;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubRead system status and firewall policies, list firewall addresses and keep address objects in a declared state on a FortiGate from any Windmill script, flow or app.
Set up in 3 steps
Create a REST API administrator
On the FortiGate, go to System > Administrators > Create New > REST API Admin. Give it an admin profile scoped to what your flows need, restrict trusted hosts to your Windmill workers' addresses, and copy the generated token. It is shown only once.
Add the resource
In Windmill, open Resources, add a FortiGate resource, and enter the FortiGate's HTTPS admin address (with the port if it isn't 443) and the token. If the FortiGate uses a private CA, trust that CA on your workers. The scripts never disable certificate checks.
Run your first script
Start with Get system status. On a multi-VDOM FortiGate, pass vdom to each script. Upsert firewall address runs as a dry run by default and returns the diff; set dry_run to false to apply it.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Resource type
The shape of the credential every script on this page expects.
fortigate
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| base_url | string | Yes | HTTPS address of the FortiGate admin interface, e.g. https://fortigate.example.com (add :port if the admin HTTPS port is not 443). No trailing slash. The certificate must match this address and be trusted by the Windmill worker (DENO_CERT or SSL_CERT_FILE): a default self-signed certificate is rejected. |
| token | string | Yes | API token generated when creating a REST API administrator (System > Administrators > Create New > REST API Admin). Sent as a Bearer token. |
Questions
How do I page through large tables?
The list scripts take start and count and return next_start. Pass it back as start until it comes back null.
Can I manage FortiGates through FortiManager instead?
Yes. If your FortiGates are managed by FortiManager, use the FortiManager integration so changes go through policy packages and don't drift from the FortiManager database.
Is my token stored on the hub?
Never. It lives only in your own Windmill workspace, encrypted at rest.