@nightsquawktech/proxmox-mcp-server 0.1.0

package/dist/catalog-pve/enrichment/get_cluster_sdn_controllers_controller.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_cluster_sdn_controllers_controller",
+  "usageNotes": "Use this to inspect the stored configuration of a specific SDN controller (BGP, EVPN, IS-IS, or Faucet) by its identifier. Pass `pending=true` to see unapplied changes staged since the last `apply`, or `running=true` to see the live frr/dataplane config as opposed to the stored config — these two flags are mutually exclusive in practice. Requires `SDN.Allocate` on the `/sdn/controllers/{controller}` path, which is a cluster-level privilege not tied to any individual node.",
+  "examples": [
+    {
+      "summary": "Read configuration of a BGP/EVPN controller, including any pending (unapplied) changes",
+      "path_params": {
+        "controller": "evpn-core"
+      },
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "If the `state` field in the response is `changed` or `new`, the controller has pending config that has not been pushed to nodes yet — run apply-sdn to activate it.",
+    "The `digest` field should be passed back in any subsequent update call to guard against concurrent modifications.",
+    "BGP-specific fields (`asn`, `peers`, `loopback`, `ebgp`, `ebgp-multihop`, `bgp-mode`, `bgp-multipath-as-relax`) are only populated for controllers of type `bgp` or `evpn`; IS-IS fields (`isis-domain`, `isis-ifaces`, `isis-net`) only appear for type `isis`."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_controllers",
+    "create_cluster_sdn_controllers",
+    "update_cluster_sdn_controllers_controller",
+    "delete_cluster_sdn_controllers_controller",
+    "get_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_dns.json

@@ -0,0 +1,21 @@
+{
+  "operationId": "get_cluster_sdn_dns",
+  "usageNotes": "Use this to list all SDN DNS provider integrations configured in the cluster. Requires 'SDN.Audit' or 'SDN.Allocate' on '/sdn/dns/<dns>' — callers only see entries they have permission on. Currently the only supported provider type is 'powerdns'; use the optional 'type' filter to scope results when you only care about that provider.",
+  "examples": [
+    {
+      "summary": "List all configured SDN DNS providers",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The response array may be empty if no DNS integrations have been configured under Datacenter > SDN > DNS.",
+    "Each returned object includes a 'dns' field (the zone/config name) and a 'type' field — use the 'dns' value as the identifier when querying individual DNS config endpoints.",
+    "PowerDNS is the only type currently enumerated; passing any other value to the 'type' filter will return an empty list."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_dns_dns",
+    "get_cluster_sdn_zones",
+    "get_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_dns_dns.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_cluster_sdn_dns_dns",
+  "usageNotes": "Use this endpoint to retrieve the current configuration of a specific SDN DNS provider object (e.g., PowerDNS) by its identifier. Requires the SDN.Allocate privilege on the /sdn/dns/{dns} path — typically held by administrators. SDN must be enabled on the cluster and the DNS object must already exist; use list_cluster_sdn_dns to enumerate available identifiers first.",
+  "examples": [
+    {
+      "summary": "Read configuration for an SDN DNS provider named 'pdns1'",
+      "path_params": {
+        "dns": "pdns1"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The dns identifier must start with a letter, end with a letter or digit, and contain only alphanumeric characters (min length 2).",
+    "This is a cluster-level read — it queries the cluster configuration database, not a specific node, so any online cluster member can serve it.",
+    "After modifying an SDN DNS object, call POST /cluster/sdn to apply pending changes cluster-wide before they take effect in the data plane."
