n8n-nodes-infoblox

A community node for n8n covering a broad slice of the Infoblox API surface — Universal DDI (IPAM, DHCP, DNS), Threat Defense, TIDE threat intelligence, Endpoint, SOC Insights, Infrastructure, Identity, CDC, and NIOS WAPI — in a single node.

Features

• One node, two APIs. Infoblox Portal (CSP, token auth) and NIOS WAPI (basic auth) live in a single Resource dropdown. There is no separate "platform" selector — picking a resource automatically selects the matching credential.
• 45+ typed resources across IPAM, DHCP, DNS, Threat Defense, Endpoint, Lookalike Detection, Redirect, TIDE, SOC Insights, Infrastructure, Locations, CDC, Audit Log, Service Logs, Auth Profiles, NTP, Identity, and Global Search — plus a Custom API Request escape hatch for each API.
• Per-resource actions. Every resource exposes only the operations the Infoblox API actually supports (verified against the swagger specs), with meaningful action labels in the Actions panel (e.g. Create a DNS record, not Create a resource). List-only resources such as logs do not offer create/update/delete.
• Dynamic Create/Update fields. A resource-mapper Fields control loads the create/update schema for the selected resource at runtime from the Infoblox swagger specs, so you get typed, validated inputs instead of hand-written JSON. A JSON Body field remains available and is merged on top for anything the schema doesn't cover.
• Automatic pagination — Universal DDI via _limit/_offset, NIOS WAPI via _paging/_page_id, TIDE via rlimit — with a Return All toggle.
• Structured Get Many filters where the API supports them, plus a free-form Query Parameters collection on every request.
• Global, Europe, and custom Infoblox Portal realms; optional SSL bypass for self-signed NIOS appliances.
• Works with n8n's usableAsTool flag for AI-agent workflows.

Installation

Install as an n8n community node from npm:

npm install n8n-nodes-infoblox

Or via the n8n UI: Settings → Community Nodes → Install and enter n8n-nodes-infoblox.

For local development:

git clone https://github.com/kboykov/n8n-nodes-infoblox.git
cd n8n-nodes-infoblox
pnpm install
pnpm build

Credentials

The node ships two credential types. The required credential is selected automatically based on the chosen resource.

Infoblox Portal API (infobloxCspApi)

Used for all Infoblox Portal / Universal DDI / Threat Defense / TIDE resources. Requires a CSP API key.

| Field | Description | | --- | --- | | Realm | Global (csp.infoblox.com), Europe (csp.eu.infoblox.com), or Custom. | | Custom Base URL | Required when Realm is Custom. | | API Key | Your CSP API key. Sent as Authorization: Token <key>. |

Connectivity test: GET /api/ddi/v1/ipam/ip_space.

Infoblox NIOS API (infobloxNiosApi)

Used for NIOS WAPI resources. HTTP basic authentication.

| Field | Description | | --- | --- | | Grid Master URL | Base URL of the NIOS Grid Master, e.g. https://grid-master.example.com. | | WAPI Version | Version string, e.g. 2.13.7. | | Username / Password | Grid Master credentials. | | Ignore SSL Issues | Disable TLS verification for self-signed certificates. |

Connectivity test: GET /wapi/v<version>/grid.

How the node is structured

Pick a Resource, then an Operation. Most resources share these fields:

| Field | Shown for | Description | | --- | --- | --- | | Resource ID | Get, Update, Delete | The Infoblox resource ID. | | Return All | Get Many | Fetch all pages automatically. | | Limit | Get Many (Return All off) | Max records to return. | | Fields | Create, Update | Resource-mapper control whose columns are loaded from the API schema at runtime. | | JSON Body | Create, Update | Optional raw JSON, merged over the mapped fields (for fields not in the schema). | | Filter Expression | Get Many (supported resources) | Infoblox _filter expression, e.g. name=="default". | | Query Parameters | All | Raw key/value query parameters appended to every request. |

Dynamic Create/Update fields (resource mapper)

For create and update operations, the Fields control fetches the relevant request-body schema for the selected resource directly from the Infoblox swagger documents (CSP /apidoc/docs/...; NIOS GitHub Pages openspec) and presents each property as a typed, mappable column. Schemas are fetched on demand and cached in memory.

