NSX Custom Roles Fail to Retain Manager API Permissions Resulting in 401 Forbidden

Products

• VMware NSX

Issue/Introduction

When utilizing custom roles or cloned system roles within VMware NSX, users encounter HTTP 401 Forbidden permission errors when executing Management/Manager API commands.   

Although modifying or pushing feature permissions via API returns an HTTP 200 OK success status, subsequent attempts to verify or utilize the permissions reveal that all Manager API-based feature configurations automatically revert back to none.

Symptom Keywords & Error Payloads:

• Custom RBAC role permissions revert to none.
  |
• 401 Unauthorized / Forbidden errors on manager endpoints.

JSON

{
    "httpStatus": "FORBIDDEN",
    "error_code": 401,
    "module_name": "common-services",
    "error_message": "User is not authorized to perform this operation on the application. Please contact the system administrator to get access."}

• Affected endpoints include legacy management API structures such as: GET /api/v1/logical-switches (associated with the switching_switches feature set).

Environment

VMware NSX
VMware NSX-T Data Center

Cause

This is expected behavior by design. Non-system or custom-defined users cannot be granted execution or read permissions for Manager-mode API features.

Custom roles are restricted entirely to features exposed in Policy mode. Any explicit payload attempt to specify or modify permissions for legacy Manager mode features (either via a raw PUT /policy/api/v1/aaa/roles/<role> API action or role cloning via the GUI) will fail silently upon application and immediately reset back to a permission state of none.

Resolution

To execute Management/Manager API operations, an out-of-the-box native System Role must be assigned to the security principal. Custom roles cannot be modified, adapted, or expanded to include permissions interacting with legacy Manager mode API endpoints.

Moving forward, transition infrastructure workflows from legacy Manager APIs to the declarative Policy API equivalent, which fully supports granular RBAC assignments under custom roles:

• Legacy Manager Mode (Unsupported via Custom Roles): GET /api/v1/logical-switches
  
  
• Modern Policy Mode (Supported via Custom Roles): GET /policy/api/v1/infra/segments (associated with the policy_segment feature set).

Additional Information

For a full breakdown of feature availability and architectural limitations across user configurations, see the following documentation:

• Create and Manage Custom Roles - Admin guide

The following specific functional spaces reside exclusively within Manager mode and are completely unsupported for accounts linked to a custom role:

• System > Configuration > Fabric: Profiles, Transport Zones, Settings (Tunnel/Remote and Tunnel Endpoint)
• System > Configuration: Identity Firewall AD
• System > Lifecycle Management: Upgrade and Migrate
• System > Settings: User Management, Support Bundle, Proxy Settings, and User Interface Settings
• Advanced Features: TraceFlow, NSX Intelligence, and Inventory of Physical Servers/Containers