A bank audit of a 3-node SD-WAN Manager cluster requires evidence of active admin users, certificate expiry dates and cluster health without logging into each node GUI. The script must use supported admin APIs and read-only access. Which Administration API use collects users, certificates and cluster info?

The required approach calls the supported SD-WAN Manager Administration APIs to collect administrative users and roles, certificate details that include expiry dates, and cluster health. A read-only credential can retrieve this evidence without changing configuration or logging into individual node GUIs. Listing users and roles and retrieving certificate details but treating node alarms as the sole health evidence is insufficient: alarms report events and do not replace a direct cluster-health query, since an empty alarm list does not establish that all members and services are healthy. Retrieving certificate subject and issuer fields and querying cluster health still misses the certificate validity dates, so it cannot establish when certificates expire. Querying each node’s service status instead of the cluster-health endpoint can help diagnose individual services, but node-level states do not necessarily establish overall cluster health or membership status. Exam caveat: check the endpoint names and response fields for the SD-WAN Manager version in use, because Administration API coverage and schemas can vary by release. Practical check: run the collection with a read-only account and verify that the response includes all nodes, each certificate’s not-after or expiry value, and a current cluster-health result.