With the API, how might you find the SSL Profiles which are not assigned to any VIP?

I'm afraid the API does not make this easy as far as I know. I think I've come across this kind of situation before, and You will need to perform some rather tedious crunching. You also need to adopt a policy in your environment of naming your objects in a certain way that makes this possible.

• Prefix all profiles with the name of their type. Example, client-SSL profiles will always be called

  clientssl_foo

  , then when you want to find client-ssl profiles, you simply look for the profiles that have "clientssl_" in their names.
  • to enumerate all client-ssl profiles, you need

    GET https://bigip/tm/ltm/profile/client-ssl

  • save this list of all client-ssl profiles in a suitable data structure
• Enumerate all Virtual servers

  • GET https://bigip/tm/ltm/virtual?expandSubcollections=true

  • The query parameter "expandsubcollections" adds some recursion, to keep you from having to issue too many repeated queries. Be careful though, for the size of response might be huge if you're dealing with a box with large configuration.
  • You will get al the profiles for each VIP under the Virtual result's items->[indexes]->profilesReference->items[indexes] (indexes indicate this is an array you iterate over)

• Each of the items under

  profilesReference

  is a profile, and you can simply check if the name contains "clientssl_"
  • if the name contains "client_ssl", then you can remove the item with this name from the earlier generated list of all clientssl profiles.

• When you have iterated over all virtuals and their profiles, you know that whatever is left in your original list is the set of clientssl profiles that were not assigned.

It may be a good idea for you to raise a formal support case and make a formal Request for Enhancement, so that future versions at least make this easier by adding some "type" annotations to profiles, and virtual servers -- or some other mechanism that negates the need for users to adopt a naming convention.

• Enumerate all client-ssl profiles (or whatever profile you wish)
  • save this list as list1
• Enumerate all virtuals (with expandSubcollections)
• for each virtual, check all listed profiles against list1, and eliminate any profiles that are found.
• repeat for each virtual until all virtuals examined, or list1 is empty.