In the enterprise virtualization ecosystem, VMware Cloud Foundation 9.1 stands out as a comprehensive platform that unifies hybrid cloud environments. However, VCF's true potential lies not only in its graphical interface but in the ability to automate complex operations through APIs. This article explores how to generate an OpenAPI collection from the SDDC Manager catalog and integrate it with Postman to build an automated workflow without needing to develop a full application from scratch. The methodology presented not only accelerates endpoint validation but also lays the groundwork for a more robust automation strategy, where concepts like custom software, artificial intelligence, and cybersecurity intertwine organically.
Generating an OpenAPI collection begins by downloading the VCF 9.1 specification package from the Broadcom portal. This JSON file describes all the resources, methods, and data models that SDDC Manager offers in a structured way. When imported into Postman, the tool transforms that abstract definition into a set of HTTP requests organized by tags, ready to be customized. However, the generated file is not production-ready: the default server URL points to localhost, and authentication must be explicitly configured. The first critical step is to replace that address with an environment variable pointing to the actual SDDC Manager appliance, thereby eliminating dependence on fixed IP addresses and facilitating portability between lab and production environments.
Once the base URL is corrected, the next challenge is authentication. VCF 9.1 uses a bearer token mechanism obtained via a POST request to the /v1/tokens endpoint. It is essential to design this request securely: credentials should not be stored in the request body or in shared environment variables. Instead, it is recommended to use Postman's local Vault or a corporate secret manager. Additionally, the collection should configure authentication at the collection level, so all child requests inherit the token automatically. The token creation request must be exempt from this inheritance, as it cannot depend on the same token it generates. This design, though simple, reflects the best practices that any custom software development should incorporate from the prototyping phase.
With authentication working, the basic read-only workflow is built. The three-step sequence starts with creating the access token, continues with retrieving the VCF domain inventory, and ends with querying a specific domain in detail. Each step includes Postman scripts that validate the response, extract relevant data, and store it in environment variables for the next step. For example, when obtaining the domain list, the script automatically selects the first domain (or one explicitly configured) and saves its ID. Then, the third request uses that ID to retrieve the complete domain. This chain of dependencies demonstrates how requests can be chained without manual intervention, an essential principle for business process automation.
Implementing this workflow in Postman does not replace a definitive automation solution but acts as a controlled testing ground. It allows validating connectivity, error handling, response structure, and selection logic before investing in a more complex development with PowerShell, Python, or an SDK. This is precisely where Q2BSTUDIO's vision comes in, as a software and technology development company that understands that controlled API experimentation dramatically reduces risk in integration projects. Engineers can quickly iterate over endpoints, detect inconsistencies in data models, and adjust transformation logic without touching a single line of production code.
Furthermore, this approach lays the foundation for incorporating advanced capabilities such as intelligent monitoring with AI, inventory analysis with BI/Power BI, or even creating AI agents that automate recurring tasks in the domain lifecycle. Cybersecurity also benefits: by keeping read-only requests in a controlled environment, accidental execution of destructive operations is avoided. For environments requiring additional protection, verification steps can be added, such as token revocation at the end of the session. Q2BSTUDIO offers cybersecurity services that include API audits and penetration testing, ensuring that any exposed interface meets industry standards.
Another key aspect is cloud portability. Although VCF 9.1 is typically deployed in on-premise environments, OpenAPI specifications allow the same collection to be adapted to instances hosted on AWS or Azure simply by changing the base_url variable and adjusting network policies. This is especially useful for companies operating in hybrid environments that need to unify their automation processes. The ability to reuse the same test suite across different cloud providers reduces duplication of effort and accelerates the adoption of multi-cloud strategies. At Q2BSTUDIO, cloud AWS/Azure teams work closely with virtualization experts to ensure smooth and secure transitions.
Finally, the article emphasizes the importance of not settling for the automatically generated collection. Although Postman organizes endpoints by tags, it is the engineer's responsibility to isolate a secure subset of operations (read-only) before running any tests. Write operations (create, modify, delete) must be kept in separate, clearly identified folders. Additionally, it is recommended to document each step, capture test results, and export a sanitized version of the collection (without credentials or tokens) to share with the team or integrate into a CI/CD pipeline. This governance habit is essential when scaling automation to hundreds of domains or clusters.
In conclusion, generating an OpenAPI collection from VCF 9.1 and Postman not only accelerates the learning curve but also provides a reusable artifact that can evolve into a complete automation solution. The combination of best practices in authentication, deterministic object selection, and validation scripts turns a simple endpoint catalog into a reliable workflow. And when it comes time to move to production, the knowledge gained during this exploration phase translates directly into a more robust design, whether for custom applications, cloud integrations, or intelligent agent deployments. Q2BSTUDIO supports organizations at every stage of this journey, from Postman prototyping to the implementation of scalable cloud architectures.
