Skip to main content
aelkadi
Staff
aelkadi
Staff
June 25, 2026

Technical Tip: How to create an IP list on FortiWeb using the REST API

  • June 25, 2026
  • 0 replies
  • 13 views

Description

This article describes how to create an IP list on FortiWeb using the REST API.

Scope

FortiWeb.

Solution

Prior to making the API request, a Base64-encoded token needs to be generated for use in the Authorization header for FortiWeb authentication. This encoding is required for successful authentication with FortiWeb. The token can be generated by accessing the following link: Base64 Encode and Decode - Online.

  1. Prepare Authorization Token:


Convert the FortiWeb credentials into Base64-encoded format to generate the Authorization token required for authentication.


Example credentials: 

{"username":"admin","password":"password1234"}


58ff6f8c.png


  1. Retrieve the CURL commands by following the steps outlined in Technical Tip: How to use browsers to obtain curl commands for testing.


bbcf302f.png


  1. Configure Postman: Launch Postman and create a new request. Set the request method to POST.

  2. Define the API URL: Use the relevant API endpoint for IP list creation. Replace <FortiWeb-IP> and <port> with the FortiWeb IP address and the required source port.


Example URL: 

https://<FortiWeb-IP>:<port>/api/v2.0/cmdb/waf/ip-list


  1. Configure headers: Include the Authorization header containing the encoded token.
    Example: Authorization: <encoded_token>.

  2. Send the request: Select Send to create the IP list.


Instructions for modifying the request body:

Adjust the request body parameters as required, including:

  • Block period: Set a value between 1 and 600 seconds.

  • Severity: Choose 'High', 'Medium', 'Low', or 'Informative'.

  • Ignore-X-Forwarded-For: Set to 'enable' or 'disable' as appropriate.


The resulting configuration will look like the following:

curl 'https://<FortiWeb-IP>:<port>/api/v2.0/cmdb/waf/ip-list' \
  -X POST \
  -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0' \
  -H 'Accept: application/json, text/plain, */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Accept-Encoding: gzip, deflate, br, zstd' \
  -H 'Content-Type: application/json;charset=utf-8' \
  -H 'Authorization: eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJhZG1pbiJ9' \
  --data-raw '{"data":{"q_type":1,"name":"Test","action":"block-period","action_val":"11","block-period":60,"severity":"Low","severity_val":"3","ignore-x-forwarded-for":"disable","ignore-x-forwarded-for_val":"0","trigger-policy":"","trigger-policy_val":"0","sz_members":-1}}'


61b284f0.png


Related documentation:
FortiWeb RESTful API reference

    Terms & ConditionsAccessibility statement