REST APIs and JSON Basics

A REST API runs over HTTP. Each request names a resource with a URI — a path such as /api/v1/vlan — and carries a verb saying what to do to it. Those verbs map cleanly onto the four CRUD operations, the four things you can do to any stored record.

The family rule is worth more than the individual codes: 2xx means success, 4xx means you the client got something wrong, 5xx means the server failed. That lets you triage an unfamiliar code correctly — a 403 you have never seen is still your problem, and a 502 still is not.

GET    https://controller/api/v1/vlan            ! Read every VLAN
POST   https://controller/api/v1/vlan            ! Create a new VLAN (body describes it)
PUT    https://controller/api/v1/vlan/50         ! Update VLAN 50
DELETE https://controller/api/v1/vlan/50         ! Delete VLAN 50

! Requests that change or read protected data carry a header:
!   Authorization: Bearer <token>
!   Content-Type: application/json

The path after the host names the resource; the verb in front names the action. Same URL, different verb, different effect — that is the whole shape of a REST call. Authentication rides in a header, typically Authorization: Bearer <token>, obtained by first logging in. Passwords never go in the URL.

A GET to /api/v1/interface/GigabitEthernet0-1 returns the payload below. Read it top to bottom rather than skimming for the value you want — the structure is what the exam asks about.

{
  "interface": "GigabitEthernet0/1",
  "admin_state": "up",
  "line_protocol": "up",
  "ipv4": {
    "address": "192.0.2.5",
    "prefix_length": 30
  },
  "description": "uplink-to-core",
  "counters": {
    "input_errors": 0,
    "crc": 0
  },
  "routing_enabled": true
}

• The outermost braces are one object — an unordered set of key/value pairs describing a single interface.
• "interface": "GigabitEthernet0/1" is a string value; both key and value sit in double quotes with a colon joining them.
• admin_state and line_protocol are the two halves of the familiar show ip interface brief status, here as separate string fields.
• ipv4 holds a nested object — the value of one key is itself another set of pairs. Nesting is how JSON expresses "the IPv4 details of this interface".
• prefix_length: 30 is a number, so it is unquoted. 192.0.2.5 is quoted because it is a string; 30 is not.
• routing_enabled: true is a boolean — lowercase and unquoted. true, false, and null are never quoted and never capitalised.
• No comma follows the last pair. A comma there would make the whole payload invalid.

If the controller returned many interfaces rather than one, a JSON array — square brackets — would hold the list, with a comma between each interface object. Arrays preserve order; objects do not. And there is still no trailing comma after the last object inside the array.

• Verbs to CRUD: POST creates, GET reads, PUT and PATCH update, DELETE deletes.
• GET is read-only and never changes device state.
• Status codes: 200 OK, 201 Created, 401 Unauthorized, 404 Not Found — 2xx success, 4xx client, 5xx server.
• Authentication is a token or API key in a header, never a password in the URL.
• JSON rules: double quotes on keys and strings, colon between key and value, comma between pairs, lowercase true/false/null, numbers unquoted, no trailing comma.
• Objects use braces and are unordered; arrays use square brackets and preserve order.