FortiADC declarative API tips and tricks

Question

As someone who played with the Declarative API here are some tips and tricks.

The declarative API can be used for General System settings and creating VirtualServer/RealServer/Pool objects in the default root VDOM or even in specific Vdoms for multitenant systems. You can do manual changes with GUI/CLI or REST-API and they are reflected in the Declarative API when you do GET requests.

As the documentation for it is not much I am making this article.

First see Does FortiADC support Declarative API for VirtualServers? | Community as I have added some useful stuff there as well.

Send all specific vdom real servers and server pools in a single declaration as if not you can get an error that the declarative API is trying delete previously send realservers and pools in a previous declaration.

You can send virtualserver config in the same declarations as the real server and real server pool but the declaration needs to start with the virtual servers first or you can first send all the real servers and server pools in a declaration and then send the Virtualservers that reference the pools. Declarative API does not support just VirtualServers that do not reference existing pools first.

Last tip is if you are using API key to send API commands don’t forget to first do “GET” request as to see the declarative system config and then to copy the API user hashed password in your future Declarative API requests because otherwise after the first POST request with FortiADC system settings you will lose the access as the API admin user will be deleted.

That is from me and it was a pleasure playing with this feature! 😎

filiaks1 · Answer

For some reason I can’t edit my article now😑 There seems to be some “AI” defense or something who knows.For Declarative API you can also use/api/user/login as shown inMy Documentas then you get Authorization header token and when sending system settings you just need to make certain that the user and password exist as to not cut your own access.For API users as shown inCreating REST API administrator users | FortiADC 8.0.3 | Fortinet Document Libraryyou need to include the hash password as otherwise you will recreate the user but with different key and basically you will cut your own access.

FortiADC declarative API tips and tricks

1 reply

For some reason I can’t edit my article now 😑 There seems to be some “AI” defense or something who knows.

For Declarative API you can also use /api/user/login as shown in My Document as then you get Authorization header token and when sending system settings you just need to make certain that the user and password exist as to not cut your own access.

For API users as shown in Creating REST API administrator users | FortiADC 8.0.3 | Fortinet Document Library you need to include the hash password as otherwise you will recreate the user but with different key and basically you will cut your own access.

For some reason I can’t edit my article now 😑 There seems to be some “AI” defense or something who knows.

For Declarative API you can also use /api/user/login as shown in My Document as then you get Authorization header token and when sending system settings you just need to make certain that the user and password exist as to not cut your own access.

For API users as shown in Creating REST API administrator users | FortiADC 8.0.3 | Fortinet Document Library you need to include the hash password as otherwise you will recreate the user but with different key and basically you will cut your own access.

Sign up

Login with SSO

Login to the community

Login with SSO