If a resource's API exposes no create/update body (for example list-only resources), the control shows a notice and you can fall back to the JSON Body field. The fetch requires the credential's host to be reachable from the n8n instance.

Resources — Infoblox Portal

The endpoint column is the Infoblox Portal API path each resource maps to. Unless noted, resources support full CRUD (Create, Get, Get Many, Update, Delete). Update methods follow each API (PATCH for Universal DDI, PUT for most Threat Defense / Infrastructure / CDC / Auth resources, POST for NTP).

Universal DDI — IPAM & DHCP

| Resource | Endpoint | Notes | | --- | --- | --- | | IP Space | /api/ddi/v1/ipam/ip_space | Top-level IPAM container. | | IP Address | /api/ddi/v1/ipam/address | Individual IP address record. | | Address Block | /api/ddi/v1/ipam/address_block | CIDR block within an IP Space. | | Subnet | /api/ddi/v1/ipam/subnet | Routable subnet. | | IPAM Range | /api/ddi/v1/ipam/range | Dynamic DHCP address range. | | Fixed Address | /api/ddi/v1/dhcp/fixed_address | Static DHCP reservation. | | DHCP Lease | /api/ddi/v1/dhcp/lease | Get Many only (read-only). | | DHCP Fingerprint | /api/ddi/v1/dhcp/fingerprint | DHCP client fingerprint. |

Filter Expression examples: name=="default", address=="10.0.0.0", cidr>=24, space=="<space-id>".

Universal DDI — DNS

| Resource | Endpoint | Notes | | --- | --- | --- | | DNS Zone | /api/ddi/v1/dns/auth_zone | Authoritative DNS zone. | | DNS Record | /api/ddi/v1/dns/record | Any DNS record type. |

Filter Expression examples: fqdn=="example.com", name_in_zone=="app1", type=="A", zone=="<zone-id>".

Threat Defense (atcfw v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | TD Access Code | /api/atcfw/v1/access_codes | Create, Get, Get Many, Delete (no update). | | TD Application Filter | /api/atcfw/v1/application_filters | Full CRUD. | | TD Category Filter | /api/atcfw/v1/category_filters | Full CRUD. | | TD Internal Domain List | /api/atcfw/v1/internal_domain_lists | Full CRUD. | | TD Named List | /api/atcfw/v1/named_lists | Full CRUD. | | TD Scheduled Report | /api/atcfw/v1/scheduled_reports | Full CRUD. | | Redirect: Custom Redirect | /api/atcfw/v1/custom_redirects | Custom redirect destination for blocked domains. |

DNS Events (dnsdata v2)

The DNS Event resource runs a time-range search (/api/dnsdata/v2/dns_event) rather than CRUD. Fields:

| Field | Description | | --- | --- | | Start Time | Required. Accepts a date/time or a Unix epoch (seconds); sent as t0. | | End Time | Required. Accepts a date/time or a Unix epoch (seconds); sent as t1. | | Return All / Limit | Paginate all matching events, or cap the count. | | Query Name | Filter by queried domain name (qname). | | Query IP | Filter by the IP that made the query (qip). | | Policy Name | Filter by the security policy that fired (policy_name). | | Threat Class | Filter by threat class (threat_class), e.g. Malware, Phishing. |

Each event is emitted as its own item.

Endpoint (atcep v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | Endpoint Device Group | /api/atcep/v1/roaming_device_groups | Full CRUD. | | Endpoint Roaming Device | /api/atcep/v1/roaming_devices | Get, Get Many. | | Endpoint VPN Profile | /api/atcep/v1/vpn_profiles | Create, Get Many, Update. |

DNS Forwarding Proxy (atcdfp v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | DFP Service | /api/atcdfp/v1/dfp_services | Get Many, Update. |

Lookalike Domain Analysis (tdlad v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | Lookalike Domain | /api/tdlad/v1/lookalike_domains | Get Many only. | | Lookalike Target | /api/tdlad/v1/lookalike_targets | Get Many only. |

SOC Insights (v2)

| Resource | Endpoint | Notes | | --- | --- | --- | | SOC Insight | /api/v2/insights | Get, Get Many. Get Many filter: Status (Active / Closed). |

TIDE — Threat Intelligence Data Exchange

TIDE resources use the Portal credential and the /tide/ path prefix on the same host.

