200-901 Infrastructure and Automation Practice Question
An engineer is writing a Python script that must authenticate to the Cisco Meraki Dashboard API and then retrieve the list of organizations the API key can access. Which authentication method and endpoint combination is correct?
⚠ Common exam trap
The trap here is assuming the API key can be passed as a query parameter or via Basic auth, when Meraki requires a dedicated request header named X-Cisco-Meraki-API-Key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include the API key in the X-Cisco-Meraki-API-Key HTTP header and send GET to /api/v1/organizations.
The Meraki Dashboard API authenticates requests with the API key placed in the X-Cisco-Meraki-API-Key header. To enumerate accessible organizations, the client sends a GET to /api/v1/organizations. Query-string keys, HTTP Basic auth, and OAuth bearer tokens are not the documented mechanism for this endpoint, so only the header-based approach with the correct path succeeds.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Include the API key in the X-Cisco-Meraki-API-Key HTTP header and send GET to /api/v1/organizations.
Why this is correct
The Meraki Dashboard API authenticates each request with the API key supplied in the X-Cisco-Meraki-API-Key header, and the organizations endpoint is GET /api/v1/organizations. This combination returns the organizations visible to that key. It is the documented, correct way to begin any Meraki automation workflow.
- ✗
Obtain an OAuth 2.0 bearer token from the Meraki identity service and send it to /api/v1/organizations.
Why it's wrong here
While Meraki supports OAuth for some integrations, the standard Dashboard API key flow uses the X-Cisco-Meraki-API-Key header and does not require a separate bearer token exchange for this endpoint. Introducing an OAuth flow adds unnecessary complexity and is not the documented method for this simple retrieval scenario.
- ✗
Send the API key as a query string parameter named key to /api/v1/organizations.
Why it's wrong here
Meraki does not accept the API key as a query parameter; it expects the key in the request header. Passing credentials in the URL also risks logging exposure. While the endpoint path is correct, the authentication mechanism is wrong, so the request would be rejected with an authentication error.
- ✗
Use HTTP Basic authentication with the API key as the username and a blank password against /api/v1/networks.
Why it's wrong here
Meraki uses a custom header for API keys, not HTTP Basic authentication, and the networks endpoint requires an organization identifier. Using Basic auth would fail authentication, and even with valid credentials the networks endpoint would not list organizations. Both the auth method and the endpoint are incorrect here.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.