Skip to content

Commit 34ad7c1

Browse files
Minor adjustments to documentation
1 parent d52044a commit 34ad7c1

6 files changed

Lines changed: 196 additions & 653 deletions

File tree

README.md

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,44 +2,47 @@
22
# pfSense REST API Documentation
33

44
---
5+
56
# Introduction
67
pfSense API is a fast, safe, REST API package for pfSense firewalls. This works by leveraging the same PHP functions and processes used
78
by pfSense's webConfigurator into API endpoints to create, read, update and delete pfSense configurations. All API
89
endpoints enforce input validation to prevent invalid configurations from being made. Configurations made via API are
910
properly written to the master XML configuration and the correct backend configurations are made preventing the need for
1011
a reboot. All this results in the fastest, safest, and easiest way to automate pfSense!
1112

13+
1214
# Requirements
1315
- pfSense 2.4.4 or later is supported
1416
- pfSense API requires a local user account in pfSense. The same permissions required to make configurations in the
1517
webConfigurator are required to make calls to the API endpoints
16-
- While not an enforced requirement, it is STRONGLY recommended that you configure pfSense to use HTTPS instead of HTTP. This ensures that login credentials and/or API tokens remain secure in-transit
18+
- While not an enforced requirement, it is **strongly** recommended that you configure pfSense to use HTTPS instead of HTTP. This ensures that login credentials and/or API tokens remain secure in-transit
19+
1720

1821
# Installation
1922
To install pfSense API, simply run the following command from the pfSense shell:<br>
2023
```
21-
pkg add https://github.com/jaredhendrickson13/pfsense-api/releases/download/v0.0.4/pfSense-2-4-pkg-API-0.0_4.txz && /etc/rc.restart_webgui
24+
pkg add https://github.com/jaredhendrickson13/pfsense-api/releases/download/v1.0.0/pfSense-2-4-pkg-API-1.0_0.txz && /etc/rc.restart_webgui
2225
```
23-
<br>
2426

2527
To uninstall, run the following command:<br>
2628
```
2729
pkg delete pfSense-pkg-API
2830
```
29-
<br>
3031

3132
### Notes:
3233
- In order for pfSense to apply some required web server changes, it is required to restart the webConfigurator after installing the package
3334
- If you do not have shell access to pfSense, you can still install via the webConfigurator by navigating to
3435
'Diagnostics > Command Prompt' and enter the commands there
3536

37+
3638
# UI Settings & Documentation
3739
After installation, you will be able to access the API user interface pages within the pfSense webConfigurator. These will be found under System > API. The settings tab will allow you change various API settings such as enabled API interfaces, authentication modes, and more. Additionally, the documentation tab will give you access to an embedded documentation tool that makes it easy to view the full API documentation with context to your pfSense instance.
3840

3941
### Notes:
4042
- Users must hold the `page-all` or `page-system-api` privileges to access the API page within the webConfigurator
4143

42-
# Authentication
44+
45+
# Authentication & Authorization
4346
By default, pfSense API uses the same credentials as the webConfigurator. This behavior allows you to configure pfSense
4447
from the API out of the box, and user passwords may be changed from the API to immediately add additional security if
4548
needed. After installation, you can navigate to System > API in the pfSense webConfigurator to configure API
@@ -57,7 +60,7 @@ Uses the same credentials as the pfSense webConfigurator. To authenticate API ca
5760
<details>
5861
<summary>JWT</summary>
5962

60-
Requires a bearer token to be included in the `Authorization` header of your request. To receive a bearer token, you may make a POST request to /api/v1/access_token/ and include a `client-id` value containing your pfSense username and a `client-token` value containing your pfSense password to your payload. For example `{"client-id": "admin", "client-token": "pfsense"}`. Once you have your bearer token, you can authenticate your APIcall by adding it to the request's authorization header. (e.g. `Authorization: Bearer xxxxxxxx.xxxxxxxxx.xxxxxxxx`)
63+
Requires a bearer token to be included in the `Authorization` header of your request. To receive a bearer token, you may make a POST request to /api/v1/access_token/ and include a `client-id` value containing your pfSense username and a `client-token` value containing your pfSense password to your payload. For example `{"client-id": "admin", "client-token": "pfsense"}`. Once you have your bearer token, you can authenticate your API call by adding it to the request's authorization header. (e.g. `Authorization: Bearer xxxxxxxx.xxxxxxxxx.xxxxxxxx`)
6164
</details>
6265