+  ],
+  "relatedOperations": [
+    "list_cluster_sdn_dns",
+    "create_cluster_sdn_dns",
+    "update_cluster_sdn_dns",
+    "delete_cluster_sdn_dns",
+    "apply_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_dry_run.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_cluster_sdn_dry_run",
+  "usageNotes": "Use this before applying SDN changes (POST /cluster/sdn) to preview exactly what will change — the diff covers both FRR routing daemon config and the network interfaces file on the specified node. Because SDN config is per-node, run this against each node in the cluster to understand the full blast radius before committing. The caller must hold Sys.Audit on /nodes/{node}; the target node must be online and reachable by the API host.",
+  "examples": [
+    {
+      "summary": "Preview pending SDN changes on node pve1",
+      "path_params": {},
+      "params": {
+        "node": "pve1"
+      }
+    }
+  ],
+  "tips": [
+    "Both frr-diff and interfaces-diff are optional in the response; an empty or absent field means no changes are pending for that subsystem.",
+    "Run this against every cluster node, not just the local one — SDN zones and VNets may generate different interface diffs per node depending on which bridges/VLANs are active there.",
+    "A non-empty frr-diff indicates BGP/EVPN routing changes; review carefully before applying as route flaps can affect VM connectivity."
+  ],
+  "relatedOperations": [
+    "post_cluster_sdn",
+    "get_cluster_sdn",
+    "get_cluster_sdn_zones",
+    "get_cluster_sdn_vnets"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics.json

@@ -0,0 +1,21 @@
+{
+  "operationId": "get_cluster_sdn_fabrics",
+  "usageNotes": "Returns the top-level index of SDN fabric subdirectories available in the cluster. Use this as a discovery call to enumerate fabric types before drilling into specific fabric configurations. Requires the SDN.Audit privilege on /sdn/fabrics; SDN must be enabled in the cluster (Datacenter > SDN).",
+  "examples": [
+    {
+      "summary": "List available SDN fabric subdirectories",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "SDN fabrics is a newer subsystem; this endpoint may return an empty array on clusters that have not configured any fabrics.",
+    "Use get_cluster_sdn to get the parent SDN index and confirm SDN is active before calling fabric-specific endpoints.",
+    "API tokens need SDN.Audit on /sdn/fabrics explicitly — cluster-level Admin does not automatically inherit SDN privileges in all PVE versions."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn",
+    "get_cluster_sdn_controllers",
+    "get_cluster_sdn_dns"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics_all.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_cluster_sdn_fabrics_all",
+  "usageNotes": "Use this endpoint to enumerate all SDN fabrics and their per-node configuration across the cluster, spanning all protocols (OSPF, OpenFabric, WireGuard, BGP). By default it returns the committed running configuration; pass 'pending=true' to inspect changes that have been staged but not yet applied. Callers need at least 'SDN.Audit' on '/sdn/fabrics/<fabric>' to see a fabric entry, and 'Sys.Audit' on '/nodes/<node_id>' to see its node entries — partial results are returned silently when permissions cover only a subset.",
+  "examples": [
+    {
+      "summary": "List all committed SDN fabrics and nodes (default view)",
+      "path_params": {},
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The response object has two top-level arrays — 'fabrics' (fabric-level config) and 'nodes' (per-node membership) — iterate both to get the full picture for a fabric.",
+    "Protocol-specific fields (e.g. 'area' for OSPF, 'persistent_keepalive' for WireGuard) are only present on entries whose 'protocol' field matches their 'instance-types'; check 'protocol' first before accessing those fields.",
+    "Use 'pending=true' after staging SDN changes (e.g. via PUT/POST fabric endpoints) to verify staged config before applying it with the SDN apply endpoint.",
+    "The 'digest' field on each fabric/node entry can be fed back to write operations to guard against concurrent modifications.",
+    "If a fabric or node is missing from the response, verify the calling token has the required 'SDN.Audit'/'Sys.Audit' privilege on the specific fabric or node path — the API silently omits unauthorized entries rather than returning an error."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_fabrics",
