IAPViewer API Reference

This page lists every Aruba Virtual Controller call IAPViewer makes. It exists for transparency — so administrators can review exactly what the app does on their network before connecting.

Transport

All calls go to the Virtual Controller's REST API on TCP port 4343 over HTTPS, on the local network only. The VC presents a self-signed HPE certificate — IAPViewer handles that automatically without modifying the device's trust store. Calls are issued serially (the VC rejects concurrent requests).

Authentication endpoints

POST /rest/login

Exchanges username + password for a session ID. Credentials come from the system Keychain; the session ID is held in memory only and discarded on disconnect or app close.

POST /rest/logout

Tears down the session on the controller. Always called on user-initiated disconnect.

GET /rest/show-cmd

The single channel through which IAPViewer issues every read query below. Each entry in the sections that follow is a value passed to this endpoint's cmd= query parameter; per-AP queries add the target AP's IP.

Cluster identity & configuration

show version

Firmware version, AOS train, model of the Virtual Controller. Drives the Firmware Compatibility tool and the connection-screen version pill. With Verbose Logging on, also queried per AP to record firmware, uptime, and last reboot cause in the event log.

show summary

Cluster name, country code, total AP count, total client count. Populates the site pill before the full AP list arrives.

show running-config

Full raw configuration. Displayed in the Config tool (which also snapshots versions of it locally, secrets masked); parsed by VSG Check to flag deviations from Aruba Validated Solution Guide best practices.

show interface

Interface state — feeds the wired-port information shown in the tree and detail cards.

show network

Configured SSIDs, security, VLAN bindings — used by Channel Detail and the Config view.

Access points

show aps

Cluster-wide AP list with model, IP, channel, TX power, utilisation, and noise floor per radio. The primary AP-state query.

show aps power-monitor

Live PoE draw per AP. Surfaced in AP detail and the PoE column.

show allowed-aps

Allowlist of APs permitted to join the cluster. Used to identify offline APs that have a slot reserved but aren't currently up.

show ap bss-table

Per-AP list of broadcast BSSIDs, with band, PHY, bonded channel width, and EIRP. Authoritative source for 20 / 40 / 80 / 160 MHz width detection, and a fallback source for radio-band identification.

show ap association

Clients currently associated to a given AP, including BSSID, signal, retry stats. Drives the AP-detail client list.

show ap debug radio-state

Conducted TX power, noise floor, and channel-busy statistics per radio. Best-effort supplementary data — on current firmware many clusters return nothing for it over REST, and the app degrades gracefully.

show ap debug driver-config

Authoritative radio configuration: mode (AP vs Air Monitor), channel assignment, and the radio's operating band — including flex-radio and other non-standard slot layouts. Also feeds LED status.

show ap debug lldp info

LLDP neighbour data per AP — identifies the upstream switch, port, allocated PoE wattage, and switch capability flags.

show ap debug lldp neighbor interface <iface> detail

Per-port LLDP neighbour detail — fetched for a specific AP wired interface to populate its wired-port detail card.

show ap debug cloud-server

Aruba Central / Activate registration state for the cluster. Used to diagnose the "expired subscription" failure mode. With Verbose Logging on, also queried per AP to record each AP's Central connection state and error history in the event log.

Clients

show clients

Wireless client list with IP, MAC, SSID, AP, signal, speed, PHY type, authentication.

show clients debug

Extended wireless client detail including encryption flags and association timestamps.

show clients wired

Wired clients learned through AP Ethernet ports.

show clients wired debug

Extended wired-client detail (port, VLAN, learn time).

show stats client <mac>

Per-client live statistics — signal trace, frame counts, throughput, retry rate, mobility trail. Drives the live trace and the Signal-stability row in Client Detail.

show ap debug client-table

Per-AP client table — last uplink/downlink signal and retry counters behind the cluster dashboard's issue analysis and Client Detail.

show ap roam-cache mac <mac>

Roam history for a specific client — best-effort, not all AOS versions expose this.

show datapath session | inc <ip>

Active sessions for a client IP — on-demand from Client Detail.

