NSX-T Group IP members API GET: /infra/domains/{domain-id}/groups/{group-id}/members/ip-addresses returns a status code HTTPS 400 - Bad Request, when a inventory group is in the failed state.

Products

• VMware NSX

Issue/Introduction

When an inventory group enters a failed state, the NSX-T Group IP members API (GET /infra/domains/{domain-id}/groups/{group-id}/members/ip-addresses) incorrectly returns an HTTP 400 - Bad Request error. Because the API request itself is valid, the 400 status code is misleading. Furthermore, troubleshooting this issue is difficult because the group's "failed" status is only reported in the NSX-T GUI and is not exposed via the API.

For more details regarding the API, refer to the Broadcom API Documentation

Environment

VMware NSX-T 4.x

Cause

This issue is caused by a breakdown in internal connectivity between the NSX-T Proton and CCP (Central Control Plane) services. When this backend communication fails, the API incorrectly throws an HTTP 400 status code instead of the appropriate HTTP 5xx (Server Error) status code.

Resolution

This issue is resolved in NSX-T 9.0 and later releases. The API behavior has been corrected so that it properly returns an HTTP 5xx (Server Error) instead of a misleading HTTP 400 error when the Proton-to-CCP RPC communication channel is broken.

The server will return the HTTP error code of 500 along with the response message *similar* to the one below:

{
    "httpStatus": "INTERNAL_SERVER_ERROR",
    "error_code": 500702,
    "module_name": "policy",
    "error_message": "Error while getting membership for the Group /infra/domains/default/groups/<group-id> from enforcement point /infra/sites/default/enforcement-points/default. Connectivity issue between Policy and CCP services. More details: - Server is temporarily unable to handle the request. Please check health of the cluster."
}