaBuiltIns to focus on workflows in subfolders below the Library workflow category, plus actions whose module is com.vmware or starts with com.vmware..

When profile is vcfaBuiltIns, omitted domains default to workflows and actions, omitted fileBaseName defaults to vcfa-builtins-context, and omitted maxItemsPerDomain defaults to 1000. Explicitly requested non-workflow/action domains are still collected normally.

After a successful collection, the tool response includes agent-facing resource URIs:

• vcfa://context/latest for the newest snapshot manifest.
• vcfa://context/snapshots/{fileName} for the generated JSON and Markdown snapshot files.

The server also emits a resource-list change notification so MCP clients can rediscover persisted context snapshots.

Artifact Promotion

prepare-artifact-promotion

Run preflight for a local workflow, action, configuration, or package artifact; optionally export a live backup; summarize risks and changes; and recommend the exact import tool call. This tool never imports.

A backup that cannot be taken is reported as a Backup skipped: line and the rest of the report is still returned. That covers a missing live target ID and, in vra8 mode, a configuration artifact: vRA 8 serves a configuration element as JSON only, so the note points at get-configuration and the project package instead.

Only the vra8 skip is pre-emptive. On any other platform a configuration backup attempts the export, and vRO 9.1 refuses it with the same 406 — so the backup fails rather than being skipped. The rest of the report is still returned. Use get-configuration or the project package to capture the element before a replacement there too; see export-configuration-file for the detail.

Parameters

Parameter	Type	Required	Default	Description
kind	enum	Yes	-	Artifact kind to prepare: workflow, action, configuration, or package.
fileName	string	Yes	-	Plain artifact file name under the configured artifact directory for the selected kind.
target	object	No	-	Optional live target and import category details used for diff, backup, and the recommended import call.
overwrite	boolean	No	true	Overwrite flag to include in the recommended import call where supported.
backup	object	No	-	Optional live backup export settings. When backup is enabled, the matching live target ID or package name is required.

target object:

Field	Type	Required	Description
categoryId	string	No	Target category ID for workflow or configuration import.
categoryName	string	No	Target category name for action import.
workflowId	string	No	Live workflow ID to diff against or export as a backup.
actionId	string	No	Live action ID to diff against or export as a backup.
configurationId	string	No	Live configuration ID to export as a backup.
packageName	string	No	Live package name to export as a backup.

backup object:

Field	Type	Required	Default	Description
enabled	boolean	Yes	-	Whether to export a live backup before promotion.
fileName	string	No	generated by tool	Optional backup artifact file name override.
overwrite	boolean	No	false	Overwrite the backup file if it already exists.

Workflows

list-workflows

List workflows from VCF Automation Orchestrator. Optionally filter by name substring.

Parameters

Parameter	Type	Required	Default	Description
filter	string	No	-	Filter workflows by name using a substring match.
limit	integer	No	-	Maximum matching workflows returned (1–1000), after filtering. Omit for the full inventory.

list-workflows-by-category

List workflows assigned to a workflow category/folder and all descendant subfolders. Recursively fetches each subcategory; may be slow for large trees. Paths are normalized (leading slash is optional). Use this when you need folder membership, for example workflows under test, test/minko, and test/minko/sql.

Parameters

Parameter	Type	Required	Default	Description
categoryId	string	No	-	Exact WorkflowCategory ID to list recursively. Provide exactly one selector.
categoryName	string	No	-	Exact WorkflowCategory name to list recursively. If multiple categories match, use categoryId or categoryPath.
categoryPath	string	No	-	Exact WorkflowCategory path to list recursively, for example /test/minko. Leading slash is optional.
includeEmptyCategories	boolean	No	false	Include descendant categories that contain no workflows.
maxCategories	number	No	50	Maximum number of categories to traverse. Use a lower value to avoid slow traversals on large trees (1–500).

get-workflow

Get detailed information about a specific workflow including its input and output parameters.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Workflow ID to inspect.

create-workflow

Create a new empty workflow in VCF Automation Orchestrator. Use list-categories first to find a workflow category ID. For reusable workflow content, prefer publishing through the project package path after local authoring and validation.

Parameters

Parameter	Type	Required	Default	Description
categoryId	string	Yes	-	Workflow category ID where the empty workflow is created.
name	string	Yes	-	Name for the new workflow.
description	string	No	-	Optional workflow description.
confirm	boolean	Yes	-	Must be true to confirm creation. If false, the workflow is not created.

delete-workflow

Delete a workflow from VCF Automation Orchestrator. This action is irreversible. A 409 reporting the workflow as in use right after delete-package is usually transient — retry first, and set force to true only if it persists.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Workflow ID to delete.
expectedName	string	No	-	Expected live workflow name to verify before deletion.
force	boolean	No	false	Delete even if vRO reports the element as in use, skipping vRO's reference check.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

run-workflow

Validate inputs against the workflow definition, then execute the workflow with optional input parameters. Returns the execution ID; use get-workflow-execution to poll status and retrieve outputs.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Workflow ID to execute.
inputs	array	No	[]	Input parameters for the workflow execution. Inspect the workflow with get-workflow before running. Inputs are validated and type-normalized against the workflow definition before execution.
expectedWorkflowName	string	No	-	Expected live workflow name to verify before execution.
expectedInputNames	string[]	No	-	Expected workflow input names, in discovered order, to verify before execution.
confirm	boolean	Yes	-	Must be true to confirm execution. If false, the workflow is not run.

inputs array item:

Field	Type	Required	Description
name	string	Yes	Parameter name matching a workflow input parameter.
type	string	No	Optional vRO parameter type. When omitted, this tool uses the type from get-workflow.
value	any	Yes	Parameter value compatible with the workflow input type.

run-workflow-and-wait

Validate inputs, execute a workflow, poll until completion, failure, or timeout, and return outputs or useful failure diagnostics.

Output parameters render as values rather than as vRO's value envelope — result (string): "ok" rather than result (string): {"string":{"value":"ok"}} — using the same unwrap as get-configuration. This replaced a narrower helper that leaked the raw envelope for array outputs.

An output parameter the server declares secure is withheld and shown as [redacted], the same marker and the same detection get-configuration uses for a secure-typed attribute: a declared type reading secure or encrypted, or a value that arrived wrapped in such an envelope whatever its declared type says. Both signals are read, because no lab has yet served such an output and the shape vRO sends is unobserved. The signal has to be a declared type or an envelope key. An Array/SecureString is caught by its type, but a secret sitting inside an untyped composite value — a Properties output, say — is announced by neither and is printed.

The failure and timeout results print log excerpts and the workflow's own exception text verbatim. Neither carries a declared type, so neither is withheld.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Workflow ID to execute.
inputs	array	No	[]	Input parameters for the workflow execution. This tool can infer parameter types from the workflow definition when type is omitted.
timeoutSeconds	integer	No	300	Maximum time to wait for completion before returning a timeout result.
pollIntervalSeconds	integer	No	2	Seconds between execution status polls.
logLimit	integer	No	20	Maximum execution log entries to include on failure or timeout. Set to 0 to suppress log excerpts.
expectedWorkflowName	string	No	-	Expected live workflow name to verify before execution.
expectedInputNames	string[]	No	-	Expected workflow input names, in discovered order, to verify before execution.
confirm	boolean	Yes	-	Must be true to confirm execution. If false, the workflow is not run.

inputs array item:

Field	Type	Required	Description
name	string	Yes	Parameter name matching a workflow input parameter.
type	string	No	Optional vRO parameter type. When omitted, this tool uses the type from get-workflow.
value	any	Yes	Parameter value compatible with the workflow input type.

list-workflow-executions

List past and current executions for a specific workflow. Use this to find an execution ID before calling get-workflow-execution.

