Cisco 350-901 DEVCOR/AUTOCOR: Using APIs

Domain 2 tests consuming HTTP APIs correctly: method semantics, status codes, authentication, pagination, rate limits, webhooks, and resilient client code. The focus is on behavior you can implement, not just endpoint names.

Request semantics

• GET is safe; PUT and DELETE are idempotent; POST creates and is not idempotent; PATCH partially updates.
• Status codes: 201 Created with Location; 204 No Content; 400 malformed; 401 missing or invalid credentials; 403 authenticated but forbidden; 404 not found; 409 conflict; 422 semantic validation failure; 429 rate limited; 5xx server-side.
• Send Content-Type and Accept; put credentials in the Authorization header, never in query strings that get logged.
• OAuth 2.0: client credentials for service-to-service; authorization code with PKCE for user-delegated access; request least-privilege scopes. API keys are simple but coarse-grained.
• Pagination: follow cursor or next links until absent; do not assume page size or stable offsets.
• Rate limits: honor Retry-After; use exponential backoff with jitter; cap retries.
• Webhooks: verify authenticity, respond 2xx quickly, process asynchronously, and deduplicate by event ID.

Worked example

Fetch all users from an API that returns data and a next cursor. Pseudocode:

resp = get('/v1/users', headers=auth)
while True:
    if resp.status == 429:
        sleep(int(resp.headers['Retry-After'])); resp = retry_same_request()
    page = resp.json(); users += page['data']
    if not page.get('next'): break
    resp = get('/v1/users?cursor=' + page['next'], headers=auth)

Reasoning: the cursor avoids offset drift when records change. Retry-After is the server's instruction, not a guess. Retrying is safe because GET is safe; retrying a POST requires an idempotency key or a duplicate check.

Traps

• Confusing 401 with 403: authentication versus authorization.
• Retrying non-idempotent POST calls blindly after a timeout.
• Ignoring pagination and silently returning partial data.
• Logging bearer tokens or putting secrets in URLs.
• Assuming every successful response is 200 or every error body has the same shape.