Cisco Catalyst SD-WAN · Authentication Profile

Cisco Catalyst Sdwan Authentication

Authentication

Cisco Catalyst SD-WAN secures its APIs with http and apiKey across 3 declared security schemes, as derived from its OpenAPI definitions.

SD-WANNetworkingWANAutomationPolicyEnterpriseNetwork ManagementInfrastructure as CodeObservabilityCisco

Methods: http, apiKey Schemes: 3 OAuth flows: API key in: header, cookie

Security Schemes

jwtBearer http

scheme: bearer

xsrfToken apiKey

· in: header (X-XSRF-TOKEN)

jsessionid apiKey

· in: cookie (JSESSIONID)

Source

Authentication Profile

generated: '2026-08-19'
method: searched
source: https://developer.cisco.com/docs/sdwan/authentication/
docs: https://developer.cisco.com/docs/sdwan/authentication/
note: The 13 harvested OpenAPI documents declare NO components.securitySchemes and no operation-level
  security[] — the authentication model lives only in the DevNet prose docs, not in the machine-readable
  contract. The login endpoints (POST /jwt/login, POST /j_security_check, GET /dataservice/client/token)
  are not present in any of the 4,138 harvested operations. This profile is searched from the docs.
summary:
  types:
  - http
  - apiKey
  api_key_in:
  - header
  - cookie
  oauth2_flows: []
  spec_declares_security: false
  documented_only: true
schemes:
- name: jwtBearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  since: SD-WAN Manager 20.18.1
  login:
    method: POST
    path: /jwt/login
    content_type: application/json
    body_fields:
    - username
    - password
    - duration
    default_duration_seconds: 1800
    max_duration_seconds: 604800
  response_claims:
  - token
  - refresh
  - sub
  - iss
  - aud
  - userGroup
  - tenant
  - duration
  - exp
  - csrf
  - isAPIKey
  - tenantId
  refresh:
    path: /jwt/refresh
    note: refresh token returned alongside the access token
  standard: RFC 7519
  source: https://developer.cisco.com/docs/sdwan/authentication/#jwt-based-authentication
- name: xsrfToken
  type: apiKey
  in: header
  parameter: X-XSRF-TOKEN
  note: Cross-site request forgery token required for most POST/PUT/DELETE operations. With JWT it arrives
    in the "csrf" claim of the login response; with session auth it is fetched from GET /dataservice/client/token.
  source: https://developer.cisco.com/docs/sdwan/authentication/
- name: jsessionid
  type: apiKey
  in: cookie
  parameter: JSESSIONID
  legacy: true
  login:
    method: POST
    path: /j_security_check
    content_type: application/x-www-form-urlencoded
    body_fields:
    - j_username
    - j_password
  note: Session-based authentication retained for backward compatibility.
  source: https://developer.cisco.com/docs/sdwan/authentication/#session-based-authentication
api_keys:
  supported: true
  note: A JWT access token issued with isAPIKey=true is a long-lived API key.
authorization:
  model: rbac
  artifact: scopes/cisco-catalyst-sdwan-scopes.yml
  note: Every operation carries an x-roles-required extension naming the SD-WAN Manager role(s) needed.
multitenancy:
  supported: true
  note: JWT carries tenant/tenantId; some APIs are provider-view only.
transport:
  https_required: true
  default_port: 8443

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cisco-catalyst-sdwan-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.