6.4 Describe APIs for Cisco Catalyst Center and SD-WAN Manager

What this objective tests

This is a describe objective. You must explain what the two controller APIs do and how a client authenticates.

Catalyst Center and SD-WAN Manager are controllers. Scripts and external systems call their northbound REST APIs. The controllers manage devices southbound. You do not memorize every endpoint. You learn the authentication flow and the common endpoint patterns.

Catalyst Center token authentication

Catalyst Center uses token authentication. The flow has two steps:

1. POST credentials to the token endpoint. Get a token back.
2. Send the token in the X-Auth-Token header on every later request.

Step 1: get the token.

curl -X POST https://10.10.10.20/dna/system/api/v1/auth/token \
  -u admin:Cisco123 \
  -H "Content-Type: application/json"

Expected response:

{
  "Token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
}

Step 2: use the token. This request reads the site hierarchy:

curl -X GET https://10.10.10.20/dna/intent/api/v1/site \
  -H "X-Auth-Token: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json"

Expected response snippet:

{
  "response": [
    {
      "id": "a1b2c3d4-0001-4000-8000-000000000001",
      "name": "Global",
      "siteNameHierarchy": "Global"
    },
    {
      "id": "a1b2c3d4-0002-4000-8000-000000000002",
      "name": "HQ",
      "siteNameHierarchy": "Global/HQ",
      "parentId": "a1b2c3d4-0001-4000-8000-000000000001"
    }
  ]
}

Read the pattern: one POST for the token, then GET requests with X-Auth-Token.

SD-WAN Manager session authentication

SD-WAN Manager (formerly vManage) uses session authentication in the classic flow. The flow has three steps:

1. POST credentials to /j_security_check. The server sets a JSESSIONID cookie.
2. Get an XSRF token from /dataservice/client/token.
3. Call /dataservice/... endpoints with the cookie. Add the X-XSRF-TOKEN header for state-changing requests.

Step 1: log in and save the cookie.

curl -c cookies.txt -X POST https://10.10.10.30/j_security_check \
  -d "j_username=admin&j_password=Cisco123"

A successful login returns an empty body and sets the JSESSIONID cookie. A failed login returns an HTML login page. Check for HTML to detect failure.

Step 2: get the XSRF token.

curl -b cookies.txt https://10.10.10.30/dataservice/client/token

Step 3: read device inventory.

curl -b cookies.txt https://10.10.10.30/dataservice/device \
  -H "X-XSRF-TOKEN: <token-from-step-2>"

Note: The session cookie, the XSRF token, and a bearer token are different artifacts. Do not copy header patterns between controllers.

Common endpoints

Compare the two controllers:

Lab: trace the authentication flows

This is a paper lab. Answer the questions. Use the curl examples above.

1. Which Catalyst Center endpoint returns a token? (Answer: POST /dna/system/api/v1/auth/token.)
2. Which header carries the Catalyst Center token on later requests? (Answer: X-Auth-Token.)
3. Which credential type does the Catalyst Center token request use? (Answer: HTTP basic auth with username and password.)
4. What does a successful SD-WAN Manager login return? (Answer: an empty body and a JSESSIONID cookie.)
5. What does a failed SD-WAN Manager login return? (Answer: an HTML login page.)
6. Why does SD-WAN Manager need an XSRF token? (Answer: it protects state-changing requests from cross-site request forgery.)
7. A script gets 401 from Catalyst Center. What do you check first? (Answer: the credentials or the token, not routing.)

Exam traps

• Catalyst Center: basic auth once, then the token in X-Auth-Token. SD-WAN Manager: session cookie plus XSRF token.
• 202 Accepted from a controller means a task started. Poll the task endpoint before you declare success.
• A 401 is an authentication problem. A 403 is a permission problem. Neither is a routing problem.
• Northbound APIs face scripts and applications. Southbound protocols face devices.
• Do not hard-code passwords in scripts. Use environment variables, a vault, or a secrets manager.

Pass check

You are ready when you can do these things:

• Describe the Catalyst Center token flow in two steps.
• Describe the SD-WAN Manager session flow in three steps.
• Match an endpoint path to the correct controller.
• Explain the difference between a session cookie, an XSRF token, and a bearer token.
• Explain why a controller API call can return 200 with an empty result list.

Sources used

• Cisco ENCOR 350-401 v1.2 exam topics: https://learningcontent.cisco.com/documents/marketing/exam-topics/350-401-ENCORE-v1.2.pdf
• Cisco Catalyst Center API documentation: https://developer.cisco.com/docs/catalyst-center/
• Cisco Catalyst SD-WAN Manager API authentication: https://developer.cisco.com/docs/sdwan/authentication/