Parameters

Parameter	Type	Required	Default	Description
workflowId	string	Yes	-	Workflow ID whose executions should be listed.
maxResults	integer	No	20	Maximum number of executions to return.
status	enum	No	-	Filter executions by status: running, completed, failed, canceled, or waiting-signal.

get-workflow-execution

Check the status and outputs of a workflow execution.

Output parameters render as values rather than as vRO's value envelope, using the same unwrap as run-workflow-and-wait and get-configuration. Array outputs previously leaked the raw envelope here.

An output parameter the server declares secure is withheld and shown as [redacted], the same marker and the same detection get-configuration uses for a secure-typed attribute: a declared type reading secure or encrypted, or a value that arrived wrapped in such an envelope whatever its declared type says. Both signals are read, because no lab has yet served such an output and the shape vRO sends is unobserved. The signal has to be a declared type or an envelope key. An Array/SecureString is caught by its type, but a secret sitting inside an untyped composite value — a Properties output, say — is announced by neither and is printed.

The content-exception text of a failed execution is printed verbatim and is not typed, so a secret a script threw is not withheld.

Parameters

Parameter	Type	Required	Default	Description
workflowId	string	Yes	-	Workflow ID associated with the execution.
executionId	string	Yes	-	Execution ID returned by run-workflow, run-workflow-and-wait, or list-workflow-executions.

get-workflow-execution-logs

Retrieve system/event log entries for a workflow execution, including workflow token messages such as System.log, System.debug, System.warn, and System.error. Use this after run-workflow, list-workflow-executions, or get-workflow-execution when detailed execution logs are needed. To save logs instead of returning them inline, provide fileName; exports are written under VCFA_EXECUTION_LOG_DIR or VCFA_ARTIFACT_DIR/execution-logs. The level parameter is a minimum severity filter for inline display and export: debug includes debug and all higher known severities plus unknown severities, info includes info, warning, and error logs, and error includes only error logs.

Log bodies are served verbatim. Unlike an output parameter, a log line carries no declared type, so there is no signal to withhold on: a workflow that writes a credential with System.log surfaces it here, and the same is true of the exception text a failed execution reports. Keep secrets out of what a workflow logs and throws rather than relying on this tool to filter them.

Parameters

Parameter	Type	Required	Default	Description
workflowId	string	Yes	-	Workflow ID associated with the execution.
executionId	string	Yes	-	Execution ID returned by run-workflow, run-workflow-and-wait, or list-workflow-executions.
maxResult	integer	No	-	Maximum number of execution log entries to fetch before filtering.
fileName	string	No	-	Plain .json or .txt file name to export under the configured execution log artifact directory. Do not pass a path.
level	debug | info | error	No	inline: none; export: info	Minimum log severity to display or export.
format	json | text	No	inferred from extension	Export format when fileName is provided. Must match the file extension when set.
overwrite	boolean	No	false	Overwrite the export file if it already exists.

export-workflow-file

Export a vRO workflow as a .workflow file under the configured workflow artifact directory.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Workflow ID to export.
fileName	string	Yes	-	Plain .workflow file name to save under the configured workflow artifact directory. Do not pass a path.
overwrite	boolean	No	false	Overwrite the file if it already exists.

scaffold-workflow-file

Generate a local importable .workflow artifact under the configured workflow artifact directory from structured metadata, linear tasks, bindings, and a vRO-compatible input_form_ for declared inputs. Each task is either a native vRO action workflow item (kind: "action", for a step that only invokes one existing action) or a scriptable task (kind: "script", the default, for custom JavaScript logic, multiple action calls, or orchestration). For reusable project content, publish the resulting workflow through the project package flow after preflight; use import-workflow-file only for narrow validation or explicitly requested one-off tests.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .workflow file name to save under the configured workflow artifact directory.
overwrite	boolean	No	false	Overwrite the file if it already exists.
workflow	object	Yes	-	Complete workflow structure to render into the artifact.

workflow object:

Field	Type	Required	Default	Description
name	string	Yes	-	Workflow display name.
tasks	array	Yes	-	Linear sequence of workflow items (native action items or scriptable tasks). At least one task is required.
id	string	No	generated UUID	Workflow UUID.
description	string	No	-	Workflow description.
version	string	No	1.0.0	Workflow version metadata.
apiVersion	string	No	6.0.0	Workflow API version metadata.
inputs	array	No	[]	Workflow input parameters.
outputs	array	No	[]	Workflow output parameters.
attributes	array	No	[]	Workflow-scoped attributes.

The generated input_form_ is UTF-16BE JSON with a BOM. It places workflow inputs on a page_general page, uses section objects with only id and fields, maps each input type to a verified control via the supported input-form type mapping, and includes options.externalValidations: [] for vRO UI compatibility. Inputs whose type is outside that table are rejected (scaffold fails) rather than silently becoming a string/textField field, which would mismatch workflow-content.

Workflow parameter object, used for inputs, outputs, and attributes:

Field	Type	Required	Description
name	string	Yes	Script-safe parameter name.
type	string	Yes	vRO parameter type, such as string, number, boolean, Array/string, or Properties. For inputs, the type must be in the supported input-form type mapping; unsupported input types are rejected.
description	string	No	Optional parameter description.

Task object:

Field	Type	Required	Default	Description
kind	string	No	script	Task kind: script (scriptable task) or action (native vRO action workflow item).
displayName	string	No	-	Task display name shown in the vRO UI.
name	string	No	itemN	Internal workflow item name.
description	string	No	-	Task description.
script	string	Yes for kind: "script"	-	JavaScript body of the scriptable task. Ignored for kind: "action" (generated automatically).
inBindings	array	No	[]	Scriptable-task bindings: bind workflow inputs or attributes into script-local variables.
outBindings	array	No	[]	Scriptable-task bindings: bind script-local variables back to workflow outputs or attributes.
module	string	Yes for kind: "action"	-	Native action module name, e.g. com.example.actions. Discover with get-action; do not invent.
actionName	string	Yes for kind: "action"	-	Native action name. Discover with get-action; do not invent.
inputs	array	No	[]	kind: "action" only. Ordered action inputs ({ name, type, source }) mapped from workflow inputs/attributes, in action signature order.
resultBinding	object	No	-	kind: "action" only. { name, type } binding the action result (actionResult) to a workflow output/attribute. Omit for actions with no return value.

Binding object (for inBindings/outBindings and inputs):

Field	Type	Required	Applies to	Description
name	string	Yes	all bindings	Script-local variable name (action parameter name for inputs).
type	string	Yes	all bindings	vRO parameter type. Must match the referenced workflow parameter or attribute type.
source	string	Yes	inBindings, inputs	Workflow input or attribute name to read from.
target	string	Yes	outBindings	Workflow output or attribute name to write to.

preflight-workflow-file

Validate a local .workflow artifact under the configured workflow artifact directory before importing it.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .workflow file name under the configured workflow artifact directory to validate.

diff-workflow-file

Compare two local .workflow artifacts, or compare a live workflow export against a local .workflow artifact. The base source is current or old; compare is proposed or new.

Parameters

Parameter	Type	Required	Default	Description
base	union	Yes	-	Current or old workflow source.
compare	union	Yes	-	Proposed or new workflow source.

Both base and compare are discriminated unions selected by source:

source value	Additional field	Description
file	fileName string	Local .workflow file under the configured workflow artifact directory.
live	workflowId string	Live workflow ID to export and use as the comparison side.

import-workflow-file

Import a .workflow file from the configured workflow artifact directory into a workflow category. Use this direct import path for narrow validation or explicitly requested one-off tests; publish reusable project content through ensure-project-package, add-workflow-to-project-package, rebuild-project-package, export-project-package, get-project-package-import-details, and import-project-package.

Parameters

Parameter	Type	Required	Default	Description
categoryId	string	Yes	-	Workflow category ID to import into.
fileName	string	Yes	-	Plain .workflow file name under the configured workflow artifact directory to import.
overwrite	boolean	No	true	Overwrite an existing workflow with the same identity.
expectedCategoryId	string	No	-	Expected workflow category ID; must match categoryId before import.
expectedCategoryName	string	No	-	Expected workflow category name to verify before import.
confirm	boolean	Yes	-	Must be true to confirm import. If false, import is not performed.

Actions

list-actions

List actions from VCF Automation Orchestrator. Optionally filter by name.

Parameters

Parameter	Type	Required	Default	Description
filter	string	No	-	Filter actions by name using a substring match.
limit	integer	No	-	Maximum matching actions returned (1–1000), after filtering. Omit for the full inventory.

get-action

Get detailed information about a specific action including its parameters. The script is summarized (sha256 + length) unless includeScript is set.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Action ID to inspect.
includeScript	boolean	No	false	If true, include the full action script. By default only a sha256/length summary of the script is returned.

create-action

Create a new action in VCF Automation Orchestrator. If an action with the same moduleName/name already exists, the tool refuses and points to update-action rather than creating a duplicate.

Parameters

Parameter	Type	Required	Default	Description
moduleName	string	Yes	-	Module or package name to create the action in, for example com.example.myactions.
name	string	Yes	-	Name for the new action.
script	string	Yes	-	JavaScript or TypeScript script content for the action.
inputParameters	array	No	[]	Input parameter definitions for the action.
returnType	string	No	-	Return type, for example string, void, or Array/string.
confirm	boolean	Yes	-	Must be true to confirm creation. If false, the action is not created.

inputParameters array item:

Field	Type	Required	Description
name	string	Yes	Action input parameter name.
type	string	Yes	vRO parameter type.
description	string	No	Optional parameter description.

update-action

Update an existing action in place via its ID (PUT /actions/{id}). Provide at least one of script, inputParameters, or returnType; unspecified fields are preserved from the live action. Inspect the action with get-action first, and pass expectedName/expectedModule to bind the update to the action you inspected.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Action ID to update.
script	string	No	-	New script content. Omit to keep the current script.
inputParameters	array	No	-	Replacement input parameter definitions (replaces the existing set); pass an empty array to clear all parameters. Omit to keep the current parameters.
returnType	string	No	-	New return type, for example string, void, or Array/string. Omit to keep the current return type.
expectedName	string	No	-	Expected live action name to verify before updating.
expectedModule	string	No	-	Expected live action module to verify before updating.
confirm	boolean	Yes	-	Must be true to confirm the update. If false, the action is not modified.

inputParameters array item:

Field	Type	Required	Description
name	string	Yes	Action input parameter name.
type	string	Yes	vRO parameter type.
description	string	No	Optional parameter description.

export-action-file

Export a vRO action as a .action file under the configured action artifact directory.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Action ID to export.
fileName	string	Yes	-	Plain .action file name to save under the configured action artifact directory. Do not pass a path.
overwrite	boolean	No	false	Overwrite the file if it already exists.

preflight-action-file

Validate a local .action artifact under the configured action artifact directory before importing it.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .action file name under the configured action artifact directory to validate.

diff-action-file

Compare two local .action artifacts, or compare a live action export against a local .action artifact. The base source is current or old; compare is proposed or new.

Parameters

Parameter	Type	Required	Default	Description
base	union	Yes	-	Current or old action source.
compare	union	Yes	-	Proposed or new action source.

Both base and compare are discriminated unions selected by source:

source value	Additional field	Description
file	fileName string	Local .action file under the configured action artifact directory.
live	actionId string	Live action ID to export and use as the comparison side.

import-action-file

Import a .action file from the configured action artifact directory into an action module. The categoryName is the target module (for example com.example.myactions); discover existing modules from the module column of list-actions — vRO does not expose action modules through list-categories (the ActionCategory type returns nothing). Use this direct import path for narrow validation or explicitly requested one-off tests; publish reusable project content through the project package tools.

Parameters

Parameter	Type	Required	Default	Description
categoryName	string	Yes	-	Action module to import into, for example com.example.myactions. Whether a not-yet-existing module is created on import is platform-dependent: vRO 8.18.1 refuses it with 404 Action category name not found, so create the module there with create-action first.
fileName	string	Yes	-	Plain .action file name under the configured action artifact directory to import.
expectedCategoryName	string	No	-	Expected module name. Must match categoryName and is verified against the live module set from list-actions; a module that does not yet exist is not rejected by this guard, but the import itself may still refuse it (see categoryName). The new-module note is reported only when this argument is supplied, since the live check runs only then.
confirm	boolean	Yes	-	Must be true to confirm import. If false, import is not performed.

delete-action

Delete an action from VCF Automation Orchestrator. This action is irreversible. A 409 reporting the action as in use right after delete-package is usually transient — retry first, and set force to true only if it persists.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Action ID to delete.
expectedName	string	No	-	Expected live action name to verify before deletion.
expectedModule	string	No	-	Expected live action module to verify before deletion.
force	boolean	No	false	Delete even if vRO reports the element as in use, skipping vRO's reference check.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

Configuration Elements

list-configurations

List configuration elements from VCF Automation Orchestrator. Optionally filter by name or scope to a specific category.

Parameters

Parameter	Type	Required	Default	Description
filter	string	No	-	Filter configuration elements by name using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching elements returned (1–1000), after category selection and filtering. Omit for the full inventory.
categoryId	string	No	-	Filter configuration elements by ConfigurationElementCategory ID. Use list-categories with type ConfigurationElementCategory to find a category ID.

get-configuration

Get detailed information about a specific configuration element including its attributes.

Attribute values are printed as values, not as the vRO type envelope they arrive in: a string reads "probe-2", an Array/string reads ["one"], and an SDK-object attribute reads its {type, href, id} descriptor. An envelope shape the server has not seen before is printed raw rather than guessed at. An attribute vRO returned with no value at all — the built-in BatchAction element declares several — reads (no value); an attribute holding "", 0 or false prints that value.

Values are JSON-encoded so an empty string reads as "" rather than as blank space, which means a string's surrounding quotes belong to the rendering and not to the value. When re-sending one to update-configuration, whose value is a plain string, send probe-2, not "probe-2".

