API request of new token

[AskingForHelp]

So far I am able to retrieve a new API token via the GUI and by using the CLI methods. Would like however to retrieve a new API token via the POST method. Read the documentation from the link below and followed by using a POST /api/v2/monitor/system/api-user/generate-key?vdom=root and a body with

{'api-user':"api-admin"}

https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/100/ 

This for only returns a 401 unauthorized. How then can proper authorization be included?

Appreciate it

[pminarik]

The API documentation states you need sysgrp.admin permission (System>Administration Users in the GUI's terminology). Does your account have that?

Additionally, I imagine there might also be some additional restrictions such as not being able to generate an API key for a "super_admin" API account. (which could be interpreted as a sort of "privilege escalation" potentially)

[AskingForHelp]

Under System > Administrators > REST API Administrator, this user has super_admin_readonly permissions. Now I have tired admin_noaccess as well but that was a no go.

[pminarik]

And what about the API user making this request?

I did a quick test with 7.0.8, and while the docs say that sysgrp.admin is required, I was only able to generate a new API-key when the requesting api-user was a super_admin. (not even prof_admin (everything read-write) was sufficient).

[AskingForHelp]

Correct the user making the request has been an apiuser. This is v7.2.2 on a FortiWifi 80F-2R. This is the below request. I have given all read/write permissions to the apiuser as well.

[pminarik]

The syntax is good, but I will have to re-iterate my suspicion that the call will most likely only be accepted if the API-user making this request is a super_admin.

[AskingForHelp]

Edited this reply from before. No, the user does not have super_admin from setting the below screenshot settings. Instead super_admin can only be achieved using the CLI. Using this command:

config system api-user

edit apiadmin

set accprofile super_admin

[AskingForHelp]

Hello all

The apiuser has been granted full permissions, including the sysgrp.admin as requested. Still am not getting any success with the API call. Any additional thoughts?

Appreciate it

[pminarik]

I'm sorry but I have to ask again: Have you set the apiuser's (the account that is making the request) access profile to super_admin? Please do note that a profile with full read-write is not equivalent to super_admin.

[AskingForHelp]

Hello,

An administrator Profile called super_admin does not appear under the drop down list when creating a REST API admin. For an Administrator, Local admin it does appear to have super_admin. Why then does super_admin appear missing for REST API admin?