About the Management Center REST API

The Secure Firewall Management Center REST API provides a lightweight API to manage a management center.

About the Management Center REST API

With the release of management center REST API, you now have light-weight, easy-to-use option for managing Secure Firewall Threat Defense (formerly Firepower Threat Defense) and legacy devices through a management center.

The REST API is an application programming interface (API), based on “RESTful” principles, which you can quickly enable on any management center running version 6.1 or higher, and use with a REST client.

After installing a REST client, you can contact the specific management center's REST agent and use standard HTTP methods to access current configuration information, and issue additional configuration parameters.

Whats New in 7.2

No new features or functionality were added in version 7.2.

New API endpoints and Methods

Table 1. New Methods and Endpoints:

Name

Methods

URL

Chassis
Evaluate Operation

GET

/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/chassisinterfaces/{interfaceUUID}/evaluateoperation
Breakout Interfaces

POST

/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/breakoutinterfaces
Join Interfaces

POST

/api/fmc_config/v1/domain/{domainUUID}/chassis/fmcmanagedchassis/{containerUUID}/operational/joininterfaces

Deployment

Download Reports

GET

/api/fmc_config/v1/domain/{domainUUID}/deployment/jobhistories/{containerUUID}/operational/downloadreports

Email Reports

GET

/api/fmc_config/v1/domain/{domainUUID}/deployment/jobhistories/{containerUUID}/operational/emailreports

Devices

EIGRP Routes

GET, GET by ID, PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/devices/devicerecords/{containerUUID}/routing/eigrproutes

Virtual EIGRP Routes

GET, GET by ID, PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/devices/devicerecords/{containerUUID}/routing/virtualrouters/{virtualrouterUUID}/eigrproutes

Device Settings

GET, PUT

/api/fmc_config/v1/domain/{domainUUID}/devices/devicesettings

Change Managers

POST

/api/fmc_config/v1/domain/{domainUUID}/devices/operational/changemanagers

Integration

EBS Snapshot

GET by ID, POST

/api/fmc_config/v1/domain/{domainUUID}/integration/ebssnapshot

Test Umbrella Connections

POST

/api/fmc_config/v1/domain/{domainUUID}/integration/operational/testumbrellaconnections

Umbrella Connections

GET, GET by ID, PUT, POST

/api/fmc_config/v1/domain/{domainUUID}/integration/umbrellaconnections

Status

Task Statuses

GET

/api/fmc_config/v1/domain/{domainUUID}/job/taskstatuses

Object

AnyConnect External Browser Packages

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/anyconnectexternalbrowserpackages

AnyConnect Packages

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/anyconnectpackages

AnyConnect Profiles

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/anyconnectprofiles

Certificate Enrollments

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/certenrollment

Certificate Maps

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/certificatemaps

Group Policies

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/grouppolicies

Host Scan Packages

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/hostscanpackages

IPv4 Address Pools

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/ipv4addresspools

IPv6 Address Pools

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/ipv6addresspools

Umbrella Protection Policies

GET, POST

/api/fmc_config/v1/domain/{domainUUID}/object/operational/umbrellaprotectionpolicies

Radius Server Groups

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/radiusservergroups

SSO Servers

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/object/ssoservers

Policy

Auto NAT Rules

PUT, DELETE

/api/fmc_config/v1/domain/{domainUUID}/policy/ftdnatpolicies/{containerUUID}/autonatrules

Manual NAT Rules

PUT, DELETE

/api/fmc_config/v1/domain/{domainUUID}/policy/ftdnatpolicies/{containerUUID}/manualnatrules

NAT Rules

DELETE

/api/fmc_config/v1/domain/{domainUUID}/policy/ftdnatpolicies/{containerUUID}/natrules

Health Policies

GET, GET by ID

/api/fmc_config/v1/domain/{domainUUID}/policy/healthpolicies

Policy Locks

GET, POST

/api/fmc_config/v1/domain/{domainUUID}/policy/operational/policylocks

RA VPNs

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns

Address Assignment Settings

PUT

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns/{containerUUID}/addressassignmentsettings/{objectId}

Certificate Map Settings

PUT

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns/{containerUUID}/certificatemapsettings/{objectId}

Connection Profiles

PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns/{containerUUID}/connectionprofiles

IPSec Advanced Settings

GET, GET by ID, PUT

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns/{containerUUID}/ipsecadvancedsettings

IPSec Crypto Maps

GET, GET by ID, PUT

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns/{containerUUID}/ipseccryptomaps

LDAP Attribute Maps

GET, GET by ID, PUT

/api/fmc_config/v1/domain/{domainUUID}/policy/ravpns/{containerUUID}/ldapattributemaps

S2S VPN Summaries

GET

/api/fmc_config/v1/domain/{domainUUID}/policy/s2svpnsummaries

Umbrella DNS Policies

GET, GET by ID, PUT, POST, DELETE

/api/fmc_config/v1/domain/{domainUUID}/policy/umbrelladnspolicies

Umbrella DNS Rules

GET, GET by ID, PUT

/api/fmc_config/v1/domain/{domainUUID}/policy/umbrelladnspolicies/{containerUUID}/umbrelladnsrules

Search

Device

GET

/api/fmc_config/v1/domain/{domainUUID}/search/device

License

Device Licenses

GET, GET by ID, PUT, PUT by ID

/api/fmc_platform/v1/license/devicelicenses

Smart Licenses

GET, POST

/api/fmc_platform/v1/license/smartlicenses

Updates

Upgrade Snapshot

POST

/api/fmc_platform/v1/updates/upgradesnapshot

Troubleshoot

Task

POST

/api/fmc_troubleshoot/v1/domain/{domainUUID}/task

Enabling the REST API

In management center, the REST API is enabled by default. However, if you are intending to use the REST API, you should confirm that it is enabled.


Note
If you are using UCAPL mode, check that the REST API is not enabled.

Procedure

Step 1

Navigate to System>Configuration>REST API Preferences>Enable REST API
Step 2

Check the "Enable REST API" checkbox.
Step 3

Click "Save". A "Save Successful" dialog will display when the REST API is enabled.

Best Practices

Cisco recommends the following best practices for optimal results with the REST API:

  • Keep UI users and script users separate. Especially do not use the admin account as an API user.

  • Do not give script users more privilege than needed.

  • Always validate the content coming from the server.

  • Validate/sanitize JSON content, as it may include embedded executable code.

  • If you are using CC or UCAPL mode you should disable REST API access to the management center and managed devices.