Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kartofflarna
New Contributor

Rest api usage

Hi,

 

I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls.

 

So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat.

 

testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"

But I get no response.

 

The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no difference

I cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not.

 

I'm sure I'm just missing something, can someone here see any obvious signs?

3 Solutions
nelis99
New Contributor II

If anyone is interested here is a powershell call for it as well (@markonans tx for curl example to build from).

$fwaddress = "192.168.1.99"

$postParams = @{username='myadminacct';secretkey='PASSWORD'} $request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/logincheck" -SessionVariable fgtSession -Method POST -Body $postParams

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]" $headers.Add('Accept','application/json') $headers.Add('Content-Type','application/json')

$request = Invoke-WebRequest -Headers $headers -Uri "https://$fwaddress/api/v2/monitor/router/ipv4/" -WebSession $fgtSession -Method GET write-host $request.Content

View solution in original post

alk0v
New Contributor

Hi, all. Next example working with FG-300 v.5.4 and PHP

 

 

$fghost = "myfg.loc"; $fglogin = "admin"; $fgpass = "supersecret";

$url = '[link]https://'.$fghost.'/logincheck';[/link]

$data = array('username'=>$fglogin,'secretkey'=>$fgpass); $post_data = http_build_query($data);

 

$curl_connection = curl_init($url);

 

curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_POST, TRUE); curl_setopt($curl_connection, CURLOPT_POSTFIELDS, $post_data); curl_setopt($curl_connection, CURLOPT_RETURNTRANSFER, TRUE); curl_setopt($curl_connection, CURLOPT_HEADER, TRUE);

 

$response = curl_exec($curl_connection);

 

preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $response, $matches);

 

$curl_connection = curl_init('[link]https://'.$fghost.'/api/v2/cmdb/firewall/vip/');[/link] curl_setopt($curl_connection, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($curl_connection, CURLOPT_COOKIE, $matches[1][0]); $response = curl_exec($curl_connection);

echo ($responce);

 

curl_close($curl_connection);

 

View solution in original post

oheigl
Contributor II

Hi,

 

remove the GET parameter, it's not needed if you pass the API key via the header:

curl -k -o $IP-$D.conf -H "Authorization: Bearer $TOKEN" "https://$IP/api/v2/monitor/system/config/backup?scope=global"

 

Also you can have a look at the debug on the FortiGate (connect via SSH since GUI is also making API requests):

 

diag debug application httpsd -1
diag debug enable

 

And please upgrade your Firmware version, in 5.6.3 everything could be a bug 

View solution in original post

32 REPLIES 32
kartofflarna
New Contributor

That was a bad example I'm so frustrated I've been trying around with anything I can find on the web, that particular line and document is for the fortiweb appliance. I'm starting to doubt the very existance of the rest api on the fortigate, does it exist or did I dream?

kartofflarna

So I found out it is working but I only have access from the browser on 

https://192.168.1.99/api/v2/monitor/system/interface However I am not able to curl it with:

curl -H "Authorization: YWRtaW46" -k "https://192.168.1.99/api/v2/monitor/system/interface"

 

I get a 401 Authorization required

kartofflarna

All the admin guides I find seem to be off, I dont think the firewall accepts basic authentication, does anyone know the url to create an authentication token?

pcraponi

Hi,

 

Official API documentation is paid.... The product is "Fortinet Developer Network" https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Developer_Network.pdf

 

But... you can start accessing "/logincheck" on your fortigate device to generate the authentication token for the REST API ;)

 

 

Regards,

Paulo Raponi, NSE8

Regards, Paulo Raponi

Regards, Paulo Raponi
kartofflarna

hmm okay, will mess around with that some more initial test just gave me 302 error though.

MikePruett

The API is wicked awesome and incredibly powerful. You have to have the developer network to get the great prebuilt tools etc that exist (saves you SO MUCH TIME).

 

I witnessed a wonderful demo of it at the Fortinet XTreme Team 2016 USA event.

Mike Pruett Fortinet GURU | Fortinet Training Videos
chrisp

the only way to use API is to pay ?

 

do I understand it correctly? 

if not why is it so difficult to find the correct format for curl with authentication?

 

 

 

Baptiste

No, if you know two FTNT guys, you can join for free for a basic access :

https://fndn.fortinet.net/index.php?/login/

 

https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/Fortinet_Developer_Network.pdf

2 FGT 100D  + FTK200

3 FGT 60E  FAZ VM  some FAP 210B/221C/223C/321C/421E

2 FGT 100D + FTK200 3 FGT 60E FAZ VM some FAP 210B/221C/223C/321C/421E
arosenblatt

So, I went to sign up for the FDN since I desperately need this API that doesn't appear to to be mentioned in any of the docs I've read. On the sign-up form is this: "All new accounts require two Fortinet Sponsors. Sponsors are Fortinet employees that can confirm your identity and validate your need for an FNDN account. Please enter emails of your Sponsors in the fields below." Are you kidding me? I need Fortinet employee sponsorship (plus apparently paying, based on the PDF linked earlier in this thread) to gain access to the API docs and tools for the devices we've already purchased? I can't even find mention of the developer network on the main Fortinet web site.  So, what's the next step here for a pleb like me?

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors