Your Python automation queries the SD-WAN Manager API about 40 times in each run: device inventory, configuration templates and health metrics. The security team requires that every run sign in fresh, that the admin password appear in no more than one request, and that the credential survive idle gaps of several minutes between batches. Which Manager API authentication approach satisfies all three requirements?

The required approach is to submit the admin password once to the login endpoint at the start of each run, then send the returned session cookie with the inventory, template, and health requests. This gives every run a fresh sign-in, keeps the password out of subsequent API requests, and lets the authenticated session span the stated idle gaps, assuming the Manager's session policy permits them. Reusing a securely stored cookie across runs is a common way to reduce login overhead, and can satisfy the password-use and idle-gap constraints, but it fails the explicit requirement for a fresh sign-in on every run. Signing in at the start of each batch is also a conventional session-management pattern: it gives the run fresh authentication and can preserve each batch's session through idle gaps, but it submits the admin password again for each batch, exceeding the one-request limit. A per-run login followed by reuse of the cookie is otherwise suitable, but relying on a short idle timeout means the session may expire during a several-minute gap, so later requests cannot use the same authenticated session. Exam caveat: session-cookie lifetime and idle-timeout behavior are Manager configuration details, not universal properties of cookie authentication. Practical check: inspect the Manager's session settings and verify in a test run that the password appears only in the login request and that the cookie remains accepted after the longest expected gap.