Secure-typed attribute values (e.g. SecureString) are redacted in the output and shown as [redacted], consistent with the context-snapshot redaction policy, as is any attribute whose value arrives in a secure or encrypted envelope regardless of its declared type.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Configuration element ID to inspect.

create-configuration

Create a new configuration element in VCF Automation Orchestrator. Use list-categories with type ConfigurationElementCategory to find a category ID first.

Parameters

Parameter	Type	Required	Default	Description
categoryId	string	Yes	-	Configuration element category ID to create the element in.
name	string	Yes	-	Name for the new configuration element.
description	string	No	-	Optional description.
attributes	array	No	[]	Initial attributes for the configuration element.
confirm	boolean	Yes	-	Must be true to confirm creation. If false, the configuration element is not created.

attributes array item:

Field	Type	Required	Description
name	string	Yes	Attribute name.
type	string	Yes	vRO attribute type.
value	string	No	Attribute value as a string.

update-configuration

Update a configuration element name, description, or attributes. Supplied attributes replace the existing attribute set. At least one of name, description, or attributes must be provided; a request with none is rejected before any live update.

The underlying PUT replaces the element rather than patching it. The live element is read once, before the confirm gate, and an omitted name or description is carried forward from it, so only the fields you supply change. Attributes are the exception: an update that omits attributes on an element that has some is refused, naming the attributes (names and types only) that would have been deleted. Re-send the attributes to keep, or pass an empty array to clear them deliberately. They are not carried forward automatically because a SecureString attribute reads back as ciphertext, and replaying that value risks storing the ciphertext as the new secret. Plain values can be read with get-configuration; secure values are printed as [redacted] and must be supplied fresh, and a secure-typed attribute sent without a value is refused rather than stored as an empty secret.

Call the tool with confirm: false first: the refusal, if any, is reported in that discovery phase, and the response names the element and the fields that will change. The same read serves the expectedName guard, so a guarded update costs one GET and one PUT.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Configuration element ID to update.
expectedName	string	No	-	Expected current configuration element name to verify before update.
name	string	No	current name	New name for the configuration element.
description	string	No	current description	New description.
attributes	array	No	-	Attributes to store, replacing the existing set. Required unless the element has no attributes; an empty array clears them. Secure-typed attributes must carry a value.
confirm	boolean	Yes	-	Must be true to confirm update. If false, the configuration element is not updated, and any refusal is reported.

attributes array item:

Field	Type	Required	Description
name	string	Yes	Attribute name.
type	string	Yes	vRO attribute type.
value	string	No	Attribute value as a string. get-configuration renders values as JSON, so send probe-2 rather than the rendered "probe-2". Required for secure types, whose current value cannot be read back.

delete-configuration

Delete a configuration element from VCF Automation Orchestrator. This action is irreversible. A 409 reporting the element as in use right after delete-package is usually transient — retry first, and set force to true only if it persists.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Configuration element ID to delete.
expectedName	string	No	-	Expected live configuration element name to verify before deletion.
force	boolean	No	false	Delete even if vRO reports the element as in use, skipping vRO's reference check.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

export-configuration-file

Export a vRO configuration element as a .vsoconf file under the configured configuration artifact directory.

Not supported in vra8 mode: vRA 8 serves a configuration element as JSON only and answers the artifact request with 406, while the same request for a workflow or an action returns the artifact. Use get-configuration to read it, or add-configuration-to-project-package followed by export-project-package to get it into a file.

The same 406 has since been observed on vRO 9.1, both standalone and appliance-embedded: application/zip, application/vcoobject+zip and application/octet-stream are all refused, while */* returns the element as JSON. On those same hosts workflow, action and package exports answer 200 application/zip, so the refusal is specific to configuration elements rather than to the host or the identity, and is not specific to vRA 8. No vRO tested serves a .vsoconf for a single element. Only the vra8 refusal is pre-emptive; on any other platform the request is sent, and a 406 is reported with the same guidance rather than as the server's HTML error page.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Configuration element ID to export.
fileName	string	Yes	-	Plain .vsoconf file name to save under the configured configuration artifact directory. Do not pass a path.
overwrite	boolean	No	false	Overwrite the file if it already exists.

preflight-configuration-file

Validate a local .vsoconf artifact under the configured configuration artifact directory before importing it.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .vsoconf file name under the configured configuration artifact directory to validate.

import-configuration-file

Import a .vsoconf file from the configured configuration artifact directory into a configuration element category. Use list-categories with type ConfigurationElementCategory to find a category ID first.

Parameters

Parameter	Type	Required	Default	Description
categoryId	string	Yes	-	Configuration element category ID to import into.
fileName	string	Yes	-	Plain .vsoconf file name under the configured configuration artifact directory to import.
expectedCategoryId	string	No	-	Expected configuration category ID; must match categoryId before import.
expectedCategoryName	string	No	-	Expected configuration category name to verify before import.
confirm	boolean	Yes	-	Must be true to confirm import. If false, import is not performed.

Resource Elements

list-resource-elements

List resource elements from VCF Automation Orchestrator. Optionally filter by name.

Parameters

Parameter	Type	Required	Default	Description
filter	string	No	-	Filter resource elements by name using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching resources returned (1–1000), after filtering. Omit for the full inventory.

export-resource-element

Export a vRO resource element by ID to a file under the configured resource artifact directory.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Resource element ID to export.
fileName	string	Yes	-	Plain file name to save under the configured resource artifact directory. Do not pass a path.
overwrite	boolean	No	false	Overwrite the file if it already exists.

import-resource-element

Import a vRO resource element from the configured resource artifact directory into a ResourceElementCategory. Use list-categories with type ResourceElementCategory to find a category ID first.

Parameters

Parameter	Type	Required	Default	Description
categoryId	string	Yes	-	Resource element category ID to import into.
fileName	string	Yes	-	Plain file name under the configured resource artifact directory to import.
expectedCategoryId	string	No	-	Expected resource category ID; must match categoryId before import.
expectedCategoryName	string	No	-	Expected resource category name to verify before import.
confirm	boolean	Yes	-	Must be true to confirm import. If false, import is not performed.

update-resource-element

Update an existing resource element's binary content from a file under the configured resource artifact directory.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Resource element ID to update.
expectedName	string	No	-	Expected live resource element name to verify before update.
expectedCategoryName	string	No	-	Expected live resource category name. Verified only where the environment reports a category for its resource elements; where it does not (vRO 8.x serves no category in the resource listing) the call is refused with that explanation rather than a mismatch, so omit it there and confirm placement with list-resource-elements.
fileName	string	Yes	-	Plain file name under the configured resource artifact directory containing the replacement content.
changesetSha	string	No	-	Optional X-VRO-Changeset-Sha value for version-controlled content.
confirm	boolean	Yes	-	Must be true to confirm update. If false, update is not performed.

delete-resource-element

Delete a resource element from VCF Automation Orchestrator. This can optionally force deletion when the resource is referenced by workflows.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Resource element ID to delete.
expectedName	string	No	-	Expected live resource element name to verify before deletion.
expectedCategoryName	string	No	-	Expected live resource category name. Verified only where the environment reports a category for its resource elements; where it does not (vRO 8.x serves no category in the resource listing) the call is refused with that explanation rather than a mismatch, so omit it there and confirm placement with list-resource-elements.
force	boolean	No	false	Delete even if the resource is referenced by workflows.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

Categories

list-categories

List categories by type. Categories are needed to create or import workflows, actions, configuration elements, and resource elements.

