REST APIs for network engineers: resources, CRUD, status codes and authentication
In short: A REST API lets software manage something over HTTPS by working with resources at URLs. The four CRUD actions map onto HTTP methods: POST creates, GET reads, PUT or PATCH updates and DELETE removes. Status codes say whether it worked. APIs authenticate callers with basic authentication, API keys, tokens or OAuth 2.0, and the secrets must be protected like passwords.
Why network engineers need REST
Controllers such as Cisco Catalyst Center, cloud-managed platforms such as Meraki, firewalls, IP address management tools and every public cloud offer a REST API. Anything you can click in the dashboard, and often more, can be done by a script. That is how inventories are exported, sites are created in bulk and monitoring tools pull data. The general concepts are covered in What an API is; here we look at them from the network side.
Resources and URLs
REST (representational state transfer) is a style rather than a protocol. Its main ideas are:
- Resources: every item, such as a device, site or VLAN, has its own URL, for example
https://controller.example.local/api/v1/network-device. - Client and server: your script is the client; the controller is the server.
- Stateless: each request carries everything needed, including authentication, so the server does not remember earlier requests.
- Representations: data is usually sent and returned as JSON, chosen with the
Content-TypeandAcceptheaders.
CRUD and HTTP methods
| Action | Method | Network example |
|---|---|---|
| Create | POST | Add a new site or a new SSID |
| Read | GET | List all devices and their software versions |
| Update | PUT (replace) or PATCH (change some fields) | Rename a device or change an SSID's VLAN |
| Delete | DELETE | Remove a decommissioned switch |
Status codes in the 200s mean success (200 OK, 201 Created, 204 No Content). 400s mean the request was wrong: 400 bad request, 401 not authenticated, 403 not allowed, 404 not found, 429 too many requests. 500s mean the server failed. A good script checks the status code before trusting the body.
curl -s -H "Accept: application/json" -H "X-Auth-Token: $TOKEN" https://controller.example.local/api/v1/network-device
curl -s -X PATCH -H "Content-Type: application/json" -H "X-Auth-Token: $TOKEN" -d @rename.json https://controller.example.local/api/v1/network-device/DEVICE-IDAuthentication
- Basic authentication sends a username and password, Base64-encoded, with every request. Base64 is not encryption, so it is only acceptable over HTTPS, and it is best used just to obtain a token.
- API keys are long random strings created in a dashboard and sent in a header. They are simple but often long-lived and powerful, so scope them tightly and rotate them.
- Tokens: you log in once and receive a token that expires after a set time. Catalyst Center, for example, issues a token from an authentication endpoint, and later calls send it in an
X-Auth-Tokenheader. - OAuth 2.0 lets an application obtain limited access on a user's behalf, or as a service account, without handling the user's password. It is common with cloud platforms. See API authentication for the flows.
Tip: never put keys or passwords in the script itself or in Git. Read them from environment variables or a secrets vault, use a dedicated read-only account for reporting, and turn certificate checking off only in an isolated lab.
Real-world example: a Wi-Fi rollout across forty shops
A fictional pharmacy chain had to create a new staff SSID on forty cloud-managed networks, one per shop. Doing it in the dashboard would have taken a day and invited typing mistakes. The network engineer created an API key for a dedicated admin account limited to the retail organisation, stored it in the team's vault, and wrote a short script. The script used GET to list the shop networks, checked each response for status 200, then sent a PUT to each network's SSID resource with the same JSON settings. A second GET confirmed every shop now had the correct VLAN and security settings. The whole change took twenty minutes, and the script went into Git for the next rollout.
Practice
Which HTTP method would you use to change only the description of a device, leaving everything else as it is?
A script receives status 401. What does that mean and what is a likely cause?
Why is basic authentication only acceptable over HTTPS?
Key takeaways
- REST APIs manage resources at URLs over HTTPS, usually with JSON.
- CRUD maps to POST, GET, PUT or PATCH, and DELETE.
- Check status codes: 2xx success, 4xx client errors, 5xx server errors.
- Authentication: basic, API keys, short-lived tokens or OAuth 2.0.
- Keep secrets out of code and Git; use least-privilege accounts.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.