Troubleshooting Fortinet device API credentials

If Auvik is unable to authenticate to a FortiGate device using the FortiOS REST API, you can use the Discovery Troubleshooting workflow to identify which requirement is preventing successful communication.

To access troubleshooting:

1. Open the device from the Device Dashboard.
2. Hover over Discovery in the entity navigation menu.
3. Click Troubleshooting.

Auvik verifies four requirements before a device can be successfully authenticated using the FortiOS REST API.

Step 1: Verify the Device Is Managed

Auvik can only collect data from devices that are managed.

If the device is currently unmanaged:

1. Click Re-enable Management.
2. Change the management status from Unmanaged to Managed.
3. Click Save.

Step 2: Verify Device API Credentials Are Assigned

Auvik requires Fortinet REST API credentials to communicate with the device.

If credentials already exist:

1. Verify that the credentials are assigned to the correct device.
2. Confirm the credentials are active and not disabled.

For more information, see How do I edit or delete device API credentials?

If credentials do not exist:

1. Create a new Fortinet device API credential.
2. Assign the credential to the affected device.

For more information, see How do I add Fortinet device API credentials?

Note: If multiple API credentials exist within Auvik, verify that the correct credential is associated with the device.

Step 3: Verify the FortiOS REST API Is Accessible

The REST API administrator account must have sufficient permissions for Auvik to collect device information.

Verify the Admin Profile Permissions

1. Log in to the FortiGate.
2. Navigate to System > Admin Profiles.
3. Edit the admin profile associated with the API administrator account.

Verify the following permissions are configured:

• Firewall → Custom → Address → Read
• Network → Custom → Configuration → Read
• Network → Router → Read
• System → Custom → Configuration → Read
• WiFi & Switch Controller → Read

4. Click OK to save any changes.

Verify the API Administrator Configuration

1. Navigate to System > Administrators.
2. Edit the REST API administrator associated with the API token.

Verify the following:

• The administrator is assigned to the correct admin profile.
• The administrator account is enabled.
• The API token is active.
• HTTPS administrative access is enabled on the interface used by the Auvik collector.
• The collector IP address is included in the Trusted Hosts list.

For Trusted Hosts, use the collector IP address in CIDR notation. For example:

192.168.1.10/32

Tip: If Trusted Hosts are configured incorrectly, the FortiGate may reject API requests even when the credentials are valid.

Step 4: Verify the Device API Credentials

The REST API administrator profile must have sufficient permissions to allow Auvik to retrieve device information.

To verify the profile:

1. Navigate to System > Admin Profiles.
2. Create a new profile or edit an existing profile.

Verify the following settings:

• System Configuration = Read/Write
• All remaining permissions = Read
• REST API Access = Enabled

3. Click OK to save the profile.

Additional Validation

If authentication continues to fail:

• Verify the API token was copied correctly into Auvik.
• Confirm the API token has not been regenerated or revoked.
• Verify the collector can reach the FortiGate over HTTPS (TCP 443 by default).
• Confirm there are no firewall policies blocking management access.
• Verify the FortiGate's administrative interface allows HTTPS access.
• Confirm the FortiGate firmware version is supported by Auvik.

Authentication Successful

Congratulations! The device has been successfully authenticated using the FortiOS REST API.

Auvik will begin collecting available device information, including:

• Device inventory details
• Interface information
• Routing configuration
• Firewall object information
• Performance and status data

Depending on the polling interval, newly collected information may take several minutes to appear in the dashboard.

FortiGate Device API returns 401 Unauthorized

A 401 Unauthorized error usually indicates that the FortiGate API credentials are invalid, unavailable to Auvik, or configured at an unsupported scope.

For Auvik FortiGate monitoring, create or regenerate the API key at the GLOBAL scope. VDOM-scoped API access is not supported.

Verify the following:

• The API administrator has sufficient read permissions for the information Auvik collects.
• The API administrator is enabled and the API key is active.
• The collector’s source IP is included in the FortiGate Trusted Hosts list, if Trusted Hosts are configured.
• HTTPS administrative access is enabled on the interface used by the collector.
• The collector can reach the FortiGate management address over HTTPS, normally TCP port 443.
• The correct FortiGate management address and API credential are entered in Auvik.
• TLS inspection or another security device is not interfering with the HTTPS connection.

If the API key was regenerated, replace the stored credential in Auvik and retry the connection. If available, test the API request from the collector host and confirm that the FortiGate returns a successful response.

API access is configured independently on each FortiGate. If multiple FortiGates are monitored, verify the API administrator, scope, permissions, Trusted Hosts, and management access on each device.

For more information, see How to Enable SNMP on a FortiGate for Auvik (HA-Safe Guide).

Troubleshoot “This field is required” when adding Fortinet Device API credentials

Symptom

You receive a validation error such as “This field is required” when saving Fortinet Device API credentials, even though the form appears complete.

Verify the credential form

Go to Discovery > Manage Credentials > Device API Credentials and select Add Device API Credentials > Fortinet (FortiGate).

Check the following fields:

• Name: Enter a unique, non-blank name.
• Device scope: If you select Limit to specific devices, select at least one device. If no devices are selected, the Device field may produce a required-field error. To avoid this, either select the required devices or choose Any device.
• Device or Host: If this field is displayed, enter a valid IPv4 address or fully qualified domain name for the FortiGate management interface. Remove any leading or trailing spaces.
• Port: Enter the FortiGate management port, commonly 443.
• Authentication: Enter the FortiGate API token in the field labeled API Token or API Key. Do not enter the token in a username or password field.
• Username and password: If these fields are available in your form, verify that the FortiGate account has REST API access and allows requests from the Auvik collector’s IP address.

Common causes

• A required field contains only spaces or hidden whitespace.
• Limit to specific devices is selected, but no device is selected.
• The credential name duplicates an existing credential name.
• The browser is displaying stale form data.
• The FortiGate REST API is not enabled or the API token has not been generated.

Try removing and re-entering the affected value, then save the credential again. If the error continues, try a hard refresh, private browsing window, or another supported browser.

Test the credential

After the credential saves:

1. Confirm the Auvik collector can reach the FortiGate management address and port.
2. Open the credential from Device API Credentials.
3. Select Test Connection, if available.
4. Confirm the credential is assigned to the intended FortiGate device.

If the connection test fails, review the FortiGate API administrator profile, HTTPS access, Trusted Hosts configuration, API token status, and collector reachability.

If the validation error persists

Collect the following information before contacting Support:

• Screenshot showing the completed form and exact error message
• FortiOS version
• FortiGate management address and port, excluding secrets
• Authentication method used
• Credential scope selected
• Approximate time of the failed save attempt

Do not include API tokens or passwords in screenshots or support requests.