A Python script pulls interface and device inventory from a Catalyst Center cluster at https://dnac.corp.local using a service account whose password sits in an environment variable. One run makes a single token exchange and then several inventory, topology, and device-detail calls. Which token authentication flow should the script implement for these Catalyst Center API requests?
Select an answer to reveal the explanation.
Short Explanation
Catalyst Center hands out a token rather than trusting raw passwords, so you trade the credentials once with Basic auth. That token then rides in the X-Auth-Token header for every call in the run — it's your coat check ticket. Passwords in headers and session cookies skip the step the controller expects.
Full Explanation
Catalyst Center issues an API token instead of letting clients send passwords on each call, so the script makes one request to the token endpoint with the username and password encoded as Basic auth in the Authorization header, reads the token value out of the reply body, and then presents it in the X-Auth-Token header for every later inventory, topology, and device-detail call. That exchange matches how the controller authenticates automation, and reusing one token for a batch keeps the run fast. Sending the service account password directly in the X-Auth-Token header fails because that header expects a token rather than credentials, so the controller rejects the call before any data returns. Posting credentials as a JSON body breaks the contract too, since the endpoint reads Basic auth from the header, and the token arrives in the response body rather than an Authorization header the client could replay. A cookie-based session flow belongs to browser-oriented web apps, while these controller APIs are token-oriented, so there is no session cookie for the script to reuse. Exam caveat: study material written before the rename still calls this product DNA Center, so confirm you are reading current Catalyst Center documentation before copying an endpoint path. Practical check: assert a non-empty token right after the first call and print its HTTP status before the loop starts.