3.2Compute, collaboration, and security APIs

Cisco automation is not only about network gear. The compute (servers), collaboration (meetings/telephony), and security domains each have management APIs, and the exam asks "which domain's API realizes this operational task." Again the core is not memorization but judging which domain the requirement belongs to and picking the target API. Provisioning servers on UCS, posting a message to Webex, or fetching policy from ISE—each is "calling an API" but through a different door.

3.2.1Compute APIs

• UCS Manager manages on-prem UCS servers (B-series/fabric interconnects) via an XML-based API, provisioning service profiles (templates for a server's identity/configuration) for consistent bare-metal deployment.
• Intersight is a cloud (SaaS) infrastructure-operations platform that manages UCS, HyperFlex, and more across sites via a REST API. Where on-prem UCS Manager governs a single domain, Intersight suits binding inventory/policy/monitoring across multiple sites from the cloud.

3.2.2Collaboration APIs

• The Webex API operates the cloud collaboration platform over REST. It exposes resources such as rooms (spaces), messages, memberships, and webhooks, and with Bearer-token auth you can build bots and ChatOps notifications (e.g., posting a message to a space when a fault is detected).
• CUCM (Unified Communications Manager) handles on-prem IP telephony call control. For administrative automation use AXL (Administrative XML) (a SOAP/XML management API to add/change users, phones, and lines); for read-centric use such as directory lookup use UDS (User Data Services) (a RESTful read interface).

3.2.3Security APIs

• XDR correlates telemetry from multiple security products to automate detection/investigation/response across them. Firepower (next-gen IPS/FW) is operated through its FMC management console's REST API for policies/objects.
• ISE (Identity Services Engine) handles authentication/authorization and network access control; its ERS (External RESTful Services) API automates endpoints/policies/guests. Secure Malware Analytics (formerly Threat Grid) takes a submitted sample and returns analysis results (behavior/verdict) via API to automate threat determination.

Suppose the security operations team asks you to automate three things: "(1) register 100 new-hire extensions into CUCM at once; (2) submit a suspicious attachment to an analysis platform, receive a verdict, and if malicious, immediately notify the SOC chat; (3) when a compromised endpoint is detected, isolate it from the access network." Lumping all of these as "security APIs" mis-targets them. Requirement (1) is an administrative write to the phone system, so use CUCM's AXL (SOAP/XML management API) to bulk-add users/phones/lines—choosing read-only UDS here cannot write and fails the requirement (UDS is for search/lookup). Requirement (2) is sample analysis, so submit the sample to Secure Malware Analytics, receive the verdict (malicious/benign) via API, and if malicious POST to the Webex API's messages endpoint to notify the SOC space—an integration that spans two domains. Requirement (3) is access-network authorization control, so the right path is ISE's ERS API to move the endpoint into a quarantine policy; touching Firepower (FMC) firewall rules is a boundary matter and a different layer from isolating within the access network. The lesson: even in "security automation," the substance of judgment is separating admin vs. read (AXL vs. UDS) and the domain in play (telephony / sample analysis / access authorization / boundary FW) and wiring each requirement to the correct API. Casually consolidating onto one API gets stuck on write-permission and scope mismatches.

3.2.4Section summary

• Compute splits by scope: UCS Manager (on-prem XML) vs. Intersight (cloud REST)
• Collaboration uses the Webex API (REST, messages/webhooks) and CUCM's AXL (SOAP admin)/UDS (REST read)
• Security is picked by use: Firepower (FMC), ISE (ERS), XDR, Secure Malware Analytics for isolation/policy/correlated response/sample analysis