Read and update your NetBox source of truth from Windmill scripts, flows and apps; every read works with a read-only token.
Set up in 3 steps
Create an API token
In NetBox, open your user menu, then API Tokens, and add a token. Tick Write enabled only for the Create, Update and Allocate actions.
Add the resource in Windmill
Open Resources, add a netbox resource, and fill in the instance URL and the token.
Run your first script
Run List Sites to check the connection.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Update IP Address
Update Interface
Update Device
Select Devices
List VRFs
List VLANs
List Sites
List Racks
List Prefixes
List IP Addresses
List Interfaces
List Devices
List Device Types
List Device Roles
List Available Prefixes
List Available IPs
Get IP Address
Get Interface
Get Device
Create IP Address
Create Device
Call NetBox API
Allocate Next Available IP
Trigger flows from NetBox
NetBox is not only a destination. These inbound paths are supported today.
NetBox webhooks on an HTTP route
Create an HTTP route with Signature authentication, Custom scheme: header X-Hook-Signature, sha512, hex, no prefix, and a secret. In NetBox, add a webhook to the route URL with the same secret, then an event rule that sends it the changes you want. Each change runs your flow with event, object_type, data and snapshots.
Resource type
The shape of the credential every script on this page expects.
netbox
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| url | string | Yes | Base URL of your NetBox instance, e.g. https://netbox.example.com (a trailing /api is accepted) |
| token | string | Yes | API token from your NetBox profile (API Tokens). v2 tokens (nbt_…) and legacy v1 tokens both work; a read-only token is enough for every read action |
Questions
How do I pick devices by a custom field?
List Devices takes custom field filters, e.g. {"tier": "edge"} (sent as cf_tier=edge). Select Devices adds Site and Role dropdowns and returns each device's full JSON, custom_fields included.
A read returns 403 with a read-only token
The token's user has no view permission on that object type. Grant view on what you read, e.g. dcim.device or ipam.prefix.
Does an update overwrite fields I leave empty?
No. Updates send only the fields you fill in, and custom_fields merge into the existing values.