CloudLabBox
Try the free demo

CCNP ENCOR lab 32 of 36

RESTCONF, REST response codes and API security

Manage an IOS XE router over HTTPS with RESTCONF: read and change YANG data with curl and Python, trigger and explain every common response code, lock the API down, and read Catalyst Center and SD-WAN Manager API responses the way the exam presents them.

Run this lab

It needs Lite: its 2 nodes are set to 3 vCPU and 5,120 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 32 - RESTCONF REST response codes and API security

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
3 vCPU, 5,120 MB
Smallest plan
Lite

The scenario

Fernhill Freight's web developers want to build a self-service portal for branch loopback and VLAN requests. They don't want SSH or XML: they want an HTTPS API with JSON. RESTCONF on the NOC's IOS XE router (CSR1) gives them exactly that, using the same YANG models as NETCONF. You'll enable and secure it, work through every verb and the response codes the portal must handle, and then read responses from Fernhill's Catalyst Center and SD-WAN Manager APIs, which the portal will also call.

DeviceInterfaceAddress
CSR1 (IOS XE 17.3)Gi110.10.50.1/24
NMS (Ubuntu desktop)eth010.10.50.100/24

RESTCONF account: admin / Fh-Restconf-2026 (privilege 15). On NMS (terminal: Applications → System Tools → MATE Terminal):

  • /opt/lab/rc.sh METHOD PATH [BODY-FILE] calls https://10.10.50.1/restconf/data/PATH with curl and prints the body and HTTP <code>. Read it: it shows the exact headers RESTCONF needs.
  • /opt/lab/rc_report.py is a Python requests script.
  • /opt/lab/catalyst-center/ and /opt/lab/sdwan-manager/ hold saved API responses.

Topology: CSR1 Gi1 — NMS eth0.

What you’ll practise

  • Map HTTP methods to CRUD operations and build RESTCONF URIs from YANG paths
  • Enable RESTCONF on IOS XE and restrict who can reach the API
  • Create, update, read and delete configuration with PUT, PATCH, GET, POST and DELETE
  • Interpret response codes (200, 201, 204, 400, 401, 404, 409) and JSON payloads
  • Describe REST API security and the Catalyst Center and SD-WAN Manager authentication flows

The tasks

  1. REST in five minutes
  2. Enable and protect RESTCONF
  3. Read with GET
  4. Create with PUT
  5. Change with PATCH, read it back
  6. Trigger the errors on purpose
  7. Use Python
  8. Read Catalyst Center and SD-WAN Manager responses

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of RESTCONF REST response codes and API security2 nodes, 1 link. Every link is listed as text below the diagram.CSR1NMSGi1eth0
2 nodes, with the interface names each link uses.
Every link, as text
  • CSR1 Gi1 to NMS eth0
Nodes in RESTCONF, REST response codes and API security, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
CSR1Cisco CSR 1000vcsr1000vng-universalk9.17.03.08a-serial2 vCPU, 4,096 MB
NMSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 32 - RESTCONF REST response codes and API security and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.