> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FortiGate Cloud

> Connect FortiGate Cloud to Triggr with a FortiCloud IAM API user to reach your FortiGates through Fortinet's cloud.

Triggr reads the live state, configuration, VPN and security profiles of the FortiGates on a FortiGate Cloud account, and can send any FortiOS REST API request to them, without a route to each firewall. To connect to a firewall directly, use [FortiGate](/integrations/fortinet/fortigate); for licences and contracts, use [FortiCloud Asset Management](/integrations/fortinet/forticloud-asset-management).

You need to be the FortiCloud account's primary user or an IAM user with SysAdmin permissions.

## Set up FortiCloud

<Steps>
  <Step title="Create a permission profile">
    In [FortiCloud IAM](https://support.fortinet.com/iam), go to **Permission Profiles > Add New**, set Status to Active, click Add Portal and add the FortiGate Cloud portal with Admin access, then click Save.
  </Step>

  <Step title="Add a dedicated API user">
    Go to **Users > Add New > API User**, enter an Email, select the profile in Permission Profile and click Add. A FortiCloud API user can have only one active token, so don't share it with scripts, other tools or [FortiCloud Asset Management](/integrations/fortinet/forticloud-asset-management).
  </Step>

  <Step title="Download the credentials">
    Click Download Credentials, set a password for the ZIP file and click Proceed. The file holds the API user's ID and password; each download resets them, and the previous ones stop working.
  </Step>
</Steps>

See Fortinet's [FortiGate Cloud API access](https://docs.fortinet.com/document/fortigate-cloud/latest/administration-guide/557024/api-access) and [Adding an API user](https://docs.fortinet.com/document/forticloud/latest/identity-access-management-iam/282341/adding-an-api-user) guides.

## Connect it in Triggr

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > FortiGate Cloud** and click **Configure** on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the API user's credentials">
    Choose the FortiGate Cloud API host for the region your FortiGates are registered to, enter the IAM API User Password and IAM API User ID, leave OAuth client\_id (optional) empty, then click **Save Configuration**.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/fortinet-fortigate-cloud/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=975724bbd9a94a141e222d89467ce5ca" alt="The FortiGate Cloud configuration window with a FortiGate Cloud API host dropdown set to api.fortigate.forticloud.com, IAM API User Password, IAM API User ID and OAuth client_id (optional) fields, and a Save Configuration button." width="1344" height="1646" data-path="images/fortinet-fortigate-cloud/configure.png" />
    </Frame>
  </Step>
</Steps>

Run List Devices in a workflow to check the connection. There's no client mapping: device actions take the FortiGate's `serialNumber` (`sn` in List Devices), so keep each client's serial numbers somewhere your workflows can read, such as a client variable. The Proxy actions take `fortiosPath`, the FortiOS REST API path after `/api/v2/`, such as `monitor/system/status`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Errors mentioning customerapiauth">
    Fortinet rejected the sign-in. Use the API user's ID (not your sign-in email) and the newest credentials file, and check it lists `fortigatecloud` as a client ID.
  </Accordion>

  <Accordion title="401 or 403 errors from actions">
    Give the profile admin access to the FortiGate Cloud portal. If the API user is used elsewhere, create a dedicated one for Triggr.
  </Accordion>

  <Accordion title="List Devices returns no devices or the wrong ones">
    Check FortiGate Cloud API host matches your region, and that the FortiGates are on the account the API user belongs to.
  </Accordion>

  <Accordion title="A device action fails while List Devices works">
    The FortiGate must be online and connected to FortiGate Cloud, and `serialNumber` must match its `sn`.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.