Fortinet black logo

REST API Solution Guide

Fabric authenticate (/fabric/authenticate)

Fabric authenticate (/fabric/authenticate)

URL: https://[server_name]/api/fabric/authenticate

This endpoint is used to deliver an access_token to FortiOS to integrate the FortiAuthenticator as a Fortinet Security Fabric device. Currently, these tokens do not expire, as long as the access token expiry of the default FortiOS fabric application remains at zero.

Supported fields

Field Display name Type Required Other restrictions
username Administrator password string Yes, unless refreshing token

User should not require multi-factor authentication, and must have Widget read/write permissions or full permissions.

password Administrator password string Yes, unless refreshing token
grant_type OAuth grant type string If refreshing token
refresh_token OAuth refresh token string If refreshing token

Note: Currently, FortiOS is not configured to refresh the token, so the token does not expire. Therefore, the refresh tokens that result from the application are set to zero.

Allowed methods

HTTP method Resource URI Action
POST /api/fabric/authenticate Get token, or refresh token

Note:

  • If the user requires multi-factor authentication, this is bypassed when issuing an OAuth token. FortiOS does not yet prompt for additional challenges after the username and password.
  • If your username is in email address format, and your Username/Realm format under Authentication > Self-Service Portal > Access Control uses the '@' symbol, ensure that you specify the realm. E.g. user@name.com@realm
  • If authenticating multiple FortiOS devices with the Security Fabric endpoint, copy and paste the token from the first authentication onto subsequent devices. Authenticating will generate a new token.

Response codes

In addition to the general codes defined in General API response codes, a POST request to this resource can also result in the following return codes:

Code Response content Description
200 OK Valid credentials
401 Unauthorized Invalid credentials, or user improperly configured.

Example

Get token:

curl -k -v -X POST \

https://[FortiAuthenticator_IP]/api/fabric/authenticate \

-H 'Content-Type: application/json' \

-d '{

"username": "tfadmin",

"password": "12345678"

}'

Response:

{

"access_token": "shrWNdu1xJRUgpcUi2bhYRX1Sl8pXe",

"expires_in": 0,

"message": "successfully authenticated",

"refresh_token": "tU85BMdOoV3pktSSiLaABJN7ySiADZ",

"scope": "read",

"success": "true",

"token_type": "Bearer"

}

Refresh a token (for future reference):

curl -k -v -X POST \

https://[FortiAuthenticator_IP]/api/fabric/authenticate \

-H 'Content-Type: application/json' \

-d '{

"grant_type": "refresh_token",

"refresh_token": "Y53b5XCLUdjkHVH49ZSheYQjafn6EV"

}'

Response:

{

"access_token": "fzMK69MdyA0vRJXh2CWnuHRcpuQrpL",

"expires_in": 0,

"message": "Token has been refreshed successfully",

"refresh_token": "UqCV1xEPSoq4vSLE0YgXAkF2zzMGO5",

"scope": "read",

"success": "true",

"token_type": "Bearer"

}

Fabric authenticate (/fabric/authenticate)

URL: https://[server_name]/api/fabric/authenticate

This endpoint is used to deliver an access_token to FortiOS to integrate the FortiAuthenticator as a Fortinet Security Fabric device. Currently, these tokens do not expire, as long as the access token expiry of the default FortiOS fabric application remains at zero.

Supported fields

Field Display name Type Required Other restrictions
username Administrator password string Yes, unless refreshing token

User should not require multi-factor authentication, and must have Widget read/write permissions or full permissions.

password Administrator password string Yes, unless refreshing token
grant_type OAuth grant type string If refreshing token
refresh_token OAuth refresh token string If refreshing token

Note: Currently, FortiOS is not configured to refresh the token, so the token does not expire. Therefore, the refresh tokens that result from the application are set to zero.

Allowed methods

HTTP method Resource URI Action
POST /api/fabric/authenticate Get token, or refresh token

Note:

  • If the user requires multi-factor authentication, this is bypassed when issuing an OAuth token. FortiOS does not yet prompt for additional challenges after the username and password.
  • If your username is in email address format, and your Username/Realm format under Authentication > Self-Service Portal > Access Control uses the '@' symbol, ensure that you specify the realm. E.g. user@name.com@realm
  • If authenticating multiple FortiOS devices with the Security Fabric endpoint, copy and paste the token from the first authentication onto subsequent devices. Authenticating will generate a new token.

Response codes

In addition to the general codes defined in General API response codes, a POST request to this resource can also result in the following return codes:

Code Response content Description
200 OK Valid credentials
401 Unauthorized Invalid credentials, or user improperly configured.

Example

Get token:

curl -k -v -X POST \

https://[FortiAuthenticator_IP]/api/fabric/authenticate \

-H 'Content-Type: application/json' \

-d '{

"username": "tfadmin",

"password": "12345678"

}'

Response:

{

"access_token": "shrWNdu1xJRUgpcUi2bhYRX1Sl8pXe",

"expires_in": 0,

"message": "successfully authenticated",

"refresh_token": "tU85BMdOoV3pktSSiLaABJN7ySiADZ",

"scope": "read",

"success": "true",

"token_type": "Bearer"

}

Refresh a token (for future reference):

curl -k -v -X POST \

https://[FortiAuthenticator_IP]/api/fabric/authenticate \

-H 'Content-Type: application/json' \

-d '{

"grant_type": "refresh_token",

"refresh_token": "Y53b5XCLUdjkHVH49ZSheYQjafn6EV"

}'

Response:

{

"access_token": "fzMK69MdyA0vRJXh2CWnuHRcpuQrpL",

"expires_in": 0,

"message": "Token has been refreshed successfully",

"refresh_token": "UqCV1xEPSoq4vSLE0YgXAkF2zzMGO5",

"scope": "read",

"success": "true",

"token_type": "Bearer"

}