NSX Policy API errors

Causes and remedies for the error codes of the NSX Policy API endpoint that tools such as the Terraform NSX-T provider use.

These errors come from the NSX Policy API endpoint of Kyvernon, which serves a subset of that API for existing tools. The response has the shape such tools expect; the error code is in it as well.

`error.nsx.unsupported`

Text in the console: The NSX Policy request uses a feature this server does not serve. Remove the field the message names and send it again.
Meaning for API clients: NSX Policy API facade: the request uses a feature outside the subset this server serves; the message names the field (DFW-HOSTBRIDGE.md §6.4).
Code: INVALID_ARGUMENT, HTTP 400

Cause. The request uses a feature outside the subset that Kyvernon serves, for example a gateway policy, a segment, a context profile or an identity group. The message names the field. Identity groups need a directory service and an agent in every guest that reports user logins; Kyvernon has neither, so group virtual machines by tag instead.

Remedy.

Remove the named field or resource from the request or from the configuration of the tool.
Manage the distributed firewall with the objects of the subset: groups, services, security policies and rules, and virtual machine tags. The firewall pages in the console show the same objects.

`error.nsx.invalid`

Text in the console: A field of the NSX Policy request is not valid. Correct the field the message names and send it again.
Meaning for API clients: NSX Policy API facade: a field of the request is not valid; the message names it.
Code: INVALID_ARGUMENT, HTTP 400

Cause. A field of the request has a value that is not valid. The message names the field.

Remedy.

Correct the named field and send the request again.
Compare with the same object in the firewall pages of the console to see which values are allowed.

`error.nsx.not_found`

Text in the console: The NSX Policy path names no object, or one you cannot see. Check the path and your permissions.
Meaning for API clients: NSX Policy API facade: the path names no object, or one the caller cannot see.
Code: NOT_FOUND, HTTP 404

Cause. The path names no object, or an object that your account cannot see. Objects of another tenant are not visible.

Remedy.

Check the identifier in the path.
Check that your account has read access to the object. A tenant user sees only the objects of the own tenant and the provider objects that apply to it.

`error.nsx.revision`

Text in the console: The object changed since you read it, so its revision is stale. Read the object again and apply your change to the new version.
Meaning for API clients: NSX Policy API facade: the _revision of the write is stale (412); read the object again.
Code: FAILED_PRECONDITION, HTTP 412

Cause. The _revision value in the write is older than the stored object: someone changed the object after you read it.

Remedy.

Read the object again and repeat the change on the current version. Tools such as Terraform do this with a refresh followed by a new plan.

`error.nsx.read_only`

Text in the console: The object is built in, or a tenant user wrote into the provider scope. Change an object of your own instead.
Meaning for API clients: NSX Policy API facade: the object is built in, or a tenant user wrote into the provider scope.
Code: PERMISSION_DENIED, HTTP 403

Cause. The object is built in, for example a service of the built-in catalogue or a platform rule, or a tenant user tried to write in the provider scope.

Remedy.

Leave the built-in object as it is and create an object of your own next to it.
As a tenant user, write in the scope of your own project.

`error.nsx.xsrf`

Text in the console: A write with a session cookie needs the session’s X-XSRF-TOKEN header. Send the header, or authenticate each request with HTTP Basic instead of the cookie.
Meaning for API clients: NSX Policy API facade: a write with a session cookie lacks the session's X-XSRF-TOKEN.
Code: PERMISSION_DENIED, HTTP 403

Cause. A write that uses a session cookie came without the X-XSRF-TOKEN header of that session.

Remedy.

Send the token that the session login returned in the X-XSRF-TOKEN header with every write, or authenticate each request with basic authentication instead of a session cookie.