Managing API users
You can define API users to restrict access to APIs based on API keys.
Creating API users
- Go to API Gateway > API User, and select the API User tab.
- Click Create New.
- Configure these settings:
Name Enter a name that identifies the user. Email Type the email address of the user that is used for contact purpose. Comments Optionally, enter a description or comments for the user. Restrict Access IPs Restrict this API key so that it may only be used from the specified IP addresses.
Both single IP addresses or IP ranges are supported.
You can enter multiple IP addresses by adding
.Restrict HTTP Referers Restrict this API key so that it may only be used when the specified URLs are present in the Referer HTTP header. This can be used to prevent an API key from being reused on other client-side web applications that don’t match this URL (but note that this does not prevent server-side reuse where the referer could be forged).
Now only full URL such ashttps://example.com/foois supported.
You can enter multiple referers by adding.
- Click OK.
You can continue creating multiple API users.
Once the API user is created successfully, an API key and UUID are automatically assigned to this user by FortiWeb. The API key and UUID can not be changed, while you can append IP or HTTP referer restrictions for this user.
Creating API user group
You can assign API users to a certain group which defines the specific permissions of the group users can perform.
- Go to API Gateway > API User, and select the API User Group tab.
- Click Create New.
- In Name, type a name that can be referenced by other parts of the configuration.
- Click OK.
- Click Create New.
- For API User, select the created API user from the drop-down list.
- Click OK.
You can continue adding more API users to the group.