Skip to main content
ydong01
Staff
Staff
November 10, 2023

Technical Tip: How to show super admin user via REST API Admin

  • November 10, 2023
  • 0 replies
  • 3208 views
Description

This article describes that normal API admin could not show super admin user and needs to change profile via CLI:

  • Create Admin Profile for REST API Admin with read-write Permissions 'api-rw':

 

1.png

 

  • Create REST API Admin 'api-adm' with newly created Admin Profile 'api-rw'

 

2.png

 

  • Query admin got success status but no admin show here:

 

curl -k -X 'GET' 'https://<FGT-IP>:443/api/v2/cmdb/system/admin?access_token=<API key>' -H 'accept: application/json' -H 'Content-Type: application/json'

 

{

  "http_method":"GET",

  "size":1,

  "matched_count":0,

  "next_idx":0,

  "revision":"472de3e5186943a752314a08a7d19718",

  "results":[

  ],

  "vdom":"root",

  "path":"system",

  "name":"admin",

  "status":"success",

  "http_status":200,

  "serial":"<FGT SN>",

  "version":"v7.2.6",

  "build":1575

 

}3.png

Scope FortiGate, API, admin profile.
Solution

Change API Admin accprofile from 'api-rw' to 'super_admin' via CLI (GUI not working):

 

FGT # show sys api-user

config system api-user

    edit "api-adm"

        set api-key ENC SH2K0D2YFgGzBPdYdX6Oappo0Jop4WAwbXCegvi0PL3jBPEh36shFGzRDDf4Og=

        set accprofile "api-rw"

        set vdom "root"

    next

end

FGT # c sys api-user

FGT (api-user) # edit api-adm

FGT (api-adm) # set accprofile super_admin

FGT (api-adm) # next

FGT (api-user) # end

FGT #

 

After that, api-adm can query the admin user:

 

4.png

 

As api-adm has a super_admin access profile, it will work as super admin.

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!