Troubleshooting Tip: Linux shows the message 'No permission for the resource' when Linux curl FortiManager by using Rest API Administrator

Description

This article describes how to troubleshoot Linux showing the message 'No permission for the resource' when Linux curl FortiManager by using Rest API Administrator.

Scope

FortiManager v7.x and v8.x.

Solution

Below is the scenario:

1. Linux uses the syntax below and gets a 'No permission for the resource' message.
   
   

curl -k --location 'https://X.X.X.X/jsonrpc' \ 
--header 'Content-Type: text/plain' \
--data '{
    "method": "get",
    "params": [
        {
            "url": "/sys/status"
        }
    ],
    "id": 1
}'

X.X.X.X = FortiManager IP address.

2. At FortiManager, go to System Settings -> Administrators, edit Rest API Administrator, select Regenerate, and copy the New API Key.
   
   

   

   
   

After that, add the New API Key to the curl information, and then Linux can curl it:

curl -k --location 'https://X.X.X.X/jsonrpc' \ 
--header 'Content-Type: text/plain' \
--header 'Authorization: Bearer XXXXX ' \
--data '{
    "method": "get",
    "params": [
        {
            "url": "/sys/status"
        }
    ],
    "id": 1
}'

X.X.X.X = FortiManager IP address.
XXXXX = Copied New API Key.

Debugging on FortiManager.

Run the following commands on FortiManager:

diagnose debug reset
get system status
diagnose debug application auth 255
diagnose debug enable

Send the JSON API request authenticated with the API key, for example, by using curl (or Postman).

The debug output displays the API user information and authentication status.

Successfully authenticated:

auth api user: from=172.26.62.2 origin=(null)
matched api admin: FMG_API_USER

The API key is correct, but the source IP address does not match the configured trusted hosts:

auth api user: from=172.26.62.2 origin=(null)
admin: FMG_API_USER (not in trusthost)

The source IP address matches a configured trusted host, but the API key is incorrect:

auth api user: from=172.26.62.2 origin=(null)
no api admin matched