TIDE Dossier Lookup performs an indicator intelligence lookup:

| Field | Description | | --- | --- | | Indicator Type | email, hash, host, ip, or url. | | Indicator Value | The indicator to look up. | | Source | Optional TIDE source name. Leave empty to query all. | | Wait for Results | Whether to poll until the lookup completes. |

TIDE Threat Data:

| Resource | Endpoint | Notes | | --- | --- | --- | | TIDE Threat | /tide/api/data/threats | Get Many only. Get Many filters: Indicator Type, Profile. Uses rlimit (max 10,000). | | TIDE Batch | /tide/api/data/batches | Create, Get, Get Many. |

Infrastructure & Locations (infra v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | Infrastructure Host | /api/infra/v1/hosts | Full CRUD. | | Infrastructure Service | /api/infra/v1/services | Full CRUD. | | Location | /api/infra/v1/locations | Full CRUD. |

Cloud Data Connector (cdc-flow v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | CDC Application | /api/cdc-flow/v1/applications | Full CRUD. | | CDC Destination: HTTP | /api/cdc-flow/v1/destinations/http | Full CRUD. | | CDC Destination: Splunk | /api/cdc-flow/v1/destinations/splunk | Full CRUD. | | CDC Destination: Syslog | /api/cdc-flow/v1/destinations/syslog | Full CRUD. | | CDC Host | /api/cdc-flow/v1/cdcs/hosts | Get, Get Many. |

Audit Log & Service Logs

| Resource | Endpoint | Notes | | --- | --- | --- | | Audit Log | /api/auditlog/v1/logs | Get Many only. Filter via the Filter Expression field (_filter). | | Service Log | /atlas-logs/v2/logs | Get Many only. Filters: Service ID (service_id), Container Name (container_name), On-Prem Host ID (ophid), Start (start), End (end). |

Authentication Profiles (authn v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | Auth Profile: LDAP | /api/authn/v1/profiles/ldap | Full CRUD. | | Auth Profile: OIDC | /api/authn/v1/profiles/oidc | Full CRUD. | | Auth Profile: SAML | /api/authn/v1/profiles/saml | Full CRUD. |

NTP Service Config (ntp v1)

| Resource | Endpoint | Notes | | --- | --- | --- | | NTP Service Config | /api/ntp/v1/service/config | Get, Get Many, Update, Delete. Update uses POST (upsert). Filter via the Filter Expression field. |

Identity (v2)

| Resource | Endpoint | Notes | | --- | --- | --- | | Identity: User | /v2/users | Full CRUD. | | Identity: Group | /v2/groups | Full CRUD. | | Identity: Compartment | /v2/compartments | Create, Get, Get Many, Update (no delete). |

Filter Expression example: name=="admin".

Global Search (atlas-search-api v1)

The Global Search resource POSTs a query across all Portal resources:

| Field | Description | | --- | --- | | Search Query | Required. Search string (3–300 characters). | | Additional Options | Optional JSON object (filters, limit, offset, highlight, exact_token). |

Custom API Request

The Custom API Request resource calls any CSP endpoint not covered above:

| Field | Description | | --- | --- | | HTTP Method | GET, POST, PUT, PATCH, or DELETE. | | Endpoint | Path (e.g. /api/ddi/v1/ipam/ip_space) or absolute URL. | | JSON Body | Optional request body for POST/PUT/PATCH. | | Query Parameters | Optional key/value query parameters. |

Resources — NIOS WAPI

NIOS WAPI Object

A generic resource for any WAPI object type (Create, Get, Get Many, Update, Delete):

| Object Type | WAPI Type | | --- | --- | | A Record | record:a | | AAAA Record | record:aaaa | | Authoritative Zone | zone_auth | | CNAME Record | record:cname | | Fixed Address | fixedaddress | | Grid | grid | | Host Record | record:host | | Member | member | | Network | network | | Network View | networkview | | PTR Record | record:ptr | | Range | range | | TXT Record | record:txt | | View | view | | Custom | Any WAPI type string |

• Get / Update / Delete operate on a WAPI _ref, supplied in the Object Reference field, e.g. record:host/ZG5zLmhvc3Qk...:app1.example.com/default. Slash-separated segments are individually URL-encoded.
• Create / Update use the Fields resource mapper (loaded from the NIOS openspec for the selected object type, by WAPI version) with JSON Body as a fallback.
• Get Many paginates with _paging, _return_as_object, _max_results, and _page_id when Return All is enabled.

