Question

A network engineer maintains an extended ACL on an IOS-XE device through RESTCONF. The current ACL contains five sequenced permit/deny rules. The engineer sends an HTTP PUT to the ACL list resource with a JSON payload that contains only three rules, expecting the device to reconcile the change. After the request returns 204, the engineer discovers the two rules omitted from the payload are gone. Why did this happen, and what should have been used to add rules without removing the others?

Accepted Answer

PUT performs a full replace of the target resource, so any rules absent from the payload are deleted; a PATCH (merge) request should be used to add or modify individual rules while preserving the rest.

Answer

PUT only ever creates new resources and never overwrites, so the deletion was a device bug; the engineer should retry with POST to append the rules idempotently.

Answer

PUT merges by default but the payload lacked the insert=first query parameter, so the device purged unlisted rules; adding that parameter to the PUT would have preserved them.

Answer

PATCH performs a full replace while PUT performs a merge, so the engineer used the wrong method and should switch to PUT to add rules non-destructively.