FortiGate model, serial, firmware version/build, hostname and uptime.

License and FortiGuard contract status. By default returns only the VM license, FortiCare and FortiGuard sections; set all=true for every entitlement. An unlicensed FortiGate-VM reports vm.status=vm_invalid and refuses most other API calls with 401.

How much of the license's object limits is used. The free FortiGate-VM evaluation license allows 1 vCPU, 2 GB RAM and at most 3 interfaces, 3 firewall policies and 3 static routes; this lists what counts against each so you can plan before hitting one.

What this FortiGate is licensed for: free evaluation VM, licensed VM or hardware; whether it reaches FortiGuard; which FortiGuard services (IPS, antivirus, web filter, application control, Internet Service Database, FortiCloud logging...) are licensed, not licensed or expiring within 30 days; and the version and age of each signature database. Tools that need a FortiGuard service check this and say so when it's missing.

Current CPU, memory, disk and session usage.

List interface configuration (IP, mode, role, alias, allowaccess).

Get one interface's full configuration.

Live interface state: link, speed, IP and traffic counters.

Update an interface. Changing the interface this server connects through (its IP, mode or allowaccess) can cut off API access, so double-check those changes.

Administrators currently logged in (GUI, SSH, API) and where from.

Read-only audit of how the FortiGate can be administered: admins without trusted hosts or MFA, the default 'admin' account, API keys, HTTPS/SSH/HTTP/telnet admin access on WAN interfaces, local-in policies, and admin passwords still stored as legacy SHA-256 instead of PBKDF2. Returns findings graded critical/warn/info, each with a suggested fix. The hash check reads a config backup, which the FortiGate logs as a config download; set check_hashes=false to skip it.

Read-only hardening audit: everything audit_admin_access checks, plus admin access on LAN interfaces, local-in coverage, telnet, FortiCloud SSO, crypto and TLS settings, SSL VPN, logging (implicit deny, local-in denies, remote targets, cleartext syslog), password policy, NTP, FortiGuard updates and stale signatures, whether accept policies are protected by security profiles, and HA heartbeat hardening. Each finding carries the order to fix it in and whether the fix can cut off admin access, and fix_plan lists them in that order. On the evaluation license it lists the FortiGuard features that don't apply and what to rely on instead. check_hashes reads a config backup, as in audit_admin_access.

Back up the full running configuration (FortiOS CLI text) to a local file and return its path and size. Allowed in read-only mode. Configs are hundreds of KB, so the text itself is not returned.

Show or hide the 'Migrate Config with FortiConverter' step of the GUI's FortiGate Setup popup. Without hide, only reports the current state. FortiGate-VM evaluation licenses are not eligible for FortiConverter, so that step never completes and the popup reappears at every login until it is hidden. There is no CLI equivalent.

Activate the free permanent evaluation license on an unlicensed FortiGate-VM by logging in to FortiCloud from the FortiGate (the same call the GUI makes). The FortiCloud account comes from the FORTICLOUD_ACCOUNT and FORTICLOUD_PASSWORD environment variables, never from tool arguments. The FortiGate reboots to apply it. Unlicensed VMs refuse most API calls, so use session auth (FORTIGATE_USERNAME/PASSWORD) on a fresh VM. FortiCare error 10 means wrong credentials, an IAM sub-user, or 2FA on the account.

High availability: the mode (standalone, active-passive, active-active), group, heartbeat interfaces and monitored interfaces, each cluster member with its role, priority and uptime, and whether members' configurations are in sync. Flags out-of-sync members, unencrypted or unauthenticated heartbeats, a single heartbeat interface and no session pickup.

FortiTokens on the FortiGate (serial, status, license) and which administrators use two-factor authentication, by which method and token. Tokens are activated through FortiGuard, so the evaluation license has none.

Turn on two-factor authentication for an administrator: fortitoken (needs an activated token serial), email (needs email_to and a working email server) or sms (needs sms_phone and SMS service); or disable it. Checks the prerequisites first. dry_run (the default) shows the change. Test a login in a private window before closing your current session.

Whether FortiGuard updates are actually reaching this FortiGate: connection state, each FortiGuard server's reachability and packet loss, the update schedule, which services are licensed, and how old each signature database is. Adds findings for failing servers, stale signatures on licensed services and a disabled update schedule. On the free evaluation license it says that FortiGuard is unavailable by design.

