AXIAM PHP SDK

NetworkApi extends ManagementSupport
in package

FinalYes

A tenant's network segments and the RADIUS reply profile each owns (RADIUS Live profile): a segment is a node of the reserved /network subtree of the resource tree (kind, VLAN, Filter-Id envelope, placement rank), and its profile is the typed `axiam-radius-reply/1` record a decision renders. Every write is conditional on the `version` the caller read and passes the server's write gate. The tenant's Session-Timeout cap is one more row of it (get_policy, replace_policy): lowering it is always allowed, raising it is allowed and audited. The decision route FreeRADIUS calls is not in this registry.

The network namespace handle (CONTRACT.md §27.2), reached as $client->management()->network(). Every method here goes through the one shared ManagementTransport, so §3 CSRF, the §4 cookie jar, the §5 tenant header, §6 TLS, §16 retry and §19 telemetry apply without this class doing anything to opt in (§27.8).

Table of Contents

Methods

__construct()  : mixed
createProfile()  : NetworkReplyProfile
`POST /api/v1/network/profiles`
createSegment()  : NetworkSegmentResponse
`POST /api/v1/network/segments`
deleteProfile()  : void
`DELETE /api/v1/network/profiles/{segment_id}?version=`
deleteSegment()  : void
`DELETE /api/v1/network/segments/{id}?version=`
forTenant()  : static
A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.
getPolicy()  : NetworkPolicyResponse
`GET /api/v1/network/policy`
getProfile()  : NetworkReplyProfile
`GET /api/v1/network/profiles/{segment_id}`
getSegment()  : NetworkSegmentResponse
`GET /api/v1/network/segments/{id}`
inOrg()  : static
A COPY of this handle scoped to `$orgId` (§27.4 rule 3).
listProfiles()  : Page<string|int, NetworkReplyProfile>
`GET /api/v1/network/profiles`
listSegments()  : Page<string|int, NetworkSegmentResponse>
`GET /api/v1/network/segments`
replacePolicy()  : NetworkPolicyResponse
`PUT /api/v1/network/policy`
replaceProfile()  : NetworkReplyProfile
`PUT /api/v1/network/profiles/{segment_id}`
replaceSegment()  : NetworkSegmentResponse
`PUT /api/v1/network/segments/{id}`

Methods

__construct()

public __construct(ManagementTransport $transport[, NamespaceScope $scope = new NamespaceScope() ][, string|null $clientOrgId = null ][, string|null $clientTenantId = null ]) : mixed
Parameters
$transport : ManagementTransport

The one wire path (§27.8).

$scope : NamespaceScope = new NamespaceScope()

Per-handle {org_id}/{tenant_id} overrides.

$clientOrgId : string|null = null

The client's own organization id, or null.

$clientTenantId : string|null = null

The client's own tenant id, or null.

deleteProfile()

`DELETE /api/v1/network/profiles/{segment_id}?version=`

public deleteProfile(string $segmentId, int $version) : void

DELETE /api/v1/network/profiles/{segment_id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters
$segmentId : string

the {segment_id} path parameter

$version : int

the required version query parameter

deleteSegment()

`DELETE /api/v1/network/segments/{id}?version=`

public deleteSegment(string $id, int $version) : void

DELETE /api/v1/network/segments/{id}.

Returns nothing; the server answers with an empty body.

NOT idempotent (§27.4 rule 6): deleting something already deleted raises NotFoundError rather than succeeding quietly.

Parameters
$id : string

the {id} path parameter

$version : int

the required version query parameter

forTenant()

A COPY of this handle scoped to `$tenantId` (§27.4 rule 3). See {@see self::inOrg()} for why it copies.

public forTenant(string $tenantId) : static
Parameters
$tenantId : string
Return values
static

inOrg()

A COPY of this handle scoped to `$orgId` (§27.4 rule 3).

public inOrg(string $orgId) : static

Returns a new handle rather than mutating this one. An administrator holding a handle to their own organization should not find it repointed at someone else's because an unrelated code path re-scoped a shared object — and on a management surface that failure mode writes to the wrong tenant rather than merely reading from it.