Parameters

Parameter	Type	Required	Default	Description
type	enum	Yes	-	Category type: WorkflowCategory, ActionCategory, ConfigurationElementCategory, or ResourceElementCategory.
filter	string	No	-	Filter categories by name using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching categories returned (1–1000), after type selection and filtering. Omit for the full inventory.

Projects

list-projects

List VCF Automation projects so agents can resolve the projectId consumed by create-deployment, create-template, create-subscription, and the project-scoped list tools instead of guessing it. The optional search is a case-insensitive substring match on project name and description, sent to the project-service as an OData $filter (substringof('<search>', tolower(name)) or substringof('<search>', tolower(description)), with the search trimmed and lower-cased and single quotes escaped), so the reported total describes the matches and a narrower search reaches projects beyond the pagination cap. If pagination still stops at the request cap, the result (including an empty match list) carries the shared truncation warning. The server-side filter is lab-verified on both platforms under VCFO-065: vRA 8.18 in vra8 mode (VCFO-072) and VCF Automation 9.1 on a tenant session. Both accept it and apply it — a needle matching nothing returns an empty page rather than the full inventory — and substringof is case-sensitive on both, which is why the filter wraps each field in tolower(). A service that rejects the filter with 400 falls back to the previous client-side match on the full project list, noted on the server's stderr; neither lab does.

A project served without a name renders as (unnamed) rather than undefined. That fallback is shared by every Automation-service renderer — the catalog item, deployment, project, and subscription list and detail tools, and the role principals under get-project — and it describes an upstream shape, not a client defect: vRA 8 serves system subscriptions with no name at all, and VCFO-070 found 5 of 68 on a lab. Every one of these guards tests truthiness rather than nullishness, so an empty-string name renders the same way. No project on either lab has been seen without a name; for projects the fallback is the convention, not an observed gap.

Parameters

Parameter	Type	Required	Default	Description
search	string	No	-	Case-insensitive substring matched against project name and description.
limit	integer	No	-	Maximum matching projects returned (1–1000), after search. Omit for the full inventory.

get-project

Get details for a specific project by its ID. Beyond the name, ID, and description the output renders the fields the project-service response carries: the owning organization ID, the shared-resources flag, the operation timeout, the machine naming template and placement policy, custom properties (a value is shown as [redacted] when its key suggests a password, token, secret, credential, or key), the role assignments, and a per-kind count of placement constraints. The two platforms serve different role arrays — administrators, members, viewers and supervisors on vRA 8, administrators, advanced users, users and auditors on VCF Automation 9.x — and only the arrays the response carries are printed. The one 9.1 project checked carried none of the shared-resources flag, operation timeout, properties or constraints, so it rendered as name, ID, description, organization ID and its four role arrays. Sections the response does not carry are omitted. Cloud zones are not part of the project-service view and are not shown. The endpoint, page envelope, page/size pagination and the 404 for an unknown ID are lab-verified on vRA 8.18 in vra8 mode and on VCF Automation 9.1 (VCFO-065). Use list-projects to discover project IDs. A project served without a name renders as (unnamed), the convention described under list-projects. Within each role array a principal is printed by email, with its type in parentheses when present; a principal served with no email, or an empty one, renders as (unnamed) too — the one fallback in the surface that stands in for something other than a name.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Project ID to inspect.

Catalog Items

list-catalog-items

List available Service Broker catalog items. Optionally narrow the inventory with a search. A catalog item served without a name renders as (unnamed), the convention described under list-projects.

Parameters

Parameter	Type	Required	Default	Description
search	string	No	-	Search catalog items by name or description, using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching catalog items returned (1–1000), after search. Omit for the full inventory.

get-catalog-item

Get catalog item details including type, source, and project assignments. A catalog item served without a name renders as (unnamed), the convention described under list-projects.

When the item carries a request schema, its inputs are rendered as the input contract for create-deployment — each input's name, type, whether it is required, its title or description, and its pattern or allowed values where present. Read this before composing create-deployment's inputs rather than guessing the shape. A property the service marks encrypted is listed and flagged as such, but its stored default is never printed, because a default on an encrypted input is a credential. Requestable: false means the item cannot currently be requested at all.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Catalog item ID to inspect.

Deployments

list-deployments

List deployments, optionally filtered by search and project ID. Use list-projects to discover project IDs. A deployment served without a name renders as (unnamed), the convention described under list-projects. VCF Automation 9.1 does serve a name, verified live under VCFO-074, so the fallback is a guard for an unobserved shape rather than the expected rendering.

Parameters

Parameter	Type	Required	Default	Description
search	string	No	-	Search deployments by name or description, using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching deployments returned (1–1000), after search and project selection. Omit for the full inventory.
projectId	string	No	-	Filter deployments by project ID (discover with list-projects).

get-deployment

Get detailed information about a specific deployment by its ID. A deployment served without a name renders as (unnamed), the convention described under list-projects.

The result renders the inputs the deployment was requested with, keyed by input name. Where get-catalog-item answers what an item takes, this answers what a deployment was given — the only record that distinguishes two deployments of the same catalog item, which can carry different input sets when they were requested against different released blueprint versions. Blueprint ID and Blueprint Version name the blueprint behind the requested Catalog Item Version, which is what that drift looks like.

Values render as JSON, so they can be copied straight into create-deployment's inputs object. Note this is the opposite of the configuration-attribute rendering described under update-configuration, where the quotes are an artifact of the rendering and must not be copied.

An input whose name reads as credential material — password, passwd, secret, token, credential, private key, api key, in any case and at any depth inside an object or array value — renders as [redacted], and the header then says those values must be supplied fresh. This check is name-based and is not a guarantee. Unlike a configuration attribute, which carries a declared type, and unlike a catalog item schema property, which carries an encrypted flag, a deployment's inputs carries values with no marker saying which were encrypted; the catalog item's schema cannot supply one either, because it can only be read at its current version, which is not necessarily the catalogItemVersion the deployment was requested against. Treat a printed value as printed: if a deployment was given a secret under a name this pattern does not match, it is in the output.

The project name is resolved through the project service, since VCF Automation 9.1 serves a deployment's projectId but no projectName. This makes get-deployment a two-request tool; when the project read fails the result still describes the deployment and shows Project ID alone. list-deployments deliberately does not resolve names, since there it would cost one extra read per row.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Deployment ID to inspect.

get-deployment-request

Get the current state of an asynchronous deployment request by the request ID returned from run-deployment-action or delete-deployment. The result renders the request ID and name, action and deployment IDs, requester, status and details, task progress, cancelability, timestamps, and affected resource IDs when the service supplies them. Untyped inputs, outputs, and expanded resources are deliberately not rendered because they can carry sensitive values.

This is the authoritative progress read for a day-2 action: a deployment's own status may remain CREATE_SUCCESSFUL throughout an action, observed on both platforms. The route is GET /deployment/api/requests/{id}, verified live on vRA 8.18 and on VCF Automation 9.1 under VCFO-095, which drove this tool against five real requests on each platform; both serve the same response keys.

Observed status sequence: PENDING → INITIALIZATION → CHECKING_APPROVAL → INPROGRESS → SUCCESSFUL, with COMPLETION between the last two on 9.1. The complete service vocabulary is wider still — FAILED and an approval hold have never been produced — so an unfamiliar status is treated as potentially active rather than finished.

