> ## Documentation Index > Fetch the complete documentation index at: https://docs.celum.io/llms.txt > Use this file to discover all available pages before exploring further. # Get VM > **Authorisation:** `vm:Get` on `krn:celum:supervisor:{name}:vm:{vm}`, or on `krn:celum:supervisor:{name}:project:{?project}:vm:{vm}` — the project-qualified form, which is how a policy scopes a tenant to one project. Either resource matching is enough. **Assistant tool:** `get_vm` ## OpenAPI ````yaml /openapi.json get /api/supervisors/{name}/vms/{vm} openapi: 3.0.3 info: description: >- The HTTP surface of the Celum backend, generated from its own router and authorisation map — so this list cannot drift from the server that serves it. **Every operation states the IAM action and resource it is authorised against.** That pairing is the part worth reading: a policy naming the right action against the wrong resource matches nothing, and fails silently. Request and response bodies come from the Go types the handlers send and decode. Where those types do not determine the shape (an interface, a map[string]any, an unknown custom encoding), the operation says so in `x-celum-schema-gap` instead of carrying a guessed schema. title: Celum API version: 1.0.0 servers: - description: Your Celum deployment url: https://{host} variables: host: default: celum.example.com description: The host your Celum backend is served from security: - sessionCookie: [] - bearerToken: [] tags: - description: AI assistant & MCP name: ai-assistant - description: Clusters & CAPI lifecycle name: capi - description: Certificates & external secrets name: certs - description: GitOps & apps name: gitops - description: IAM, audit & auth name: iam - description: Image library name: images - description: Infrastructure & supervisors name: infrastructure - description: Networking name: networking - description: Observability & platform health name: observability - description: Platform onboarding & settings name: platform-settings - description: Projects name: projects - description: Registries & mirroring name: registries - description: Security & flows name: security - description: Storage name: storage - description: Templates & addons name: templates - description: Virtualization platform (KubeVirt/CDI) name: virt - description: Virtual machines name: vms - description: Workloads & topology name: workloads paths: /api/supervisors/{name}/vms/{vm}: get: tags: - vms summary: Get VM description: >- **Authorisation:** `vm:Get` on `krn:celum:supervisor:{name}:vm:{vm}`, or on `krn:celum:supervisor:{name}:project:{?project}:vm:{vm}` — the project-qualified form, which is how a policy scopes a tenant to one project. Either resource matching is enough. **Assistant tool:** `get_vm` operationId: get_supervisors_byName_vms_byVm parameters: - description: >- The supervisor's name, as registered under Administration → Supervisors. in: path name: name required: true schema: type: string - description: The virtual machine's name. in: path name: vm required: true schema: type: string responses: '200': content: application/json: schema: allOf: - $ref: '#/components/schemas/k8s.VMDetail' nullable: true type: object description: Success. '401': description: Not authenticated — no valid session cookie or API token. '403': description: >- Authenticated, but no policy allows this action on this resource. The body carries the action and resource that were evaluated. '404': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Not Found. '500': content: application/json: schema: $ref: '#/components/schemas/api.ErrorBody' description: Internal Server Error. components: schemas: k8s.VMDetail: properties: annotations: additionalProperties: type: string type: object catalogLabels: additionalProperties: type: string type: object conditions: items: $ref: '#/components/schemas/k8s.VMCondition' nullable: true type: array cpu: format: int64 type: integer created: type: string createdBy: type: string disks: items: $ref: '#/components/schemas/k8s.VMDisk' nullable: true type: array evictionStrategy: type: string exposedPorts: items: format: int32 type: integer type: array externalIP: type: string firmware: type: string guestAgentConnected: type: boolean guestOSInfo: $ref: '#/components/schemas/k8s.VMGuestOSInfo' hostname: type: string identityIP: type: string identityPool: type: string identityStale: type: boolean imageName: type: string instanceType: type: string interfaces: items: $ref: '#/components/schemas/k8s.VMInterface' nullable: true type: array ipAddress: type: string labels: additionalProperties: type: string type: object machineType: type: string memory: type: string name: type: string namespace: type: string nodeName: type: string ready: type: boolean runStrategy: type: string startTime: type: string status: type: string uid: type: string volumeStatuses: items: $ref: '#/components/schemas/k8s.VMVolumeStatus' type: array required: - conditions - cpu - created - disks - guestAgentConnected - identityStale - instanceType - interfaces - ipAddress - memory - name - namespace - nodeName - ready - runStrategy - status type: object x-go-type: backend/internal/k8s.VMDetail api.ErrorBody: properties: error: type: string required: - error type: object k8s.VMCondition: properties: message: type: string reason: type: string status: type: string type: type: string required: - message - reason - status - type type: object x-go-type: backend/internal/k8s.VMCondition k8s.VMDisk: properties: accessModes: items: type: string type: array bus: type: string fsType: type: string name: type: string provisioner: type: string reclaimPolicy: type: string removable: type: boolean size: type: string source: type: string storageClass: type: string type: type: string required: - bus - name - removable - size - source - storageClass - type type: object x-go-type: backend/internal/k8s.VMDisk k8s.VMGuestOSInfo: properties: id: type: string kernelRelease: type: string kernelVersion: type: string name: type: string prettyName: type: string version: type: string versionId: type: string type: object x-go-type: backend/internal/k8s.VMGuestOSInfo k8s.VMInterface: properties: interface: type: string ip: type: string mac: type: string name: type: string required: - interface - ip - mac - name type: object x-go-type: backend/internal/k8s.VMInterface k8s.VMVolumeStatus: properties: containerDiskName: type: string hotplugVolume: type: boolean name: type: string persistentVolume: type: string phase: type: string required: - name type: object x-go-type: backend/internal/k8s.VMVolumeStatus securitySchemes: sessionCookie: description: >- The session cookie issued by the OIDC sign-in flow. This is what a browser uses. in: cookie name: k8s-gate-session type: apiKey bearerToken: description: >- An API token, minted from your own identity page. A token carries the IAM groups you held **when it was minted**, and cannot bypass deletion approval — except for guest clusters inside a project that same token created. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.