Technical Tip: How to generate API Authorization token for FortiWeb

Description

This article describes how to generate an API authorization token to access FortiWeb via the REST API.

Scope

FortiWeb v7.2 and later.

Solution

Overview:

Unlike FortiGate, FortiWeb does not support dedicated API users. Instead, API authentication is performed using a Base64-encoded authorization token derived from administrator credentials.

Authentication method:

To authenticate API requests to FortiWeb, must generate an Authorization header using Base64 encoding of the following JSON structure:

{"username":"user","pwd":"fortinet","vdom":"root"}

Note:

Replace user, pwd, and root with actual credentials and VDOM as required.

Steps to Generate an Authorization Token

Step 1: Prepare JSON Payload:

 {"username":"user","password":"pwd","vdom":"root"}

Step 2: Encode using Base64.

Encode the string using Linux, macOS, or online tools.

Linux / macOS Command:

 echo -n '{"username":"user","password":"pwd","vdom":"root"}' | base64

Or use Base64 Encode and Decode - Online on a Windows machine. 

Example Output:

eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJmb3J0aW5ldCIsInZkb20iOiJyb290In0=

Step 3: Use in API request.

Include the encoded value in the Authorization header when making API calls.

Sample API call:

curl -k -X GET "https://<FortiWeb-IP>/api/v2.0/cmdb/system/interfaces" \
-H "accept: application/json" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "Authorization: eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJmb3J0aW5ldCIsInZkb20iOiJyb290In0="