Fortinet black logo

Handbook

Configuring an API Gateway User

Configuring an API Gateway User

1. Go to Web Application Firewall > API Gateway.

2. Click the API Gateway User tab.

3. Click Create New to display the configuration editor and set up the configuration.

4. Save the configuration.

Settings

Guidelines

Name

Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. Whitespaces are not allowed. After you initially save the configuration, you cannot edit the name.

Comments

(Optional) Enter a description or comments for the user.

UUID

Non-editable. Automatically generated when the user is created.

API Key

Non-editable. Automatically generated when the user is created.

Restricted Access IPs

Restrict this API key so that it may only be used from the specified IP addresses.

Restrict HTTP Referers

Restrict this API key so that it may only be used when the specified URLs are present in the Referer HTTP header. This can be used to prevent an API key from being reused on other client-side web applications that don’t match this URL.

Only full URLs that begin with http:// or https:// are supported.

Configuring an API Gateway User

1. Go to Web Application Firewall > API Gateway.

2. Click the API Gateway User tab.

3. Click Create New to display the configuration editor and set up the configuration.

4. Save the configuration.

Settings

Guidelines

Name

Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. Whitespaces are not allowed. After you initially save the configuration, you cannot edit the name.

Comments

(Optional) Enter a description or comments for the user.

UUID

Non-editable. Automatically generated when the user is created.

API Key

Non-editable. Automatically generated when the user is created.

Restricted Access IPs

Restrict this API key so that it may only be used from the specified IP addresses.

Restrict HTTP Referers

Restrict this API key so that it may only be used when the specified URLs are present in the Referer HTTP header. This can be used to prevent an API key from being reused on other client-side web applications that don’t match this URL.

Only full URLs that begin with http:// or https:// are supported.