An A10 API script does not need to change configuration to be useful. Inventory, checks and reporting are often a good first application.
A script that reliably retrieves information establishes how authentication, responses and errors are handled. Those same foundations will be needed if configuration changes are added later.
The following example retrieves virtual-server configuration using aXAPIv3. The GET collection endpoint is documented in the virtual-server reference. Its endpoints and object fields follow the ACOS 6.0.8 reference; the script is not a device integration test.
Understand the API session
The documented flow is to authenticate at /axapi/v3/auth, use the returned signature in subsequent requests and finish with /axapi/v3/logoff.
The header format is Authorization: A10 <signature>, and aXAPIv3 uses HTTPS. These steps are documented in the ACOS 6.0.8 API introduction.
Treat the signature as sensitive information. It should not appear in ordinary reports or debug output.
Retrieve virtual-server configuration
This example requires Python 3 and the requests package. An explicit Content-Type header also accompanies the logoff request, as required by the documented session flow. The management hostname must match the device certificate. An internal CA bundle can be provided through A10_CA_BUNDLE.
import getpass
import os
import sys
import requests
base_url = "https://a10-mgmt.example.nl"
username = input("A10 username: ")
password = getpass.getpass("A10 password: ")
session = requests.Session()
session.headers.update({
"Accept": "application/json",
"Content-Type": "application/json",
})
session.verify = os.environ.get("A10_CA_BUNDLE", True)
authenticated = False
primary_error = False
try:
login = session.post(
f"{base_url}/axapi/v3/auth",
json={
"credentials": {
"username": username,
"password": password,
}
},
timeout=(5, 20),
)
login.raise_for_status()
signature = login.json()["authresponse"]["signature"]
if not isinstance(signature, str) or not signature:
raise ValueError("Missing authentication signature")
session.headers["Authorization"] = f"A10 {signature}"
authenticated = True
response = session.get(
f"{base_url}/axapi/v3/slb/virtual-server",
timeout=(5, 20),
)
response.raise_for_status()
data = response.json()
servers = data.get("virtual-server-list")
if not isinstance(servers, list):
raise ValueError("Unexpected virtual-server response")
for virtual_server in servers:
name = virtual_server["name"]
address = (
virtual_server.get("ip-address")
or virtual_server.get("ipv6-address")
or "<not shown>"
)
print(f"{name}: {address}")
except Exception:
primary_error = True
raise
finally:
try:
if authenticated:
logout = session.post(
f"{base_url}/axapi/v3/logoff",
timeout=(5, 10),
)
logout.raise_for_status()
except Exception as error:
print(f"Logout failed: {type(error).__name__}", file=sys.stderr)
if not primary_error:
raise
finally:
session.close()The script reads configuration in the account’s current partition context. Select the intended context using the documented procedure for the deployed release when working with multiple partitions. The script does not modify device configuration. Authentication and logout still use POST because those operations belong to session management.
Requests supports sessions, timeouts and TLS verification with a custom CA bundle. Setting verify=False would disable verification and is not an appropriate default. See the Requests advanced usage documentation.
Validate more than the HTTP status
raise_for_status() checks the HTTP response status. The script also checks that the response contains a virtual-server list. A missing list produces an error instead of a misleading empty inventory.
A production implementation should handle missing fields and unexpected responses explicitly. An empty list may genuinely indicate no configured objects, but it should also prompt verification of context and permissions when known objects are expected.
Add an expected minimum inventory where appropriate. If five known services should be present, an empty report must not silently count as a healthy result. The example preserves the original failure when logout also fails, and reports the cleanup failure separately.
Configuration is not service health
A virtual server in a configuration list is not proof that it processes usable traffic.
A10 documents separate configuration, statistics and operational resources for several objects, including service-groups. A broader report should distinguish an object that exists from a service that is administratively allowed, operationally available and actually handling requests.
The required fields depend on the object and ACOS release. Align the implementation with that release's API reference rather than assuming identical responses everywhere.
Prepare for scheduled execution
Periodic operation needs an account with appropriate minimal permissions, managed credentials, clear error handling and consistent output. Pin dependencies and record the device and collection timestamp.
A failed run should produce a non-success exit code. The scheduler or monitoring system must also avoid presenting an old report as current after collection has stopped.
These additions turn a small inventory example into a useful operational component: understandable, repeatable and explicit about what it has actually established.