query_device_api
Read a FortiOS REST API path on a managed device through FortiManager to retrieve live monitor state or running configuration, with no direct route or credentials needed.
Instructions
Read a diagnostic FortiOS REST API path on a managed device through FortiManager.
Proxies a GET through /sys/proxy/json, so the device needs no direct
route or credentials. Use it for what no dedicated tool covers: live state
from monitor paths, the running configuration from cmdb paths.
Read-only: only GET is sent, and only to an allowlist of paths (each
with everything below it): monitor system status/resource/interface/
ha-peer/dhcp/link-monitor, router (ipv4, lookup, bgp, ospf, ...), network
arp/lldp, firewall session/policy hit counts, vpn ipsec/ssl, virtual-wan,
switch-controller managed-switch/status and detected-device, wifi clients
and APs,
user device/firewall; cmdb firewall, router, system interface/zone/sdwan/
ha/global/dns/snmp, vpn.ipsec, switch-controller, wireless-controller,
user group and the security profiles. Anything else, and every file
export or dump, is refused with the full list. Secrets are redacted by
field name and value, SNMP community strings included, and params
accepts the listed query parameters only.
Args:
path: API path without query string, e.g.
/api/v2/monitor/router/ipv4 or /api/v2/cmdb/firewall/address
device: Managed device name. Defaults to DEFAULT_DEVICE when omitted.
adom: ADOM name (default: DEFAULT_ADOM or "root")
vdom: VDOM to query (default: the device's own default)
params: Query parameters, from: count, datasource, destination,
exclude-default-values, filter, format, include_vlan, ip_version,
key, pattern, scope, skip, sort, source, start, summary, with_meta.
Use count and format to keep large tables small, e.g.
{"count": 50, "format": "name|subnet"}. filter applies to
cmdb paths; monitor/firewall/session ignores it and takes
source or destination.
The row selectors ``filter``, ``key``, ``pattern`` and ``sort``
are refused where they could reveal what the response hides: on
SNMP community tables (any ``community``/``snmp-community``
segment, anything under ``system.snmp``), on a field whose name
marks a secret (``filter=password=@a``), and entirely while
output masking is on, since a substring match or a sort on an
address field recovers a masked address one query at a time.
``filter`` must be ``field<op>value`` clauses joined by commas
(ops ``==``, ``!=``, ``=@``, ``!@``, ``<``, ``<=``, ``>``,
``>=``); a comma inside a value is refused, not guessed at.
``source``/``destination`` stay available with masking on: they
take one whole address, the same exact lookup
``get_device_client_location`` accepts.Returns: dict with keys: - adom, device, path - http_status, version, build: as reported by the device - results: the device's answer, secrets redacted - error / error_code: on failure
Example: >>> await query_device_api("/api/v2/monitor/router/bgp/neighbors", "branch1")
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"path": "<path>"
},
"name": "query_device_api"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| adom | No | ||
| path | Yes | ||
| vdom | No | ||
| device | No | ||
| params | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||