Network configuration has historically been managed through CLI sessions on individual devices, with changes recorded in a wiki or a shared document if they were recorded at all. A versioned API changes the operational model in ways that matter for both reliability and compliance.
The problem with CLI-based network management ¶
When a network engineer SSHes into a switch and makes a configuration change, that change is applied immediately and the previous state is gone unless someone took a manual backup. In practice, manual backups are inconsistent. The result is that after two or three years of incremental changes, the running configuration of a network device diverges from any documented baseline, and reconstructing the history of changes requires reading through chat logs or asking the person who made them.
What a versioned API provides ¶
A versioned API treats network configuration as data. You submit a desired state, the API validates it, applies it, and records the previous state, the new state, the authenticated user, and the timestamp. If the change causes a problem, you can roll back to the previous state with a single API call. The history of every change is queryable. This is the same model that infrastructure-as-code tools like Terraform use for cloud resources, applied to the physical network layer.
BGP-specific considerations ¶
BGP configuration is particularly sensitive to change management because a misconfigured route advertisement can propagate quickly and affect traffic across multiple nodes. On the Husk Mesh Vault network layer, BGP peer configuration changes go through a validation step before being applied: the API checks that the proposed peer ASN and prefix list are consistent with the existing routing table and rejects changes that would create a routing loop or advertise a prefix not allocated to the tenant.
Audit trail implications ¶
For teams operating under ISMS certification, the audit trail produced by a versioned network API is directly useful. Every change has a timestamp, an authenticated identity, and a diff. This is the kind of evidence an ISMS auditor looks for when reviewing change management controls. Producing it from CLI-based management requires significant additional tooling; a versioned API produces it as a side effect of normal operations.
The operational benefit of a versioned network API is not primarily about automation. It is about making the current state of the network knowable and the history of changes recoverable without manual effort.