Technical Tip: How to create a REST API Admin user and assign it to an admin profile

Description

This article describes how to deploy a REST API Admin user and change the super_admin_readonly profile by default to perform a full backup.

Scope

FortiGate.

Solution

1. Go to System -> Administrators -> Create New -> REST API Admin.

Note:
When trying to create the REST API Admin user, a non-super_admin user will not see the option to create a 'REST API Admin' via CLI or GUI.

Example scenario:
Go to System -> Administrators -> Create New -> The REST API Admin selection is grayed out because the "adminprof" user is not super_admin. 

2. Create the user, in this example 'test_api'. Do not forget to copy the API Key when backing up the config file.

In case a new API key needs to be generated, it can be regenerated:

Change the profile by CLI:

config system api-user
    edit test_api
        set accprofile "super_admin_readonly"    
(test_api) # set accprofile super_admin         
end

Note:
If the API user was created through the GUI, the super_admin access profile cannot be assigned from the GUI. To change the API user's access profile to super_admin, use the CLI as shown above.

To create an API user via CLI:

config system api-user
    edit test_api
        set api-key ************
        set accprofile super_admin
        set vdom "root"
    end 

Generate the API token: 

execute api-user generate-key <API username>

Starting with FortiOS v7.6.x, it is also possible to add the expiry date of the API key. 

execute api-user generate-key <API username> <expiry time>

For example: 

execute api-user generate-key test_api 480 

The last parameter (480) is optional and specifies the API key expiration time in minutes. If omitted, the generated API key does not expire.

Note:
Do not forget that if the configuration file is backed up with a super_admin_readonly, all configurations will not be visible.

When Trusted Hosts are configured, the API client's IP address must be included in the Trusted Host list for both the System Administrator and the System API User to ensure successful API access.

Related documents:

execute api-user

REST API administrator