What is the difference between a northbound and a southbound API?

A northbound API connects the controller to the management software and applications above it (typically REST over TLS). A southbound API connects the controller to the individual devices below it and pushes configuration changes down to them.

* Intent comes in northbound over an encrypted REST API; the controller turns it into device configuration and pushes it southbound. *

Cisco DNA Center (now Cisco Catalyst Center) is a typical example:

1. An admin changes a switch's configuration in the controller's management GUI or through a script.
2. That request reaches the controller over its northbound REST API. Because it carries credentials and configuration, this traffic should be encrypted, for example with TLS.
3. The controller translates the change and sends it over a southbound API and a programmatic interface to the affected routers, switches and wireless access points.

Go deeper:

• Northbound interface — Wikipedia — the term and how it contrasts with southbound.
• Cisco Catalyst Center API documentation — the northbound REST API of the controller used as the example.