# Safe Omada MCP

[![CI](https://github.com/gaspareduard/Omada-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/gaspareduard/Omada-mcp/actions/workflows/ci.yml)
[![npm version](https://img.shields.io/npm/v/safe-omada-mcp)](https://www.npmjs.com/package/safe-omada-mcp)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](./LICENSE)
[![Node.js 24+](https://img.shields.io/badge/node-24%2B-green)](https://nodejs.org)

Security-focused MCP server for TP-Link Omada Open API workflows.

## At a Glance

- Production-safe baseline uses `stdio`
- Omada credentials are environment-only
- Capability profiles and category gating control what tools are exposed
- HTTP remains in the codebase only as an explicitly unsafe, lab-only path
- Validated against live Omada Controller 6.x environments and designed around the documented 5.x/6.x Open API surface

## Quick Start

### Option 1: Use with Claude Desktop via Docker

1. Pull or build an image:

   ```bash
   docker pull ghcr.io/gaspareduard/omada-mcp:latest
   ```

   If you do not publish an image yet, build locally instead:

   ```bash
   npm run docker:build
   ```

2. Edit your Claude Desktop MCP config:
   - macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
   - Windows: `%APPDATA%\Claude\claude_desktop_config.json`

3. Add the server entry:

   ```json
   {
     "mcpServers": {
       "safe-omada": {
         "command": "docker",
         "args": [
           "run",
           "-i",
           "--rm",
           "-e", "OMADA_BASE_URL=https://your-omada-controller.local",
           "-e", "OMADA_CLIENT_ID=your-client-id",
           "-e", "OMADA_CLIENT_SECRET=your-client-secret",
           "-e", "OMADA_OMADAC_ID=your-omadac-id",
           "-e", "OMADA_SITE_ID=your-site-id",
           "-e", "OMADA_STRICT_SSL=true",
           "ghcr.io/gaspareduard/omada-mcp:latest"
         ]
       }
     }
   }
   ```

4. Restart Claude Desktop and verify the server by listing sites or devices.

### Option 2: Run the container directly

```bash
docker run --rm -it \
  --env-file .env \
  ghcr.io/gaspareduard/omada-mcp:latest
```

### Option 3: Run locally for development

```bash
npm install
npm run build
npm start
```

## Configuration

The server reads configuration from environment variables. See `.env.example` for the complete reference.

### Required Omada Variables

| Variable | Required | Default | Description |
| --- | --- | --- | --- |
| `OMADA_BASE_URL` | Yes | - | Base URL of the Omada controller |
| `OMADA_CLIENT_ID` | Yes | - | OAuth client ID from Omada Platform Integration |
| `OMADA_CLIENT_SECRET` | Yes | - | OAuth client secret |
| `OMADA_OMADAC_ID` | Yes | - | Omada controller ID (`omadacId`) |
| `OMADA_SITE_ID` | No | - | Optional default site ID |
| `OMADA_STRICT_SSL` | No | `true` | Enforce TLS certificate validation |
| `OMADA_TIMEOUT` | No | `30000` | HTTP timeout in milliseconds |

### Capability and Logging

| Variable | Required | Default | Description |
| --- | --- | --- | --- |
| `OMADA_CAPABILITY_PROFILE` | No | `safe-read` | Built-in profile: `safe-read`, `ops-write`, `admin`, `compatibility` |
| `OMADA_TOOL_CATEGORIES` | No | profile default | Explicit category override |
| `MCP_SERVER_LOG_LEVEL` | No | `info` | `debug`, `info`, `warn`, `error`, `silent` |
| `MCP_SERVER_LOG_FORMAT` | No | `plain` | `plain`, `json`, or `gcp-json` |

### Capability Profiles

| Profile | Intended use |
| --- | --- |
| `safe-read` | Default read-only operational visibility |
| `ops-write` | Limited operational write actions |
| `admin` | Full documented tool surface, including admin mutations |
| `compatibility` | Reserved for future controller-specific fallback modules |

### Destructive Tool Confirmation Gate

The four restore tools (`restoreController`, `restoreControllerFromFileServer`, `restoreSites`, `restoreSitesFromFileServer`) enforce a two-step confirmation: without `confirmDangerous: true` the tool returns a warning explaining the action is irreversible and that a force recovery or factory reset may be required if something goes wrong.

**Scope of this protection:** this gate is effective in conversational AI sessions where the warning is surfaced to a human who then decides whether to confirm. It does not prevent a fully autonomous agent from passing `confirmDangerous: true` programmatically without human review.

**True human-in-the-loop enforcement requires one or both of:**
- **MCP client approval mode** — Claude Desktop and compatible MCP hosts can be configured to require explicit human approval before any tool call executes. This is the only reliable technical gate against autonomous execution.
- **Capability profile restriction** — the restore tools require `maintenance:rw`, which is only granted under `ops-write` or `admin`. Keeping the deployment on the default `safe-read` profile blocks all restore tools entirely.

### Optional HTTP Lab Mode

HTTP is **not** part of the supported production baseline.

It only starts when both of these are set:
- `MCP_SERVER_USE_HTTP=true`
- `MCP_UNSAFE_ENABLE_HTTP=true`

Use it only for local lab/debug scenarios.

| Variable | Required | Default | Description |
| --- | --- | --- | --- |
| `MCP_SERVER_USE_HTTP` | No | `false` | Legacy lab-only switch |
| `MCP_UNSAFE_ENABLE_HTTP` | No | `false` | Explicit acknowledgement required |
| `MCP_HTTP_PORT` | No | `3000` | HTTP port |
| `MCP_HTTP_BIND_ADDR` | No | `127.0.0.1` | Loopback bind address only (`127.0.0.1` or `::1`) |
| `MCP_HTTP_PATH` | No | `/mcp` | MCP endpoint path |
| `MCP_HTTP_ENABLE_HEALTHCHECK` | No | `true` | Enable health check |
| `MCP_HTTP_HEALTHCHECK_PATH` | No | `/healthz` | Health check path |
| `MCP_HTTP_ALLOW_CORS` | No | `true` | Enable CORS |
| `MCP_HTTP_ALLOWED_ORIGINS` | No | `127.0.0.1, localhost` | Allowed origins |
| `MCP_HTTP_NGROK_ENABLED` | No | `false` | Legacy placeholder; disabled in safe baseline |
| `MCP_HTTP_NGROK_AUTH_TOKEN` | No | - | Legacy placeholder |

## Development and Validation

### Common Commands

| Task | Command |
| --- | --- |
| Run dev server | `npm run dev` |
| Build | `npm run build` |
| Lint + type-check | `npm run check` |
| Unit tests | `npm test` |
| Coverage gates | `npm run test:coverage` |
| Symlink integrity | `npm run symlinks:check` |
| README/tool sync | `node scripts/check-readme-sync.mjs` |
| Tool/test mapping | `node scripts/check-tool-tests.mjs` |

### Inspector

Use the MCP Inspector when you want to test the built server interactively:

```bash
npm run inspector
npm run inspector:build
```

## Project Notes

- The safe baseline is `stdio` first.
- HTTP remains a legacy, explicitly unsafe lab path.
- The repo includes `docs/openapi/` as the implementation reference for Omada endpoints.
- README tool tables below are kept in sync with the registered MCP tools.

## Tools

### Site & Client

| Tool                        | Description                                                                  |
| --------------------------- | ---------------------------------------------------------------------------- |
| `listSites` | Lists all sites configured on the controller. |
| `getSiteCapacity` | Get site capacity settings including maximum device and client counts. |
| `getSiteDetail` | Get detailed information about a site, including name, region, timezone, and configuration. |
| `getSiteDeviceAccount` | Get device account settings for a site. |
| `getSiteNtpStatus` | Get NTP server status and configuration for a site. |
| `getSiteRememberSetting` | Get the remember device setting for a site. |
| `getSiteSpecification` | Get site specification including device limits and feature capabilities. |
| `getSiteUrl` | Get the URL associated with a site for OpenAPI access. |
| `getSiteTemplateConfig` | Get configuration settings for a site template. Requires `siteTemplateId`. |
| `getSiteTemplateDetail` | Get detailed information about a site template. Requires `siteTemplateId`. |
| `getSiteTemplateList` | List all site templates configured on the controller. |
| `listClients` | Lists active client devices for a site. |
| `getClient` | [DEPRECATED] Use `listClients` instead. When you have a client MAC, `getClientDetail` is also available. This tool filters the site client list in-process. |
| `listMostActiveClients` | Gets the most active clients sorted by traffic usage. |
| `listClientsActivity` | Gets client activity statistics over time. |
| `listClientsPastConnections`| Gets past connection history for clients.                                    |
| `setClientRateLimit` | Sets custom bandwidth limits (download/upload) for a specific client. |
| `setClientRateLimitProfile` | Applies a predefined rate limit profile to a specific client.                |
| `disableClientRateLimit` | Disables bandwidth rate limiting for a specific client. |
| `blockClient` | Blocks a client from network access with an auditable mutation summary. |
| `unblockClient` | Restores a blocked client to network access with an auditable mutation summary. |
| `reconnectClient` | Forces a client to reconnect with an auditable mutation summary. |
| `rebootDevice` | Reboots a managed device with an auditable mutation summary. |
| `setDeviceLed` | Changes a device LED state with an auditable mutation summary. |
### Device