Ask the FortiGate to contact FortiGuard now and refresh its entitlements and signature packages (the GUI's 'Check update now'). Needs a FortiGuard license. With dry_run (the default) it only reports what would happen and the current signature ages.

Running firmware (version, build, maturity, release notes), newer images FortiGuard offers, the supported upgrade path, and the automatic firmware upgrade settings. Images and upgrade paths come from FortiGuard, so the evaluation license lists none; check https://www.fortiguard.com/psirt for the running release by hand there.

List IPv4 firewall policies in evaluation order.

Get one firewall policy.

Create a firewall policy. New policies are added at the end of the list; use move_firewall_policy to reorder. FortiGate-VM evaluation licenses allow only 3 policies.

Update a firewall policy. Only the fields given change; list fields are replaced, not appended.

Delete a firewall policy.

Move a policy before or after another one (policies match top-down).

Hit counts, bytes, packets and last-used time per policy.

Current sessions through the firewall, optionally filtered, with the matched and total session counts. Sessions to the FortiGate itself (admin GUI/API) may be counted but not listed.

List firewall address objects.

Get one firewall address object.

Create a firewall address: a subnet/host, an IP range, or an FQDN.

Update a firewall address object.

Delete a firewall address (fails while a policy or group still uses it).

List firewall address groups and their members.

Create an address group.

Update an address group. members replaces the whole member list.

Delete an address group (fails while a policy still uses it).

List custom firewall services (port definitions).

Create a custom TCP/UDP service.

List service groups and their members.

Create a service group, e.g. K3S-MGMT = [SSH, K8S-API, PING]. Grouping services lets one policy cover what would otherwise need several, which helps under the evaluation license's 3-policy limit.

Update a service group. members replaces the whole member list.

Delete a service group (fails while a policy still uses it).

Delete a custom service (fails while a policy still uses it).

List virtual IPs (port forwards / static NAT) and the policies that use each one.

Create a port forward (VIP): traffic arriving on extintf at extip:extport goes to mappedip:mappedport. A VIP only passes traffic once a policy from extintf uses it as a destination. With attach_to_policy, the VIP is added to that existing policy's destinations instead of needing a new policy (the evaluation license allows only 3). FortiOS does not allow VIPs and ordinary addresses in the same policy's destinations, so the target must already use only VIPs, or pass replace_destinations=true to turn it into a VIP-only policy (its old destinations stop being reachable through it). In that policy, services match the mapped (internal) port.

Delete a VIP. FortiOS refuses while a policy uses it; detach=true first removes it from every policy's destinations. A policy whose only destination is this VIP blocks the delete: change or delete that policy first.

Search application-control signatures by name (contains, case-insensitive) and/or category, e.g. query=YouTube or category=P2P. Returns id, name, category and risk.

Application-control categories (id and name), e.g. P2P, Proxy, Game, Video/Audio.

App-control profiles with their rules, showing application and category names instead of ids.

Add a rule to an app-control profile matching applications and/or categories by name (or id). Rules are checked top-down and the built-in profiles start with a catch-all pass rule, so new rules are inserted at the top by default (position=bottom to append). Only affects policies whose application_list is this profile.

Remove a rule from an app-control profile by its id (see list_app_control_profiles).

Security profiles by kind (ips, antivirus, webfilter, dnsfilter, application, emailfilter, dlp, file-filter, waf, videofilter, ssh-filter, virtual-patch), each with the firewall policies that use it, and whether the FortiGuard service behind the kind is licensed (and what the profile can still do if not). Read or change a profile's settings with get_config / set_config on the endpoint shown.

Check that accept policies are actually protected: traffic from or to a WAN interface with no IPS sensor, profiles attached while security profiles are disabled on the policy, antivirus/DLP/file filter with an inspection profile that can't see inside HTTPS, profiles whose FortiGuard service isn't licensed, and policies that don't log. Read-only.

List SSL/SSH inspection profiles with the CA each one re-signs with. The built-in no-inspection, certificate-inspection and deep-inspection profiles are read-only; edit custom-deep-inspection or a copy instead.

Update an SSL/SSH inspection profile, e.g. the CA used to re-sign certificates during deep inspection. Clients must trust that CA, and FortiGate-VM evaluation licenses re-sign RSA sites with 512-bit keys regardless of the CA, which modern clients reject.

