Question

A SOC engineer is writing a Python integration against a threat intelligence vendor's REST API. The vendor documentation states that each request must include the header 'X-API-Key: <value>' and that no username or password is transmitted. The engineer's colleague suggests using Python's requests library with the auth=(user, pass) parameter instead. Which statement correctly describes the authentication mechanism required and why the colleague's approach is inappropriate?

Accepted Answer

The API uses an API key mechanism; the key must be placed in a custom request header, and using auth=(user, pass) would send Basic authentication credentials the API does not expect.

Answer

The API uses HTTP Basic authentication; the colleague is correct, and the X-API-Key header is only optional metadata.

Answer

The API uses OAuth 2.0 bearer tokens; the key should be sent as 'Authorization: Bearer <value>' instead of a custom header.

Answer

The API uses a custom token mechanism requiring a prior login call to exchange the key for a session token before any header is sent.