> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # FortiGate API > Report your clients' FortiGates, FortiSwitches and FortiAPs, their health, firmware, logs and contracts, and change policies, VPNs and settings through FortiGate Cloud and FortiCloud > [!NOTE] > > Automatically enabled when you configure FortiGate permissions in your agent workflow. ## What It Does * Find the client's FortiCloud account, and its FortiGates in FortiGate Cloud * Report each FortiGate's status, CPU and memory, firmware and upgrade path, HA, interfaces, SD-WAN and VPN tunnels * Report the FortiSwitches and FortiAPs each FortiGate manages, with their status and firmware * Report registrations, support contracts, FortiGuard services and licences that expire within a window, from FortiCloud Asset Management and each FortiGate * Read event, traffic and security logs, from the FortiGate's memory or disk, its FortiAnalyzer, or FortiCloud * Check whether FortiGate Cloud backs up each FortiGate's configuration, and list its saved revisions * Return firewall policies and the addresses and services they use, and add, change or remove them * Upgrade firmware from FortiGuard, and restart a FortiGate, FortiSwitch or FortiAP * Keep your PSA's configuration items and renewal tickets in step with FortiCloud's contracts Neo reaches a FortiGate through FortiGate Cloud, over the management tunnel FortiGate Cloud keeps to it, so the FortiGate does not need to be reachable from the internet. A FortiGate that is not in FortiGate Cloud, or is offline, is out of reach for its own checks; its FortiCloud registrations and contracts still answer. Changes to a FortiGate through FortiGate Cloud need a paid FortiGate Cloud subscription. ## How the agent handles a renewal report The agent lists each client's registered products in FortiCloud and the FortiGuard services on each FortiGate, then reports per client every contract, entitlement and service that ends within the window you asked for, with the serial, the model and the date. It names the products and clients it could not reach, so nothing is reported as fine without a check. ## Permission Groups | Group | Access levels | Covers | | - | - | - | | Devices, Registrations and Contracts | Disabled, Read Only, Read / Write | FortiGates in FortiGate Cloud, FortiCloud registrations, entitlements, contracts and licences | | Monitoring, Logs and Reports | Disabled, Read Only, Read / Write | Status, performance, logs (memory, disk, FortiAnalyzer, FortiCloud), FortiView, security rating, reports and automation | | Firewall Policies and Objects | Disabled, Read Only, Read / Write | Firewall policies, addresses, services, schedules, VIPs, shapers, sessions, proxy and ZTNA rules | | Security Profiles | Disabled, Read Only, Read / Write | Antivirus, IPS, web filter, application control, DNS filter, email filter, DLP, sandbox and threat feeds | | VPN | Disabled, Read Only, Read / Write | IPsec and SSL VPN settings, tunnels and their status | | Network, Wireless and Switching | Disabled, Read Only, Read / Write | Interfaces, zones, DHCP, DNS, routing, SD-WAN, HA, FortiSwitches and FortiAPs | | Firmware, Restarts and Backups | Disabled, Read Only, Read / Write | Firmware and upgrade paths, FortiGuard updates, restarts, configuration revisions and backup settings | | System Settings | Disabled, Read Only, Read / Write | Global settings, SNMP, NTP, replacement messages, Security Fabric and hardware settings | | Users, Certificates and Administration | Disabled, Read Only, Read / Write | Users, user groups, authentication servers, FortiTokens, certificates, administrators, and FortiCloud accounts and organizational units | ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every read | No write is allowed | | **Helpdesk** | Every read; monitoring and inventory writes | Every other write | | **IT Admin** | Firmware, restart, VPN, network and system writes, and the Helpdesk writes | Policy, security profile and administration writes, and every write under Safety Controls | | **Full Automation** | Every write except those below | Only the writes under Safety Controls | ## Safety Controls | Control | Behavior | | - | - | | **Always ask** | A write that sets a password, key or other secret, or changes a user's two-factor sign-in; any change to an SNMP community, whose name is its community string; any change to the FortiGate's administrator accounts, REST API users, their access profiles, single sign-on administrators and SAML sign-in; changing an administrator's or user's password; FortiToken changes; running a CLI script or storing one; any change to an automation stitch, trigger, condition, destination or action, and firing a stitch; shutting the FortiGate down; changing its VDOM mode or its private data encryption; a FortiSwitch factory reset; turning FortiGate Cloud management of a FortiGate on or off; decommissioning or transferring a registered product; and deleting an organizational unit. These always ask a technician, whatever the profile | | **Secrets** | Every password, pre-shared key, shared secret, private key and SNMP community comes back as `[hidden by Neo]`. A write that leaves the field out keeps the stored value; a write that sends the marker back is refused, and so is a filter or sort on a hidden field | | **Deletes** | A configuration change or delete must name one entry; a delete or change of a whole table, or one that selects entries with a filter or names several VDOMs, is refused. Before a change that sends a list, Neo reads the entry: when the field is a child table (BGP neighbors, OSPF interfaces and their keys, RADIUS accounting servers), the change is refused, whatever the list holds, because it would replace every entry and drop their hidden secrets; the agent changes one entry at a time. A list of references, such as a policy's addresses, goes through. When the read fails, the change is not sent | | **Firmware** | Only FortiGuard's signed images: an upgrade from a file or a URL, without the signature check, or that formats the boot partition, is refused | | **Right client** | On a ticket whose company is mapped to a FortiCloud account, every call must name that account, and every FortiGate or product it names must be in it. Calls that list or change every client's account are refused on such a ticket | | **Refused** | The FortiGate's own FortiCloud and FortiCare sign-in, registration and deregistration; reads of a configuration backup, a saved revision's file, certificate, debug and crash log downloads, licence files, a new API key or generated Wi-Fi keys; packet captures; file uploads; restoring a configuration, formatting the log disk, and any change to the FortiGate's FortiGate Cloud or FortiManager management settings, which is how Neo reaches it. A read that answers a file instead of JSON is not passed on, apart from raw log lines | ## How to Configure **1. Connect FortiGate** Save your FortiCloud API user in the Neo Dashboard under the **Networking** integrations category. See [Connecting FortiGate to Neo](https://docs.neoagent.io/integrations/fortigate/connecting-to-neo.md). **2. Configure permissions** On the agent's **Tools & Settings** tab, click **Networking** and expand the **FortiGate** block. Pick one of its **Presets**, which are the access profiles above, or set each permission group yourself. > [!TIP] > > Start with **Read Only**. Health checks, renewal reports, logs and policy reviews need only reads. An agent that opens tickets or updates configuration items in your PSA needs the PSA tools too. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.