RESTCONF: managing network devices over HTTPS with YANG

What RESTCONF is

RESTCONF, defined in RFC 8040, takes the same YANG data models used by NETCONF and makes them available through HTTPS. Every container and list item in a model gets a URL. Instead of XML RPCs over SSH you send ordinary HTTP requests, so any tool that speaks REST can manage the device. It is ideal for quick integrations, web applications and engineers who already know API basics.

URLs and media types

The data resource normally sits under /restconf/data. After that comes the YANG path, with the module name as a prefix on the first node. List entries are selected with =key, and characters such as / in a key must be URL-encoded (%2F). Set the media type in headers:

• Accept: application/yang-data+json to receive JSON.
• Content-Type: application/yang-data+json when sending JSON.
• Use application/yang-data+xml for XML instead.

Read with curl, prompting for the password (-u with only a username makes curl ask) and trusting your own CA (certificate authority) file:

curl -u netadmin --cacert ca.pem \
  -H "Accept: application/yang-data+json" \
  https://192.168.10.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet2

HTTP methods

PATCH is the safest choice for small changes because it only touches what you send. PUT replaces the whole target, so anything you leave out is removed.

RESTCONF from Python

import os
import requests

HOST = "192.168.10.1"
BASE = f"https://{HOST}/restconf/data"
AUTH = (os.environ["NET_USER"], os.environ["NET_PASS"])
HEADERS = {
    "Accept": "application/yang-data+json",
    "Content-Type": "application/yang-data+json",
}

url = f"{BASE}/ietf-interfaces:interfaces/interface=GigabitEthernet2"
r = requests.get(url, auth=AUTH, headers=HEADERS, verify="ca.pem", timeout=10)
r.raise_for_status()
print(r.json())

body = {"ietf-interfaces:interface": {"name": "GigabitEthernet2",
                                      "description": "Uplink to core-sw1"}}
r = requests.patch(url, json=body, auth=AUTH, headers=HEADERS, verify="ca.pem", timeout=10)
print(r.status_code)   # 204 No Content means success

Tip: do not use verify=False outside a throwaway lab. Install a proper certificate on the device, or point verify at your internal CA, so you know you are talking to the real switch.

Security and practical tips

• Enable RESTCONF only on management interfaces and restrict access with ACLs (access control lists).
• Use a dedicated, least-privilege account with AAA logging; HTTP Basic authentication is common, so TLS is essential.
• Expect 401 for bad credentials, 404 for a wrong path and 400 for a body that does not match the model.
• Explore paths with GET first and copy the structure you get back when building PATCH bodies.
• RESTCONF has no candidate or locking; changes go straight to the running configuration (on most devices), so test in a lab.