| Tool                    | Description                                                                       |
| ----------------------- | --------------------------------------------------------------------------------- |
| `listDevices` | Lists provisioned devices for a given site. |
| `getDevice` | [DEPRECATED] Use `listDevices` instead and filter results client-side. This tool filters the site device list in-process; there is no dedicated device-detail endpoint. |
| `searchDevices` | Searches for devices globally across all sites the user has access to. |
| `listDevicesStats` | Queries statistics for global adopted devices with pagination and filtering. |
| `getSwitchStackDetail` | Retrieves detailed configuration and status for a switch stack. |
| `getSwitchDetail` | Fetches detailed configuration and status for a specific switch. |
| `getGatewayDetail` | Fetches detailed configuration and status for a specific gateway. |
| `getGatewayWanStatus` | Gets WAN port status for a specific gateway. |
| `getGatewayLanStatus` | Gets LAN port status for a specific gateway. |
| `getGatewayPorts` | Gets port information for a specific gateway. |
| `getApDetail` | Fetches detailed configuration and status for a specific access point. |
| `getApRadios` | Gets radio information for a specific access point. |
| `getStackPorts` | Gets port information for a switch stack. |
| `listPendingDevices` | Lists devices pending adoption in a site. |
| `getAllDeviceBySite` | Gets all devices in a site including offline and disconnected devices. |
| `getFirmwareInfo` | Gets the latest available firmware info for a device. Use `listDevices` for MACs. |
| `getGridAutoCheckUpgrade` | Gets the auto-check firmware upgrade plan list (paginated).                     |
| `listSwitchNetworks` | Lists VLAN network assignments for a switch (paginated). Requires `switchMac`. |
| `getSwitchGeneralConfig` | Gets general configuration for a switch. Requires `switchMac`.                  |
| `getCableTestLogs` | Gets cable test history for a switch. Requires `switchMac`. |
| `getCableTestFullResults` | Gets full per-port cable diagnostics for a switch. Requires `switchMac`.        |
| `getOswStackLagList` | Gets Link Aggregation Group (LAG) list for a switch stack. Requires `stackId`. |
| `getStackNetworkList` | Gets VLAN network list for a switch stack (paginated). Requires `stackId`. |
| `getApUplinkConfig` | Gets uplink configuration for an AP (wired/mesh mode). Requires `apMac`. |
| `getRadiosConfig` | Gets per-radio configuration for an AP (channel, power, width). Requires `apMac`. |
| `getApVlanConfig` | Get VLAN configuration for an access point, including management VLAN and per-SSID VLAN tagging settings. |
| `getMeshStatistics` | Gets mesh link statistics for an AP. Requires `apMac`. |
| `getRFScanResult` | Gets last RF scan results for an AP. Requires `apMac`. |
| `getSpeedTestResults` | Gets last speed test results for an AP. Requires `apMac`. |
| `getApSnmpConfig` | Gets SNMP configuration for an AP. Requires `apMac`. |
| `getApLldpConfig` | Gets LLDP configuration for an AP. Requires `apMac`. |
| `getApGeneralConfig` | Gets general configuration for an AP (name, LED, country). Requires `apMac`. |
| `getUplinkWiredDetail` | Get wired uplink detail for an access point: uplink switch, port number, link speed, and PoE status. |
| `getDownlinkWiredDevices` | Gets wired downlink devices on an AP's LAN ports. Requires `apMac`.            |
| `getFirmwareUpgradePlan` | Get the firmware upgrade plan list for devices managed by the controller. |
| `getUpgradeLogs` | Get firmware upgrade logs showing the history of upgrade operations performed on devices. |
| `getDeviceTagList` | Get the list of device tags defined in a site. |
| `getApQosConfig` | Get QoS configuration for a specific access point. Requires `apMac`. |
| `getApIpv6Config` | Get IPv6 configuration for a specific access point. Requires `apMac`. |
| `getSitesApsIpSetting` | Get IP settings for an AP. Requires `apMac`. |
| `getSitesApsChannelLimit` | Get channel limit configuration for an AP. Requires `apMac`. |
| `getSitesApsAvailableChannel` | Get list of available channels for an AP. Requires `apMac`. |
| `getSitesApsLoadBalance` | Get load balance configuration for an AP. Requires `apMac`. |
| `getSitesApsOfdma` | Get OFDMA configuration for an AP. Requires `apMac`. |
| `getSitesApsPowerSaving` | Get power saving configuration for an AP. Requires `apMac`. |
| `setApPowerSaving` | Updates AP power saving configuration with support checks and dry-run preview. Requires `apMac`. |
| `setApChannelLimit` | Updates AP channel-limit configuration with support checks and dry-run preview. Requires `apMac`. |
| `setApConfig` | Updates documented AP configuration families with dry-run preview. Covers AP general, IP, IPv6, QoS, radio, service, load-balance, OFDMA, trunk, bridge, WLAN group, port, channel, AFC, and antenna settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires `apMac`. |
| `getSitesApsTrunkSetting` | Get trunk port setting for an AP. Requires `apMac`. |
| `getSitesApsBridge` | Get bridge configuration for an AP. Requires `apMac`. |
| `listSitesApsPorts` | List ports for an AP. Requires `apMac`. |
| `getSitesSwitchesEs` | Get ES switch details. Requires `switchMac`. |
| `getSitesSwitchesEsGeneralConfig` | Get ES switch general configuration. Requires `switchMac`. |
| `listSitesCableTestSwitchesPorts` | List cable test port info for a switch. Requires `switchMac`. |
| `listSitesCableTestSwitchesIncrementResults` | Get incremental cable test results for a switch. Requires `switchMac`. |
| `getUpgradeOverviewCritical` | Get the number of critical models available for upgrade. |
| `getUpgradeOverviewTryBeta` | Get the current status of the try-beta firmware upgrade switch. |
| `listUpgradeFirmwares` | List available firmware packages for upgrade (paginated). |
| `listUpgradeOverviewFirmwares` | List firmware overview for upgradeable devices (paginated). |
| `listSitesStacks` | List switch stacks in a site (paginated). |
| `getSitesDeviceWhiteList` | Get the device adoption whitelist for a site (paginated). |
| `getSitesGatewaysGeneralConfig` | Get general configuration for a gateway. Requires `gatewayMac`. |
| `getSitesGatewaysPin` | Get PIN information for a gateway. Requires `gatewayMac`. |
| `getSitesGatewaysSimCardUsed` | Get SIM card usage info for a gateway. Requires `gatewayMac`. |
| `getSitesHealthGatewaysWansDetails` | Get gateway WAN health details. Requires `gatewayMac`. |
| `setGatewayConfig` | Updates documented gateway configuration families with dry-run preview. Covers general, services, advanced, radios, WLAN, and port settings. Setter-only families return planned payloads and an explicit warning when controller readback is unavailable. Requires `gatewayMac`. |

