Dell OS10 RESTCONF API: Automating Switch Config

Screen-scraping a switch with expect scripts works until the prompt changes or a banner appears in the middle of a command, which is why the RESTCONF API on Dell SmartFabric OS10 is the more durable automation path. OS10 exposes an RFC 8040-compliant RESTCONF interface over HTTPS: you authenticate with the switch credentials, address YANG-modeled data with a URI, and push or read configuration as JSON or XML. This article covers enabling the service, authenticating, reading operational state, pushing interface and VLAN configuration, verifying the change landed, and the errors that waste the most time.

Prerequisites: enable RESTCONF and know the port

OS10# configure terminal
OS10(config)# restconf enable
OS10(config)# end
OS10# write memory
OS10# show restconf

The service listens on TCP 443 with a self-signed certificate by default, so automation clients either need the CA installed or TLS verification disabled. The API root is /restconf and the YANG library root is /restconf/data. Until restconf enable is saved, every request returns a connection refused error that looks like a firewall problem.

Reading state first, always

Before pushing anything, confirm the URI you intend to write. Reading the same branch tells you the exact container names, which differ from the CLI names.

curl -s -k -u admin:password \
  -H "Accept: application/yang-data+json" \
  https://10.10.10.30/restconf/data/ietf-interfaces:interfaces

curl -s -k -u admin:password \
  -H "Accept: application/yang-data+json" \
  https://10.10.10.30/restconf/data/ietf-interfaces:interfaces/interface=ethernet1/1/1

A GET that returns HTTP 200 with an empty body usually means the path exists but the leaf is unset — not that the API is broken. Compare the output against show running-configuration interface ethernet1/1/1 on the CLI before trusting a model field name.

Pushing configuration with PATCH and PUT

RESTCONF distinguishes PUT (replace the target resource) from PATCH (merge). For day-to-day changes, PATCH with application/yang-data+json is safer because it does not delete sibling leaves you forgot to include.

cat > /tmp/vlan200.json <<'EOF'
{ "ietf-interfaces:interface": [
  { "name": "vlan200",
    "type": "iana-if-type:l2vlan",
    "description": "AUTOMATED-SERVER-VLAN",
    "enabled": true,
    "dell-vlan:vlan": { "vlan-id": 200, "name": "SERVERS" } } ] }
EOF

curl -s -k -u admin:password -X PATCH \
  -H "Content-Type: application/yang-data+json" \
  -H "Accept: application/yang-data+json" \
  --data @/tmp/vlan200.json \
  https://10.10.10.30/restconf/data/ietf-interfaces:interfaces

Note the vendor prefix inside the payload: standard ietf-interfaces covers the generic attributes, while OS10-specific values such as the VLAN name live under the dell-* namespace. Mixing namespaces in one document is normal, but omitting the prefix produces a 400 with the unhelpful message "unexpected element".

Verifying the change from the API, not the CLI

curl -s -k -u admin:password \
  -H "Accept: application/yang-data+json" \
  https://10.10.10.30/restconf/data/ietf-interfaces:interfaces/interface=vlan200 | python3 -m json.tool

OS10# show running-configuration interface vlan200

Always read the resource back after a write. OS10 validates the payload against the YANG model and returns 204 on success, but a 204 means "accepted", not "operational" — a VLAN can exist in the configuration while the SVI stays down because the member ports are not up. Confirm the operational state via /restconf/data/ietf-interfaces:interfaces-state or the equivalent CLI show.

Operational notes that save time

• Credentials: use a dedicated service account with a role limited to configuration access, not admin. Rotate it on the same schedule as your other automation secrets.
• Rate: the API is not a streaming telemetry channel. Poll on the order of seconds, not milliseconds; for continuous metric collection use telemetry or SNMP instead.
• Idempotency: compare the current state with your intended state before writing. Blind PUT loops rewrite the whole container and can disturb unrelated interfaces.
• Failure handling: treat 400 as a payload bug, 401/403 as credentials or role, 404 as a wrong path, and 409 as a concurrent change. Retry only the last two.

If the same workflow spans several vendors, the same patterns carry over — the differences are mostly path namespaces. For CLI-only devices, a Python wrapper built on SSH remains the fallback; the approaches compared in Netmiko network automation still apply for the switches that lag behind on model-driven interfaces. Where the goal is orchestration rather than a single script, the job-template model described in AWX job templates scales better than a pile of curl calls.

One last habit worth adopting: keep the JSON payloads in git next to the playbook or script that sends them. When a VLAN definition changes in six months, the diff explains why, and the API call becomes reproducible rather than remembered.

原文链接：https://www.dell.com/support/manuals/en-us/dell-emc-smartfabric-os10/smartfabric-os-user-guide-10-5-0/restconf-api-tasks