Task progress is not monotonic. The service reports a placeholder totalTasks at submission (1 for a power action, 2 for a delete) and replaces it once it enumerates the tasks, so a caller polling across that transition sees 0/1 become 1/5. The tool renders what the service served rather than smoothing it. completedAt has never been served by either platform, so the Completed At: line has never appeared in practice.

A create request reads back through this tool too, carrying no actionId and a name of Create. Its ID is returned nowhere at submission — POST /catalog/api/items/{id}/request answers {deploymentId, deploymentName} and no request ID — so discover it with list-deployment-requests. A request outlives its deployment: after a delete that listing answers 404 while each individual request still reads by ID here.

For deletion, a successful request is not by itself proof that every resource is gone. Also confirm that get-deployment answers 404 or that list-deployments no longer includes the deployment.

Parameters

Parameter	Type	Required	Default	Description
requestId	string	Yes	-	Deployment request ID returned by run-deployment-action or delete-deployment.

list-deployment-requests

List the requests submitted against one deployment — its create request, every day-2 action, and a queued delete — whoever submitted them and through whatever interface, including the platform UI and earlier sessions. This is the discovery route for a request ID to hand to get-deployment-request, and the only way to reach a create request's ID, which is returned nowhere at submission.

Each row renders the request's name and ID, its status, either its actionId or a create marker, task progress, and the requester. Untyped inputs, outputs, and expanded resources are not rendered, the same omission get-deployment-request makes: a create request carries the inputs the deployment was requested with, and a listing is not the place to print them. A request served without a name renders as (unnamed), the convention described under list-projects. Rows are rendered in the order the service serves them; no ordering is claimed, because none has been measured.

The route is GET /deployment/api/deployments/{id}/requests, which answers a Spring page on vRA 8.18 and on VCF Automation 9.1 alike, observed under VCFO-095. The equivalent GET /deployment/api/requests?deploymentId=<id> exists on both and is not used: the deployment-scoped read is the plain answer to a deploymentId argument (VCFO-097).

The listing is scoped to a deployment that still exists. Once the deployment is gone the route answers 404. The tool reports that without claiming which cause it was — an unknown deployment and a platform not serving the route answer the same status — and names what still works either way: every request it would have listed keeps reading by ID through get-deployment-request, so an ID captured earlier stays usable. Confirm the ID itself with list-deployments.

Parameters

Parameter	Type	Required	Default	Description
deploymentId	string	Yes	-	Deployment whose requests to list (discover with list-deployments).
limit	integer	No	-	Maximum requests returned (1–1000). Omit for the deployment's full request history.

create-deployment

Create a new deployment from a catalog item. This provisions real infrastructure, with the cost and capacity that follow from it, and the only way to remove it afterwards is delete-deployment, which is itself a destructive day-2 operation rather than an undo. It is annotated destructive for that reason, the one additive create- tool that is (VCFO-084).

Use list-catalog-items to find the catalog item ID, list-projects to find the project ID, and list-deployments to verify afterwards. Both IDs are opaque UUIDs that nothing else in the call identifies, so a transposed one requests a different blueprint into a different project and the request still reports success. Pass expectedCatalogItemName and expectedProjectName from that discovery to bind the request to the target you inspected: each is read back from live metadata before anything is submitted, and a mismatch refuses without provisioning. Only the names are offered — an expected ID would compare an argument of this call against itself and could never fail.

When an expected name is supplied but the live record carries none, the call refuses with a "cannot verify" message rather than reporting a mismatch against a missing value: a caller who asked for two-phase verification is never told the target was confirmed when it was not. A verification read that fails outright is reported as such, so it is never mistaken for a failed provision.

On success the tool reports the deployment ID and name the service assigned. Provisioning is asynchronous, so poll get-deployment until the status is terminal — VCF Automation 9.1 and vRA 8.18 both move CREATE_INPROGRESS → CREATE_SUCCESSFUL (note there is no underscore in INPROGRESS). If the service returns no identifier at all, the tool says so explicitly and names list-deployments with the project ID, rather than leaving the caller unsure whether anything was requested.

Use get-catalog-item to read the item's request schema before composing inputs; a required input the blueprint declares is rejected by the catalog service if it is missing or fails the schema's pattern.

Verified live on both platforms: VCF Automation 9.1 (VCFO-074) and, in VCFA_TARGET_PLATFORM=vra8 mode, vRA 8.18 (VCFO-088). Both answer the request with the same bare array of {deploymentId, deploymentName}; the vRA 8 lab's single-VM blueprint took about four minutes to reach CREATE_SUCCESSFUL.

Parameters

Parameter	Type	Required	Default	Description
catalogItemId	string	Yes	-	Catalog item ID to deploy.
deploymentName	string	Yes	-	Name for the new deployment.
projectId	string	Yes	-	Project ID in which to create the deployment (discover with list-projects).
version	string	No	latest	Catalog item version to deploy.
reason	string	No	-	Reason or comment for the deployment request.
inputs	object	No	{}	Catalog item input parameters as a key/value object. Use get-catalog-item or catalog documentation to verify the expected shape before deploying.
expectedCatalogItemName	string	No	-	Expected catalog item name, verified against get-catalog-item before the request is submitted.
expectedProjectName	string	No	-	Expected project name, verified against get-project before the request is submitted.
confirm	boolean	Yes	-	Must be true to confirm deployment creation. If false, the deployment request is not submitted.

delete-deployment

Delete a deployment by its ID. This is a destructive live operation, and an asynchronous one: the service answers with the Deployment.Delete request it queued, the deployment reads DELETE_INPROGRESS for a while (about 45 s on the vRA 8.18 lab) and then answers 404. The tool therefore reports the deletion as requested — with the request ID and status when the service returns them — and names get-deployment (poll to 404) and list-deployments (poll to absence) as the way to confirm it; a success line here is not evidence that the resources are gone. When the request's status is not a running one (PENDING, INITIALIZATION, CHECKING_APPROVAL, INPROGRESS, COMPLETION), the tool says so instead of promising a 404 — a request held by an approval policy never reaches DELETE_INPROGRESS. The delete itself is verified live on VCF Automation 9.1 (VCFO-074) and on vRA 8.18 in vra8 mode (VCFO-088), and its request body and status vocabulary are now observed on both platforms (VCFO-095), where the request reached SUCCESSFUL on the same poll the deployment answered 404.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Deployment ID to delete.
expectedName	string	No	-	Expected deployment name to verify before deletion.
expectedProjectId	string	No	-	Expected deployment project ID to verify before deletion.
expectedProjectName	string	No	-	Expected deployment project name to verify before deletion. A VCF Automation 9.1 deployment carries no project name of its own, so the name is resolved through the project service from the deployment's projectId; a project that reports no name is refused as unverifiable rather than as a mismatch.
expectedStatus	string	No	-	Expected deployment status to verify before deletion.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

list-deployment-actions

List deployment-level day-2 actions available for a VCF Automation deployment. Both platforms tested serve a bare array of action objects carrying id, name, displayName, description, valid and actionType — five actions on VCF Automation 9.1 (VCFO-074), ten on vRA 8.18 (VCFO-088) — and neither serves inputParameters or inputs, so the input hints below remain unobserved.