+    "get_cluster_sdn_fabrics_id",
+    "get_cluster_sdn_fabrics_id_nodes",
+    "get_cluster_sdn_fabrics_id_nodes_nodeid",
+    "post_cluster_sdn_fabrics",
+    "put_cluster_sdn_fabrics_id",
+    "post_cluster_sdn_apply"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics_fabric.json

@@ -0,0 +1,26 @@
+{
+  "operationId": "get_cluster_sdn_fabrics_fabric",
+  "usageNotes": "Use this endpoint to list all SDN fabric configurations defined in the cluster, including OSPF, BGP, OpenFabric, and WireGuard fabrics. Requires 'SDN.Audit' or 'SDN.Allocate' permission on '/sdn/fabrics/<fabric>' — results are automatically scoped to fabrics the caller can see. Use the 'pending' flag to inspect staged-but-not-yet-applied changes, or 'running' to see the actively deployed configuration (the two may differ after edits before an SDN apply).",
+  "examples": [
+    {
+      "summary": "List all fabrics showing pending (staged) configuration",
+      "path_params": {},
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "Omitting both 'pending' and 'running' returns the saved (committed) configuration — not necessarily what is currently running on nodes.",
+    "Each returned object includes a 'protocol' field (openfabric, ospf, wireguard, bgp) that determines which other fields are present; filter by protocol to avoid acting on irrelevant fabric types.",
+    "The 'digest' field in each entry can be passed to write operations to guard against concurrent modifications.",
+    "SDN fabrics are a cluster-wide resource; this endpoint hits the cluster API layer and does not require a specific node to be targeted."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_fabrics_fabric_fabric",
+    "post_cluster_sdn_fabrics",
+    "put_cluster_sdn_fabrics_fabric",
+    "delete_cluster_sdn_fabrics_fabric",
+    "put_cluster_sdn_apply"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics_fabric_id.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_cluster_sdn_fabrics_fabric_id",
+  "usageNotes": "Retrieves the full configuration of a single SDN fabric by its ID, including protocol type (openfabric, ospf, wireguard, or bgp) and all protocol-specific properties. Use this before issuing an update to capture the current `digest` value, which acts as an optimistic concurrency lock to prevent overwriting concurrent changes. Requires either SDN.Audit or SDN.Allocate on the fabric's ACL path; API tokens are supported.",
+  "examples": [
+    {
+      "summary": "Fetch configuration for an OSPF fabric named 'dc1fab'",
+      "path_params": {
+        "id": "dc1fab"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The `digest` field in the response should be passed back in any subsequent update call to guard against concurrent modification.",
+    "Protocol-specific fields (e.g. `area` for ospf, `csnp_interval`/`hello_interval` for openfabric, `persistent_keepalive` for wireguard) are only present when the fabric's `protocol` matches their `instance-types`.",
+    "The fabric `id` must be 2–8 alphanumeric characters (hyphens allowed in the middle); exact pattern is `[a-zA-Z0-9][a-zA-Z0-9-]{0,6}[a-zA-Z0-9]`.",
+    "A `lock-token` in the response indicates the global SDN configuration is currently locked; avoid writes until it clears."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_fabrics",
+    "put_cluster_sdn_fabrics_fabric_id",
+    "delete_cluster_sdn_fabrics_fabric_id",
+    "post_cluster_sdn_fabrics"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics_node.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_cluster_sdn_fabrics_node",
+  "usageNotes": "Lists all node entries across all SDN fabrics the caller has access to; results are filtered by the caller's per-fabric SDN.Audit/SDN.Allocate and per-node Sys.Audit/Sys.Modify permissions, so different API tokens may see different subsets. Use the 'pending' flag to preview uncommitted SDN config changes before applying them, or 'running' to inspect the currently active (applied) state. The returned 'digest' field from each entry should be passed to write operations to prevent concurrent modification conflicts.",
+  "examples": [
+    {
+      "summary": "List all SDN fabric nodes with pending (uncommitted) config included",
