;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubList managed devices, policy packages and firewall addresses, keep address objects in a declared state and install policy packages on FortiManager from any Windmill script, flow or app.
Set up in 3 steps
Create a REST API Admin
On the FortiManager (7.2.2 or later), go to System Settings > Administrators > Create New > REST API Admin. Give it an admin profile scoped to what your flows need, set JSON API access to Read or Read-Write, restrict trusted hosts to your Windmill workers' addresses, and copy the generated API key. It is shown only once.
Add the resource
In Windmill, open Resources, add a FortiManager resource, and enter the FortiManager's HTTPS address and the API key. If the FortiManager uses a private CA, trust that CA on your workers. The scripts never disable certificate checks.
Run your first script
Start with List devices on your ADOM (root if ADOMs are disabled). Upsert firewall address runs as a dry run by default and returns the diff; set dry_run to false to apply it.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Resource type
The shape of the credential every script on this page expects.
fortimanager
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| base_url | string | Yes | HTTPS address of the FortiManager, e.g. https://fortimanager.example.com (add :port if not 443). No trailing slash. The certificate must match this address and be trusted by the Windmill worker (DENO_CERT or SSL_CERT_FILE): a default self-signed certificate is rejected. |
| token | string | Yes | API key of a REST API Admin with JSON API access set to Read or Read-Write (System Settings > Administrators > Create New > REST API Admin). Sent as a Bearer token. |
Questions
How do I install a package and wait for the result?
Install policy package returns a task id right away. In a flow, follow it with Get task status in a loop until percent reaches 100. The install succeeded when num_err is 0, and line holds the per-device results.
My ADOM uses workspace mode. Will the write scripts work?
Writes to a workspace-mode ADOM need the ADOM locked first and committed after. The shipped scripts don't lock, so add the lock and commit steps around them. Install policy package also exposes FortiManager's auto_lock_ws install flag.
Is my API key stored on the hub?
Never. It lives only in your own Windmill workspace, encrypted at rest.