Parameters

Parameter	Type	Required	Default	Description
deploymentId	string	Yes	-	Deployment ID whose available actions should be listed.

run-deployment-action

Run a deployment-level day-2 action. Use list-deployment-actions first to find the action ID and any required inputs.

On success the tool renders the DeploymentRequest the service queued and, when it includes an ID, directs the caller to poll get-deployment-request until it reports a confirmed terminal or held status. Observed active statuses are PENDING, INITIALIZATION, CHECKING_APPROVAL, INPROGRESS, and COMPLETION; because the complete service vocabulary is wider still, an unfamiliar status is treated as potentially active rather than finished by default. For Deployment.Delete, the tool additionally says to verify that get-deployment answers 404 or list-deployments no longer includes the deployment. For any other action, confirm the outcome on the deployment's resources after the request succeeds. A request whose status is known to be non-running is reported as held or finished rather than as something to wait for. Verified live on vRA 8.18 in vra8 mode under VCFO-088 — the first day-2 submission on any platform — and on VCF Automation 9.1 under VCFO-095, which submitted the first day-2 action on 9.x and found the same request body and vocabulary, plus a COMPLETION status vRA 8.18 does not show.

Parameters

Parameter	Type	Required	Default	Description
deploymentId	string	Yes	-	Deployment ID to act on.
actionId	string	Yes	-	Deployment action ID to run.
reason	string	No	-	Reason for requesting the day-2 action.
inputs	object	No	{}	Day-2 action inputs as a key/value object. Use list-deployment-actions to discover required inputs before running.
expectedDeploymentName	string	No	-	Expected deployment name to verify before submitting the day-2 action.
expectedProjectId	string	No	-	Expected deployment project ID to verify before submitting the day-2 action.
expectedProjectName	string	No	-	Expected deployment project name to verify before submitting the day-2 action. Resolved through the project service, as described under delete-deployment.
expectedStatus	string	No	-	Expected deployment status to verify before submitting the day-2 action.
expectedActionName	string	No	-	Expected deployment action name to verify against the current action list before submitting.
confirm	boolean	Yes	-	Must be true to confirm the day-2 action request. If false, the request is not submitted.

Blueprint Templates

list-templates

List blueprint templates in VCF Automation Cloud Assembly. Optionally filter by search and project ID.

Parameters

Parameter	Type	Required	Default	Description
search	string	No	-	Search templates by name or description, using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching templates returned (1–1000), after search and project selection. Omit for the full inventory.
projectId	string	No	-	Filter templates by project ID (discover with list-projects).

get-template

Get detailed information about a specific blueprint template by its ID. The YAML content is summarized (sha256 + length) unless includeContent is set.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Template or blueprint ID to inspect.
includeContent	boolean	No	false	If true, include the full blueprint YAML content. By default only a sha256/length summary of the content is returned.

create-template

Create a new blueprint template in VCF Automation Cloud Assembly. Use list-templates to verify afterwards.

content is schema-optional but should always be supplied. VCF Automation 9.1 refuses a create that omits it with 400 {"message":"Unknown Server Validation Error","statusCode":400} — a body naming neither the field nor the rule — while a minimal content: "formatVersion: 1" document is accepted and creates the blueprint in DRAFT (verified live under VCFO-099).

It stays optional in the schema because vRA 8 does create an empty template from exactly that request (verified under VCFO-070), and no 9.0 environment exists to establish that the whole 9.x family behaves like 9.1. So nothing is refused pre-emptively: the request is sent, and a 400 on a create that omitted content is reported with that guidance appended to the server's own message rather than as an opaque validation error. A 400 raised for any other reason — malformed YAML, an unknown project — keeps its own message unchanged.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Name for the new template.
projectId	string	Yes	-	Project ID in which to create the template (discover with list-projects).
description	string	No	-	Optional template description.
content	string	No	-	YAML blueprint content for the template. Effectively required on VCF Automation 9.1, which refuses a create without it; omitting it creates an empty template on vRA 8 only. Treat this as Cloud Assembly blueprint content and verify conventions from existing templates or docs before authoring.
requestScopeOrg	boolean	No	false	If true, the template is available org-wide rather than project-scoped.
confirm	boolean	Yes	-	Must be true to confirm creation. If false, the template is not created.

delete-template

Delete a blueprint template by its ID. This action is irreversible.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Template or blueprint ID to delete.
expectedName	string	No	-	Expected template name to verify before deletion.
expectedProjectId	string	No	-	Expected template project ID to verify before deletion.
expectedProjectName	string	No	-	Expected template project name to verify before deletion.
expectedStatus	string	No	-	Expected template status to verify before deletion.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

Packages

list-packages

List vRO packages available on the Orchestrator instance. Optionally filter by name substring.

Parameters

Parameter	Type	Required	Default	Description
filter	string	No	-	Filter packages by name using a case-insensitive substring match, applied client-side.
limit	integer	No	-	Maximum matching packages returned (1–1000), after filtering. Omit for the full inventory.

get-package

Get details of a specific vRO package by its fully qualified package name.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Fully qualified package name, for example com.example.mypackage.

export-package

Export a vRO package as a ZIP file under the configured package artifact directory on the server.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Fully qualified package name to export, for example com.example.mypackage.
fileName	string	Yes	-	Plain .package or .zip file name to save under the configured package artifact directory. Do not pass a path.
overwrite	boolean	No	false	Overwrite the file if it already exists.
exportConfigurationAttributeValues	boolean	No	-	Include configuration attribute values when supported by vRO.
exportGlobalTags	boolean	No	-	Include global tags when supported by vRO.
exportVersionHistory	boolean	No	-	Include version history when supported by vRO.
exportConfigSecureStringAttributeValues	boolean	No	-	Include secure string configuration values when supported by vRO.

get-package-import-details

Analyze a local package file before import and return package elements and certificate details.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .package or .zip file name under the configured package artifact directory.

create-package

Create a vRO package by exact fully qualified name. Refuses to create if the package already exists.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Exact fully qualified package name.
description	string	No	-	Package description.
confirm	boolean	Yes	-	Must be true to create the package.

ensure-project-package

Resolve and reuse the exact configured project package. Creates it only when createIfMissing and confirm are both true.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact project package name.
description	string	No	VCFA_PROJECT_PACKAGE_DESCRIPTION	Description used only when the package is created.
createIfMissing	boolean	No	false	Create the exact package if it is missing.
confirm	boolean	No	false	Must be true with createIfMissing to create.

add-workflow-to-project-package

Add a workflow and dependencies to the exact project package.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name.
workflowId	string	Yes	-	Workflow ID to add.
confirm	boolean	Yes	-	Must be true to add content.

add-action-to-project-package

Add an action and dependencies to the exact project package.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name.
categoryName	string	Yes	-	Action category/module name.
actionName	string	Yes	-	Action name.
confirm	boolean	Yes	-	Must be true to add content.

add-configuration-to-project-package

Add a configuration element and dependencies to the exact project package.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name.
configurationId	string	Yes	-	Configuration element ID.
confirm	boolean	Yes	-	Must be true to add content.

add-resource-to-project-package

Add a resource element and dependencies to the exact project package.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name.
resourceId	string	Yes	-	Resource element ID.
confirm	boolean	Yes	-	Must be true to add content.

rebuild-project-package

Rebuild the exact project package after adding content.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name.
confirm	boolean	Yes	-	Must be true to rebuild.

export-project-package

Export the exact project package to the configured package artifact directory.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name.
fileName	string	No	{packageName}.package	Output package file name.
overwrite	boolean	No	false	Overwrite the local package file if it exists.
exportConfigurationAttributeValues	boolean	No	-	Include configuration attribute values when supported by vRO.
exportGlobalTags	boolean	No	-	Include global tags when supported by vRO.
exportVersionHistory	boolean	No	-	Include version history when supported by vRO.
exportConfigSecureStringAttributeValues	boolean	No	-	Include secure string configuration values when supported by vRO.

get-project-package-import-details

Analyze an exported project package file before import.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name used for default file naming.
fileName	string	No	{packageName}.package	Package file name to analyze.

import-project-package

Import an exported project package file.

