HTTP

What it does: two tabs. Request — asks a web address for its status code, response headers and timing, without downloading the whole page. Auth check (formerly the API tool) — answers one question fast: does this API credential still work? Auth is the first thing to break when "the automation broke but nothing changed".

What you need: Request — a URL (e.g. https://example.com). Auth check — pick a Platform (Cisco Catalyst Center, Meraki, NetBox, Juniper Mist, Arista CloudVision, Palo Alto PAN-OS, FortiGate, Aruba Central, AOS-CX, ServiceNow, and a few suggested extras — or Generic REST for any URL with None / Bearer / X-API-Key / Basic), enter the address, and a credential: pick one from the Vault or type it. Typed credentials stay in this screen's memory only.

Safe to run: yes. Request makes one read-only request. Auth check makes one read-only GET; a few platforms need one extra step first and the screen says so before you run it — Catalyst Center issues a 60-minute session token, the new Aruba Central can exchange a client id/secret for a token, and an AOS-CX switch needs a login (the check always logs out afterwards). It never generates a PAN-OS key and never mints an Aruba Classic token. Redirects aren't followed with your credential, the credential is only ever sent in a header, and it never appears in the verdict, the Activity log, or anything you copy, export or add to a Case. Untrusted certificates are refused unless you tick "Ignore certificate errors for <host>" — for that one host, and it accepts any certificate problem (self-signed, wrong name, expired). A credential is never sent to a plain http:// address unless you tick "Send the credential over unencrypted HTTP to <host>"; the verdict then carries a ⚠.

What to expect / reading results: Request — the status code is the headline: 200 = OK; 301/302/307/308 = redirect, shown with its Location (where it points) and never followed — type that address to check it; 401/403 = an auth problem; 404 = not found; 5xx = the server itself erred. The headers show what the server runs, caching, and security settings. Auth check — the verdict: Reached and authenticated (the platform's success code, and the same GET without your credential is not let in); Reached — open (the endpoint answered with no credential: Generic None, or an open endpoint that lets anyone in, so the credential isn't proven); Reached, but refused (401/403, with what that code means for that platform — NetBox and PAN-OS answer 403 for a bad key, for example — plus the server's WWW-Authenticate hint); or Not reached, with the layer that failed: DNS, TCP, TLS, or a timeout (on Cisco ISE a timeout usually means ERS is switched off). 429 means rate-limited (nothing is retried). Below it: the steps it ran, status, time, what auth was sent (masked), and the certificate. A preset marked "unverified" couldn't be confirmed in the vendor's public docs — its verdict says "unverified — confirm in your lab".

Demo mode: Auth check answers with sample verdicts on the demo network — nothing is sent.

See also: background reading in the API & MCP reference section — "API tokens & auth-first", "NETCONF / RESTCONF", "gNMI (streaming telemetry)" and "How MCP fits together".