F5 BIG-IP

Infrastructure Host, username and password iControl REST API reference

Automate F5 BIG-IP load balancing (LTM) and access (APM) through iControl REST from Windmill scripts, flows and apps.

Set up in 3 steps

Create an automation user on the BIG-IP

Create a dedicated BIG-IP user for Windmill rather than reusing a person's account, with a role that covers the partitions your scripts change (and APM access for the session and policy actions). Remote users (LDAP, RADIUS, TACACS+) work with the default token authentication.

Add the resource

Open Resources, click Add a resource/API and pick F5 BIG-IP. Enter the management URL (with :8443 on single-NIC VE), the user name and the password. If the BIG-IP certificate comes from a private CA, trust that CA on your Windmill workers.

Run your first script

Start with List pools or List virtual servers. Upsert pool runs as a dry run by default and returns the diff; set dry_run to false to apply it, then run Save configuration.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Resource type

The shape of the credential every script on this page expects.

f5_bigip

View raw schema →

Field	Type	Required	What it is
base_url	string	Yes	Management URL of the BIG-IP, e.g. https://bigip.example.com (add the port for single-NIC VE deployments, e.g. https://10.0.0.5:8443). No trailing slash. The certificate must match this address and be trusted by the Windmill worker (DENO_CERT or SSL_CERT_FILE): a default self-signed certificate is rejected.
username	string	Yes	BIG-IP user name.
password	string	Yes	Password of the BIG-IP user.
auth_method	string	No	token (default): exchange the user name and password for an X-F5-Auth-Token at /mgmt/shared/authn/login, required for remotely authenticated (LDAP, RADIUS, TACACS+) and non-Administrator users. basic: send HTTP Basic auth on every call (local Administrator accounts only).
login_provider_name	string	No	Login provider used for token authentication. Leave empty for tmos (local and the system's configured remote auth); set it only when your BIG-IP uses a named provider.

Questions

Are my changes persistent?

iControl REST changes the running configuration. Run Save configuration after your changes so they survive a reboot.

Why does every run log in?

With token authentication each run exchanges the user name and password for a short-lived X-F5-Auth-Token and deletes it when done, so no token piles up on the BIG-IP.

Set up in 3 steps

Create an automation user on the BIG-IP

Add the resource

Run your first script

Scripts

Upsert pool

Set pool member state

Save configuration

List virtual servers

List pools

List active sessions

List access profiles

Get pool members

Delete session

Apply access policy

Resource type

f5_bigip

Questions