6366
<details>
@@ -66,23 +69,26 @@ Requires a bearer token to be included in the `Authorization` header of your req
6669
Uses standalone tokens generated via the UI. These are better suited to distribute to systems as they are revocable and will only allow API authentication and not UI or SSH authentication (like the local database credentials). To generate or revoke credentials, navigate to System > API within the UI and ensure the Authentication Mode is set to API token. Then you should have the options to configure API Token generation, generate new tokens, and revoke existing tokens. Once you have your API token, you may authenticate your API call by adding a `client-id` value containing yourAPI token client ID and a `client-token` value containing your API token client token to your payload. (e.g. `{"client-id": "cccdj-311s", "client-token": "42jkjl-k234jlk1b38123kj3kjl-ffwzzuilaei"}`
6770
</details>
6871

69-
# Authorization
70-
pfSense API uses the same privielges as the pfSense webConfigurator. The required privileges for each endpoint are stated within the API documentation.
72+
### Authorization
73+
pfSense API uses the same privileges as the pfSense webConfigurator. The required privileges for each endpoint are stated within the API documentation.
74+
7175

7276
# Response Codes
7377
`200 (OK)` : API call succeeded<br>
7478
`400 (Bad Request)` : An error was found within your requested parameters<br>
7579
`401 (Unauthorized)` : API client has not completed authentication or authorization successfully<br>
76-
`403 (Forbidden)` : The API endpoint has refused your call. Commonly due to your access settings found in `System > API`<br>
80+
`403 (Forbidden)` : The API endpoint has refused your call. Commonly due to your access settings found in System > API<br>
7781
`404 (Not found)` : Either the API endpoint or requested data was not found<br>
7882
`500 (Server error)` : The API endpoint encountered an unexpected error processing your API request<br>
7983

84+
8085
# Error Codes
8186
A full list of error codes can be found by navigating to /api/v1/system/api/errors/ after installation. This will return
8287
JSON data containing each error code and their corresponding error message. No authentication is required to view the
8388
error code library. This also makes API integration with third-party software easy as the API error codes and messages
8489
are always just an HTTP call away!
8590

91+
8692
# Queries
8793
For endpoints supporting `GET` requests, you may query the return data to only return data you are looking for. To query data, you may add the data you are looking for to your payload. You may specify as many query parameters as you like to, in order to match the query, each parameter must match exactly. If no matches were found, the endpoint will return an empty array in the data field.
8894
<details>
@@ -105,7 +111,7 @@ For example, say an API endpoint normally returns a response like this without a
105111
}
106112
```
107113

108-
If I wanted the endpoint to only return the objects that had their `type` set to `type1` I could add `{"type": "type1"}` to my payload. These would return something like this:
114+
If I wanted the endpoint to only return the objects that had their `type` set to `type1` I could add `{"type": "type1"}` to my payload. This would return something like this:
109115

110116
```json
111117
{
@@ -131,9 +137,13 @@ If I wanted the endpoint to only return the objects that had their `type` set to
131137
### Notes:
132138
- For those using the Local database or API token authentication types, `client-id` and `client-token` are excluded from queries
133139

140+
134141
# Rate limit
135142
There is no limit to API calls at this time but is important to note that pfSense's XML configuration was not designed for quick simultaneous writes like a traditional database. It may be necessary to delay API calls in sequence to prevent unexpected behavior. Alternatively, you may limit the API to read-only mode to only allow endpoints with read (GET) access within the webConfigurator's System > API page.
136143

144+
145+
# Endpoints
146+
137147
## Indices
138148

139149
* [ACCESS_TOKEN](#access_token)
@@ -2549,9 +2559,7 @@ URL: https://{{$hostname}}/api/v1/services/unbound/host_override
25492559

25502560
```js
25512561
{
2552-
"host": "test",
2553-
"domain": "example.com",
2554-
"aliases": true
2562+
"id": 0
25552563
}
25562564
```
25572565

@@ -4175,4 +4183,3 @@ URL: https://{{$hostname}}/api/v1/user/privilege
41754183

41764184
---
41774185
[Back to top](#pfsense-rest-api-documentation)
4178-
> Made with &#9829; by [thedevsaddam](https://github.com/thedevsaddam) | Generated at: 2020-09-27 11:01:44 by [docgen](https://github.com/thedevsaddam/docgen)

0 commit comments

Comments
 (0)