Introduction

This blog post derives its inspiration from several other blogs on this topic, including this one, as well as a practical guide and a RESTCONF + YANG walkthrough. The reason to have another one is to tailor this blog to Arrcus devices running ArcOS.

NETCONF is an incredibly powerful protocol for automating the management of network devices. RESTCONF offers the same data model foundation (YANG) but over a familiar HTTP/REST interface, making it accessible to a much wider audience — anyone who can write a curl command or use Postman can manage an Arrcus device programmatically.

Upcoming Workshop: NANOG 98 — Miami, Florida (October 2026)

We are planning a hands-on workshop around this topic at NANOG 98, to be held in Miami, Florida in October 2026. The workshop will give network engineers direct experience using RESTCONF to configure and query Arrcus devices, covering the concepts and examples described in this blog post.

Stay tuned for registration details and the full agenda as the event approaches.

What is RESTCONF?

RESTCONF is an HTTP-based protocol defined in RFC 8040. It provides a programmatic interface for accessing configuration data and operational state that is described in YANG data models — the same models used by NETCONF. Key properties:

• Uses standard HTTP methods: GET, POST, PUT, PATCH, DELETE
• Data is exchanged in JSON or XML (JSON is the default in ArcOS)
• Transport is HTTPS (or HTTP, though not recommended)
• Authentication uses HTTP Basic Auth
• Stateless — each call is independent

ArcOS exposes its entire configuration and operational state via RESTCONF (as well as the CLI), implemented per RFC 8040.

YANG Data Model Primer

RESTCONF URIs map directly to YANG data model nodes. Three key YANG constructs:

ArcOS implements both OpenConfig and native Arrcus YANG models. Most configuration and state data is accessed via the OpenConfig module paths (e.g., openconfig-system, openconfig-interfaces), with Arrcus-specific augmentations applied on top.

ArcOS RESTCONF: Default Settings

Security note: ArcOS ships with a self-signed certificate for the SSL connection. This must be replaced with a certificate signed by a trusted Certificate Authority before deploying in a production environment. The default settings provide minimal confidentiality only.

Configuring the RESTCONF Server

RESTCONF is disabled by default and must be explicitly enabled. All RESTCONF server parameters are managed via the system restconf-server CLI hierarchy.

View available options

Enable the RESTCONF server

TLS configuration

Example: install a CA-signed certificate

Check RESTCONF server status

This displays the current configuration and status of the RESTCONF server. A sample output:

URI Structure

The general RESTCONF URI pattern for ArcOS:

For invoking RPCs and actions:

Discovering the RESTCONF root

Per RFC 8040, the RESTCONF root can be discovered via:

ArcOS implements this endpoint. It returns an XRD/XML document confirming the RESTCONF root is /restconf:

Note that the response is application/xrd+xml regardless of the Accept header — this is normal for the host-meta endpoint.

Verifying connectivity

Once you know the root is /restconf, confirm the server is responding correctly by fetching the YANG library:

A successful HTTP 200 response confirms RESTCONF is enabled and reachable.

HTTP Methods in Detail

GET — Read data

Used to retrieve configuration or operational state. Does not modify anything.

Expected response: HTTP 200

PATCH — Create or update configuration

The preferred method for configuration changes in ArcOS. Merges the supplied data with existing configuration.

Expected response: HTTP 204

PUT — Replace a resource

Replaces the entire target resource with the supplied data. Always do a GET first to avoid accidentally removing existing sub-configuration.

Expected response: HTTP 201 (created) or 204 (replaced)

POST — Create a new resource or invoke an RPC

Expected response: HTTP 201

DELETE — Remove a resource

Expected response: HTTP 204

Note: Remove the -k flag once you have replaced the self-signed certificate with a valid CA-signed certificate.

Practical Examples on ArcOS

Retrieve system state

Sample response:

Use the ?depth=1 query parameter to limit response verbosity:

List all supported YANG modules

This returns the full list of YANG modules implemented on the device, including revision dates and schema URLs — useful for discovering the correct module names and paths to use in subsequent calls.

HTTP Response Code Reference

Using Postman

Postman provides a graphical interface for issuing RESTCONF calls and is useful for exploration and debugging.

Setup

1. Download and install Postman.
2. If using ArcOS with the default self-signed certificate, go to Settings → General and disable SSL certificate verification.
3. Create a new Collection and add a new Request.

Headers

Under the Headers tab, add:

Authentication

Under the Authorization tab, select Basic Auth and enter the ArcOS username and password.

Running requests

For PATCH and POST, set the JSON payload under the Body tab (select raw → JSON).

User Privileges

ArcOS applies the same role-based access control to RESTCONF as to the CLI. Users in the operators group have read-only access; users in the admins group can make configuration changes. Refer to the Understanding User Model in ArcOS section of the CLI guide for full details.

ArcOS-Specific Behavior and Limitations

References

• RFC 8040 — RESTCONF Protocol
• RESTCONF Practical Guide — algoderedes.com
• RESTCONF and YANG — networkop.co.uk
• RESTCONF Tutorial — ultraconfig.com.au
• ArcOS CLI Guide v8.1.2 — System Level Configuration Guide → RESTCONF