List local and CA certificates with key type and size, validity and usage flags. Certificates with RSA keys under 2048 bits are flagged weak: FortiGate-VM evaluation licenses generate 512-bit factory certificates. Bundled public CAs are omitted unless include_bundle is true.

Download a certificate's PEM (public part only), e.g. the deep-inspection CA Fortinet_CA_SSL so clients can be told to trust it. Returns the PEM and its SHA-256 fingerprint.

Live FortiView summary of the sessions passing through right now, grouped by source, destination, application, country, interface, policy or protocol. Destinations include the resolved hostname; application IDs are translated to names. Empty when nothing is flowing (it reflects current sessions, not history).

IPv4 ARP table: which MAC answers for which IP on each interface.

Read FortiGate logs, newest first. Useful types: traffic/forward (sessions through policies, with app identification), app-ctrl (per-connection application and, with certificate inspection, the HTTPS hostname), event/system (admin and config events), ips, webfilter. FortiGate-VMs without a log disk only keep logs in memory, which is lost on reboot.

Where logs go: each syslog server (up to 4), FortiAnalyzer (up to 3), FortiGuard Cloud, local disk and memory, with transport and encryption. Flags logs that only live in memory (lost on reboot), syslog sent as cleartext UDP, and FortiAnalyzer without certificate verification.

Send logs to a syslog server: sets server, port and transport on one of the four syslog slots and enables it. mode is udp (default), reliable (TCP) or legacy-reliable; with reliable, enc_algorithm (high, high-medium, low) adds TLS. Validated against the FortiGate's schema; dry_run (the default) shows the change without sending it.

Active IPv4 routing table (connected, static, DHCP-learned and dynamic routes).

List configured static routes.

Add a static route. FortiGate-VM evaluation licenses allow only 3 routes.

Delete a static route by its sequence number (seq-num from list_static_routes).

System DNS settings: upstream resolvers the FortiGate itself uses and forwards to.

Interfaces where the FortiGate answers DNS queries, and in which mode.

Serve DNS on an interface. Modes: recursive (local zones first, then forward to the system resolvers), non-recursive (local zones only), forward-only.

Stop serving DNS on an interface.

List local DNS zones (dns-database) with their records.

Create a local DNS zone. view=shadow serves internal clients. FortiOS does not accept wildcard (*) hostnames, so add one record per name.

Delete a local DNS zone and all its records.

Add a record to a local DNS zone. Wildcard (*) hostnames are rejected by FortiOS.

Delete a record from a local DNS zone by its id (see list_dns_zones).

List DHCP servers with their ranges, options and reservations.

Current DHCP leases handed out by the FortiGate.

Update a DHCP server. Note: vci_match=true makes the server answer only clients whose vendor class matches vci-string (FortiOS defaults to FortiSwitch/FortiExtender), which silently ignores ordinary clients.

Reserve an IP for a MAC address on a DHCP server (the IP may sit outside the pool).

Remove a DHCP reservation by its id (see list_dhcp_servers).

Find FortiOS API endpoints by keyword, from the FortiGate's own schema: configuration (cmdb, e.g. 'bgp' -> router/bgp) and live state (monitor, e.g. 'ha peer' -> system/ha-peer). Use it to reach any setting no dedicated tool covers, then describe_config, get_config, set_config or get_monitor.

Describe a configuration endpoint from the FortiGate's schema: whether it is a table (many entries, keyed by mkey) or a single settings object, and each field's type, allowed values, range and default. Pass field for one field in full, including the sub-fields of a nested table.

Read any configuration endpoint: a whole settings object, every entry of a table, or one entry by mkey. Password and key fields are shown as '', never their values.

Change any configuration endpoint, validated against the FortiGate's schema first: field names, option values, integer ranges, string lengths, and table vs single-object rules. action is update (default), create or delete. With dry_run (the default) nothing is sent; the result shows the request and each field's current and new value. Fields that reference other objects take a list of names, e.g. srcaddr: ['LAB-NET'].

Read any monitor (live state) endpoint, e.g. system/ha-peer, router/ipv4, vpn/ipsec, user/firewall. Only endpoints FortiOS serves with GET are allowed: monitor POST endpoints act on the device (reboots, disconnects, updates), so they stay in the dedicated tools or fortigate_api.

Call any FortiOS REST endpoint directly. path must start with /api/v2/ (cmdb/... for configuration, monitor/... for live state). FORTIGATE_READ_ONLY still applies. Prefer the dedicated tools when one exists.