A REST API request that lacks required authentication information is rejected by the server before the requested operation is executed. REST APIs commonly use HTTP status codes to communicate request success or failure. When authentication credentials, API tokens, session cookies, or authorization headers are missing or invalid, the server normally returns a client-error response in the 4xx range.
Common examples include 401 Unauthorized, meaning authentication is required or failed, and 403 Forbidden, meaning the server understood the request but refuses access because the requester lacks permission. The server does not authenticate based only on source IP unless a separate IP-based access- control mechanism has been deliberately configured, so option A is not generally correct. The server also does not normally keep the HTTP transaction open indefinitely waiting for credentials, so option B is wrong. Option C is dangerous and wrong: APIs should not downgrade unauthenticated requests into guest execution unless an endpoint is intentionally public. In ENCOR automation, REST API security requires explicit authentication and authorization, usually over HTTPS/TLS. References/topics:
ENCOR Automation, REST APIs, HTTP status codes, API authentication, tokens, Cisco Catalyst Center API behavior.