You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+21-14Lines changed: 21 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,44 +2,47 @@
2
2
# pfSense REST API Documentation
3
3
4
4
---
5
+
5
6
# Introduction
6
7
pfSense API is a fast, safe, REST API package for pfSense firewalls. This works by leveraging the same PHP functions and processes used
7
8
by pfSense's webConfigurator into API endpoints to create, read, update and delete pfSense configurations. All API
8
9
endpoints enforce input validation to prevent invalid configurations from being made. Configurations made via API are
9
10
properly written to the master XML configuration and the correct backend configurations are made preventing the need for
10
11
a reboot. All this results in the fastest, safest, and easiest way to automate pfSense!
11
12
13
+
12
14
# Requirements
13
15
- pfSense 2.4.4 or later is supported
14
16
- pfSense API requires a local user account in pfSense. The same permissions required to make configurations in the
15
17
webConfigurator are required to make calls to the API endpoints
16
-
- While not an enforced requirement, it is STRONGLY recommended that you configure pfSense to use HTTPS instead of HTTP. This ensures that login credentials and/or API tokens remain secure in-transit
18
+
- While not an enforced requirement, it is **strongly** recommended that you configure pfSense to use HTTPS instead of HTTP. This ensures that login credentials and/or API tokens remain secure in-transit
19
+
17
20
18
21
# Installation
19
22
To install pfSense API, simply run the following command from the pfSense shell:<br>
- In order for pfSense to apply some required web server changes, it is required to restart the webConfigurator after installing the package
33
34
- If you do not have shell access to pfSense, you can still install via the webConfigurator by navigating to
34
35
'Diagnostics > Command Prompt' and enter the commands there
35
36
37
+
36
38
# UI Settings & Documentation
37
39
After installation, you will be able to access the API user interface pages within the pfSense webConfigurator. These will be found under System > API. The settings tab will allow you change various API settings such as enabled API interfaces, authentication modes, and more. Additionally, the documentation tab will give you access to an embedded documentation tool that makes it easy to view the full API documentation with context to your pfSense instance.
38
40
39
41
### Notes:
40
42
- Users must hold the `page-all` or `page-system-api` privileges to access the API page within the webConfigurator
41
43
42
-
# Authentication
44
+
45
+
# Authentication & Authorization
43
46
By default, pfSense API uses the same credentials as the webConfigurator. This behavior allows you to configure pfSense
44
47
from the API out of the box, and user passwords may be changed from the API to immediately add additional security if
45
48
needed. After installation, you can navigate to System > API in the pfSense webConfigurator to configure API
@@ -57,7 +60,7 @@ Uses the same credentials as the pfSense webConfigurator. To authenticate API ca
57
60
<details>
58
61
<summary>JWT</summary>
59
62
60
-
Requires a bearer token to be included in the `Authorization` header of your request. To receive a bearer token, you may make a POST request to /api/v1/access_token/ and include a `client-id` value containing your pfSense username and a `client-token` value containing your pfSense password to your payload. For example `{"client-id": "admin", "client-token": "pfsense"}`. Once you have your bearer token, you can authenticate your APIcall by adding it to the request's authorization header. (e.g. `Authorization: Bearer xxxxxxxx.xxxxxxxxx.xxxxxxxx`)
63
+
Requires a bearer token to be included in the `Authorization` header of your request. To receive a bearer token, you may make a POST request to /api/v1/access_token/ and include a `client-id` value containing your pfSense username and a `client-token` value containing your pfSense password to your payload. For example `{"client-id": "admin", "client-token": "pfsense"}`. Once you have your bearer token, you can authenticate your API call by adding it to the request's authorization header. (e.g. `Authorization: Bearer xxxxxxxx.xxxxxxxxx.xxxxxxxx`)
61
64
</details>
62
65
63
66
<details>
@@ -66,23 +69,26 @@ Requires a bearer token to be included in the `Authorization` header of your req
66
69
Uses standalone tokens generated via the UI. These are better suited to distribute to systems as they are revocable and will only allow API authentication and not UI or SSH authentication (like the local database credentials). To generate or revoke credentials, navigate to System > API within the UI and ensure the Authentication Mode is set to API token. Then you should have the options to configure API Token generation, generate new tokens, and revoke existing tokens. Once you have your API token, you may authenticate your API call by adding a `client-id` value containing yourAPI token client ID and a `client-token` value containing your API token client token to your payload. (e.g. `{"client-id": "cccdj-311s", "client-token": "42jkjl-k234jlk1b38123kj3kjl-ffwzzuilaei"}`
67
70
</details>
68
71
69
-
# Authorization
70
-
pfSense API uses the same privielges as the pfSense webConfigurator. The required privileges for each endpoint are stated within the API documentation.
72
+
### Authorization
73
+
pfSense API uses the same privileges as the pfSense webConfigurator. The required privileges for each endpoint are stated within the API documentation.
74
+
71
75
72
76
# Response Codes
73
77
`200 (OK)` : API call succeeded<br>
74
78
`400 (Bad Request)` : An error was found within your requested parameters<br>
75
79
`401 (Unauthorized)` : API client has not completed authentication or authorization successfully<br>
76
-
`403 (Forbidden)` : The API endpoint has refused your call. Commonly due to your access settings found in `System > API`<br>
80
+
`403 (Forbidden)` : The API endpoint has refused your call. Commonly due to your access settings found in System > API<br>
77
81
`404 (Not found)` : Either the API endpoint or requested data was not found<br>
78
82
`500 (Server error)` : The API endpoint encountered an unexpected error processing your API request<br>
79
83
84
+
80
85
# Error Codes
81
86
A full list of error codes can be found by navigating to /api/v1/system/api/errors/ after installation. This will return
82
87
JSON data containing each error code and their corresponding error message. No authentication is required to view the
83
88
error code library. This also makes API integration with third-party software easy as the API error codes and messages
84
89
are always just an HTTP call away!
85
90
91
+
86
92
# Queries
87
93
For endpoints supporting `GET` requests, you may query the return data to only return data you are looking for. To query data, you may add the data you are looking for to your payload. You may specify as many query parameters as you like to, in order to match the query, each parameter must match exactly. If no matches were found, the endpoint will return an empty array in the data field.
88
94
<details>
@@ -105,7 +111,7 @@ For example, say an API endpoint normally returns a response like this without a
105
111
}
106
112
```
107
113
108
-
If I wanted the endpoint to only return the objects that had their `type` set to `type1` I could add `{"type": "type1"}` to my payload. These would return something like this:
114
+
If I wanted the endpoint to only return the objects that had their `type` set to `type1` I could add `{"type": "type1"}` to my payload. This would return something like this:
109
115
110
116
```json
111
117
{
@@ -131,9 +137,13 @@ If I wanted the endpoint to only return the objects that had their `type` set to
131
137
### Notes:
132
138
- For those using the Local database or API token authentication types, `client-id` and `client-token` are excluded from queries
133
139
140
+
134
141
# Rate limit
135
142
There is no limit to API calls at this time but is important to note that pfSense's XML configuration was not designed for quick simultaneous writes like a traditional database. It may be necessary to delay API calls in sequence to prevent unexpected behavior. Alternatively, you may limit the API to read-only mode to only allow endpoints with read (GET) access within the webConfigurator's System > API page.
> Made with ♥ by [thedevsaddam](https://github.com/thedevsaddam) | Generated at: 2020-09-27 11:01:44 by [docgen](https://github.com/thedevsaddam/docgen)
0 commit comments