+      "path_params": {},
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "Protocol-specific fields (allowed_ips, endpoint, peers, public_key, role) only appear on WireGuard-protocol entries; interfaces shape varies by protocol (openfabric, ospf, wireguard, bgp).",
+    "Omitting both 'pending' and 'running' returns the stored (committed) configuration — useful as a baseline before making changes.",
+    "The 'lock-token' field in the response is used to safely unlock the global SDN configuration if it was left locked by an interrupted write operation."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_fabrics",
+    "get_cluster_sdn_fabrics_fabric",
+    "get_cluster_sdn_fabrics_fabric_node",
+    "post_cluster_sdn_fabrics_fabric_node",
+    "put_cluster_sdn_fabrics_fabric_node"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics_node_fabric_id.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "get_cluster_sdn_fabrics_node_fabric_id",
+  "usageNotes": "Returns the list of nodes configured within a specific SDN fabric, including per-node IP addresses, protocol-specific interface definitions, and WireGuard peer/key details. Requires SDN.Audit permission on /sdn/fabrics/{fabric_id}; nodes where you lack Sys.Audit or Sys.Modify are silently omitted. Use the 'pending' flag to inspect staged changes before an SDN apply, or 'running' to compare the active kernel/daemon state against stored config.",
+  "examples": [
+    {
+      "summary": "List all nodes in the 'wg-core' WireGuard fabric, showing only pending (unapplied) config",
+      "path_params": {
+        "fabric_id": "wg-core"
+      },
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "fabric_id must be 2–8 alphanumeric characters (hyphens allowed in the middle); leading/trailing hyphens are rejected.",
+    "The response shape varies by protocol: WireGuard nodes include 'allowed_ips', 'endpoint', 'peers', 'public_key', and 'role'; OSPF/OpenFabric nodes expose 'interfaces'; BGP nodes expose 'interfaces' with interface names only.",
+    "The 'digest' field in each node entry can be passed back on write operations to guard against concurrent modifications.",
+    "Omitting both 'pending' and 'running' returns the stored/committed configuration — the baseline before any unapplied edits."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_fabrics",
+    "get_cluster_sdn_fabrics_fabric_id",
+    "get_cluster_sdn_fabrics_node_fabric_id_node_id",
+    "put_cluster_sdn_fabrics_node_fabric_id_node_id",
+    "post_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_fabrics_node_fabric_id_node_id.json

@@ -0,0 +1,26 @@
+{
+  "operationId": "get_cluster_sdn_fabrics_node_fabric_id_node_id",
+  "usageNotes": "Use this to inspect the configuration of a specific node within an SDN fabric — including its IP addresses, protocol-specific interfaces, and (for WireGuard fabrics) its public key, allowed IPs, role, and peer definitions. The caller must hold SDN.Audit or SDN.Allocate on the fabric path AND Sys.Audit or Sys.Modify on the node path. The returned digest can be passed to update operations to guard against concurrent modifications.",
+  "examples": [
+    {
+      "summary": "Retrieve WireGuard fabric node configuration for 'pve1' in fabric 'wg01'",
+      "path_params": {
+        "fabric_id": "wg01",
+        "node_id": "pve1"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'protocol' field in the response determines which optional fields are present — only wireguard nodes include 'public_key', 'allowed_ips', 'endpoint', 'role', and 'peers'.",
+    "Save the returned 'digest' before issuing any update call; passing a stale digest will cause the update to be rejected, preventing accidental overwrites.",
+    "For WireGuard external nodes, 'public_key' must already be set; if it is absent, the node is incomplete and peering will fail.",
+    "The 'lock-token' field, when present, indicates the SDN global config is locked by a pending apply operation — avoid writes until it clears."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_fabrics_node",
+    "put_cluster_sdn_fabrics_node_fabric_id_node_id",
+    "delete_cluster_sdn_fabrics_node_fabric_id_node_id",
+    "get_cluster_sdn_fabrics_fabric_id"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_ipams.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "get_cluster_sdn_ipams",