NIOS Custom API Request

Sends an arbitrary request to the Grid Master. Endpoint paths are accepted with or without the /wapi/v<version> prefix.

Query Parameters

The Query Parameters collection appends raw key/value pairs to any request — for field selection, ordering, or controls not exposed as structured fields.

| Context | Examples | | --- | --- | | Universal DDI | _filter=name=="default", _fields=id,name,comment, _order_by=name asc, _limit, _offset | | TIDE | type=host, profile=malware, detected=true, rlimit=1000 | | NIOS WAPI | _return_fields=name,ipv4addrs, _return_as_object=1, _max_results=500, name=app1.example.com, network_view=default |

Example workflows

List all subnets in an IP Space

1. Resource: Subnet → Operation: Get Many
2. Filter Expression: space=="<space-id>"
3. Return All: enabled

Create a DNS A record

1. Resource: DNS Record → Operation: Create
2. Fields: set type = A, name_in_zone = app1, zone = <zone-id>, rdata = { "address": "10.0.0.10" }

Look up a threat indicator in TIDE Dossier

1. Resource: TIDE Dossier Lookup
2. Indicator Type: Host, Indicator Value: malware.example.com, Wait for Results: enabled

Query DNS security events for the last hour

1. Resource: DNS Event
2. Start Time: one hour ago, End Time: now
3. Threat Class: Malware, Return All: enabled

Audit log entries via filter expression

1. Resource: Audit Log → Operation: Get Many
2. Filter Expression: user_name=="[email protected]"

Get NIOS host records for a domain

1. Resource: NIOS WAPI Object → Object Type: Host Record → Operation: Get Many
2. Query Parameters: name = app1.example.com, _return_fields = name,ipv4addrs

Development

pnpm install       # install dependencies
pnpm build         # compile to dist/
pnpm lint          # n8n community-node lint rules
pnpm lint:fix      # auto-fix lint errors
pnpm dev           # watch mode

Requires pnpm 11+ and TypeScript 5+. Built output goes to dist/ (the only thing published) and is not committed.

Project layout

credentials/
  InfobloxCspApi.credentials.ts     # CSP token credential
  InfobloxNiosApi.credentials.ts    # NIOS basic-auth credential
nodes/Infoblox/
  Infoblox.node.ts                  # thin entry: description, routing, methods
  Infoblox.node.json
  constants.ts                      # endpoints, resource groups, update-method rules
  types.ts
  GenericFunctions.ts               # transport, pagination, body/response helpers
  swagger.ts                        # runtime spec fetch + resource-mapper columns
  descriptions/                     # resource / operation / field definitions
    SharedDescription.ts            #   resource selector, shared mapper, query params
    CloudDescription.ts             #   Portal resources, per-resource operations, fields
    NiosDescription.ts              #   NIOS object + custom request
    index.ts
  actions/                          # execution logic
    cloud.ts
    nios.ts
  infoblox.svg

Releases are cut by publishing a GitHub Release tagged with the version; a GitHub Actions workflow then publishes to npm with provenance.

Notes & limitations

• The resource mapper covers create/update body schemas. For deeply nested object shapes, the JSON Body field (merged over the mapped fields) and Custom API Request remain available.
• Available operations and fields ultimately depend on your Infoblox product version, enabled modules, and account permissions.
• Authentication is API key (CSP) and basic auth (NIOS); OAuth is not implemented.
• TIDE list requests are capped at 10,000 records (rlimit).
• Enable Ignore SSL Issues only in controlled environments, and prefer least-privilege API accounts (read-only for monitoring, write access only for provisioning).

API documentation

• Infoblox CSP API Reference
• Infoblox NIOS WAPI / openspec
• n8n Community Nodes Docs

License

MIT