Technical Tip: Creating, deleting and execute of CLI script with API calls under FortiManager

Description

This article describes how to use API calls to create, execute, and delete a CLI script from FortiManager.

Scope

FortiManager.

Solution

To create a session with an API user.

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "user": "APIuser",
        "passwd": "APIpass"
      },
      "url": "/sys/login/user"
    }
  ]
}

To create a CLI script to device database.

{
  "id": 1,
  "method": "set",
  "params": [
    {
      "data": {
        "target": "device_database",
        "type": "cli",
        "name": "AT-FW_411651021",
        "content": "#1_CREATE_VLAN_IFACE
config system interface
    edit VLAN2003
        set vdom 'root'
        set ip 10.91.3.254 255.255.255.0
        set allowaccess ping
    end
#END"
      },
      "url": "/dvmdb/adom/root/script"
    }
  ],
  "session": "8GdESeYyTt56Vm9=="
}

Possible targets are:

In FortiManager v7.6.5 and higher, the create script request has changed:

{
  "id": 2,
  "method": "set",
  "params": [
    {
      "url": "/pm/config/adom/{{ADOM}}/obj/fmg/script",
      "data": {
        "content": "<script content>",
        "name": "test_script",
        "type": "cli", //or "jinja" or "tcl"
        "target": "devicedb"
      }
    }
  ],
  "session": "{{session}}"
}

Possible targets include:

To run the script against a device.

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "data": {
        "adom": "root",
        "package": "",
        "scope": [
          {
            "name": "AT-FW",
            "vdom": "root"
          }
        ],
        "script": "AT-FW_411651021"
      },
      "url": "/dvmdb/adom/root/script/execute"
    }
  ],
  "session": "8GdESeYyTt56Vm97=="
}

To run it against many devices, set the scope like this:

"scope": [
  {
    "name": "dev_001",
    "vdom": "global"
  },
  {
    "name": "dev_002",
    "vdom": "global"
  }
]

To run it against a policy package.

{
  "data": {
    "adom": "root",
    "package": "pkg_001",
    "script": "script_001"
  }
}

To delete a script.

{
  "id": 1,
  "method": "delete",
  "params": [
    {
      "url": "/dvmdb/adom/root/script/",
      "confirm": 1,
      "filter": [
        "name",
        "in",
        "AT-FW_411651021"
      ]
    }
  ],
  "session": "8GdESeYyTt56Vm97=="
}

To review the task that was created for the script's execution.

{
  "id": 1,
  "method": "get",
  "params": [
    {
      "url": "/task/task/79222"
    }
  ],
  "session": "8GdESeYyTt56Vm97=="
}

To view the Script Execution Summary of the script:

• First, obtain the log_id:

{
  "method": "get",
  "params": [
    {
      "url": "/dvmdb/adom/{{ADOM}}/script/log/summary/device/{{FGT}}"
    }
  ],
  "id": "1",
  "session": "8GdESeYyTt56Vm97=="
}

• The output of the request will look similar to the following:

{
  "result": [
    {
      "data": [
        {
          "exec_time": "Wed Jan 28 15:15:50 2026",
          "log_id": 135210,
          "script_name": "Test_Script",
          "seq": 1
        },

Extract the latest 'log_id' (in this example, it is 135210).

• To view the results of the script execution, use the log_id to fetch the script log:

{
  "method": "get",
  "params": [
    {
      "url": "/dvmdb/adom/{{ADOM}}/script/log/output/device/{{FGT}}/logid/135210"
    }
  ],
  "id": "1",
  "session": "8GdESeYyTt56Vm97=="
}

To log out of a session, run the following:

{
  "id": 1,
  "method": "exec",
  "params": [
    {
      "url": "/sys/logout"
    }
  ],
  "session": "8GdESeYyTt56Vm97=="
}