Fortigate Cloud API all devices endpoint not accessible anymore

[Tfromcube]

Good day! For monitoring purposes, we set up a custom integration with the Fortigate Cloud API. A couple of months ago, our custom integrations stopped working. Authentication still succeeds so it's not a credential/auth issue.

We noticed that the following endpoint does not return any data anymore: 

https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices

 Instead we are hit with the following error:

{"error":"invalid_client","error_description":"Authentication failed","error_code":-1}

This error indicated invalid_client (we used fortigatecloud as per the docs). Even stranger is the fact that we can query the API enpoints for individual devices by specifying the gate's SN.

https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices/FGT40FXXXXXX

This proves that my access_token is valid and can authenticate against the API endpoints (again: with client_id: fortigatecloud). The fact we get a valid response also confirms to me that it's not a network issue on our end.

Anyone have any similar issues/is able to replicate the issue in their env? Either this endpoint broke or has been changed. I have a FDN account and have full access to the endpoints. Thanks all for any suggestions.

[joshbergm]

Well... I don't think that this will solve your issue since it's a complete different software package but maybe worth a try

Client authentication failed since few months · Issue #37 · sendpulse/sendpulse-rest-api-php

[pciurea · Accepted solution]

Hi T,

Can you add "?account_id=XXXX" to the end of the URL and check?
You can find the account ID by logging in the support site.

The following should work if you switched to using OU's on the support site. 

https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices?account_id=XXXX

Thanks

Petre

[Tfromcube]

Hi Petre, that did the trick indeed, thanks!. Is this change documented anywhere? I fear other endpoints might have been changed as well such as:

https://euapi.fortigate.forticloud.com/forticloudapi/v1/fgt/FGT60F2xxxxxxx/api/v2/monitor/firewall/policy

==> BASE URL + /v1/fgt/{sn}/{FortiOS API Path}.

This usually allows us to perform GET requests on our gates through Fortigate Cloud API authn. However, I get the same error when trying to query that endpoint:

{"error":"invalid_client","error_description":"Authentication failed","error_code":-1}

Thanks for the reply!

[Tfromcube]

Nevermind above, adding the mentioned suffix to the request worked, I had a typo in my SN earlier ;)