+  "usageNotes": "Use this to list all configured SDN IPAM integrations on the cluster, optionally filtered by type (netbox, phpipam, or pve). Requires 'SDN.Audit' or 'SDN.Allocate' permission on '/sdn/ipams/<ipam>' — results are filtered per caller's privileges, so an empty list may mean missing permissions rather than no IPAMs configured. SDN must be enabled and the cluster-wide SDN configuration must be applied before IPAM entries appear.",
+  "examples": [
+    {
+      "summary": "List all configured SDN IPAMs",
+      "path_params": {},
+      "params": {}
+    },
+    {
+      "summary": "List only NetBox IPAM integrations",
+      "path_params": {},
+      "params": {
+        "type": "netbox"
+      }
+    }
+  ],
+  "tips": [
+    "The built-in 'pve' IPAM type uses Proxmox's own IP tracking and is available without any external integration.",
+    "If you expect an IPAM to appear but the list is empty, check your SDN.Audit or SDN.Allocate permission on /sdn/ipams/<ipam> rather than assuming it is unconfigured.",
+    "IPAM entries must be committed via the SDN apply step before they are active on nodes."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_ipams_{ipam}",
+    "get_cluster_sdn",
+    "get_cluster_sdn_vnets",
+    "get_cluster_sdn_zones"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_ipams_ipam.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_cluster_sdn_ipams_ipam",
+  "usageNotes": "Use this endpoint to retrieve the configuration of a specific SDN IPAM object by its identifier. Requires the SDN.Allocate privilege on /sdn/ipams/{ipam}, so API tokens must have that permission granted. SDN must be enabled on the cluster; the returned object contains backend-specific fields (e.g., type, url, token) depending on whether the IPAM is netbox, phpipam, or pve.",
+  "examples": [
+    {
+      "summary": "Read configuration for an IPAM named 'netbox1'",
+      "path_params": {
+        "ipam": "netbox1"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The ipam identifier must match the pattern [a-zA-Z][a-zA-Z0-9]*[a-zA-Z0-9] (alphanumeric, start and end with a letter or digit, minimum 2 chars).",
+    "Use list_cluster_sdn_ipams first to discover valid IPAM identifiers before calling this endpoint.",
+    "Changes to SDN IPAM objects require a subsequent apply step (POST /cluster/sdn) before they take effect cluster-wide; reading with this endpoint always reflects the stored (pending) config."
+  ],
+  "relatedOperations": [
+    "list_cluster_sdn_ipams",
+    "update_cluster_sdn_ipams_ipam",
+    "delete_cluster_sdn_ipams_ipam",
+    "apply_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_ipams_ipam_status.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_cluster_sdn_ipams_ipam_status",
+  "usageNotes": "Use this to retrieve the current IP address allocations tracked by a specific SDN IPAM plugin (e.g., phpIPAM or netbox). The SDN stack must be configured and the named IPAM object must exist; results are filtered to zones/vnets where the caller holds 'SDN.Audit' or 'SDN.Allocate'. Useful for auditing IP utilization or verifying that leases were correctly recorded after VM/container provisioning.",
+  "examples": [
+    {
+      "summary": "List all IPAM entries for the IPAM object named 'myipam'",
+      "path_params": {
+        "ipam": "myipam"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'ipam' path param must match an existing SDN IPAM object name — check configured IPAM objects first via the SDN IPAM list endpoint.",
+    "Results are silently scoped to zones/vnets the caller can see; an empty array may mean the IPAM has entries but the token lacks SDN.Audit on those paths.",
+    "SDN must be applied (not just configured) for IPAM entries to reflect the live network state."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_ipams",
+    "get_cluster_sdn",
+    "get_cluster_sdn_vnets",
+    "get_cluster_sdn_zones"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_prefix_lists.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_cluster_sdn_prefix_lists",
+  "usageNotes": "Use this endpoint to enumerate all SDN prefix lists defined in the cluster — these are named IP prefix sets used by BGP-based SDN configurations (e.g., EVPN zones). Without the 'verbose' flag only IDs are returned, making it useful for quick existence checks before referencing a prefix list in a zone or route-map. Requires 'SDN.Audit' or 'SDN.Allocate' permission on the relevant SDN objects; users without either permission receive an empty list rather than an error.",
