Identifying the Workflow in a Python API Script

What it is

Reading a script means working out from its imports, URLs, methods and loops what job the code performs.

The exam shows a Python script that calls a Cisco API, and asks what it does. The answer comes from a few clues: the authentication step, the HTTP method, the path, the data sent and what is done with the reply.

You do not need to run the code. You need to read it in the same order each time.

How it works

Read the script from the top, and find the method, the path and the data.

A reading routine

1. Check the imports. requests means REST. ncclient means NETCONF. A platform SDK names the platform.
2. Find the authentication. An X-Auth-Token header suggests Catalyst Center. An X-Cisco-Meraki-API-Key header suggests Meraki. A call to aaaLogin suggests ACI. A RESTCONF path with application/yang-data+json suggests a device.
3. Find the HTTP method. GET reads, POST creates, PUT or PATCH changes and DELETE removes.
4. Read the path. It names the object that is being used.
5. Check the body. The fields show what is created or changed.
6. See what happens to the reply. A loop with a print means reporting, and a second call that uses a field from the first is a chained workflow.

Clues by platform

Example 1: Meraki

headers = {"X-Cisco-Meraki-API-Key": API_KEY}

orgs = requests.get(BASE_URL + "/organizations", headers=headers).json()
org_id = orgs[0]["id"]

nets = requests.get(
    BASE_URL + "/organizations/" + org_id + "/networks", headers=headers
).json()
for net in nets:
    print(net["name"])

The key header and the paths show Meraki. The script reads the first organisation, takes its ID, and then lists the networks of that organisation. The workflow is list the networks in an organisation.

Example 2: Catalyst Center

auth = requests.post(
    BASE_URL + "/dna/system/api/v1/auth/token", auth=("admin", PASSWORD)
)
token = auth.json()["Token"]

headers = {"X-Auth-Token": token}
devices = requests.get(
    BASE_URL + "/dna/intent/api/v1/network-device", headers=headers
).json()["response"]

for d in devices:
    if d["reachabilityStatus"] != "Reachable":
        print(d["hostname"], d["managementIpAddress"])

The script gets a token, reads the device inventory, and prints devices that are not reachable. The workflow is report unreachable devices.

Example 3: ACI

session = requests.Session()
login = {"aaaUser": {"attributes": {"name": "admin", "pwd": PASSWORD}}}
session.post(BASE_URL + "/api/aaaLogin.json", json=login)

tenant = {"fvTenant": {"attributes": {"name": "Demo"}}}
session.post(BASE_URL + "/api/node/mo/uni.json", json=tenant)

The script logs in to the APIC and posts a fvTenant object under uni, which is the root of the policy tree. The workflow is create a tenant named Demo.

Example 4: RESTCONF

url = BASE_URL + "/restconf/data/ietf-interfaces:interfaces/interface=Loopback100"
headers = {
    "Content-Type": "application/yang-data+json",
    "Accept": "application/yang-data+json",
}
body = {
    "ietf-interfaces:interface": {
        "name": "Loopback100",
        "type": "iana-if-type:softwareLoopback",
        "enabled": True,
    }
}
requests.put(url, headers=headers, json=body, auth=("admin", PASSWORD))

A PUT on a path that names an interface, with a body that names a software loopback, creates or replaces Loopback100 on the device. The workflow is configure a loopback interface.

Other things to notice

• A while loop that reads a task status points to an asynchronous workflow.
• A for loop over a list of devices means a bulk operation.
• A try block with raise_for_status() adds error handling.
• Values read from os.environ show that secrets are kept out of the code.
• verify=False suggests a lab device with a self signed certificate.

Stating the workflow

Give the answer as one sentence with a verb and an object, such as list, create, update or delete plus the object and the platform. If a script has several steps, describe the order: log in, read, filter, report.