Parameters
$orgId : string
Return values
static

listProfiles()

`GET /api/v1/network/profiles`

public listProfiles([PageRequest|null $page = null ]) : Page<string|int, NetworkReplyProfile>

Returns ONE page. Page::$total is the server's count across all pages and is not count($page) — see §27.4 rule 4.

Parameters
$page : PageRequest|null = null

which page to fetch; defaults to the first

Return values
Page<string|int, NetworkReplyProfile>

listSegments()

`GET /api/v1/network/segments`

public listSegments([PageRequest|null $page = null ][, string|null $site = null ]) : Page<string|int, NetworkSegmentResponse>

Returns ONE page. Page::$total is the server's count across all pages and is not count($page) — see §27.4 rule 4.

Parameters
$page : PageRequest|null = null

which page to fetch; defaults to the first

$site : string|null = null

the optional site query parameter

Return values
Page<string|int, NetworkSegmentResponse>

replacePolicy()

`PUT /api/v1/network/policy`

public replacePolicy(ReplaceNetworkPolicyRequest $body) : NetworkPolicyResponse

A replacement (§27.4 rule 5), conditional on the policy's version -- 0 for a tenant that has never written one, which is the first write. Lowering the cap is always allowed and raising it is allowed and audited; lowering it never rewrites a profile, it only clamps what a profile reads as (§36.3 rules 6 and 7). It needs network:segments_write at the /network root. Never retried (§36.7). The composed form is the manifest (ManifestBuilder::networkPolicy()).

Parameters
$body : ReplaceNetworkPolicyRequest

the request body

Return values
NetworkPolicyResponse

replaceProfile()

`PUT /api/v1/network/profiles/{segment_id}`

public replaceProfile(string $segmentId, ReplaceNetworkReplyProfileRequest $body) : NetworkReplyProfile

A replacement (§27.4 rule 5), conditional on two versions you read: the profile's own version and the owning segment's segment_version; a stale one is 409 and writes nothing (§36.3 rule 2). Read both (getProfile(), getSegment()) and send every member back. A read is the effective profile: a stored session_timeout_secs above the tenant's lowered cap reads as the cap with session_timeout_clamped: true, so a read-modify-write cannot restore the stored value -- what you send is what is stored, the clamped value from then on, and a value above the current cap is 403 (§36.3 rule 6). Raise the cap first (replacePolicy()), leaving the profile alone, to restore it. Never retried, and never repeated for you (§36.9). The composed form is the manifest (ManifestBuilder::networkProfile()).

Parameters
$segmentId : string

the {segment_id} path parameter

$body : ReplaceNetworkReplyProfileRequest

the request body

Return values
NetworkReplyProfile

replaceSegment()

`PUT /api/v1/network/segments/{id}`

public replaceSegment(string $id, ReplaceNetworkSegmentRequest $body) : NetworkSegmentResponse

A replacement (§27.4 rule 5), conditional on the version you read: a stale one is 409 and writes nothing (§36.3 rule 2). Read the segment with getSegment(), change what you mean to, and send every member back -- enabled, filter_ids, vlan_id, rank and the version; what you leave out is not preserved. kind, site_key and name are not in the body and never change (rule 4). A change of vlan_id, rank or enabled on a segment that has a profile also needs network:grant (rule 1), and a filter_ids that would strand the profile's filter_id is 409 strands_profile. Never retried, and never repeated for you: a 409 means another administrator wrote, so read again and decide (§36.9). The composed form is the manifest (ManifestBuilder::networkSegment()), which builds this body from the read.

Parameters
$id : string

the {id} path parameter

$body : ReplaceNetworkSegmentRequest

the request body

Return values
NetworkSegmentResponse
On this page

Search results