Talking to Cisco SD-WAN: Automating vManage With the REST API
The overlay has an API — use it instead of clicking through dashboards.
Cisco SD-WAN is API-first whether you treat it that way or not. Every screen in vManage is backed by a /dataservice endpoint. Automating it starts with one slightly awkward authentication flow.
The auth handshake
vManage uses session-cookie auth plus a cross-site request token. You log in for a JSESSIONID, then fetch an X-XSRF-TOKEN you must attach to every write.
import requests
class VManage:
def __init__(self, host, user, pw):
self.base = f"https://{host}"
self.s = requests.Session()
self.s.verify = False # lab only; pin the cert in production
self._login(user, pw)
def _login(self, user, pw):
r = self.s.post(f"{self.base}/j_security_check",
data={"j_username": user, "j_password": pw})
if "html" in r.text.lower():
raise RuntimeError("vManage login failed")
token = self.s.get(f"{self.base}/dataservice/client/token")
self.s.headers["X-XSRF-TOKEN"] = token.textList devices in the fabric
def devices(self):
r = self.s.get(f"{self.base}/dataservice/device")
return r.json()["data"]
vm = VManage("vmanage.example.com", "automation", "••••")
for d in vm.devices():
print(d["host-name"], d["device-type"], d["reachability"])Collect BFD session health
In SD-WAN, tunnel health is BFD health. A down BFD session means a dead data-plane tunnel between two edges, regardless of what the routing looks like.
def bfd_summary(self, system_ip):
r = self.s.get(f"{self.base}/dataservice/device/bfd/sessions",
params={"deviceId": system_ip})
return r.json()["data"]
for s in vm.bfd_summary("10.255.0.1"):
state = s["state"]
flag = "OK " if state == "up" else "DOWN"
print(f"{flag} {s['src-ip']} -> {s['dst-ip']} ({s['color']}/{s['dst-color']})")What the control plane gives you for free
Because vSmart distributes routing through OMP, the fabric's intended state lives in one place. Pulling OMP routes from vManage lets you diff intended overlay reachability against the BFD reality on the edges — the SD-WAN equivalent of config-vs-state drift.
/logout. vManage caps concurrent sessions, and leaked sessions from crashed scripts will eventually lock you out.Was this helpful?
Generate scripts for the task covered in this post
Describe what you need and NAPT writes production-ready automation in Netmiko, NAPALM, or Nornir.
Open Script Generator →Related posts
From Noise to Narrative: How the RCA Engine Builds a Causal Story From Your Findings
The Root Cause Analysis engine reads every finding your scripts produce and stitches them into a single causal chain — root, contributing, symptom.
Read →The Streaming Console: A Live Terminal That Remembers Everything
Run any diagnostic script against any device, watch output stream in real time, and end up with structured findings the platform can reason about.
Read →Intent: Saying What You Mean and Proving the Network Agrees
Write a one-line statement of how the network should behave. The Intent engine compiles it into checks and tells you where reality diverges.
Read →