An automation engineer must call Prism Central REST APIs to generate a weekly capacity report. The script must authenticate without embedding a user password in source control. Which method should the engineer use?

Prism Central v4 APIs support API key authentication for unattended automation. An administrator creates a service account in Prism Central, generates an API key for it, and grants the account only the role the report needs. The script then sends the key in the X-Ntnx-Api-Key request header on each call; this is not an Authorization: Basic or bearer header, so the header name matters. Because the key belongs to a service account, it can be rotated or revoked without touching any person's password, and it can be stored in a secrets manager instead of source control. Storing the administrator password in the script and sending HTTP Basic authentication puts a reusable, high-privilege secret in the repository, which violates the requirement. Logging in through the Prism UI form creates an interactive browser session meant for people, not a credential flow for a scheduled script. CVM SSH keys secure command-line access to Controller VMs; they cannot sign or authenticate Prism Central REST requests. Exam caveat: least privilege applies to the service account as much as to people, so give it a read-only role if the report only reads capacity data. Operational check: create the key, store it in your secrets manager, and test one read-only v4 call with the X-Ntnx-Api-Key header before scheduling the report.