A school district script fails against vManage because each request looks unauthenticated after the first call. Which practice correctly handles API authentication/session behavior?
Select an answer to reveal the explanation.
Short Explanation
vManage is a nightclub with a wristband: you check in once, wear the token/session on every request, and check out when done. Showing up bare-armed after the first song gets you bounced—and sticking enable secrets in headers is worse.
Full Explanation
vManage REST usage typically requires an authenticated login that returns a token or session cookie reused on later GETs/POSTs, with proper TLS and eventual logout or refresh on expiry. Device enable secrets, cleartext credentials in URLs, and IP-only trust models are insecure and incompatible with controller API design. Correct session/token handling is a foundational Domain 5 programmability skill for school-district automation.