| The JSON API connector was introduced in FortiManager 7.2.1. It offers a generic way of linking IP addresses to address groups, similar to what FSSO-based connector would do. Since the feature is leveraging the standard FSSO mechanism, it works with any recent versions of FortiOS 7.0, 7.2, 7.4 and 7.6 (FortiOS version needs to be supported to use FortiManager as a FSSO server). With JSON API connector IP addresses can be imported from different sources, for example middleware program that supports API. To create the JSON API Connector: - Enter the ADOM.
- Navigate to Policy & Objects -> Object Configuration -> Security Fabric -> Endpoint/Identity.
- Select Create New.
- Select the JSON API connector.
Enter the JSON API Connector Name (json_api_connector_001), toggle on the Status, add 3 Tags (from tag_001 to tag_003), then select OK: 
SSH to the FortiManager and enter the command: execute fmpolicy print-adom-object adom_test "user adgrp" all
fmg # execute fmpolicy print-adom-object adom_test "user adgrp" all
Dump all objects for category [user adgrp] in adom [adom_test]:
---------------
config user adgrp
edit "js_json_api_connector_001_tag_001"
set server-name "FortiManager"
set connector-source "FMG JSON"
next
edit "js_json_api_connector_001_tag_002"
set server-name "FortiManager"
set connector-source "FMG JSON"
next
edit "js_json_api_connector_001_tag_003"
set server-name "FortiManager"
set connector-source "FMG JSON"
next
end This output indicates that: - FortiManager has created FSSO-related objects.
- FSSO objects are using the prefix js_<connector_name>_<object_name> For instance JSON API connector is named: json_api_connector_001 , hence for the tag tag_001 the corresponding FSSO object name will be js_json_api_connector_001_tag_001
- Managed devices (FortiGate) will use FortiManager as their FSSO server (considering the server-name attribute)
To create tags and address groups via API call, the following request can be used as an example:
{
"id": 1,
"method": "add",
"params": [
{
"data": {
"name": "json_api_connector_001",
"status": "enable"
},
"url": "/pm/config/adom/adom_test/obj/user/json"
},
{
"url": "/pm/config/adom/adom_test/obj/user/adgrp",
"data": [
{
"name": "js_json_api_connector_001_tag_001",
"server-name": "FortiManager",
"connector-source": "FMG JSON"
},
{
"name": "js_json_api_connector_001_tag_002",
"server-name": "FortiManager",
"connector-source": "FMG JSON"
},
{
"name": "js_json_api_connector_001_tag_003",
"server-name": "FortiManager",
"connector-source": "FMG JSON"
}
]
}
],
"session": "{{session}}"
}
Note: - Specific value for server-name, has to be used FortiManager.
- Any string value for connector-source can be used, but it is recommended to have FMG JSON as in FortiManager GUI.
Response: {
"id": 1,
"result": [
{
"data": {
"name": "json_api_connector_001"
},
"status": {
"code": 0,
"message": "OK"
},
"url": "/pm/config/adom/adom_test/obj/user/json"
},
{
"status": {
"code": 0,
"message": "OK"
},
"url": "/pm/config/adom/adom_test/obj/user/adgrp"
}
]
} Using the FortiManager CLI Script: - Script Name create_json_api_connector
- Type CLI Script
- Run script on Policy Package or Adom Database
Use following content:
config user json
edit json_api_connector_001
set status enable
next
end
config user adgrp
edit js_json_api_connector_001_tag_001
set connector-source "FMG JSON"
set server-name FortiManager
next
edit js_json_api_connector_001_tag_002
set connector-source "FMG JSON"
set server-name FortiManager
next
edit js_json_api_connector_001_tag_003
set connector-source "FMG JSON"
set server-name FortiManager
next
end
Create a Firewall Address: - Enter ADOM
- Navigate to Policy & Objects -> Object Configurations -> Firewall Objects -> Addresses.
- Select Create New.
- Enter the name firewall_address_001, set Type to Dynamic and Sub Type to FSSO, select FSSO Group js_json_api_connector_001_tag_001, then select OK.
