Technical Tip: FortiGate Cloud API: Device endpoints not accessible anymore after switching to OUs in the Support website

[pciurea]

Description	This article describes the behavior where device endpoints are not accessible anymore via API after switching to OUs in the Support site. Custom monitoring or integration scripts that previously worked begin failing with an authentication-related error, despite valid credentials and access tokens. OAuth authentication completes successfully and returns a valid access_token. API calls to individual device endpoints continue to work. API call to retrieve all devices fails: https://XXapi.fortigate.forticloud.com/forticloudapi/v1/devices Error returned: {"error":"invalid_client","error_description":"Authentication failed","error_code":-1}
Scope	FortiGate Cloud API.
Solution	When Organizational Units (OUs) are enabled in the Fortinet Support Portal, the FortiGate Cloud API requires an explicit account context for certain endpoints. The /devices endpoint no longer defaults to a single account and therefore requires the account_id parameter to be specified. Append the account_id query parameter to the /devices endpoint. Corrected endpoint: https://XXapi.fortigate.forticloud.com/forticloudapi/v1/devices?account_id=XXXX Example to EU region: https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices?account_id=XXXX How to find the account ID: Log in to the Fortinet Support Portal. Navigate to account or OU settings. Select the Organization: Locate the Account ID associated with the relevant Organization. Additional notes: This behavior change primarily affects environments that have migrated to OU-based account management. API calls scoped to a specific device serial number do not require the account_id parameter. Existing integrations may need to be updated to include this parameter when querying account-wide resources.