REST API administrator

REST API administrator accounts are used for automated configuration, backup creation, and monitoring of the FortiGate.

For more information about the REST API, see the Fortinet Development Network (FNDN). Note that an account is required to access the FNDN.

To create a REST API administrator in the GUI:

1. Go to System > Administrators.

2. Select Create New > REST API Admin.

3. Configure the administrator:

   Username	The username of the administrator. Do not use the characters < > ( ) # " ' in the administrator username. Using these characters in an administrator username might have a cross site scripting (XSS) vulnerability.
   Administrator Profile	Where permissions for the REST API administrator are defined. A REST API administrator should have the minimum permissions required to complete the request.
   PKI Group	Certificate matching is supported as an extra layer of security. Both the client certificate and token must match to be granted access to the API.
   CORS Allow Origin	Cross Origin Resource Sharing (CORS) allows third-party web apps to make API requests to the FortiGate using the token.
   Trusted Hosts	The following can be used to restrict access to FortiGate API: Multiple trusted hosts/subnets can be configured IPv6 hosts are supported Allow all (0.0.0.0/0) is not allowed You need your Source Address to create the trusted host.

4. Click OK.

   An API token is generated. Make note of the token, as it is only shown once.

To create a REST API administrator in the CLI:

1. Create the REST API administrator:

   config system api-user
       edit "api-admin"
           set comments <string>
           set api-key ************
           set accprofile "API profile"
           set vdom "root"
           config trusthost
               edit 1
                   set ipv4-trusthost <class_ip&net_netmask>
               next
               ...
           end
       next
   end
   

2. Generate the API token:

   # execute api-user generate-key <API username>

   Make note of the token, as it is only shown once.

By default, The SSO administrator account can only be assigned the admin_no_access or super_admin_readonly profile. You can define a new administrator profile with the required permissions for the account. For example, you could use a specific API user to query the FortiGate for just their own status. In that case, the profile would be configured as read-only.