Create a Policy Package and include a firewall policy, for example with following values: - Name: Policy_001
- Source: firewall_address_001
- Action: Accept
Install the newly created policy package, which includes the policy with dynamic object firewall_address_001 Observer the FortiGate FSSO polling activity: - SSH to FortiManager.
- Enter the following commands:
diagnose system print connector adom_test json json_api_connector_001
2026-03-10 11:31:00 Request:
2026-03-10 11:31:00 { "client": "\/bin\/newcli:6461", "id": 1, "method": "exec", "params": [{ "data": { "adom": "adom_test", "connector
2026-03-10 11:31:00 __get_user_list : no user info obtained from server json_api_connector_001
2026-03-10 11:31:00 __get_cuser_list : no user info obtained from server json_api_connector_001
2026-03-10 11:31:00 __get_adgrp_list : 3 adgrp info obtained from server json_api_connector_001
2026-03-10 11:31:00 Group List:
2026-03-10 11:31:00 idx: 0; id: ; name: js_json_api_connector_001_tag_001; tag: ; desc:
2026-03-10 11:31:00 idx: 1; id: ; name: js_json_api_connector_001_tag_002; tag: ; desc:
2026-03-10 11:31:00 idx: 2; id: ; name: js_json_api_connector_001_tag_003; tag: ; desc:
2026-03-10 11:31:00
2026-03-10 11:31:00 Response:
This is expected since there is no IP addresses yet attached to the FSSO objects. The same tests can be repeated after populating addresses. For example, the following script can be used: coding: utf-8
from pyFMG import fortimgr
ip = "10.210.35.112"
username ="test"
password = "test1"
with fortimgr.FortiManager(
ip,
username,
password,
verbose=True,
disable_request_warnings=True
) as fmg:
adom = "adom_test"
connector = "json_api_connector_001"
data = {
"command": "add" ,
"path": f"{adom}/{connector}",
"group": "tag_001",
"ip-addr": [
"10.1.0.1",
"10.1.0.2",
"10.1.0.3",
],
}
url = "/connector/user/manage"
fmg.debug = True
fmg.execute(
url,
data=data
)
fmg.debug=False This script will add 10.1.0.1, 10.1.0.2 and 10.1.0.3. To confirm connect via SSH to managed device (FortiGate) and run: diagnose debug authd fsso list:
----FSSO logons----
IP: 10.1.0.1 User: Groups: js_json_api_connector_001_tag_001 Workstation: MemberOf: js_json_api_connector_001_tag_001
IP: 10.1.0.2 User: Groups: js_json_api_connector_001_tag_001 Workstation: MemberOf: js_json_api_connector_001_tag_001
IP: 10.1.0.3 User: Groups: js_json_api_connector_001_tag_001 Workstation: MemberOf: js_json_api_connector_001_tag_001
Total number of logons listed: 3, filtered: 0
----end of FSSO logons---- To get the list of IP addresses linked to objects: diagnose debug authd fsso show-address
FSSO Dynamic Addresses(master=1):
firewall_address_001, ref 1
ADGRP: js_json_api_connector_001_tag_001
ADDR(LI): 10.1.0.1
ADDR(LI): 10.1.0.2
ADDR(LI): 10.1.0.3 To get the list of IP addresses learned via the FSSO mechanism from the firewall's perspective: diagnose firewall auth list
10.1.0.1
type: fsso, id: 0, duration: 18432, idled: 18432
server: FortiManager
packets: in 0 out 0, bytes: in 0 out 0
group_id: 33554433
group_name: js_json_api_connector_001_tag_001
10.1.0.2
type: fsso, id: 0, duration: 18432, idled: 18432
server: FortiManager
packets: in 0 out 0, bytes: in 0 out 0
group_id: 33554433
group_name: js_json_api_connector_001_tag_001
10.1.0.3
type: fsso, id: 0, duration: 18432, idled: 18432
server: FortiManager
packets: in 0 out 0, bytes: in 0 out 0
group_id: 33554433
group_name: js_json_api_connector_001_tag_001
----- 3 listed, 0 filtered ------ | 
