Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kartofflarna
New Contributor

Rest api usage

Hi,

 

I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.

 

So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.

 

testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"

But I get no response.

 

The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference

I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.

 

I'm sure I'm just missing something, can someone here see any obvious signs?

3 Solutions
nelis99
New Contributor II

If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).

$fwaddress = "192.168.1.99"

$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')

$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content

View solution in original post

alk0v
New Contributor

Hi, all. Next example working with FG-300 v.5.4 and PHP

 

 

$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";

$url = '[link]https://'.$fghost.'/logincheck';[/link]

$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);

 

$curl_connection = curl_init($url);

 

curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);

 

$response = curl_exec($curl_connection);

 

preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);

 

$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);

echo ($responce);

 

curl_close($curl_connection);

 

View solution in original post

oheigl
Contributor II

Hi,

 

remove the GET parameter, it's not needed if you pass the API key via the header:

curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"

 

Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):

 

diag debug application httpsd -1
diag debug enable

 

And please upgrade your Firmware version, in 5.6.3 everything could be a bug 

View solution in original post

32 REPLIES 32
Irfan_Pathan
New Contributor III

Hi, Create api user, You will get api key token.

then  curl -k https://<deviceipaddress>/api/v2/cmdb/firewall/address?vdom=root&access_token=<apikeytokenhere>

nbctcp
New Contributor III

 

SW INFO: -fortigate version

Version: FortiGate-VM64-KVM v6.2.1,build0932,190716 (GA)

 

CONFIG:

# show system api-user config system api-user edit "api-admin" set api-key ENC SH2PPzcc9QjwfKbZt65EU5ufPXSGvnazXmEJatKySDyFiAUjmbEk0ZEKRbXG2Q= set accprofile "super_admin" set vdom "root" config trusthost edit 1 set ipv4-trusthost 10.0.1.70 255.255.255.255 next end next end

 

PROBLEMS: # curl -k http://10.0.1.51/api/v2/c...x4gwhH53jb551QrbQwkG58 [1] 28518 root@eve-ng:~# <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>401 Authorization Required</TITLE> </HEAD><BODY> <H1>Authorization Required</H1> This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.<P> <P>Additionally, a 401 Authorization Required error was encountered while trying to use an ErrorDocument to handle the request. </BODY></HTML>

 

QUESTIONS:

1. I got above error with those config, although I am using super_admin profile

What's wrong with step?

In curl, I can only using http because  I am using trial license

 

tq

http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
emnoc
Esteemed Contributor III

Pass the header  in the header field.

 

https://socpuppet.blogspot.com/2019/09/howto-use-fortios-apiuser.html

 

Header set with curl and "-H" option, this is required.

 

"Authorization: Bearer 6qQyk7Q3Hpz8k6z74161xG0Q5GNkpn" 

 

BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.

 

Ken Felix

 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Jordan_Thompson_FTNT

emnoc wrote:

 

BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.

 

This is correct - API keys can only be used over HTTPS.

nbctcp
New Contributor III

@emnoc

I am following your way, but I still got error 403

Here my steps

STEPS TAKEN https://github.com/Nevets82/Posh-FortiGate config system accprofile     edit "readonly_admin"         set mntgrp read         set admingrp read         set updategrp read         set authgrp read         set sysgrp read         set netgrp read         set loggrp read         set routegrp read         set fwgrp read         set vpngrp read         set utmgrp read         set wanoptgrp read         set endpoint-control-grp read         set wifi read     next end   config system admin         edit readonly_user         set trusthost1 192.168.88.70 255.255.255.255         set accprofile readonly_admin         set comments "User for PowerShell backup and troubleshooting tasks"         set vdom root         set password P@ssw0rd     next end   config system api-user    edit api-readonly_user    set accprofile readonly_admin    set vdom root    config trusthost    edit 1    set ipv4-trusthost 192.168.88.70 255.255.255.255    end end   # execute api-user generate-key api-readonly_user New API key: mrfQbbhnwsp39HQmtkjw4N6HxyNgmm NOTE: The bearer of this API key will be granted all access privileges assigned to the api-user api-admin.   # cat fortibackup.sh #/bin/bash IP=192.168.88.41 TOKEN=mrfQbbhnwsp39HQmtkjw4N6HxyNgmm D=`date +%F_%T` curl  -k -o $IP-$D.conf  -H  "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup/?scope=global&amp;access_token=$TOKEN" exit   PROBLEMS: # ./fortibackup.sh # cat 192.168.88.41-2019-11-21_14\:58\:15.conf {   "http_method":"GET",   "status":"error",   "http_status":403,   "vdom":"root",   "path":"system",   "name":"config",   "action":"backup",   "serial":"FGT80C3909631394",   "version":"v5.6.3",   "build":1547 }   QUESTIONS: [ol]
  • I still got error 403 code [/ol]Which steps I am missing   tq

     

    emnoc wrote:

    Pass the header  in the header field.

     

    https://socpuppet.blogspot.com/2019/09/howto-use-fortios-apiuser.html

     

    Header set with curl and "-H" option, this is required.

     

    "Authorization: Bearer 6qQyk7Q3Hpz8k6z74161xG0Q5GNkpn" 

     

    BTW, I'm like 100% sure the API will not work over HTTP, but double-check. In real life nobody will send credentials over unsecured HTTP.

     

    Ken Felix

     

     

    Ken Felix

  • http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
    oheigl
    Contributor II

    Hi,

     

    remove the GET parameter, it's not needed if you pass the API key via the header:

    curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"

     

    Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):

     

    diag debug application httpsd -1
    diag debug enable

     

    And please upgrade your Firmware version, in 5.6.3 everything could be a bug 

    nbctcp
    New Contributor III

    You are correct guru

    1. modify accprofile mntgrp

    -turn on debug

    diag debug application httpsd -1 diag debug enable

    I can see, maintenance group complain about write permission

    -modify

    config system accprofile     edit "readonly_admin"         set mntgrp read change to config system accprofile     edit "readonly_admin"         set mntgrp read-write   2. modify this curl  -k -o $IP-$D.conf  -H  "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup/?scope=global"   RESULT: 1. I can get the config but not full config. How do I know that, because full config usually 500kb, while this is 125kb   QUESTIONS: 1. How to get full config
    http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
    oheigl
    Contributor II

    I don't think it's possible, because you can't even select something like that via the GUI, only via CLI.

     

    But the full configuration just adds all the default values, so it's not useful anyway, or what would you like to achieve?

    nbctcp
    New Contributor III

    Full configuration is useful in case I need to keep my public key.

    Public key won't appear in standard config.

    Unless I need to take note which Fortigate has public key and what the key

     

    QUESTIONS: 1. beside Public key. In what case do I need full-config actually I am curios why full-config is created.

    Must a  be a reason for that

    2. Can I restore using full-config

    tq

    http://goo.gl/lhQjmUhttp://nbctcp.wordpress.com
    oheigl
    Contributor II

    I just tried a configuration backup and the certificate with the public and private key is in there, without a full configuration. The full configuration is useful to check if default values have changed or something like that, but other then that I can't see a reason why you would need it. Maybe in older FortiOS versions the keys weren't backuped, can't remember exactly.

     

    Kind regards

    Labels
    Top Kudoed Authors