Connect FortiGate device via API Token

FortiConverter can import configurations through REST-API. Each API request can use an API token to be authenticated.

An API token is generated by creating a new REST API admin on FortiGate GUI.

Set up the global scope in the admin profile:

1. Open the CLI console and make sure the device is in the multiple VDOM mode.
2. config global

   show system accprofile <your permission profile>

   […]

   set scope global (It should be global)

   […]

Create new REST API admin

Step 1: Create an administrator profile

1. On the FortiGate GUI, select System > Admin Profiles > Create New.
2. Create a New Profile.
3. Enter a profile name and enable all the Read/Write permissions. Please note the profile name, it will be used in Step 2.



4. Click OK.

Step 2: Create a REST API Admin:

1. On the FortiGate GUI, select System > Administrators > Create New > REST API Admin.



2. Enter the API-user's name and select the profile name you created from Step 1.
3. The trusted host must be specified to ensure that the machine of your FortiConverter installed can reach the FortiGate.



4. Click OK and an API token will be generated.



5. Make a note of the API token as it’s only shown once and cannot be retrieved.
6. Click Close to complete creation of the REST API Admin.

Regenerate an API token for API-user:

In FortiGate GUI, go to System > Administrators.

1. Edit your REST API admin user
2. Click Regenerate.

In CLI console, use the CLI command below:

execute api-user generate-key [API user name]

The steps above must be performed from the FortiGate GUI as an administrator with the super_admin profile.

Next: Connecting FortiGate devices