Incoming Webhook Quarantine stitch

The Incoming Webhook Quarantine stitch for API calls to the FortiGate accepts multiple parameters (MAC address and FortiClient UUID) from an Incoming Webhook trigger, which enacts either the Access Layer Quarantine action (MAC address) or the FortiClient Quarantine action (FortiClient UUID). This is a default automation stitch included in FortiOS.

To trigger the Incoming Webhook Quarantine stitch in the GUI:
  1. Create a new API user:
    1. Go to System > Administrators.
    2. Click Create New > REST API Admin.
    3. Configure the New REST API Admin settings, and copy the API key to the clipboard.

  2. Enable the stitch:

    1. Go to Security Fabric > Automation.

    2. Under Incoming Webhook, right-click Incoming Webhook Quarantine, and select Select Status > Enable.

  3. Get the sample cURL request:
    1. Click the Trigger trigger tab.
    2. Under Incoming Webhook, right-click Incoming Webhook Call, and select Edit.
    3. In the API admin key field, enter the API key you recorded previously. The Sample cURL request field updates.

    4. Copy the Sample cURL request to the clipboard.
    5. Click OK.