FortiGate model, serial, firmware version/build, hostname and uptime.

License and FortiGuard contract status. By default returns only the VM license, FortiCare and FortiGuard sections; set all=true for every entitlement. An unlicensed FortiGate-VM reports vm.status=vm_invalid and refuses most other API calls with 401.

How much of the license's object limits is used. The free FortiGate-VM evaluation license allows 1 vCPU, 2 GB RAM and at most 3 interfaces, 3 firewall policies and 3 static routes; this lists what counts against each so you can plan before hitting one.

Current CPU, memory, disk and session usage.

List interface configuration (IP, mode, role, alias, allowaccess).

Get one interface's full configuration.

Live interface state: link, speed, IP and traffic counters.

Update an interface. Changing the interface this server connects through (its IP, mode or allowaccess) can cut off API access, so double-check those changes.

Administrators currently logged in (GUI, SSH, API) and where from.

Back up the full running configuration (FortiOS CLI text) to a local file and return its path and size. Allowed in read-only mode. Configs are hundreds of KB, so the text itself is not returned.

Show or hide the 'Migrate Config with FortiConverter' step of the GUI's FortiGate Setup popup. Without hide, only reports the current state. FortiGate-VM evaluation licenses are not eligible for FortiConverter, so that step never completes and the popup reappears at every login until it is hidden. There is no CLI equivalent.

Activate the free permanent evaluation license on an unlicensed FortiGate-VM by logging in to FortiCloud from the FortiGate (the same call the GUI makes). The FortiCloud account comes from the FORTICLOUD_ACCOUNT and FORTICLOUD_PASSWORD environment variables, never from tool arguments. The FortiGate reboots to apply it. Unlicensed VMs refuse most API calls, so use session auth (FORTIGATE_USERNAME/PASSWORD) on a fresh VM. FortiCare error 10 means wrong credentials, an IAM sub-user, or 2FA on the account.

List IPv4 firewall policies in evaluation order.

Get one firewall policy.

Create a firewall policy. New policies are added at the end of the list; use move_firewall_policy to reorder. FortiGate-VM evaluation licenses allow only 3 policies.

Update a firewall policy. Only the fields given change; list fields are replaced, not appended.

Delete a firewall policy.

Move a policy before or after another one (policies match top-down).

Hit counts, bytes, packets and last-used time per policy.

Current firewall sessions, optionally filtered.

List firewall address objects.

Get one firewall address object.

Create a firewall address: a subnet/host, an IP range, or an FQDN.

Update a firewall address object.

Delete a firewall address (fails while a policy or group still uses it).

List firewall address groups and their members.

Create an address group.

Update an address group. members replaces the whole member list.

Delete an address group (fails while a policy still uses it).

List custom firewall services (port definitions).

Create a custom TCP/UDP service.

List service groups and their members.

Create a service group, e.g. K3S-MGMT = [SSH, K8S-API, PING]. Grouping services lets one policy cover what would otherwise need several, which helps under the evaluation license's 3-policy limit.

Update a service group. members replaces the whole member list.

Delete a service group (fails while a policy still uses it).

Delete a custom service (fails while a policy still uses it).

List virtual IPs (port forwards / static NAT) and the policies that use each one.

Create a port forward (VIP): traffic arriving on extintf at extip:extport goes to mappedip:mappedport. A VIP only passes traffic once a policy from extintf uses it as a destination. With attach_to_policy, the VIP is added to that existing policy's destinations instead of needing a new policy (the evaluation license allows only 3). FortiOS does not allow VIPs and ordinary addresses in the same policy's destinations, so the target must already use only VIPs, or pass replace_destinations=true to turn it into a VIP-only policy (its old destinations stop being reachable through it). In that policy, services match the mapped (internal) port.

Delete a VIP. FortiOS refuses while a policy uses it; detach=true first removes it from every policy's destinations. A policy whose only destination is this VIP blocks the delete: change or delete that policy first.

Search application-control signatures by name (contains, case-insensitive) and/or category, e.g. query=YouTube or category=P2P. Returns id, name, category and risk.

Application-control categories (id and name), e.g. P2P, Proxy, Game, Video/Audio.

App-control profiles with their rules, showing application and category names instead of ids.

Add a rule to an app-control profile matching applications and/or categories by name (or id). Rules are checked top-down and the built-in profiles start with a catch-all pass rule, so new rules are inserted at the top by default (position=bottom to append). Only affects policies whose application_list is this profile.

Remove a rule from an app-control profile by its id (see list_app_control_profiles).

List SSL/SSH inspection profiles with the CA each one re-signs with. The built-in no-inspection, certificate-inspection and deep-inspection profiles are read-only; edit custom-deep-inspection or a copy instead.

Update an SSL/SSH inspection profile, e.g. the CA used to re-sign certificates during deep inspection. Clients must trust that CA, and FortiGate-VM evaluation licenses re-sign RSA sites with 512-bit keys regardless of the CA, which modern clients reject.

List local and CA certificates with key type and size, validity and usage flags. Certificates with RSA keys under 2048 bits are flagged weak: FortiGate-VM evaluation licenses generate 512-bit factory certificates. Bundled public CAs are omitted unless include_bundle is true.

Download a certificate's PEM (public part only), e.g. the deep-inspection CA Fortinet_CA_SSL so clients can be told to trust it. Returns the PEM and its SHA-256 fingerprint.

Live FortiView summary of the sessions passing through right now, grouped by source, destination, application, country, interface, policy or protocol. Destinations include the resolved hostname; application IDs are translated to names. Empty when nothing is flowing (it reflects current sessions, not history).

IPv4 ARP table: which MAC answers for which IP on each interface.

Read FortiGate logs, newest first. Useful types: traffic/forward (sessions through policies, with app identification), app-ctrl (per-connection application and, with certificate inspection, the HTTPS hostname), event/system (admin and config events), ips, webfilter. FortiGate-VMs without a log disk only keep logs in memory, which is lost on reboot.

Active IPv4 routing table (connected, static, DHCP-learned and dynamic routes).

List configured static routes.

Add a static route. FortiGate-VM evaluation licenses allow only 3 routes.

Delete a static route by its sequence number (seq-num from list_static_routes).

System DNS settings: upstream resolvers the FortiGate itself uses and forwards to.

Interfaces where the FortiGate answers DNS queries, and in which mode.

Serve DNS on an interface. Modes: recursive (local zones first, then forward to the system resolvers), non-recursive (local zones only), forward-only.

Stop serving DNS on an interface.

List local DNS zones (dns-database) with their records.

Create a local DNS zone. view=shadow serves internal clients. FortiOS does not accept wildcard (*) hostnames, so add one record per name.

Delete a local DNS zone and all its records.

Add a record to a local DNS zone. Wildcard (*) hostnames are rejected by FortiOS.

Delete a record from a local DNS zone by its id (see list_dns_zones).

List DHCP servers with their ranges, options and reservations.

Current DHCP leases handed out by the FortiGate.

Update a DHCP server. Note: vci_match=true makes the server answer only clients whose vendor class matches vci-string (FortiOS defaults to FortiSwitch/FortiExtender), which silently ignores ordinary clients.

Reserve an IP for a MAC address on a DHCP server (the IP may sit outside the pool).

Remove a DHCP reservation by its id (see list_dhcp_servers).

Call any FortiOS REST endpoint directly. path must start with /api/v2/ (cmdb/... for configuration, monitor/... for live state). FORTIGATE_READ_ONLY still applies. Prefer the dedicated tools when one exists.