# F5OS RESTCONF path explainer

> Paste an F5OS RESTCONF path and get it decoded segment by segment: the YANG module prefix, the container hierarchy, list keys such as tenant=tenant1, and the module:node prefixing convention. It also explains the port 8888 /restconf versus port 443 /api duality from F5OS 1.8. Local and offline.

- Tool: https://ronutz.com/en/tools/f5os-restconf-path-explainer
- Family: Networking

---

## What it does

Paste an F5OS RESTCONF path and the tool decodes it segment by segment: the API root, the YANG module prefixes, the container hierarchy, and any list keys such as `tenant=tenant1`. It names the modules it recognises and says what each one governs. It parses the path text only: nothing is fetched, no schema is consulted, and nothing leaves the browser.

## Why an F5OS path needs decoding

F5OS, the platform layer beneath tenants on VELOS and rSeries, is driven by **RESTCONF** (RFC 8040) over data modelled in **YANG**, not by iControl REST over the TMOS object model. Somebody fluent in `/mgmt/tm/ltm/virtual` meets `/restconf/data/f5-tenants:tenants/tenant=tenant1/config` and has no way to tell which part is a module, which is a container, and which selects an instance. That is a vocabulary problem rather than a hard one, and it is what this tool removes.

## The module prefix and the prefixing convention

`f5-tenants:tenants` is the node `tenants` in the YANG module `f5-tenants`. F5OS uses vendor-neutral **OpenConfig** modules — `openconfig-system`, `openconfig-interfaces`, `openconfig-vlan` — alongside F5's own `f5-` modules. **Only the first node of a module carries the prefix**; nodes beneath it are written bare because they inherit it. A prefix reappearing part-way down a path means the path has crossed into a different module, which is the single most useful thing to notice when reading one.

## List keys, and the port duality

RESTCONF addresses a list entry by putting its key in the path — `tenant=tenant1` selects one tenant from the `tenants` list — rather than by a query parameter. The tool marks these separately from plain containers.

It also explains the port arrangement that catches people: F5OS originally exposed RESTCONF on **port 8888** under `/restconf`, and from **F5OS 1.8** the same API is reachable on the standard HTTPS port under `/api`. Two paths that look different can address the identical resource. Authentication uses an `X-Auth-Token` header, and that token is itself a JWT, so it expires.

## What it will not do

The module table is finite and deliberately short. If a path uses a module the tool does not know, it decodes the structure and **says the module is unrecognised rather than describing it from a guess**. It also validates nothing against a schema, because it has none: it cannot tell you whether a node exists in your F5OS release, only how the path you typed is constructed.

## Using it

Paste a bare path, a full URL, or a path with a query string. Query parameters are set aside and named, because they qualify the request rather than identify the resource.

## Standards and references

- [F5OS RESTCONF API](https://clouddocs.f5.com/api/f5os/)
- [RFC 8040 - RESTCONF Protocol](https://www.rfc-editor.org/rfc/rfc8040)
- [OpenConfig - vendor-neutral YANG models](https://www.openconfig.net/)

## Related reading

- [Reading an F5OS RESTCONF path](https://ronutz.com/en/learn/f5os-restconf-paths.md): F5OS is driven by RESTCONF over YANG, not by iControl REST over a TMOS object model. This explains how to read a path: the module prefix, the container hierarchy, list keys, the module:node convention, and the 8888 versus 443 duality.
- [Reading an iControl REST path](https://ronutz.com/en/learn/icontrol-rest-paths.md): Why iControl REST URLs contain tildes, how the module and collection are laid out, what a partition and folder path means, and which query options change the size of the answer.
- [The three states an F5OS tenant can be in](https://ronutz.com/en/learn/f5os-tenant-lifecycle.md): Configured, provisioned, deployed — and the rule that changing vCPU or memory means going backwards through them. Plus the published memory formula, and why a VELOS example will not commit on an rSeries.