Parameters

Parameter	Type	Required	Default	Description
packageName	string	No	VCFA_PROJECT_PACKAGE_NAME	Exact package name used for default file naming.
fileName	string	No	{packageName}.package	Package file name to import.
overwrite	boolean	No	true	Whether to overwrite existing package contents.
expectedPackageName	string	No	-	Expected package name from package import details to verify before import.
confirm	boolean	Yes	-	Must be true to import.
importConfigurationAttributeValues	boolean	No	-	Import configuration attribute values when supported by vRO.
tagImportMode	enum	No	-	Tag import mode: DoNotImport, ImportAndOverwriteExistingValue, or ImportButPreserveExistingValue.
importConfigSecureStringAttributeValues	boolean	No	-	Import secure string configuration values when supported by vRO.

preflight-package

Validate a local .package or .zip artifact under the configured package artifact directory before importing it.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .package or .zip file name under the configured package artifact directory to validate.

import-package

Import a vRO package from the configured package artifact directory into the Orchestrator instance.

Parameters

Parameter	Type	Required	Default	Description
fileName	string	Yes	-	Plain .package or .zip file name under the configured package artifact directory to import.
overwrite	boolean	No	true	Whether to overwrite existing package contents.
expectedPackageName	string	No	-	Expected package name from package import details to verify before import.
confirm	boolean	Yes	-	Must be true to confirm import. If false, import is not performed.
importConfigurationAttributeValues	boolean	No	-	Import configuration attribute values when supported by vRO.
tagImportMode	enum	No	-	Tag import mode: DoNotImport, ImportAndOverwriteExistingValue, or ImportButPreserveExistingValue.
importConfigSecureStringAttributeValues	boolean	No	-	Import secure string configuration values when supported by vRO.

delete-package

Delete a vRO package by its fully qualified name. Optionally delete all workflows, actions, and configurations inside the package.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Fully qualified package name to delete, for example com.example.mypackage.
expectedName	string	No	-	Expected live package name to verify before deletion.
deleteContents	boolean	No	false	Also delete all elements inside the package. On 9.x the members are released asynchronously, so deleting one immediately afterwards can be refused with a transient 409; retrying clears it.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.

Plugins

list-plugins

List installed plugins in VCF Automation Orchestrator. Optionally filter by name substring.

Reads both the VCF Automation 9.x link/attributes listing and the flat { plugins: [...], total } envelope served by the vRO embedded in vRA 8 (vra8 mode). That endpoint ignores the conditions query, so in vra8 mode the filter is applied client-side as a case-insensitive substring match on the plugin module name, with surrounding whitespace ignored like every other client-side list filter. A plugin the server reports as disabled is marked [disabled].

Parameters

Parameter	Type	Required	Default	Description
filter	string	No	-	Filter plugins by name using a substring match.
limit	integer	No	-	Maximum matching plugins returned (1–1000), after filtering. Omit for the full inventory.

Extensibility Subscriptions

list-event-topics

List available Event Broker topics.

Parameters

Parameter	Type	Required	Default	Description
limit	integer	No	-	Maximum event topics returned (1–1000). Omit for the full inventory.

list-subscriptions

List extensibility subscriptions, optionally filtered by project ID. A subscription served without a name renders as (unnamed), the convention described under list-projects; this is the tool where that shape was first seen live, since vRA 8 serves its system subscriptions with no name at all.

Parameters

Parameter	Type	Required	Default	Description
projectId	string	No	-	Filter subscriptions by project ID (discover with list-projects).
limit	integer	No	-	Maximum matching subscriptions returned (1–1000), after project selection. Omit for the full inventory.

get-subscription

Get subscription details including blocking setting and priority. Constraints are summarized (sha256 + length) unless includeConstraints is set. A subscription served without a name renders as (unnamed), the convention described under list-projects.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Subscription ID to inspect.
includeConstraints	boolean	No	false	If true, include the full constraints JSON. By default only a sha256/length summary of the constraints is returned.

create-subscription

Create a subscription linking an Event Broker topic to a vRO workflow or ABX action. The success line renders the element the service returned, so on a platform that serves it without a name it reads (unnamed), the convention described under list-projects.

Parameters

Parameter	Type	Required	Default	Description
name	string	Yes	-	Name for the subscription.
eventTopicId	string	Yes	-	Event topic ID to subscribe to. Use list-event-topics to discover available topics.
runnableType	enum	Yes	-	Runnable type to trigger: extensibility.vro for a vRO workflow or extensibility.abx for an ABX action.
runnableId	string	Yes	-	ID of the workflow or ABX action to trigger.
projectId	string	No	-	Project ID to scope the subscription to (discover with list-projects).
description	string	No	-	Optional subscription description.
blocking	boolean	No	-	Whether the subscription blocks the event pipeline until the runnable completes.
priority	number	No	-	Subscription priority. Lower number means higher priority.
timeout	number	No	-	Timeout in minutes for runnable execution.
disabled	boolean	No	false	Create the subscription in a disabled state.
confirm	boolean	Yes	-	Must be true to confirm creation. If false, the subscription is not created.

update-subscription

Update a subscription. All fields except id are optional; only supplied fields are updated. The success line renders the element the service returned, so on a platform that serves it without a name it reads (unnamed), the convention described under list-projects.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Subscription ID to update.
expectedName	string	No	-	Expected subscription name to verify before update.
expectedEventTopicId	string	No	-	Expected event topic ID to verify before update.
expectedRunnableId	string	No	-	Expected runnable ID to verify before update.
name	string	No	current name	New subscription name.
description	string	No	current description	New description.
disabled	boolean	No	current state	Set to true to disable or false to enable.
runnableId	string	No	current runnable	New workflow or ABX action ID.
runnableType	enum	No	current type	New runnable type: extensibility.vro or extensibility.abx.
blocking	boolean	No	current setting	New blocking setting.
priority	number	No	current priority	New subscription priority. Lower number means higher priority.
timeout	number	No	current timeout	New timeout in minutes.
confirm	boolean	Yes	-	Must be true to confirm update. If false, the subscription is not updated.

delete-subscription

Delete an extensibility subscription.

Parameters

Parameter	Type	Required	Default	Description
id	string	Yes	-	Subscription ID to delete.
expectedName	string	No	-	Expected subscription name to verify before deletion.
expectedEventTopicId	string	No	-	Expected event topic ID to verify before deletion.
expectedRunnableId	string	No	-	Expected runnable ID to verify before deletion.
confirm	boolean	Yes	-	Must be true to confirm deletion. If false, deletion is not performed.