Register Switch Credentials for HFT | NVIDIA Minerva User Guide

NVIDIA Minerva needs each switch's NVUE credentials to configure HFT. Only Platform Admins can register switch credentials. You register the credentials on the platform, not on the collectors. NVIDIA Minerva stores the passwords encrypted and never shows them.

Important: Each import replaces the whole credential set. Any registered switch that is not in the file is deleted. List every switch in every file, including switches behind other collectors. When you import in the UI, NVIDIA Minerva shows the switches it will add and delete, and nothing changes until you click Apply.

Prepare the Credential File

Credentials must be in a CSV or JSON file. In a CSV file, the first line must name the columns.

switch,host,port,username,password
leaf-01,192.0.2.11,8765,cumulus,<password>
leaf-02,192.0.2.12,8765,cumulus,<password>

Field	Required	Description
`switch`	Yes	The switch's device name, as the topology shows it
`host`	Yes	The switch's management IPv4 address
`port`	No	The NVUE HTTPS port. The default is `8765`.
`username`	Yes	The NVUE username
`password`	Yes	The NVUE password
`skip_verify`	No	`false` makes NVIDIA Minerva verify the switch's certificate. See Verify Switch Certificates for HFT. Empty or `true` keeps the default unverified connection.

To update a switch's credentials, import the file again with the new values. In the UI, a file with an invalid row is refused, and nothing changes. With the API, a row that fails validation is skipped, and that switch's existing credentials are kept.

Import Credentials in the UI

Go to Topology > Provision > Metadata > Credentials. You can also get there from the High Frequency Telemetry settings page: click Manage credentials.
To start from a template, click Sample CSV or Sample JSON.
Click Import credentials, click Choose file, and select your CSV or JSON file.
Review the switches that will be added and deleted, and then click Apply.

To edit existing credentials, start from an export: click Actions > Download CSV or Download JSON. Exported files don't include passwords, so fill in every password before you import the file again. The export also includes access_method, skip_verify, and use_basic_auth columns. Leave them as exported; skip_verify keeps each switch's current certificate setting.

The Credentials page shows how many switches are configured. For each switch, it lists the management address, port, username, protocol, and credential status.

Import Credentials with the API

The HFT API is at https://<platform-ip>/api/hft-control/v1 and uses the NVIDIA Minerva API key. See Configure an API Key. The API accepts only the JSON format.

{
  "type": "json",
  "switches": [
    {"switch": "leaf-01", "host": "192.0.2.11", "port": 8765, "username": "cumulus", "password": "<password>"}
  ]
}

Run a dry run, and check deleted and deleted_switches in the response:

curl -sk -X POST -H "X-API-Key: <api-key>" -H "Content-Type: application/json" \
  --data-binary @switches.json \
  "https://<platform-ip>/api/hft-control/v1/credentials/switches/import?dry_run=true"

If the dry run shows only the changes you expect, run the same command without ?dry_run=true.
Delete switches.json. It contains passwords.

To list registered switches, send GET /credentials/switches. To remove a switch, import the file again without it.

Last updated: October 29, 2026