REST API super-admin profiled admin access using PKI group fails.

Description

An error during the authentication of a REST API super-admin profile admin account and available workarounds.

Scope

FortiOS 7.4, 7.6.

Solution

There is a KB article, Technical Tip: FortiGate REST API access using PKI group, describing an option to use PKI user settings on FortiOS for REST API admin authentication with a token and certificate.

REST API super-admin profiled admin access using a PKI group fails with errors “No matched peer found for given certificate”, “Peer certificate invalid or missing,” and “Failed api-key login attempt”.

These debugs should be enabled to see authentication attempts:

diagnose debug reset
diagnose debug application httpsd -1
diagnose debug application fnbamd -1
diagnose debug console timestamp enable
diagnose debug enable

Debug snippets while a super-admin-profiled REST API admin sends a request to any interface with enabled HTTPS service. Some debug outputs are skipped intentionally:

2026-10-09 12:46:19 [httpsd 1042 - 1791542779     info] fweb_debug_init[626] -- New GET request for  "/api/v2/monitor/system/status" from "192.168.178.20:63854"  <<<--- REQUEST 
2026-10-09 22:46:19 [2416] handle_req-Rcvd auth_cert req id=4475563298818, len=1894, opt=0
2026-10-09 22:46:19 [705] fnbamd_cert_check_group_list-checking group with name 'api-group'
2026-10-09 22:46:19 [518] __check_add_peer-check 'api-group'
2026-10-09 22:46:19 [520] __check_add_peer-'api-group' is not a peer user.   <<<--- ERROR #1
..
..
2026-10-09 22:46:19 [1256] fnbamd_cert_auth_copy_cert_status-req_id=4475563298818
2026-10-09 22:46:19 [884] fnbamd_cert_check_matched_groups-checking group with name 'api-group'
2026-10-09 22:46:19 [954] fnbamd_cert_check_matched_groups-not matched <<<--- ERROR #2
2026-10-09 22:46:19 [1295] fnbamd_cert_auth_copy_cert_status-Leaf cert status is unchecked.
2026-10-09 22:46:19 [1383] fnbamd_cert_auth_copy_cert_status-Cert st 2c0, req_id=4475563298818
2026-10-09 22:46:19 [239] fnbamd_comm_send_result-Sending result 0 (nid 672) for req 4475563298818, len=2592
2026-10-09 22:46:19 2026-10-09 12:46:19 [1390] destroy_auth_cert_session-id=4475563298818
[httpsd 1042 - 1791542779  warning] _peer_auth_certificate_valid[182] -- No matched peer found for given certificate.  <<<--- ERROR #3
2026-10-09 22:46:19 2026-10-09 12:46:19 [1228] fnbamd_cert_auth_uninit-req_id=4475563298818
[httpsd 1042 - 1791542779     info] api_access_check_for_api_key[664] -- Peer certificate invalid or missing. <<<--- ERROR #4
2026-10-09 22:46:19 2026-10-09 12:46:19 [1874] fnbamd_ldaps_destroy-
[httpsd 1042 - 1791542779  warning] _lock_out_check_and_lock_out[418] -- Failed api-key login attempt from 192.168.178.20. (4/10 attempts within 60s).  <<<--- ERROR #6
2026-10-09 22:46:19 [1447] fnbamd_rads_destroy-

There is a known issue, which is resolved in 7.6.7 and 8.0.0.
The problem is with restricted PKI-user authentication, which can not retrieve other VDOM settings.

Unfortunately, there is no fix yet for the 7.4 major version; however, there are available workarounds:

1. Use a connection to the root.VDOM interface.

2. Create and apply pki-user settings and group to api-admin account in the VDOM which interface request is reached.

The following snippet is a configuration for workaround #2:

• API-user settings in global VDOM:
  
  

FR02FW02 (global) # show system api-user
config system api-user
   edit "apiadm01"
      set comments ""
      set api-key ENC KEY
      set accprofile "super_admin"
      set peer-auth enable
      set peer-group "pkigr-ext-vd"
   next
end

• User-peer and user-group settings in the VDOM where the request is reached:
  
  

FR02FW02 # config vdom
FR02FW02 (vdom) # edit external
current vf=external:1

FR02FW02 (external) # show user peer
config user peer
   edit "peer-ext"
      set ca "CA_Cert_1"
   next
end

FR02FW02 (external) # show user group
config user group
   edit "SSO_Guest_Users"
next
   edit "pkigr-ext-vd"
      set member "peer-ext"
   next
end

• Settings of the interface that the request has reached:
  
  

FR02FW02 # config vdom
FR02FW02 (vdom) # edit external
FR02FW02 (external) # show system interface port2
config system interface
   edit "port2"
     set vdom "external"
     set ip 10.5.208.220 255.255.192.0
     set allowaccess ping https ssh http telnet fgfm
     set type physical
     set snmp-index 4
   next
end

• HTTPS debug outputs:
  
  

2026-10-14 11:44:08 [httpsd 1789 - 1791971048 info] _peer_auth_certificate_valid[189] -- Api-key + certificate login successful for apiadm01 via pki peer peer-ext
2026-10-14 11:44:08 [httpsd 1789 - 1791971048 info] api_access_check_for_api_key[691] -- API Key request authorized for apiadm01 from 10.5.255.254.

Related article:

REST API administrator