+  "examples": [
+    {
+      "summary": "List all prefix lists with full details, showing any pending (uncommitted) changes",
+      "path_params": {},
+      "params": {
+        "verbose": true,
+        "pending": true,
+        "running": false
+      }
+    }
+  ],
+  "tips": [
+    "Omitting 'verbose' (or setting it to false) returns only IDs — sufficient for checking membership before a create/update call.",
+    "Use 'pending: true' after editing SDN config to see staged changes before running 'apply' (which pushes them to the running config).",
+    "Use 'running: true' to see what is actually active in the data plane, which may differ from stored config if an apply has not yet been performed.",
+    "Prefix lists only appear if SDN is enabled on the cluster and at least one EVPN or BGP-capable zone is configured."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_prefix_lists_prefixlist",
+    "create_cluster_sdn_prefix_lists",
+    "get_cluster_sdn_zones",
+    "apply_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_prefix_lists_id.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_cluster_sdn_prefix_lists_id",
+  "usageNotes": "Retrieves the configuration of a single SDN prefix list by its identifier. Use this to inspect prefix entries, verify membership, or confirm the current state before modifying the list. Requires the SDN.Audit privilege on the specific prefix-list path; the SDN subsystem must be enabled on the cluster.",
+  "examples": [
+    {
+      "summary": "Fetch the configuration for a prefix list named 'rfc1918'",
+      "path_params": {
+        "id": "rfc1918"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "Prefix list IDs follow the pve-sdn-prefix-list-id format — use only alphanumeric characters and hyphens.",
+    "Changes to SDN objects (including prefix lists) are staged until applied via the SDN apply endpoint; the returned config reflects the staged/pending state.",
+    "If the prefix list was recently created or modified and not yet applied, the returned object may differ from what is currently active in the data plane."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_prefix_lists",
+    "create_cluster_sdn_prefix_lists",
+    "update_cluster_sdn_prefix_lists_id",
+    "delete_cluster_sdn_prefix_lists_id",
+    "apply_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_prefix_lists_id_entries.json

@@ -0,0 +1,23 @@
+{
+  "operationId": "get_cluster_sdn_prefix_lists_id_entries",
+  "usageNotes": "Use this to inspect the individual CIDR entries belonging to a specific SDN prefix list, which is useful for auditing route filters or verifying BGP/EVPN policy before pushing changes. Requires the SDN.Audit privilege on the prefix list's SDN path (/sdn/prefix-lists/{id}). The prefix list must already exist; use get_cluster_sdn_prefix_lists to enumerate valid IDs first.",
+  "examples": [
+    {
+      "summary": "List all entries in a prefix list named 'trusted-ranges'",
+      "path_params": {
+        "id": "trusted-ranges"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "After a prefix list is modified, run this endpoint to confirm the expected entries are present before applying or reloading SDN.",
+    "An empty array response is valid and simply means the prefix list exists but has no entries configured yet.",
+    "API tokens are supported (allowtoken: true), making this safe to call from automation scripts with a read-only SDN.Audit token."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_prefix_lists",
+    "get_cluster_sdn_prefix_lists_id",
+    "get_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_prefix_lists_id_entries_url_seq.json

@@ -0,0 +1,24 @@
+{
+  "operationId": "get_cluster_sdn_prefix_lists_id_entries_url_seq",
+  "usageNotes": "Retrieves a single entry from an SDN prefix list by its sequence number. Use this to inspect a specific IP prefix/network rule within a named prefix list before modifying or deleting it. Requires SDN.Audit privilege on the prefix list object; SDN must be configured and the prefix list must exist.",
+  "examples": [
+    {
+      "summary": "Fetch entry at sequence 10 from prefix list 'rfc1918'",
