• All variables used in the collection are stored at the highest level of the Collection.
• Click on Collection Title in the left sidebar, then click on the Variables tab
• You’ll see variables for
  • The API Base URLs
  • api_username and api_password for authentication
  • client_id for authentication (only used to override the automated client_id in the script)
  • access_token, and expires_as for storing Bearer tokens returned from authentication request for each client_id/request

• We’ve set up the FortiCloud Postman collection to automate the authentication process and store the access token for use in subsequent requests
  • You can see the scripting used to fetch Bearer tokens by clicking on the Scripts tab at the top level of the Collection, and viewing the Pre-request Script
  • Pseudocode

    1. Grab the URL of the request, along with the API Username and Password
    2. Set the authentication client_id depending on the path in the URL
    3. If (No bearer token or it's already ): get a new bearer token with api_username, api_password, and client_id
    4. Set the bearer token in the request header for the given request type

• 

Click on Add New –> API User

• Enter a username for the API User such as: flexapiuser
• Choose the SysAdmin Permission Profile
• Click Next

• When the API User is created, you will see a message to download the credentials.
• Click to download, and enter a password to encrypt the file, such as FortiFlex2025!

• You’ll get a password-protected zip file with the API credentials. Open it using the same password you entered when downloading the file.
• The folder will contain a single text file with the apiId and password
• You’ll enter the apiId and password into a Postman Collection Variables the next step

• Back in Postman, enter the newly created apiId and password into the Postman Collection Variables
• Copy the apiId from the credentials text file into the api_user Postman Current value variable
• Copy the password from the credentials text file into the api_password Postman Current value variable
• Click Save to save the collection variables

• From the top level FortiCloud Collection, open folder: FortiFlex V2.0–>Programs, and then POST Request: List
• Click the Send button

• You should see a response with a 200 OK status and 2 different serialNumber in the response body

Congratulations, you’re now authenticated with the FortiFlex API!

Next, we can retrieve a list of Entitlements by sending a request to the /entitlements/list endpoint.

• Open the Post List request from Entitlements folder in the collection
• enter the configId returned from the previous request into the Body of the Get Entitlements request, and click Send

• Open the reactivate request from the Entitlements folder in the collection
• Under the Body tab, enter the serialNumber you got from the previous request
• Click Send to enable the entitlement
• You should see a response with a 200 OK status and the entitlement status updated to “ACTIVE”
• You can verify this by sending the list request and checking the status, or by checking the WebUI