A Python script runs discovery and then provisions a site through the Catalyst Center REST API. The script must authenticate once, reuse the session across dozens of calls, and re-authenticate only when the controller reports the token has expired. Which authentication flow should the script implement?
Select an answer to reveal the explanation.
Short Explanation
You log in once and carry the returned token on every later request, so you're not paying the login cost over and over. When the controller reports that the token has expired, you log in again. That works like a wristband at the gate: one stamp gets you in, and you only queue again when it runs out.
Full Explanation
The correct approach is to POST the credentials to Catalyst Center’s authentication endpoint once, retain the returned token, and send it in the X-Auth-Token header for subsequent API calls. This reuses the authenticated session across discovery and provisioning while limiting re-authentication to the controller’s indication that the token has expired. Renewing shortly before the documented expiration can be a useful proactive strategy in systems that permit it, but it violates the explicit requirement to wait for the controller to report expiry; otherwise, the token is reused as required. Authenticating once per worker and caching that worker’s token is a common pattern for parallel clients, but it creates multiple authenticated sessions rather than one shared session for the script’s calls. Re-authenticating after any 401 or 403 is a common defensive retry pattern, yet those status codes can reflect authorization or request problems rather than token expiry, so this may refresh when the controller has not reported expiry. Exam caveat: an HTTP error alone does not necessarily establish that a token expired; follow the controller’s documented response semantics. Practical check: log authentication requests and token-expiry responses, and verify that ordinary API calls reuse the same token without triggering extra authentication.