### Network

| Tool                          | Description                                                                 |
| ----------------------------- | --------------------------------------------------------------------------- |
| `getInternetInfo` | Gets internet configuration information for a site. |
| `getInternet` | [DEPRECATED] Use `getInternetInfo` instead. Gets full WAN/Internet configuration for the site gateway. |
| `getInternetBasicPortInfo` | Gets WAN port summary/basic info for the site gateway. |
| `getInternetLoadBalance` | Gets WAN load balancing configuration (failover/load balance). |
| `getWanPortsConfig` | Gets per-port WAN configuration including connection type and IP settings. |
| `getWanLanStatus` | Gets WAN-LAN connectivity status for a site. |
| `getGridVirtualWan` | Gets virtual WAN list (paginated). |
| `getIspBandScan` | Gets ISP band scan results for a WAN port. Requires `portUuid`. |
| `getDisableNatList` | Gets the list of wired networks with NAT disabled (paginated). |
| `getLtePortConfig` | Gets LTE/cellular WAN port configuration. |
| `getWanPortDetail` | [DEPRECATED] Use `getWanPortsConfig` instead. Gets detailed WAN port configuration for all gateway WAN ports. |
| `getWanIspProfile` | Gets ISP scan profile result for a WAN port. Requires `portUuid`. |
| `getWanQosConfig` | Gets QoS configuration for gateway WAN ports. |
| `getWanHealthDetail` | [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires `gatewayMac`. |
| `getWanUsageStats` | [DEPRECATED] Use `getDashboardTrafficActivities` instead. Gets WAN traffic usage statistics for the site. |
| `getWanNatConfig` | Gets one-to-one NAT rules (paginated). |
| `getPortForwardingStatus` | Gets port forwarding status and rules. Required: `type` (`user` or `upnp`). Optional pagination: `page` (default 1), `pageSize` (default 10). |
| `getLanNetworkList` | [DEPRECATED] Use `getLanNetworkListV2` instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated. |
| `getLanNetworkListV2` | Get the LAN network list using the v2 API, with richer VLAN and DHCP data (paginated). |
| `getInterfaceLanNetwork` | Gets interface-level LAN network bindings. Optional type filter (0=WAN, 1=LAN). |
| `getInterfaceLanNetworkV2` | Get interface-level LAN network bindings (v2 API). Returns richer per-interface VLAN and network data. |
| `getLanProfileList` | Gets the list of LAN profiles configured in a site. |
| `getApLoadBalance` | [DEPRECATED] Use `getSitesApsLoadBalance` instead. Same endpoint, retained for backward compatibility. getSitesApsLoadBalance is the canonical tool name. |
| `getApOfdmaConfig` | [DEPRECATED] Use `getSitesApsOfdma` instead. Same endpoint, retained for backward compatibility. getSitesApsOfdma is the canonical tool name. |
| `getMulticastRateLimit` | Get multicast rate limit settings for a site. |
| `getWlanGroupList` | Gets the list of WLAN groups configured in a site. |
| `getSsidList` | Gets the list of SSIDs in a WLAN group. |
| `getSsidDetail` | Gets detailed information for a specific SSID. Required: `wlanId` and `ssidId`. |
| `listAllSsids` | Lists wireless SSIDs across all WLAN groups. |
| `getFirewallSetting` | Gets the site-global firewall settings returned by the official Omada firewall endpoint. |
| `setFirewallSetting` | Updates site firewall settings with dry-run preview using the official Omada Open API firewall endpoint. |
| `setAclConfigTypeSetting` | Updates the gateway ACL mode (`through profiles` or `custom`) with dry-run preview. |
| `getVpnSettings` | Gets VPN settings for a site. |
| `listSiteToSiteVpns` | Lists site-to-site VPN configurations. |
| `listPortForwardingRules` | [DEPRECATED] Use `getPortForwardingList` instead. Lists NAT port forwarding rules. |
| `listOsgAcls` | Lists gateway (OSG) ACL rules. |
| `createGatewayAcl` | Creates a gateway ACL rule with dry-run preview using the official Omada Gateway ACL schema. |
| `updateGatewayAcl` | Updates a gateway ACL rule with dry-run preview after confirming the ACL exists. |
| `listEapAcls` | Lists access point (EAP) ACL rules. |
| `createEapAcl` | Creates an EAP ACL rule with dry-run preview using the official Omada EAP ACL schema. |
| `updateEapAcl` | Updates an EAP ACL rule with dry-run preview after confirming the ACL exists. |
| `deleteAcl` | Deletes an ACL rule with dry-run preview after confirming the ACL exists. |
| `listStaticRoutes` | [DEPRECATED] Use `getGridStaticRouting` instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page. |
| `getStaticRoutingInterfaceList` | Gets available interfaces for static routing.                             |
| `listPolicyRoutes` | [DEPRECATED] Use `getGridPolicyRouting` instead. This tool aggregates all pages; getGridPolicyRouting is paginated. |
| `getGridPolicyRouting` | Gets policy routing rules (paginated). |
| `getOspfProcess` | Gets OSPF process configuration for the site gateway. |
| `getOspfInterface` | Gets OSPF interface configuration for the site gateway. |
| `getVrrpConfig` | Gets VRRP configuration for OSW devices. |
| `getOspfNeighbors` | Gets OSPF neighbor devices for the site gateway. |
| `getGridOtoNats` | Gets 1:1 NAT rules (paginated). |
| `getAlg` | Gets ALG (Application Layer Gateway) configuration. |
| `getUpnpSetting` | Gets UPnP setting for the site gateway. |
| `getDdnsGrid` | Gets DDNS entries (paginated). |
| `getDhcpReservationGrid` | Gets DHCP reservations (paginated). |
| `createDhcpReservation` | Creates a DHCP reservation after validating the target LAN and optional IP address. |
| `updateDhcpReservation` | Updates a DHCP reservation after validating the target LAN and optional IP address. |
| `deleteDhcpReservation` | Deletes a DHCP reservation by MAC address with a dry-run preview option. |
| `getGridIpMacBinding` | Gets IP-MAC binding entries (paginated). |
| `getIpMacBindingGeneralSetting` | Gets IP-MAC binding global toggle setting.                               |
| `getBandwidthControl` | Gets global bandwidth control configuration. |
| `getGridBandwidthCtrlRule` | Gets bandwidth control rules (paginated). |
| `setBandwidthControlRule` | Creates or updates a bandwidth control rule with dry-run preview after validating the target rule id plus referenced LAN and WAN identifiers. |
| `deleteBandwidthControlRule` | Deletes a bandwidth control rule with dry-run preview after confirming the rule exists. |
| `getSessionLimit` | Gets session limit global setting. |
| `getGridSessionLimitRule` | Gets per-rule session limit rules (paginated). |
| `getSnmpSetting` | Gets SNMP configuration (version, community string). |
| `getLldpSetting` | Gets LLDP global setting. |
| `getRemoteLoggingSetting` | Gets remote logging (syslog) configuration. |
| `getDnsCacheDataList` | Gets the DNS cache data list (paginated). |
| `getIptvSetting` | Gets IPTV service configuration for the site. |
| `getNtpSetting` | Gets NTP server configuration and synchronisation status. |
| `getSyslogConfig` | Deprecated; alias of `getRemoteLoggingSetting` for controller syslog configuration. |
| `getAccessControl` | Gets controller access control configuration. |
| `setAccessControl` | Updates portal access control settings with dry-run preview and schema validation for pre-auth and free-auth policy entries. |
| `setAppControlRule` | Creates or updates an application control rule with dry-run preview after validating the create/update payload shape, existing rule id, and referenced application ids. |
| `deleteAppControlRule` | Deletes an application control rule with dry-run preview after confirming the rule exists. |
| `getDnsCacheSetting` | Gets DNS cache setting. |
| `getDnsProxy` | Gets DNS proxy configuration. |
| `getIgmp` | Gets IGMP snooping and proxy setting. |
| `getSwitchVlanInterface` | Gets VLAN interface configuration for a specific switch. Requires `switchMac`. |
| `getLanDnsRules` | Gets LAN DNS rules for the site (paginated). |
| `getLanProfileEsUsage` | Gets EAP/switch device usage for a LAN profile. Requires `profileId`. |
| `getLanClientCount` | Gets client distribution breakdown across LAN segments. |
| `listRadiusProfiles` | Lists RADIUS authentication profiles. |
| `listGroupProfiles` | Lists group profiles (IP, MAC, or port groups). |
| `getApplicationControlStatus` | Gets application control status for a site.                                 |
| `getSshSetting` | Gets SSH settings for a site. |
| `listTimeRangeProfiles` | Lists time range profiles. |
| `getRateLimitProfiles` | Gets the list of available rate limit profiles for bandwidth control. |
### Firewall & ACL

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getDot1xConfig` | Get 802.1X switch port authentication setting. Alias for `getSwitchDot1xSetting`. |
| `getRadiusProxyConfig` | Get global RADIUS proxy configuration (controller-level, no siteId). |
| `getApplicationAcl` | [DEPRECATED] Get application control rules. Alias for `getAppControlRules`. |
### Firewall Traffic & QoS

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getGatewayQosClassRules` | Get gateway QoS class rules (paginated). |
| `getBandwidthCtrlDetail` | Get bandwidth control details for a site. |
| `getAppControlRules` | Get application control rules (paginated). |
| `getAppControlCategories` | Get application control category list. |
| `getUrlFilterRules` | Get URL filter gateway rules. Alias for `getGridGatewayRule`. |
| `getUrlFilterBlacklist` | Get URL filter MAC deny list. Alias for `getGridDenyMacFiltering`. |
| `getUrlFilterWhitelist` | Get URL filter MAC allow list. Alias for `getGridAllowMacFiltering`. |
| `getMacFilterDetail` | Get MAC filter general setting. Alias for `getMacFilteringGeneralSetting`. |
| `getQosPolicy` | Get QoS policy configuration for a site. |
| `getTrafficPriority` | Get traffic priority rules for a site. |
| `getTrafficStats` | [DEPRECATED] Use `getDashboardTrafficActivities` instead. Get WAN usage statistics. Alias for `getWanUsageStats`. |
| `getQosPolicyRule` | [DEPRECATED] Alias for `getQosPolicy`. |
| `getQosMarkingRule` | [DEPRECATED] Alias for `getQosPolicy`. |
| `getDscpConfig` | [DEPRECATED] Alias for `getQosPolicy`. |
### Firewall IDS / IPS

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getGlobalSecuritySetting` | [DEPRECATED] Use `getThreatList` instead. Get global security/threat management list. Alias for `getThreatList`. |
### Security & Threat Management

| Tool              | Description                                               |
| ----------------- | --------------------------------------------------------- |
| `getThreatList` | Gets global threat management list. Required: `archived` (bool). Optional: `startTime`/`endTime` (seconds since epoch), `severity` (0=Critical, 1=Major, 2=Moderate/Concerning, 3=Minor, 4=Low), `page`, `pageSize`. |
| `getTopThreats` | Gets top threats from the global threat management view. |
### Composite Troubleshooting Tools

Single-call tools that internally aggregate multiple Omada API calls in parallel. Use these instead of chaining individual tools when you need a quick overview or are starting a troubleshooting session.

| Tool | Description |
| ---- | ----------- |
| `getNetworkHealthSummary` | Composite: combines dashboard overview (device/client counts), internet/WAN status, client distribution, and recent active threats into a single response. First call for any troubleshooting session. |
| `getGatewayHealth` | Composite: auto-discovers the gateway then fetches its detail (CPU, memory, firmware), WAN port statuses, LAN interface statuses, and port list in one call. Use for internet/WAN diagnostics. |
| `diagnoseClient` | Composite: given a client MAC, IP, or hostname — fetches current connection status, detailed client info (VLAN, signal, policy), and recent connection history in one call. |
| `getSecurityOverview` | Composite: combines active threat list (up to 20, newest first) and firewall settings into one response. Use for security posture checks or investigating alerts. |