+      "path_params": {
+        "id": "rfc1918",
+        "url_seq": "10"
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The url_seq value corresponds to the sequence number assigned when the prefix list entry was created — list all entries first if the sequence number is unknown.",
+    "SDN prefix lists are cluster-wide; this endpoint reads from the SDN controller configuration, not per-node state.",
+    "API tokens are supported (allowtoken: true), making this safe for read-only automation without interactive credentials."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_prefix_lists_id_entries",
+    "get_cluster_sdn_prefix_lists_id",
+    "get_cluster_sdn_prefix_lists"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_route_maps.json

@@ -0,0 +1,28 @@
+{
+  "operationId": "get_cluster_sdn_route_maps",
+  "usageNotes": "Use this to enumerate all SDN route maps visible to the authenticated user. Results are filtered by permission — only route maps where the caller holds SDN.Audit or SDN.Allocate on the cluster are returned. Pass `running: true` to retrieve the currently active (applied) configuration rather than the pending/configured state.",
+  "examples": [
+    {
+      "summary": "List all pending SDN route maps",
+      "path_params": {},
+      "params": {}
+    },
+    {
+      "summary": "List only the running (applied) SDN route maps",
+      "path_params": {},
+      "params": {
+        "running": true
+      }
+    }
+  ],
+  "tips": [
+    "Without the `running` flag, the response reflects the saved configuration which may differ from what is currently active if `pvesh set /cluster/sdn/reload` has not been run.",
+    "Each returned object contains only the `id` field; use a per-route-map GET to retrieve full configuration details.",
+    "SDN must be enabled in the cluster (Datacenter > SDN) before route maps appear; an empty array is the normal response on clusters that have never configured SDN routing."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_route_maps_id",
+    "create_cluster_sdn_route_maps",
+    "get_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_route_maps_entries.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "get_cluster_sdn_route_maps_entries",
+  "usageNotes": "Use this endpoint to list all SDN route map entries across all route maps, inspecting their match criteria, set actions, and permit/deny policy. Pass `pending=true` to preview staged (unapplied) changes before committing them with the SDN apply operation, or `running=true` to see the currently active dataplane state. Results are filtered to route maps where the caller holds at least SDN.Audit or SDN.Allocate on the relevant object path.",
+  "examples": [
+    {
+      "summary": "List all route map entries including any pending (unapplied) changes",
+      "path_params": {},
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "Each entry belongs to a specific route-map-id; use the returned route-map-id to scope follow-up calls to a single route map.",
+    "The `order` field (0-65535) determines evaluation sequence within a route map -- lower order is evaluated first.",
+    "exit-action controls what happens after a match: 'on-match-next' continues to the next entry, 'on-match-goto' jumps to a specific order index, 'continue' evaluates remaining entries regardless of match.",
+    "Changes made via POST/PUT are staged and require an SDN apply operation (PUT /cluster/sdn) to take effect in the running dataplane; use pending=true to review before applying.",
+    "The digest field returned per entry can be supplied on update/delete calls to guard against concurrent modification races."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_route_maps",
+    "get_cluster_sdn_route_maps_{name}_entries",
+    "put_cluster_sdn"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_route_maps_entries_route_map_id.json

@@ -0,0 +1,29 @@
+{
+  "operationId": "get_cluster_sdn_route_maps_entries_route_map_id",
+  "usageNotes": "Use this to inspect all ordered entries (permit/deny rules) within a specific SDN route map, including their match conditions and set actions. Requires SDN.Audit or SDN.Allocate on the route-map resource. Use the 'pending' flag to preview uncommitted changes before running 'apply' on the SDN config.",
+  "examples": [
+    {
