REST API administrator
REST API administrator accounts are used for automated configuration, backup creation, and monitoring of the FortiGate.
For more information about the REST API, see the Fortinet Development Network (FNDN). Note that an account is required to access the FNDN.
Only an administrator with the super_admin profile can create a REST API administrator by using the GUI or CLI. |
To create a REST API administrator in the GUI:
-
Go to System > Administrators.
-
Select Create New > REST API Admin.
-
Configure the administrator:
Username
The username of the administrator.
Do not use the characters
< > ( ) # " '
in the administrator username. Using these characters in an administrator username might have a cross site scripting (XSS) vulnerability.Administrator Profile
Where permissions for the REST API administrator are defined.
A REST API administrator should have the minimum permissions required to complete the request.
PKI Group
Certificate matching is supported as an extra layer of security. Both the client certificate and token must match to be granted access to the API.
CORS Allow Origin
Cross Origin Resource Sharing (CORS) allows third-party web apps to make API requests to the FortiGate using the token.
Trusted Hosts
The following can be used to restrict access to FortiGate API:
-
Multiple trusted hosts/subnets can be configured
-
IPv6 hosts are supported
-
Allow all (0.0.0.0/0) is not allowed
You need your Source Address to create the trusted host.
-
-
Click OK.
An API token is generated. Make note of the token, as it is only shown once.
To create a REST API administrator in the CLI:
-
Create the REST API administrator:
config system api-user edit "api-admin" set comments <string> set api-key ************ set accprofile "API profile" set vdom "root" set peer-auth enable set peer-group <group> config trusthost edit 1 set ipv4-trusthost <class_ip&net_netmask> next ... end next end
-
Generate the API token:
# execute api-user generate-key <API username>
Make note of the token, as it is only shown once.
By default, The SSO administrator account can only be assigned the admin_no_access or super_admin_readonly profile. You can define a new administrator profile with the required permissions for the account. For example, you could use a specific API user to query the FortiGate for just their own status. In that case, the profile would be configured as read-only. |