### Dashboard / Monitor

| Tool                         | Description                                                     |
| ---------------------------- | --------------------------------------------------------------- |
| `getDashboardWifiSummary` | Gets WiFi summary from the site dashboard. |
| `getDashboardSwitchSummary` | Gets switch summary from the site dashboard. |
| `getDashboardTrafficActivities` | Gets traffic activity data from the site dashboard.          |
| `getDashboardPoEUsage` | Gets PoE usage data from the site dashboard. |
| `getDashboardTopCpuUsage` | Gets top CPU usage data from the site dashboard. |
| `getDashboardTopMemoryUsage` | Gets top memory usage data from the site dashboard.             |
| `getDashboardMostActiveSwitches` | Gets most active switches from the site dashboard.          |
| `getDashboardMostActiveEaps` | Gets most active access points from the site dashboard.         |
| `getDashboardOverview` | Get the site overview: device counts, client counts, connectivity graph, and overall health status. |
| `getTrafficDistribution` | Gets traffic distribution by protocol/app type over a time range. Requires `start` and `end` timestamps (seconds). |
| `getRetryAndDroppedRate` | Gets wireless retry rate and dropped packet rate over a time range. Requires `start` and `end` timestamps (seconds). |
| `getIspLoad` | Gets per-WAN ISP link load over a time range. Requires `start` and `end` timestamps (seconds). |
| `getChannels` | Gets channel distribution and utilization across all APs. |
| `getInterference` | Gets top RF interference sources detected by APs. |
| `getGridDashboardTunnelStats` | Gets VPN tunnel statistics. Required: `type` (0 = Server, 1 = Client). |
| `getGridDashboardIpsecTunnelStats` | Gets IPsec tunnel statistics.                            |
| `getGridDashboardOpenVpnTunnelStats` | Gets OpenVPN tunnel statistics by type. Requires `type` parameter. |

### Insight

| Tool                      | Description                                                        |
| ------------------------- | ------------------------------------------------------------------ |
| `listSiteThreatManagement`| Lists site-level threat management events.                         |
| `getWids` | Gets WIDS (Wireless Intrusion Detection) information for a site. |
| `getRogueAps` | Gets rogue access points detected in a site. |
| `getVpnTunnelStats` | Gets VPN tunnel statistics for a site. |
### VPN

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getIpsecTunnelList` | List all site-to-site VPN (IPsec) tunnels. Alias for `listSiteToSiteVpns`. |
| `getIpsecTunnelDetail` | Get detailed config for a specific IPsec tunnel by ID. Alias for `getSiteToSiteVpnInfo`. |
| `getAdvancedVpnSetting` | Get advanced VPN configuration settings for a site. Alias for `getVpnSettings`. |
| `getVpnUserList` | Get VPN users for a site (paginated). |
| `getVpnUserDetail` | Get users for a specific client-to-site VPN server. |
| `getVpnClientStatus` | Get status of client-to-site VPN clients. Alias for `listClientToSiteVpnClients`. |
| `getVpnRouteConfig` | [DEPRECATED] Use `getGridPolicyRouting` instead. This tool aggregates all pages; getGridPolicyRouting is paginated. |
### Profiles

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getGoogleLdapProfile` | Get Google LDAP profile configuration for a site. |
| `getBuiltinRadiusUsers` | Get built-in RADIUS server user list (paginated). |
| `getRadiusUserDetail` | [DEPRECATED] Alias for `getBuiltinRadiusUsers`. |
| `getPpskNetworkProfile` | List PPSK network profiles for a site by type. |
| `getPpskUserGroup` | Get PPSK user group details for a specific profile. |
| `getPpskUserList` | [DEPRECATED] Alias for `getPpskUserGroup`. |
| `getServiceProfile` | Get service type profiles (paginated). Alias for `listServiceType`. |
| `getQosProfile` | Get rate limit profiles. Alias for `getRateLimitProfiles`. |
| `getScheduleProfile` | Get time range profiles. Alias for `listTimeRangeProfiles`. |
| `getGroupPolicyDetail` | Get group policy profiles filtered by group type. |
| `getIpGroupProfile` | [DEPRECATED] Get IP group profiles. Alias for `getGroupPolicyDetail` with groupType="0". |
| `getUrlGroupProfile` | [DEPRECATED] Get URL/port group profiles. Alias for `getGroupPolicyDetail` with groupType="1". |
| `getAppGroupProfile` | [DEPRECATED] Get MAC group profiles. Alias for `getGroupPolicyDetail` with groupType="2". |
| `getVlanProfile` | Get LAN/VLAN profiles. Alias for `getLanProfileList`. |
| `getUserRoleProfile` | Get user role profiles from the controller (global, no siteId). |
| `getPortalProfile` | Get captive portal profiles for a site. |
### Logs

| Tool                  | Description                                                  |
| --------------------- | ------------------------------------------------------------ |
| `listSiteEvents` | Lists site event logs. |
| `listSiteAlerts` | Lists site alert logs. |
| `listSiteAuditLogs` | Lists site audit logs. |
| `listGlobalEvents` | Lists global event logs across all sites. |
| `listGlobalAlerts` | Lists global alert logs across all sites. |
### Controller

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getCertificate` | Get SSL/TLS certificate configuration for the controller. |
| `getClientHistoryDataEnable` | Get the client history data collection enable setting. |
| `getControllerPort` | Get the controller port configuration for device adoption. |
| `getDataRetention` | Get data retention settings for the controller. |
| `getExperienceImprovement` | Get the experience improvement program setting (telemetry). |
| `getGlobalDashboardOverview` | Get global controller dashboard overview without client data. |
| `getPortalPort` | Get portal port configuration for the controller web interface. |
### Maintenance

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getBackupFileList` | List available controller backup files. |
| `getBackupResult` | Get the result of the most recent controller backup operation. |
| `getRestoreResult` | Get the result of the most recent controller restore operation. |
| `getSiteBackupFileList` | List available backup files for a site. |
| `getSiteBackupResult` | Get the backup result for a site. |
| `getRogueApExport` | Export Rogue AP scan results for a site in CSV or Excel format. |
| `backupController` | Trigger a controller configuration backup to the self/cloud server. |
| `backupControllerToFileServer` | Trigger a controller configuration backup to an external file server (FTP/SFTP). |
| `restoreController` | Restore controller configuration from a backup file on the self/cloud server. |
| `restoreControllerFromFileServer` | Restore controller configuration from a backup file on an external file server. |
| `backupSites` | Trigger a multi-site configuration backup to the self/cloud server (up to 300 sites). |
| `backupSitesToFileServer` | Trigger a multi-site configuration backup to an external file server (up to 300 sites). |
| `restoreSites` | Restore multiple site configurations from backup files on the self/cloud server. |
| `restoreSitesFromFileServer` | Restore multiple site configurations from backup files on an external file server. |
### Account Users

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getAllCloudUsers` | List all cloud users on the controller, excluding the root account. |
| `getAllLocalUsers` | List all local users on the controller, excluding the root account. |
| `getAllRoles` | [DEPRECATED] Use `getUserRoleProfile` instead. List all user roles configured on the controller. |
| `getAllUsersApp` | List all users (cloud and local) in grid view. |
| `getAvailableRoles` | List roles available for user assignment. |
| `getRoleDetail` | Get detailed information about a specific role. Requires `roleId`. |
### Account Cloud

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getCloudAccessStatus` | Get cloud access status for the controller. |
| `getCloudUserInfo` | Get cloud user account information. |
| `getMfaStatus` | Get global MFA (multi-factor authentication) status. |
| `getRemoteBindingStatus` | Get remote binding status between controller and cloud. |
### Schedules

| Tool                          | Description                                                                              |
| ----------------------------- | ---------------------------------------------------------------------------------------- |
| `getPoeScheduleList` | List PoE schedules for a site. |
| `getPortScheduleList` | List port schedules for a site. |
| `getPortSchedulePorts` | List ports with port schedule assignments for a site. |
| `getRebootScheduleList` | List device reboot schedules for a site template. Requires `siteTemplateId`. |
| `getUpgradeScheduleList` | List firmware upgrade schedules for a site. |
## Supported Omada API Operations

