Octet

Say this first

Catalyst Center (formerly DNA Center) manages campus and branch: design, provisioning, software images, plug-and-play, SD-Access fabrics and assurance, exposed through the Intent API. APIC manages an ACI data center fabric of Nexus 9000 switches with a policy object model (tenants, VRFs, bridge domains, EPGs, contracts). Everything in the APIC GUI is a REST call against that model.

Go deeper

Catalyst Center

Design: sites, buildings, floors, IP pools, global settings (DNS, NTP, AAA).
Policy: group-based policy with ISE and SGTs for SD-Access.
Provision: templates, PnP zero-touch onboarding, SWIM for image upgrades.
Assurance: health scores, client and device telemetry, issue detection.
SD-Access fabric: LISP control plane, VXLAN data plane, TrustSec (SGT) policy plane.
API: get a token from POST /dna/system/api/v1/auth/token with basic auth, then send it in the X-Auth-Token header, for example GET /dna/intent/api/v1/network-device.

ACI APIC

Fabric: spine-leaf Nexus 9000 in ACI mode, APIC cluster (three or more in production).
Object model: tenant contains VRFs, bridge domains and application profiles with EPGs. Contracts allow traffic between EPGs. With no contract, EPGs cannot talk (allow-list model).
Internals: IS-IS underlay, VXLAN overlay, COOP on spines for endpoint lookup, MP-BGP to distribute external routes.
API: POST /api/aaaLogin.json returns a token (also set as the APIC-cookie cookie). Query a class with GET /api/class/fvTenant.json or one object with GET /api/mo/uni/tn-Prod.json. The GUI's API Inspector shows the exact call behind every click.

Others worth naming

Cisco SD-WAN Manager and Controller, Meraki Dashboard (cloud managed), Arista CloudVision, Juniper Apstra.

They will ask next

What is an EPG and why does ACI need contracts?
An endpoint group is a set of endpoints that share policy, for example all web servers. ACI forwards inside an EPG freely but blocks traffic between EPGs unless a contract allows it. That allow-list model is how ACI does segmentation without per-switch ACLs.
How would you onboard 50 new branch switches with Catalyst Center?
Build the site hierarchy and settings, attach a day 0 template and an image to the site, claim the devices in PnP (by serial number), and let them come up on a DHCP scope that points them to Catalyst Center (DHCP option 43 or a DNS name such as pnpserver). Then check them in assurance.

Traps

Calling ACI "just a GUI". The point is the object model and API; the GUI is one client of it.
Saying Catalyst Center forwards traffic or is in the data path. It never is.

How did you do?