Technical Tip: Manage the FortiSASE connector config on FortiManager via the API

Description

This article describes how to use the API to clear unwanted configuration for a FortiSASE connector from FortiManager.

Scope

FortiManager, FortiSASE.

Solution

FortiManager stores configuration for the FortiSASE connector in its device database, but it has limited management abilities in the GUI. Advanced management such as deleting unwanted configuration can only be done via the API.

This article shows deleting an unused FSSO server as an example. Similar requests can be used for other objects as well.

• Run this API request to export the current configuration of the FortiSASE connector. This helps to review the 'config objects' part of the FortiSASE connector.

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "exec",
  "params": [
    {
      "data": {
        "device": "Connector_to_FortiSASE"
      },
      "url": "/deployment/export/config"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

• Run this API request to delete the user group referencing the FSSO server:

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "delete",
  "params": [
    {
      "url": "/pm/config/device/Connector_to_FortiSASE/vdom/root/user/adgrp",
      "confirm": 1,
      "filter": ["name","in","CN=LAB-FORTINET_INTERNET_ACCESS,OU=GROUPS,DC=LAB,DC=COM"]
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}

• Run this API request to delete the FFSO server. Here, 'FortiAuthenticator' is the name of the FSSO server object.

{
  "id": 1,
  "jsonrpc": "1.0",
  "method": "delete",
  "params": [
    {
      "url": "/pm/config/device/Connector_to_FortiSASE/vdom/root/user/fsso/FortiAuthenticator"
    }
  ],
  "session": "{{session}}",
  "verbose": 1
}