| Operation ID                        | Description                                               | Tool                          |
| ----------------------------------- | --------------------------------------------------------- | ----------------------------- |
| `getSiteList` | List controller sites.                                    | `listSites` |
| `getDeviceList` | List devices assigned to a site.                          | `listDevices`, ~~`getDevice`~~ [DEPRECATED] |
| `searchGlobalDevice` | Search for devices across all accessible sites.           | `searchDevices` |
| `getGridAdoptedDevicesStatByGlobal` | Query statistics for global adopted devices.              | `listDevicesStats`            |
| `getOswStackDetail` | Retrieve details for a switch stack.                      | `getSwitchStackDetail` |
| `getSwitch` | Get detailed info for a specific switch.                  | `getSwitchDetail` |
| `getGateway` | Get detailed info for a specific gateway.                 | `getGatewayDetail` |
| `getGatewayWanPortStatus` | Get WAN port status for a specific gateway.               | `getGatewayWanStatus` |
| `getGatewayLanPortStatus` | Get LAN port status for a specific gateway.               | `getGatewayLanStatus` |
| `getGatewayPorts` | Get port info for a specific gateway.                     | `getGatewayPorts` |
| `getAp` | Get detailed info for a specific access point.            | `getApDetail` |
| `getApRadios` | Get radio info for a specific access point.               | `getApRadios` |
| `getStackPorts` | Get port info for a switch stack.                         | `getStackPorts` |
| `getGridPendingDevices` | List devices pending adoption in a site.                  | `listPendingDevices` |
| `getGridActiveClients` | List active clients connected to a site.                  | `listClients`, ~~`getClient`~~ [DEPRECATED] |
| `getMostActiveClients` | Get most active clients sorted by traffic.                | `listMostActiveClients` |
| `getClientActivity` | Get client activity statistics over time.                 | `listClientsActivity` |
| `getGridPastConnections` | Get client past connection history.                       | `listClientsPastConnections` |
| `updateClientRateLimitSetting` | Set rate limit setting for a client.                      | `setClientRateLimit`, `setClientRateLimitProfile`, `disableClientRateLimit` |
| `getRateLimitProfileList` | Get rate limit profile list.                              | `getRateLimitProfiles` |
| `getGlobalThreatList` | Get global view threat management list.                   | `getThreatList` |
| `getTopThreatList` | Get top threats from global threat management.            | `getTopThreats` |
| `getInternet` | [DEPRECATED] Use `getInternetInfo` instead. Get internet configuration info for a site.               | `getInternetInfo` |
| `getPortForwardStatus` | Get port forwarding status by type.                       | `getPortForwardingStatus` |
| `getLanProfileList` | Get LAN profile list.                                     | `getLanProfileList` |
| `getWlanGroupList` | Get WLAN group list.                                      | `getWlanGroupList` |
| `getSsidList` | Get SSID list for a WLAN group.                           | `getSsidList` |
| `getSsidDetail` | Get detailed SSID configuration.                          | `getSsidDetail` |
| `getSsidListAll` | List SSIDs across all WLAN groups.                        | `listAllSsids` |
| `getFirewallSetting` | Get the site-global firewall settings returned by the official Omada firewall endpoint. | `getFirewallSetting` |
| `modifyFirewallSetting` | Update site firewall settings with dry-run support. | `setFirewallSetting` |
| `getVpn` | Get VPN settings for a site.                              | `getVpnSettings` |
| `getSiteToSiteVpnList` | List site-to-site VPN configurations.                     | `listSiteToSiteVpns` |
| `getPortForwardingList` | List NAT port forwarding rules.                           | `getPortForwardingList` (prefer); ~~`listPortForwardingRules`~~ [DEPRECATED] |
| `getOsgAclList` | List gateway ACL rules.                                   | `listOsgAcls` |
| `getAclConfigTypeSetting` | Get gateway ACL config mode for the site gateway. | `getAclConfigTypeSetting` |
| `modifyAclConfigTypeSetting` | Update gateway ACL config mode with dry-run support. | `setAclConfigTypeSetting` |
| `createOsgAcl` | Create a gateway ACL with dry-run support. | `createGatewayAcl` |
| `modifyOsgAcl` | Update a gateway ACL with dry-run support. | `updateGatewayAcl` |
| `getEapAclList` | List access point ACL rules.                              | `listEapAcls` |
| `createEapAcl` | Create an EAP ACL with dry-run support. | `createEapAcl` |
| `modifyEapAcl` | Update an EAP ACL with dry-run support. | `updateEapAcl` |
| `deleteAcl` | Delete an ACL rule with dry-run support. | `deleteAcl` |
| `getStaticRoutingList` | List static routing rules.                                | `getGridStaticRouting` (prefer); ~~`listStaticRoutes`~~ [DEPRECATED] |
| `getRadiusProfileList` | List RADIUS authentication profiles.                      | `listRadiusProfiles` |
| `getGroupProfileList` | List group profiles (IP, MAC, port groups).               | `listGroupProfiles` |
| `getApplicationControlStatus` | Get application control status for a site.                | `getApplicationControlStatus` |
| `addRule` | Create an application control rule with dry-run support. | `setAppControlRule` |
| `editRule` | Update an application control rule with dry-run support. | `setAppControlRule` |
| `deleteRules` | Delete an application control rule with dry-run support. | `deleteAppControlRule` |
| `getSshSetting` | Get SSH settings for a site.                              | `getSshSetting` |
| `getTimeRangeProfileList` | List time range profiles.                                 | `listTimeRangeProfiles` |
| `getWanLanStatus` | Get WAN-LAN connectivity status for a site.               | `getWanLanStatus` |
| `getSiteThreatManagementList` | List site-level threat management events.                 | `listSiteThreatManagement` |
| `getWids` | Get WIDS information for a site.                          | `getWids` |
| `getRogueAps` | Get rogue access points detected in a site.               | `getRogueAps` |
| `getVpnTunnelStats` | Get VPN tunnel statistics for a site.                     | `getVpnTunnelStats` |
| `getSiteEvents` | List site event logs.                                     | `listSiteEvents` |
| `getSiteAlerts` | List site alert logs.                                     | `listSiteAlerts` |
| `getSiteAuditLogs` | List site audit logs.                                     | `listSiteAuditLogs` |
| `getEvents` | List global event logs across all sites.                  | `listGlobalEvents` |
| `getAlerts` | List global alert logs across all sites.                  | `listGlobalAlerts` |
| `disableClientRateLimit` | Disable rate limiting for a specific client, removing any bandwidth.... | `disableClientRateLimit` |
| `getAccessControl` | Get controller access control configuration. | `getAccessControl` |
| `modifyAccessControl` | Update portal access control configuration with dry-run support. | `setAccessControl` |
| `getAlg` | Get ALG (Application Layer Gateway) configuration for the site gateway. | `getAlg` |
| `getAllDeviceBySite` | Get all devices in a site including offline and disconnected devices. | `getAllDeviceBySite` |
| `getApDetail` | Fetch full configuration and status for a specific access point: mo.... | `getApDetail` |
| `getApGeneralConfig` | Get general configuration for an access point. | `getApGeneralConfig` |
| `getApLldpConfig` | Get LLDP (Link Layer Discovery Protocol) configuration for an acces.... | `getApLldpConfig` |
| `getApRadios` | Get radio status for a specific access point: 2.4GHz and 5GHz band .... | `getApRadios` |
| `getApSnmpConfig` | Get SNMP configuration for an access point. | `getApSnmpConfig` |
| `getApUplinkConfig` | Get the uplink configuration for an access point. | `getApUplinkConfig` |
| `getBandwidthControl` | Get the global bandwidth control configuration for the site. | `getBandwidthControl` |
| `getCableTestLogs` | Get cable test logs for a switch. | `getCableTestLogs` |
| `getChannels` | Get channel distribution and utilization across all APs. | `getChannels` |
| `getClient` | [DEPRECATED] Use `listClients` instead. When you have a client MAC, `getClientDetail` is also available. This tool filters the site client list in-process. | `getClient` |
| `getDashboardPoEUsage` | Get PoE (Power over Ethernet) usage statistics for a site, showing .... | `getDashboardPoEUsage` |
| `getDashboardSwitchSummary` | Get switch summary for a site dashboard: total switch count, total .... | `getDashboardSwitchSummary` |
| `getDashboardTopCpuUsage` | Get the top devices by CPU usage for a site, useful for identifying.... | `getDashboardTopCpuUsage` |
| `getDashboardWifiSummary` | Get WiFi summary for a site dashboard: total APs, connected AP coun.... | `getDashboardWifiSummary` |
| `getDdnsGrid` | Get DDNS (Dynamic DNS) entries for the site gateway. | `getDdnsGrid` |
| `getDevice` | [DEPRECATED] Use `listDevices` instead. This alias filters the device list in-process to return a single device; there is no separate device-detail API. | `getDevice` |
| `getDhcpReservationGrid` | Get DHCP reservations for the site. | `getDhcpReservationGrid` |
| `createDhcpReservation` | Create a DHCP reservation for the site after LAN/IP validation and duplicate-IP preflight. | `createDhcpReservation` |
