Fortinet white logo
Fortinet white logo

Administration Guide

REST API administrator

REST API administrator

REST API administrator accounts are used for automated configuration, backup creation, and monitoring of the FortiGate.

For more information about the REST API, see the Fortinet Development Network (FNDN). Note that an account is required to access the FNDN.

Note

Only an administrator with the super_admin profile can create a REST API administrator by using the GUI or CLI.

To create a REST API administrator in the GUI:
  1. Go to System > Administrators.

  2. Select Create New > REST API Admin.

  3. Configure the administrator:

    Username

    The username of the administrator.

    Do not use the characters < > ( ) # " ' in the administrator username. Using these characters in an administrator username might have a cross site scripting (XSS) vulnerability.

    Administrator Profile

    Where permissions for the REST API administrator are defined.

    A REST API administrator should have the minimum permissions required to complete the request.

    PKI Group

    Certificate matching is supported as an extra layer of security. Both the client certificate and token must match to be granted access to the API.

    CORS Allow Origin

    Cross Origin Resource Sharing (CORS) allows third-party web apps to make API requests to the FortiGate using the token.

    Trusted Hosts

    The following can be used to restrict access to FortiGate API:

    • Multiple trusted hosts/subnets can be configured

    • IPv6 hosts are supported

    • Allow all (0.0.0.0/0) is not allowed

    You need your Source Address to create the trusted host.

  4. Click OK.

    An API token is generated. Make note of the token, as it is only shown once.

To create a REST API administrator in the CLI:
  1. Create the REST API administrator:

    config system api-user
        edit "api-admin"
            set comments <string>
            set api-key ************
            set accprofile "API profile"
            set vdom "root"
            set peer-auth enable
            set peer-group <group>
            config trusthost
                edit 1
                    set ipv4-trusthost <class_ip&net_netmask>
                next
                ...
            end
        next
    end
  2. Generate the API token:

    # execute api-user generate-key <API username>

    Make note of the token, as it is only shown once.

Note By default, The SSO administrator account can only be assigned the admin_no_access or super_admin_readonly profile. You can define a new administrator profile with the required permissions for the account. For example, you could use a specific API user to query the FortiGate for just their own status. In that case, the profile would be configured as read-only.

REST API administrator

REST API administrator

REST API administrator accounts are used for automated configuration, backup creation, and monitoring of the FortiGate.

For more information about the REST API, see the Fortinet Development Network (FNDN). Note that an account is required to access the FNDN.

Note

Only an administrator with the super_admin profile can create a REST API administrator by using the GUI or CLI.

To create a REST API administrator in the GUI:
  1. Go to System > Administrators.

  2. Select Create New > REST API Admin.

  3. Configure the administrator:

    Username

    The username of the administrator.

    Do not use the characters < > ( ) # " ' in the administrator username. Using these characters in an administrator username might have a cross site scripting (XSS) vulnerability.

    Administrator Profile

    Where permissions for the REST API administrator are defined.

    A REST API administrator should have the minimum permissions required to complete the request.

    PKI Group

    Certificate matching is supported as an extra layer of security. Both the client certificate and token must match to be granted access to the API.

    CORS Allow Origin

    Cross Origin Resource Sharing (CORS) allows third-party web apps to make API requests to the FortiGate using the token.

    Trusted Hosts

    The following can be used to restrict access to FortiGate API:

    • Multiple trusted hosts/subnets can be configured

    • IPv6 hosts are supported

    • Allow all (0.0.0.0/0) is not allowed

    You need your Source Address to create the trusted host.

  4. Click OK.

    An API token is generated. Make note of the token, as it is only shown once.

To create a REST API administrator in the CLI:
  1. Create the REST API administrator:

    config system api-user
        edit "api-admin"
            set comments <string>
            set api-key ************
            set accprofile "API profile"
            set vdom "root"
            set peer-auth enable
            set peer-group <group>
            config trusthost
                edit 1
                    set ipv4-trusthost <class_ip&net_netmask>
                next
                ...
            end
        next
    end
  2. Generate the API token:

    # execute api-user generate-key <API username>

    Make note of the token, as it is only shown once.

Note By default, The SSO administrator account can only be assigned the admin_no_access or super_admin_readonly profile. You can define a new administrator profile with the required permissions for the account. For example, you could use a specific API user to query the FortiGate for just their own status. In that case, the profile would be configured as read-only.