Automation
The Automation domain tests how you configure and query Cisco data center platforms programmatically: NX-API, the ACI and UCS APIs, POAP, Guest Shell, EEM, and common tools such as Ansible and Terraform.
NX-API
NX-API exposes the CLI over HTTP/HTTPS after feature nxapi is enabled. It supports CLI_ASCII, CLI_JSON, and XML input/output. A JSON request looks like: {"ins_api":{"version":"1.0","type":"cli_show","chksum":"0","output_format":"json","input":"show version"}} The response mirrors the CLI with structured fields, which is why it suits scripts better than screen scraping.
ACI and UCS APIs
ACI uses the DME REST API. Log in to /api/aaaLogin.xml with a username and password, receive a token cookie, and send it with every subsequent request; the token expires (refreshTimeoutSeconds), so long jobs must refresh it. Objects are addressed by distinguished name, for example /api/mo/uni/tn-TENANT.json. UCS Manager exposes the XML API at /nuova. You call aaaLogin, get a cookie, then use configResolveDn, configResolveClass, or configConfMo to read and write objects.
POAP
PowerOn Auto Provisioning configures a switch on first boot with no startup config: DHCP gives an IP and the script/configuration location, and the switch downloads and applies it. It is not a day-2 tool.
On-box automation
Guest Shell is a Linux container on NX-OS where Python scripts run locally; EEM applets trigger actions on syslog or timer events. Ansible's nxos modules use network_cli or httpapi connections; Terraform providers for ACI and Intersight are declarative and idempotent.
Worked example
A script must read interface counters from 40 switches. Use NX-API cli_show with input "show interface counters", parse the JSON body, and loop over devices; the alternative, SSH and screen scraping, breaks when output formatting changes. If the request returns 401, the token expired and must be refreshed.
Traps
- Forgetting feature nxapi, so the HTTPS port never answers.
- Reusing an expired ACI token.
- Expecting POAP to run on a switch that already has a startup config.
- Assuming Ansible modules are idempotent without checking returned state.