Managing API users

You can define API users to restrict access to APIs based on API keys.

Creating API users

1. Go to API Gateway > API User, and select the API User tab.
2. Click Create New.
3. Configure these settings:
   

   Name	Enter a name that identifies the user.
   Email	Type the email address of the user that is used for contact purpose.
   Comments	Optionally, enter a description or comments for the user.
   Type	Standard Once the API user is created successfully, an API key and UUID are automatically assigned to this user by FortiWeb. In cases such as the key is stolen or lost, you click the Refresh button to refresh the key. Dynamic FortiWeb adopts RSA algorithm to generate token. It uses public key to encode, and private key to decode a random string with minimum length 64. You need to enter the RSA key for dynamic key. JWT JSON Web Token (JWT) is an open standard (RFC 7519) that defines a way for transmitting information –like authentication and authorization facts– between two parties: an issuer and an audience. For the JWT key, you need to enter the value for the required fields so that FortiWeb can communicate with the JWT server to validate the key.
   Restrict Access IPs	Restrict this API key so that it may only be used from the specified IP addresses. Both single IP addresses or IP ranges are supported. You can enter multiple IP addresses by adding .
   Restrict HTTP Referers	Restrict this API key so that it may only be used when the specified URLs are present in the Referer HTTP header. This can be used to prevent an API key from being reused on other client-side web applications that don’t match this URL (but note that this does not prevent server-side reuse where the referer could be forged). Now only full URL such as HTTPS://example.com/foo is supported. You can enter multiple referers by adding .

4. Click OK.
   You can continue creating multiple API users.
   
   Once the API user is created successfully, an API key and UUID are automatically assigned to this user by FortiWeb. The API key and UUID can not be changed, while you can append IP or HTTP referer restrictions for this user.
   

Creating API user group

You can assign API users to a certain group which defines the specific permissions of the group users can perform.

1. Go to API Gateway > API User, and select the API User Group tab.
2. Click Create New.
3. In Name, type a name that can be referenced by other parts of the configuration.
4. Click OK.
5. Click Create New.
6. For API User, select the created API user from the drop-down list.
7. Click OK.
   You can continue adding more API users to the group.