| `updateSitesSettingServiceDhcp` | Update an existing DHCP reservation for the site. | `updateDhcpReservation` |
| `deleteSitesSettingServiceDhcp` | Delete an existing DHCP reservation for the site. | `deleteDhcpReservation` |
| `getDnsCacheSetting` | Get DNS cache setting for the site gateway. | `getDnsCacheSetting` |
| `getDnsProxy` | Get DNS proxy configuration for the site gateway. | `getDnsProxy` |
| `getFirewallSetting` | Get the site-global firewall settings returned by the official Omada firewall endpoint. | `getFirewallSetting` |
| `modifyFirewallSetting` | Update site firewall settings with dry-run support. | `setFirewallSetting` |
| `getFirmwareInfo` | Get the latest available firmware information for a device. | `getFirmwareInfo` |
| `getGatewayDetail` | Fetch full configuration and status for a specific gateway: model, .... | `getGatewayDetail` |
| `getGatewayLanStatus` | Get LAN port status for a specific gateway: port link state, speed,.... | `getGatewayLanStatus` |
| `getGatewayPorts` | Get all WAN and LAN port details for a specific gateway: link statu.... | `getGatewayPorts` |
| `getGatewayWanStatus` | Get the WAN port status and connectivity information for a specific.... | `getGatewayWanStatus` |
| `getGridBandwidthCtrlRule` | Get bandwidth control rules for the site gateway. | `getGridBandwidthCtrlRule` |
| `createBandwidthCtrlRule` | Create a bandwidth control rule with dry-run support. | `setBandwidthControlRule` |
| `modifyBandwidthCtrlRule` | Update a bandwidth control rule with dry-run support. | `setBandwidthControlRule` |
| `deleteBandwidthCtrlRule` | Delete a bandwidth control rule with dry-run support. | `deleteBandwidthControlRule` |
| `getGridIpMacBinding` | Get IP-MAC binding entries for the site. | `getGridIpMacBinding` |
| `getGridOtoNats` | Get 1:1 NAT rules for the site gateway. | `getGridOtoNats` |
| `getGridPolicyRouting` | Get policy routing rules for the site gateway. | `getGridPolicyRouting` |
| `getGridSessionLimitRule` | Get per-rule session limit rules for the site gateway. | `getGridSessionLimitRule` |
| `getGridVirtualWan` | Get virtual WAN list for the site gateway. | `getGridVirtualWan` |
| `getIgmp` | Get IGMP (Internet Group Management Protocol) setting for the site. | `getIgmp` |
| `getInterfaceLanNetwork` | Get interface-level LAN network bindings. | `getInterfaceLanNetwork` |
| `getInterference` | Get top RF interference sources detected by APs. | `getInterference` |
| `getInternet` | [DEPRECATED] Use `getInternetInfo` instead. Get full WAN/Internet configuration for the site gateway. | `getInternet` |
| `getInternetBasicPortInfo` | Get WAN port summary / basic info for the site gateway. | `getInternetBasicPortInfo` |
| `getInternetInfo` | Get internet configuration information for a site, including WAN se.... | `getInternetInfo` |
| `getInternetLoadBalance` | Get WAN load balancing configuration for the site gateway. | `getInternetLoadBalance` |
| `getIspBandScan` | Get ISP band scan results for a WAN port. Requires `portUuid`. | `getIspBandScan` |
| `getIspLoad` | Get per-WAN ISP link load over a time range. | `getIspLoad` |
| `getLanClientCount` | Get client distribution breakdown across LAN segments (wired, wireless, guest). | `getLanClientCount` |
| `getLanDnsRules` | Get LAN DNS rules configured for the site (paginated). | `getLanDnsRules` |
| `getLanNetworkList` | [DEPRECATED] Use `getLanNetworkListV2` instead. This tool aggregates all pages; getLanNetworkListV2 is explicitly paginated. | `getLanNetworkList` |
| `getLanProfileEsUsage` | Get EAP/switch device usage for a specific LAN profile. Requires `profileId`. | `getLanProfileEsUsage` |
| `getLanProfileList` | Get the list of LAN profiles configured in a site. | `getLanProfileList` |
| `getLtePortConfig` | Get LTE/cellular WAN port configuration for the site gateway. | `getLtePortConfig` |
| `getLldpSetting` | Get LLDP (Link Layer Discovery Protocol) global setting for the site. | `getLldpSetting` |
| `getMeshStatistics` | Get mesh link statistics for an access point. | `getMeshStatistics` |
| `getOswStackLagList` | Get Link Aggregation Group (LAG) list for a switch stack. | `getOswStackLagList` |
| `getPortForwardingList` | Get a paginated page of NAT port forwarding rules for the site gateway. | `getPortForwardingListPage` |
| `getPortForwardingStatus` | Get port forwarding status and rules for a site. | `getPortForwardingStatus` |
| `getRFScanResult` | [DEPRECATED] Get the last RF scan results for an access point. | `getRFScanResult` |
| `getRadiosConfig` | Get per-radio configuration for an access point. | `getRadiosConfig` |
| `getRateLimitProfiles` | Get the list of available rate limit profiles for a site. | `getRateLimitProfiles` |
| `getRemoteLoggingSetting` | Get remote logging (syslog) configuration for the site. | `getRemoteLoggingSetting` |
| `getDnsCacheDataList` | Get the DNS cache data list for the site (paginated). | `getDnsCacheDataList` |
| `getDisableNatList` | Get the list of wired networks with NAT disabled (paginated). | `getDisableNatList` |
| `getIptvSetting` | Get IPTV service configuration for the site. | `getIptvSetting` |
| `getNtpSetting` | Get NTP server configuration and synchronisation status for the site. | `getNtpSetting` |
| `getOspfInterface` | Get OSPF interface configuration for the site gateway. | `getOspfInterface` |
| `getOspfNeighbors` | Get OSPF neighbor devices for the site gateway. | `getOspfNeighbors` |
| `getOspfProcess` | Get OSPF process configuration for the site gateway. | `getOspfProcess` |
| `getSwitchVlanInterface` | Get VLAN interface configuration for a specific switch. Requires `switchMac`. | `getSwitchVlanInterface` |
| `getSyslogConfig` | [DEPRECATED] Alias of `getRemoteLogging` for controller syslog configuration. | `getSyslogConfig` |
| `getVrrpConfig` | Get VRRP configuration for OSW devices on the site. | `getVrrpConfig` |
| `getWanHealthDetail` | [DEPRECATED] Alias for the WAN health tool; kept for backward compatibility. Requires `gatewayMac`. | `getWanHealthDetail` |
| `getWanIspProfile` | Get ISP scan profile result for a WAN port. Requires `portUuid`. | `getWanIspProfile` |
| `getWanNatConfig` | Get one-to-one NAT configuration (WAN NAT rules) for the site gateway (paginated). | `getWanNatConfig` |
| `getWanPortDetail` | [DEPRECATED] Use `getWanPortsConfig` instead. Get detailed WAN port configuration for all gateway WAN ports on the site. | `getWanPortDetail` |
| `getWanQosConfig` | Get QoS configuration for gateway WAN ports on the site. | `getWanQosConfig` |
| `getWanUsageStats` | [DEPRECATED] Use `getDashboardTrafficActivities` instead. Get WAN traffic usage statistics and activity data for the site. | `getWanUsageStats` |
| `getRetryAndDroppedRate` | Get wireless retry rate and dropped packet rate over a time range. | `getRetryAndDroppedRate` |
| `getRogueAps` | Get the list of rogue (unauthorized) access points detected by WIDS.... | `getRogueAps` |
| `getSessionLimit` | Get the session limit global setting for the site gateway. | `getSessionLimit` |
| `getSnmpSetting` | Get SNMP configuration for the site. | `getSnmpSetting` |
| `getSpeedTestResults` | Get the last speed test results for an access point. | `getSpeedTestResults` |
| `getSitesApsChannelLimit` | Get AP channel-limit configuration. | `getSitesApsChannelLimit` |
| `updateSitesApsChannelLimit` | Update AP channel-limit configuration with dry-run support. | `setApChannelLimit` |
| `modifyGeneralConfig_2` | Update AP general configuration with dry-run support. | `setApConfig` |
| `modifyIpSettingConfig` | Update AP IP settings with dry-run support. | `setApConfig` |
| `modifyIpv6SettingConfig` | Update AP IPv6 settings with dry-run support. | `setApConfig` |
| `modifyApQosConfig` | Update AP QoS settings with dry-run support. | `setApConfig` |
| `modifyRadiosConfig` | Update AP radio settings with dry-run support. | `setApConfig` |
| `modifyApServicesConfig` | Update AP service settings with dry-run support. | `setApConfig` |
| `modifyApLoadBalanceConfig` | Update AP load-balance settings with dry-run support. | `setApConfig` |
| `modifyApOfdmaConfig` | Update AP OFDMA settings with dry-run support. | `setApConfig` |
| `getSitesApsPowerSaving` | Get AP power saving configuration. | `getSitesApsPowerSaving` |
| `updateSitesApsPowerSaving` | Update AP power saving configuration with dry-run support. | `setApPowerSaving` |
| `modifyApTrunkSettingConfig` | Update AP trunk settings with dry-run support. | `setApConfig` |
| `modifyApBridgeInfo` | Update AP bridge settings with dry-run support. | `setApConfig` |
| `modifyApPort` | Update AP port settings with dry-run support. | `setApConfig` |
| `modifyApChannelConfig` | Update AP channel configuration with dry-run support. | `setApConfig` |
| `modifyAfcConfig` | Update AP AFC configuration with dry-run support. | `setApConfig` |
| `modifyAntennaGainConfig` | Update AP antenna gain settings with dry-run support. | `setApConfig` |
| `updateWlanGroupConfig` | Update AP WLAN group assignment with dry-run support. | `setApConfig` |
| `modifyGeneralConfig_1` | Update gateway general configuration with dry-run support. | `setGatewayConfig` |
| `modifyConfigGeneral` | Update gateway config/general settings with dry-run support. | `setGatewayConfig` |
| `modifyConfigServices` | Update gateway services configuration with dry-run support. | `setGatewayConfig` |
| `modifyConfigAdvanced` | Update gateway advanced settings with dry-run support. | `setGatewayConfig` |
| `modifyConfigRadios` | Update gateway radio configuration with dry-run support. | `setGatewayConfig` |