+      "summary": "List all entries for a route map named 'bgp-out-filter', showing pending (unapplied) config",
+      "path_params": {
+        "route-map-id": "bgp-out-filter"
+      },
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "Entries are returned ordered by the 'order' field (0–65535); lower order = evaluated first.",
+    "The 'call' field chains evaluation to another route map by ID, enabling modular policy composition.",
+    "Use 'exit-action' values like 'on-match-next' or 'on-match-goto' to control evaluation flow after a match.",
+    "If both 'pending' and 'running' are omitted, the response reflects the saved (committed) config.",
+    "The digest field in each entry can be passed to update/delete calls to prevent concurrent modification races."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_route_maps",
+    "get_cluster_sdn_route_maps_route_map_id",
+    "get_cluster_sdn_route_maps_entries_route_map_id_order",
+    "post_cluster_sdn_route_maps_entries_route_map_id",
+    "put_cluster_sdn_apply"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_route_maps_entries_route_map_id_entry_order.json

@@ -0,0 +1,27 @@
+{
+  "operationId": "get_cluster_sdn_route_maps_entries_route_map_id_entry_order",
+  "usageNotes": "Retrieves the full configuration of a single route map entry identified by its zero-based order index, including its action (permit/deny), match conditions, set actions, and exit-action flow control. Use this before updating or deleting an entry to capture the current digest for optimistic concurrency protection. Requires SDN.Audit or SDN.Allocate on the route-map path; SDN must be enabled on the cluster.",
+  "examples": [
+    {
+      "summary": "Fetch entry at order 10 from route map 'bgp-out'",
+      "path_params": {
+        "route-map-id": "bgp-out",
+        "order": 10
+      },
+      "params": {}
+    }
+  ],
+  "tips": [
+    "The 'order' value is the sequence index (0–65535), not a line number — gaps between entries are intentional and used for inserting new entries between existing ones.",
+    "Capture the returned 'digest' field and pass it to update/delete calls to prevent overwriting concurrent changes.",
+    "The 'call' field, if present, indicates this entry delegates control to another route map — follow that map's entries to understand the full policy chain.",
+    "exit-action values: 'on-match-goto <order>' jumps to a specific entry, 'on-match-next' continues to the next sequential entry, 'continue' evaluates the next entry regardless of match."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_route_maps_entries_route_map_id",
+    "create_cluster_sdn_route_maps_entries_route_map_id",
+    "update_cluster_sdn_route_maps_entries_route_map_id_entry_order",
+    "delete_cluster_sdn_route_maps_entries_route_map_id_entry_order",
+    "get_cluster_sdn_route_maps"
+  ]
+}

package/dist/catalog-pve/enrichment/get_cluster_sdn_vnets.json

@@ -0,0 +1,26 @@
+{
+  "operationId": "get_cluster_sdn_vnets",
+  "usageNotes": "Use this to enumerate all SDN VNets defined in the cluster's Software-Defined Networking configuration. SDN must be enabled on the cluster and at least one zone must exist before any VNets will appear. Pass `pending=true` to inspect unapplied changes (e.g., after creating a VNet but before running `pvesh create /cluster/sdn` to apply), or `running=true` to see only what is currently active on the data plane.",
+  "examples": [
+    {
+      "summary": "List all VNets with pending changes visible",
+      "path_params": {},
+      "params": {
+        "pending": true
+      }
+    }
+  ],
+  "tips": [
+    "A VNet with `state: new` or `state: changed` has been configured but not yet applied — call the SDN apply endpoint to push it to nodes.",
+    "The `tag` field means a VLAN tag for VLAN/QinQ zones and a VXLAN VNI for VXLAN/EVPN zones — the semantics differ by zone type.",
+    "Results are filtered by the caller's permissions: only VNets under zones where the token has `SDN.Audit` or `SDN.Allocate` on `/sdn/zones/<zone>/<vnet>` are returned.",
+    "Use `digest` from each returned VNet as an optimistic-lock token when submitting updates to prevent overwriting concurrent changes."
+  ],
+  "relatedOperations": [
+    "get_cluster_sdn_zones",
+    "get_cluster_sdn_vnets_vnet",
+    "get_cluster_sdn_controllers",
+    "post_cluster_sdn_vnets",
+    "put_cluster_sdn"
+  ]
+}