Channel quality & spectrum

show ap arm rf-summary

Per-AP ARM (Adaptive Radio Management) summary — primary channel, quality score, channel busy. The backbone of the Channel Quality tool.

show ap spectrum status

Distinguishes "Spectrum Monitor" (FFT-active) from "Air Monitor" mode on a per-radio basis.

show ap spectrum channel-metrics

Per-channel utilisation, WiFi/non-WiFi split, noise floor — only available from a Spectrum Monitor radio.

show ap spectrum channel-details

Detailed per-channel breakdown including non-WiFi device contribution. Powers the Channel Detail card.

show ap spectrum device-list

Non-WiFi RF emitters detected by Spectrum Monitor radios (microwave, Bluetooth, cordless phone, etc.).

show ap spectrum client-list

Per-channel client load observed by Spectrum Monitor radios.

show spectrum-alert 100

Recent spectrum alerts (rogue, interference) raised by Spectrum Monitor radios — cluster-wide, single call.

RF environment

show ap monitor ap-list

Every BSSID detected by the cluster's monitoring radios. Drives RF Neighbors and the Channel View foreign-SSID ghost overlay.

show ap monitor pot-ap-list

Potential ("pot") AP list — supplementary detection data feeding RF Neighbors.

show ids aps

IDS classification (valid / interfering / rogue) for detected neighbour APs.

show ids clients

IDS-flagged client devices.

Voice & Video (UCC)

These run only at the end of a load when Load UCC Data is enabled in Settings → Data Loading (off by default). They power the Voice/Video view's "active call vs registered" classification.

show ucm hashtable

Cluster-wide. Identifies which clients are running Unified Communications apps (Wi-Fi calling, FaceTime, Teams/Zoom/Meet, etc.) and the app/server each is using.

show wificall-dns-patterns

Cluster-wide. The carrier ePDG DNS patterns the controller uses to recognise Wi-Fi-calling traffic. Fetched once per session and cached.

show ucm cdrs

Per-AP (only APs hosting a UC-classified client). Call Detail Records — the primary "is a call up?" signal; sees encrypted streams (Wi-Fi Calling, SRTP) that the datapath filter drops.

show datapath session ucc

Per-AP. Byte/packet counters for UC media flows the AP can deep-inspect — a secondary throughput signal.

show datapath session | inc 4500

Per-AP. IPsec (UDP/4500) tunnel counters. Compared against the previous refresh to tell an active Wi-Fi call from an idle ePDG registration.

Bluetooth (BLE) discovery

Runs only at the end of a load when Load BLE Data is enabled in Settings → Data Loading (off by default). Powers the BLE radios shown under each AP in the Clients & APs tree and the BLE Discovery browser.

show ap debug ble-table all

Per-AP. The AP's onboard BLE radio plus every beacon-class BLE device it currently hears, with this AP's RSSI. Fanned out to every online AP, then aggregated by device MAC across the cluster (the AP's own radios are filtered out).

Security & deny list

show denylist-client

Current deny-list entries with reason, timestamp, and MAC. Drives the Deny List tool. The tool's block / unblock snippet builder generates CLI text from this data locally — the snippet is shown to you as copy-and-paste text and the app never sends it to the controller.

show log user 200

Authentication log — pulled on demand from the Deny List tool to show why a specific MAC was denied.

Logs & diagnostics

show log <type> <count>

Filterable event log retrieval — the Logs tab issues one of these per selected log type (system, security, network, user, etc.) with a user-chosen line count.

show activate

Aruba Activate cloud registration state — pulled when the controller reports it is Activate / Central-managed, and per AP whenever Verbose Logging is on.

Test API tool

The Test API button in the site editor runs a fixed, self-contained probe against the configured VC (and the fallback IP, if one is set): POST /rest/login, read-only show version and show aps queries, then POST /rest/logout — capturing the raw request and response for every step. It sends nothing else. The tool exists so administrators can verify reachability and see exactly what the controller returns before the main app ever touches the site.