| `modifyConfigWlans` | Update gateway WLAN configuration with dry-run support. | `setGatewayConfig` |
| `modifyPortConfig` | Update a gateway port configuration with dry-run support. | `setGatewayConfig` |
| `batchModifyPortConfig` | Update multiple gateway ports with dry-run support. | `setGatewayConfig` |
| `getSshSetting` | Get SSH access settings for a site. | `getSshSetting` |
| `getSsidDetail` | Get detailed information for a specific SSID (wireless network), in.... | `getSsidDetail` |
| `getSsidList` | Get the list of SSIDs (wireless networks) configured in a WLAN group. | `getSsidList` |
| `getStackNetworkList` | Get the VLAN network list for a switch stack. | `getStackNetworkList` |
| `getStackPorts` | Get all port information for a switch stack. | `getStackPorts` |
| `getSwitchDetail` | Fetch full configuration and status for a specific switch: model, f.... | `getSwitchDetail` |
| `getSwitchStackDetail` | Fetch detailed information for a specific switch stack. | `getSwitchStackDetail` |
| `getThreatList` | Get the global view threat management list. | `getThreatList` |
| `getTopThreats` | Get the top threats from the global threat management view across a.... | `getTopThreats` |
| `getTrafficDistribution` | Get traffic distribution by protocol and application type over a ti.... | `getTrafficDistribution` |
| `getUpnpSetting` | Get UPnP (Universal Plug and Play) setting for the site. | `getUpnpSetting` |
| `getVpnSettings` | Get VPN configuration settings for a site. | `getVpnSettings` |
| `getVpnTunnelStats` | Get VPN tunnel statistics for a site (paginated), including active .... | `getVpnTunnelStats` |
| `getWanLanStatus` | Get the WAN and LAN connectivity status for a site. | `getWanLanStatus` |
| `getWanPortsConfig` | Get WAN port settings for the site gateway. | `getWanPortsConfig` |
| `getWids` | Get Wireless Intrusion Detection System (WIDS) information for a si.... | `getWids` |
| `getWlanGroupList` | Get the list of WLAN groups configured in a site. | `getWlanGroupList` |
| `listAllSsids` | List all wireless SSIDs across all WLAN groups in a site: SSID name.... | `listAllSsids` |
| `listClients` | List all network clients (wired and wireless) connected to a site. | `listClients` |
| `listClientsActivity` | Get client activity statistics over time from the dashboard. | `listClientsActivity` |
| `listClientsPastConnections` | Get client past connection list with historical connection data. | `listClientsPastConnections` |
| `listDevices` | List all provisioned (adopted) network devices in a site: gateways,.... | `listDevices` |
| `listEapAcls` | List EAP (access point) ACL rules for a site: wireless client acces.... | `listEapAcls` |
| `listGlobalAlerts` | List alert logs across all sites on the controller: threshold breac.... | `listGlobalAlerts` |
| `listGlobalEvents` | List system event logs across all sites on the controller. | `listGlobalEvents` |
| `listGroupProfiles` | List group profiles (IP groups, MAC groups, port groups) configured.... | `listGroupProfiles` |
| `listMostActiveClients` | Get the most active clients in a site, sorted by total traffic. | `listMostActiveClients` |
| `listOsgAcls` | List gateway (OSG) ACL rules for a site: firewall rules controlling.... | `listOsgAcls` |
| `listPendingDevices` | List devices discovered on the network but not yet adopted into thi.... | `listPendingDevices` |
| `listPolicyRoutes` | [DEPRECATED] Use `getGridPolicyRouting` instead. This tool aggregates all pages; getGridPolicyRouting is paginated. | `listPolicyRoutes` |
| `listPortForwardingRules` | [DEPRECATED] Use `getPortForwardingList` instead. List all NAT port forwarding rules for a site: external port, inter.... | `listPortForwardingRules` |
| `listRadiusProfiles` | List RADIUS authentication profiles configured for a site: server I.... | `listRadiusProfiles` |
| `listSiteAlerts` | List alert logs for a site: threshold breaches, device failures, se.... | `listSiteAlerts` |
| `listSiteAuditLogs` | List admin audit logs for a site: who made what configuration chang.... | `listSiteAuditLogs` |
| `listSiteEvents` | List system event logs for a site: device online/offline, client co.... | `listSiteEvents` |
| `listSiteThreatManagement` | List site-level threat management events detected by IPS, with opti.... | `listSiteThreatManagement` |
| `listSiteToSiteVpns` | List site-to-site VPN configurations: tunnel name, remote IP, statu.... | `listSiteToSiteVpns` |
| `listSites` | List all sites configured on the Omada controller. | `listSites` |
| `listStaticRoutes` | [DEPRECATED] Use `getGridStaticRouting` instead. This tool aggregates all pages; getGridStaticRouting returns a single paginated page. | `listStaticRoutes` |
| `listSwitchNetworks` | List VLAN network assignments for a switch. | `listSwitchNetworks` |
| `listTimeRangeProfiles` | List time range profiles configured for a site. | `listTimeRangeProfiles` |
| `searchDevices` | Search for devices globally across all sites the user has access to. | `searchDevices` |
| `setClientRateLimit` | Set custom rate limit (bandwidth control) for a specific client. | `setClientRateLimit` |
| `getAclConfigTypeSetting` | Get the ACL configuration type setting for the site gateway (L2 or .... | `getAclConfigTypeSetting` |
| `getAttackDefenseSetting` | Get the DDoS and attack defense configuration, including flood prot.... | `getAttackDefenseSetting` |
| `getAuditLogSettingForGlobal` | Get global audit log notification settings for the controller. | `getAuditLogSettingForGlobal` |
| `getAuditLogSettingForSite` | Get site-level audit log notification settings, including audit eve.... | `getAuditLogSettingForSite` |
| `getAuditLogsForGlobal` | Get global audit logs (paginated). | `getAuditLogsForGlobal` |
| `getBandSteeringSetting` | Get the band steering configuration. | `getBandSteeringSetting` |
| `getBandwidthCtrl` | [DEPRECATED] Use `getBandwidthControl` instead. Get the global bandwidth control configuration for the site. | `getBandwidthControl` |
| `getBeaconControlSetting` | Get the beacon control setting, which manages 802.11 beacon transmi.... | `getBeaconControlSetting` |
| `getChannelLimitSetting` | [DEPRECATED] Get the channel limit setting that restricts which cha.... | `getChannelLimitSetting` |
| `getClientActiveTimeout` | Get the client inactivity timeout setting. | `getClientActiveTimeout` |
| `getClientDetail` | Get full detail for a specific client by MAC address, including con.... | `getClientDetail` |
| `getClientToSiteVpnServerInfo` | Get detailed configuration for a specific client-to-site VPN server.... | `getClientToSiteVpnServerInfo` |
| `getClientsDistribution` | Get client count distribution by connection type and band (wired, 2.... | `getClientsDistribution` |
| `getControllerStatus` | Get the Omada controller health and status, including running state.... | `getControllerStatus` |
| `getDeviceAccessManagement` | Get the device access management settings, controlling which device.... | `getDeviceAccessManagement` |
| `getEapDot1xSetting` | Get the 802.1X EAP setting for access points, controlling port-base.... | `—` |
| `getGeneralSettings` | Get the global general settings for the Omada controller, including.... | `getGeneralSettings` |
| `getGridAllowList` | Get the IPS allow list (paginated). | `getGridAllowList` |
| `getGridAllowMacFiltering` | Get the MAC address allow-list entries (paginated). | `getGridAllowMacFiltering` |
| `getGridBlockList` | Get the IPS block list (paginated). | `getGridBlockList` |
| `getGridClientHistory` | Get per-client connection history (paginated). | `getGridClientHistory` |
| `getGridDenyMacFiltering` | Get the MAC address deny-list entries (paginated). | `getGridDenyMacFiltering` |
| `getGridEapRule` | Get the URL filter AP rules (paginated). | `getGridEapRule` |
| `getGridGatewayRule` | Get the URL filter gateway rules (paginated). | `getGridGatewayRule` |
| `getGridIpsecFailover` | Get IPsec failover configuration (paginated). | `getGridIpsecFailover` |
| `getGridKnownClients` | Get historical known clients list (paginated). | `getGridKnownClients` |
| `getGridSignature` | Get the IPS signature list (paginated). | `getGridSignature` |
| `getGridStaticRouting` | Get static routing rules for the site gateway with explicit pagination. | `getGridStaticRouting` |
| `getGroupProfilesByType` | Get group profiles filtered by type (e.g. | `getGroupProfilesByType` |
| `getIpsConfig` | Get the IPS (Intrusion Prevention System) global configuration, inc.... | `getIpsConfig` |
| `getIpsecVpnStats` | Get IPsec VPN tunnel statistics for a site (paginated), including a.... | `getIpsecVpnStats` |
| `getLdapProfileList` | List all LDAP authentication profiles configured on the site. | `getLdapProfileList` |
| `getLogSettingForGlobal` | Get global log notification settings (v1), including global alert r.... | `getLogSettingForGlobal` |
| `getLogSettingForGlobalV2` | Get global log notification settings (v2), with extended notificati.... | `—` |
| `getLogSettingForSite` | Get site-level log notification settings (v1), including alert reci.... | `getLogSettingForSite` |
| `getLogSettingForSiteV2` | Get site-level log notification settings (v2), with extended notifi.... | `—` |
| `getLogging` | Get the controller logging configuration, including log levels and .... | `getLogging` |
| `getMacAuthSetting` | Get the MAC authentication global setting. | `getMacAuthSetting` |
| `getMacAuthSsids` | Get per-SSID MAC authentication settings showing which SSIDs have M.... | `getMacAuthSsids` |
