Interpreting Python Scripts That Call Security APIs

What it is

Most Cisco security products expose a REST API, and the exam asks you to read a Python script that calls one.

You do not need to write long programs. You need to follow what each call does: the method, the path, the headers, the body and how the response is used. The Cisco Secure Firewall Management Center (FMC) is a common example.

How it works

A typical script has three steps: authenticate, call an endpoint, and process the JSON.

A token based example

The script below asks the FMC for a token, then lists network objects. Read it from the top.

import requests
from requests.auth import HTTPBasicAuth

BASE = "FMC_BASE_URL"   # scheme and host of the FMC
USER = "api_user"
PASSWORD = "secret"

# Step 1: authenticate with HTTP basic auth
auth_url = BASE + "/api/fmc_platform/v1/auth/generatetoken"
resp = requests.post(auth_url, auth=HTTPBasicAuth(USER, PASSWORD), verify=False)
resp.raise_for_status()

token = resp.headers["X-auth-access-token"]
domain = resp.headers["DOMAIN_UUID"]

# Step 2: call a configuration endpoint with the token
headers = {"X-auth-access-token": token, "Content-Type": "application/json"}
url = BASE + "/api/fmc_config/v1/domain/" + domain + "/object/networks"
resp = requests.get(url, headers=headers, params={"limit": 25, "offset": 0}, verify=False)

# Step 3: process the JSON
data = resp.json()
for item in data.get("items", []):
    print(item["name"], item["id"])

Reading it line by line

The first call is a POST with basic authentication. A successful reply carries the token and the domain identifier in the response headers, not in the body. Later requests send the token back in the X-auth-access-token header.

The second call is a GET on an object path that includes the domain ID. The params dictionary becomes the query string. The script then turns the body into a Python dictionary with .json() and loops over the items list.

What each element tells you

Status codes

The response code tells you whether the call worked.

• 200: success for a read or update.
• 201: an object was created.
• 204: success with no body, which some APIs return for a delete or update.
• 400: the request was malformed.
• 401: missing or invalid authentication, often an expired token.
• 403: authenticated but not permitted.
• 404: the path or object does not exist.
• 429: too many requests, so slow down.

Pagination and errors

Large result sets are returned in pages. The script uses limit and offset and loops until it has read everything. Good scripts call raise_for_status() or test status_code, and wrap calls in try and except so a failure is clear.

Safe habits

A script should read secrets from environment variables or a vault, not store them in the file. Tokens expire, so a long script must refresh or request a new one. Use certificate validation in production.