Technical Tip: Monitor Blocked IPs page via REST API

[shafiq23]

Description	This article describes how to use curl/Postman to monitor the FortiView Blocked IPs page on Source IP due to Block Period action using REST API.
Scope	FortiWeb 6.3 and later.
Solution	The blocked IPs page lets the administrator monitor and manage client IP addresses that violate certain protection rules. The client IP address listed on the Blocked IPs page is also automatically removed after the block period duration expires. The blocked IPs page can be monitored using REST API to help the administrator suggest permanent blocklisting and guide adjusting configurations, such as alerts. Prepare cURL commands that meet the required format specifications for the request. Request Method: GET. Host header. Authorization header. Encode the string with BASE64 and use it as an Authorization token. {“username”:”admin”,”password”:“a”,”vdom”:”root”} Example: $ echo ‘{“username”:”admin”,”password”:”fortinet”,”vdom”:”root”}’ | base64 eyJ1c2VybmFtZSI6ImFkbWluIiwicGFzc3dvcmQiOiJmb3J0aW5ldCIsInZkb20iOiJyb290In0K A sample of the cURL command would look like below: curl -k -X GET ‘https://<FWB-IP> /api/v2.0/monitor/blockedips’ -H ‘Authorization:<token>’ -H ‘Content-Type: application/json’ Steps to perform in Postman: Open Postman. Select the Import tab on the upper left side. Paste the cURL command in the import field.   Select the appropriate option to continue. Select Send to post the command.                                                                                REST API result.                                                               FortiView Blocked IPs documentation: Blocked IPs  For more information, refer to FortiWeb RESTful API Reference: FortiWeb REST API Reference