200-901 APIs explained

Understanding and Using APIs is the heaviest single domain of 200-901 at 20%, and the skills spill into the platform and automation domains as well. It tests whether you can build a REST request from documentation, read the response, and work out what went wrong from a status code. Expect short code fragments and error scenarios.

The anatomy of a REST request

A request has a method, a URL (with path and query parameters), headers and an optional body. A response has a status code, headers and a body, usually JSON.

Path parameters identify a resource (/devices/123), query parameters filter (?limit=10), and the headers carry metadata such as Content-Type: application/json and authentication.

Status codes

The difference between 401 and 403 is a frequent question: 401 means the server does not know who you are (missing or invalid credentials), and 403 means it knows and refuses. A 404 means check the URL; a 400 means check the body or parameters; a 5xx means the server failed and retrying later may help.

Troubleshooting from the response

Combine three pieces: the status code, the request you sent and the documentation. If a documented endpoint returns 404, compare the path. If it returns 400, compare the body fields and the Content-Type. If it returns 401 after working earlier, the token has probably expired.

Authentication

Basic authentication over plain HTTP exposes the credentials, so it must use HTTPS. Base64 is encoding, not encryption.

Constraints when consuming APIs

Rate limits return 429, often with a Retry-After header. Large lists are paginated, so you follow a link header or a page parameter until the end. Requests need timeouts. Calls can fail transiently, which calls for limited retries with backoff.

Webhooks

A webhook reverses the direction: instead of polling, you give the service a URL and it sends an HTTP POST to you when an event happens. It is more efficient than polling and nearly real time. Your receiver must be reachable, should answer quickly with a 2xx code, and should verify the sender, for example with a shared secret or signature.

API styles

REST uses resources and HTTP methods. RPC calls a named procedure (JSON-RPC and gRPC are examples). A synchronous call waits for the answer; an asynchronous one returns at once and delivers the result later, for example through polling a job ID or a webhook.

Python and the requests library

import requests
r = requests.get(
    "https://api.example.com/v1/devices",
    headers={"Authorization": "Bearer TOKEN"},
    params={"limit": 10},
    timeout=10,
)
r.raise_for_status()
for d in r.json()["items"]:
    print(d["name"])

json= sends a dictionary as a JSON body and sets the content type, while .json() parses a response. raise_for_status() raises an exception on 4xx and 5xx.

Example questions

Next: Cisco platforms and development. Revisit the cheat sheet for the status code table.