| `getMacFilteringGeneralSetting` | Get the MAC filtering global setting. | `getMacFilteringGeneralSetting` |
| `getMailServerStatus` | Get the mail server connection status for the controller. | `getMailServerStatus` |
| `getMeshSetting` | Get the mesh networking configuration including mesh topology mode .... | `getMeshSetting` |
| `getOsgCustomAclList` | Get the custom gateway ACL rules list (paginated). | `getOsgCustomAclList` |
| `getOswAclList` | Get the switch ACL list (paginated). | `getOswAclList` |
| `getOuiProfileList` | Get the OUI-based device profile list (paginated). | `getOuiProfileList` |
| `getPPSKProfiles` | List Private PSK (PPSK) profiles for the site by type. | `getPPSKProfiles` |
| `getPastClientNum` | Get historical client count trend over a time range. | `getPastClientNum` |
| `getRadioFrequencyPlanningConfig` | Get the RF planning configuration for the site, including frequency.... | `getRadioFrequencyPlanningConfig` |
| `getRadioFrequencyPlanningResult` | Get the RF planning result for the site. | `getRadioFrequencyPlanningResult` |
| `getRadiusServer` | Get the global RADIUS server configuration for the controller. | `getRadiusServer` |
| `getRadiusUserList` | List local RADIUS server users (paginated). | `getRadiusUserList` |
| `getRemoteLogging` | Get the global syslog/remote logging configuration, including syslo.... | `getRemoteLogging` |
| `getRetention` | Get the data retention configuration for the controller, including .... | `getRetention` |
| `getRoamingSetting` | Get the client roaming configuration, including 802.11r/k/v setting.... | `getRoamingSetting` |
| `getRoutingTable` | Get the live routing table for a site filtered by type. | `getRoutingTable` |
| `getServiceTypeSummary` | Get a summary of service type profiles for the site, including pred.... | `getServiceTypeSummary` |
| `getSiteToSiteVpnInfo` | Get detailed information about a specific site-to-site VPN by ID, i.... | `getSiteToSiteVpnInfo` |
| `getSsidsBySite` | Get a flat SSID list filtered by device type. | `getSsidsBySite` |
| `getSslVpnServerSetting` | Get the SSL VPN server configuration, including port, protocol, and.... | `getSslVpnServerSetting` |
| `getSwitchDot1xSetting` | Get the 802.1X switch port authentication setting. | `—` |
| `getThreatCount` | Get the global threat count grouped by severity level (critical, hi.... | `getThreatSeverity` |
| `getThreatDetail` | Get detailed information about a specific IPS threat event by its ID. | `getThreatDetail` |
| `getUiInterface` | Get the UI interface settings for the controller, including timeout.... | `getUiInterface` |
| `getUrlFilterGeneral` | Get the URL filter global setting, including whether URL filtering .... | `getUrlFilterGeneral` |
| `getWebhookForGlobal` | Get the global webhook notification settings, including webhook URL.... | `getWebhookForGlobal` |
| `getWebhookLogsForGlobal` | Get webhook dispatch logs (paginated). | `getWebhookLogsForGlobal` |
| `getWidsBlacklist` | Get the WIPS (Wireless Intrusion Prevention System) rogue AP blackl.... | `getWidsBlacklist` |
| `getWireguardSummary` | Get a summary of WireGuard VPN configurations for the site, includi.... | `getWireguardSummary` |
| `listClientToSiteVpnClients` | List all client-to-site VPN client configurations on the site. | `listClientToSiteVpnClients` |
| `listClientToSiteVpnServers` | List all client-to-site VPN server configurations on the site, incl.... | `listClientToSiteVpnServers` |
| `listDevicesStats` | Query statistics for global adopted devices with pagination and fil.... | `listDevicesStats` |
| `listMdnsProfile` | List all Bonjour/mDNS service profiles configured on the site for c.... | `listMdnsProfile` |
| `listServiceType` | List service type profiles (paginated). | `listServiceType` |
| `listWireguard` | List WireGuard VPN tunnels (paginated). | `listWireguard` |
| `listWireguardPeers` | List WireGuard peers (paginated). | `listWireguardPeers` |
| `getDashboardMostActiveEaps` | Get the most active access points from the site dashboard by traffic. | `getDashboardMostActiveEaps` |
| `getDashboardTopMemoryUsage` | Get top memory usage data for devices from the site dashboard. | `getDashboardTopMemoryUsage` |
| `getDashboardTrafficActivities` | Get traffic activity data and throughput summary from the site dashboard. | `getDashboardTrafficActivities` |
| `getGridDashboardTunnelStats` | Get VPN tunnel statistics for the grid dashboard view. | `getGridDashboardTunnelStats` |
| `setClientRateLimitProfile` | Apply a predefined rate limit profile to a specific client. | `setClientRateLimitProfile` |
| `getGatewayQosClassRules` | Get gateway QoS class rules (paginated). | `getGatewayQosClassRules` |
| `getBandwidthCtrlDetail` | Get bandwidth control details for a site. | `getBandwidthCtrlDetail` |
| `getAppControlRules` | Get application control rules (paginated). | `getAppControlRules` |
| `getAppControlCategories` | Get application control category list. | `getAppControlCategories` |
| `getQosPolicy` | Get QoS policy configuration for a site. | `getQosPolicy` |
| `getTrafficPriority` | Get traffic priority rules for a site. | `getTrafficPriority` |
| `getVpnUserList` | Get VPN users for a site (paginated). | `getVpnUserList` |
| `getVpnUserDetail` | Get users for a specific client-to-site VPN server by ID. | `getVpnUserDetail` |
| `getGoogleLdapProfile` | Get Google LDAP profile configuration for a site. | `getGoogleLdapProfile` |
| `getPpskUserGroup` | Get PPSK user group details for a specific profile ID. | `getPpskUserGroup` |
| `getPortalProfile` | Get captive portal profiles for a site. | `getPortalProfile` |
| `getUserRoleProfile` | Get user role profiles from the controller (global). | `getUserRoleProfile` |
| `getRadiusProxyConfig` | Get global RADIUS proxy configuration (controller-level). | `getRadiusProxyConfig` |
| `getSiteEntity` | Get site detail. | `getSiteDetail` |
| `getSiteUrlByOpenApi` | Get site URL. | `getSiteUrl` |
| `getNtpServerStatus` | Get NTP server status for a site. | `getSiteNtpStatus` |
| `getSiteSpecification` | Get site specification. | `getSiteSpecification` |
| `getSiteRememberSettingByOpenApi` | Get site remember device setting. | `getSiteRememberSetting` |
| `getSiteDeviceAccountSetting` | Get site device account setting. | `getSiteDeviceAccount` |
| `getSiteSettingCap` | Get site capacity setting. | `getSiteCapacity` |
| `getSiteTemplateList` | List site templates. | `getSiteTemplateList` |
| `getSiteTemplateEntity` | Get site template detail. | `getSiteTemplateDetail` |
| `getSiteTemplateConfiguration` | Get site template configuration. | `getSiteTemplateConfig` |
| `getDataRetention` | Get data retention settings. | `getDataRetention` |
| `getControllerPort` | Get controller port setting. | `getControllerPort` |
| `getPortalPort` | Get portal port setting. | `getPortalPort` |
| `getCertificate` | Get certificate configuration. | `getCertificate` |
| `getExpImprove` | Get experience improvement setting. | `getExperienceImprovement` |
| `getGernalSettings_1` | Get global dashboard overview without client data. | `getGlobalDashboardOverview` |
| `getClientHistoryDataEnable` | Get client history data enable setting. | `getClientHistoryDataEnable` |
| `getSelfServerFileList` | List controller backup files. | `getBackupFileList` |
| `getBackupResult` | Get controller backup result. | `getBackupResult` |
| `getRestoreResult` | Get controller restore result. | `getRestoreResult` |
| `getSiteBackupResult` | Get site backup result. | `getSiteBackupResult` |
| `getSelfServerSiteFileList` | List site backup files. | `getSiteBackupFileList` |
| `getAllCloudUsersExcludeRoot` | List all cloud users excluding root. | `getAllCloudUsers` |
| `getAllLocalUsersExcludeRoot` | List all local users excluding root. | `getAllLocalUsers` |
| `getAllRoles` | [DEPRECATED] Use `getUserRoleProfile` instead. List all roles. | `getAllRoles` |
| `getRole` | Get role detail. | `getRoleDetail` |
| `getAvailableRole` | List available roles. | `getAvailableRoles` |
| `getAppGridUsers` | List all users in app grid view. | `getAllUsersApp` |
| `getCloudAccessStatus` | Get cloud access status. | `getCloudAccessStatus` |
| `getCloudUserInfo` | Get cloud user info. | `getCloudUserInfo` |
| `getGlobalMFAStatus` | Get global MFA status. | `getMfaStatus` |
| `getRemoteBindingStatus` | Get remote binding status. | `getRemoteBindingStatus` |
| `getUpgradeScheduleList` | List upgrade schedules for a site. | `getUpgradeScheduleList` |
| `getRebootScheduleList_1` | List reboot schedules for a site template. | `getRebootScheduleList` |
| `getPoeScheduleList` | List PoE schedules for a site. | `getPoeScheduleList` |
| `getPortScheduleList` | List port schedules for a site. | `getPortScheduleList` |
| `getPortSchedulePorts` | List ports with port schedules. | `getPortSchedulePorts` |
| `getMulticastRateLimitByOpenApi` | Get multicast rate limit setting. | `getMulticastRateLimit` |
| `getApLoadBalanceConfig` | Get AP load balance configuration. | `getApLoadBalance` |
| `getApOfdmaConfig` | [DEPRECATED] Use `getSitesApsOfdma` instead. Same endpoint, retained for backward compatibility. getSitesApsOfdma is the canonical tool name. | `getApOfdmaConfig` |

## Devcontainer support

The repository includes a ready-to-use [devcontainer](https://containers.dev/) configuration with a dedicated Omada controller sidecar for local development and testing. See [`.devcontainer/README.md`](.devcontainer/README.md) for details.

## License

This project is licensed under the [MIT License](LICENSE).