Firewall Policies API

Firewall policies control which traffic the Firebox allows or denies between networks. The Firebox matches each connection to a policy based on the traffic source, destination, and traffic type.

The Firebox Firewall Policies API is a RESTful API that you can use to create, retrieve, update, enable, disable, and delete firewall policies for cloud-managed Fireboxes.

You can also use read-only GET endpoints to retrieve configuration objects that firewall policies reference, such as policy groups, traffic types, aliases, networks, users, groups, SNAT actions, SD-WANs, traffic shaping rules, schedules, and content filtering rules.

For more information about firewall policies, go to About Firebox Firewall Settings in Fireware Help.

You can use the Firebox Firewall Policies API to:

Get Firewall Policies
Create a Firewall Policy
Get a Firewall Policy
Update a Firewall Policy
Enable or Disable a Firewall Policy
Delete a Firewall Policy
Retrieve configuration objects that firewall policies reference

Get Firewall Policies

/{v1}/configuration/{accountid}/firewall/policies

Make a request to this endpoint to retrieve a list of firewall policies for an account or for a specific device.

You can specify the device query parameter to view the firewall policy details for any specific device. You can also specify the full query parameter to view the summary or all the details of the firewall policies for an account or a device in the response.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device

string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only firewall policies for this device are returned.

Example: 12345

full

integer

Specifies the level of detail in the response. You can specify one of these values:

1 - Shows all the details of a firewall policy response.
0 - Shows a summary of each policy that includes only the id, name, group, and device parameters.

If this parameter is not specified, then you can view only the summary of each policy that includes the id, name, group, and device parameters.

Example: 1

Example Request

This request retrieves firewall policies for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/policies?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

{
    "count": 1,
    "objects": [
        {
            "id": "fpol_12345_ARBHLJ70Y78rGOIGBS",
            "object": "firewall_policy",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Outgoing",
            "description": "Allow outgoing traffic",
            "enabled": true,
            "action": "allow",
            "type": "outbound",
            "traffic_types": [
                "ftyp_12345_HTTP80AAABBBCCC",
                "ftyp_12345_HTTPS443DDDEEEF"
            ],
            "sources": [
                {
                    "type": "system_alias",
                    "value": "Any-Internal"
                }
            ],
            "destinations": [
                {
                    "type": "system_alias",
                    "value": "Any-External"
                }
            ],
            "idle_timeout": {
                "override_global": false
            },
            "nat": {
                "dynamic_nat": {
                    "enabled": true,
                    "type": "global"
                }
            },
            "sticky_connection": {
                "override_global": false
            }
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of firewall policies returned.
objects array	List of firewall policy objects.

id string	Unique ID that identifies this firewall policy.
object string	Type of object. The value is firewall_policy.
version integer	Version number of the policy object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Device this policy applies to. Example: 12345
created integer	Time that the object was created, specified in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects added or updated with the Firebox Firewall Policies API.

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Create a Firewall Policy

/{v1}/configuration/{accountid}/firewall/policies

Make a request to this endpoint to create a new firewall policy for a device. You must specify the group parameter to indicate which policy category to add the policy to.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Request Body

device

string | integer

REQUIRED

WatchGuard Cloud Firebox device ID.

Example: 12345

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Example Request

This request creates a new outbound firewall policy for device 12345:

curl -X POST 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/policies
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-d '{
		"device": 12345,
		"name": "Outgoing",
		"description": "Allow outgoing traffic",
		"enabled": true,
		"action": "allow",
		"type": "outbound",
		"group": "fgrp_12345_COREPOLICIESABC",
		"traffic_types": [
			"ftyp_12345_HTTP80AAABBBCCC",
			"ftyp_12345_HTTPS443DDDEEEF"
		],
		"sources": [
			{
				"type": "system_alias",
				"value": "Any-Internal"
			}
		],
		"destinations": [
			{
				"type": "system_alias",
				"value": "Any-External"
			}
		],
		"idle_timeout": {
			"override_global": false
		},
		"nat": {
			"dynamic_nat": {
				"enabled": true,
				"type": "global"
			}
		},
		"sticky_connection": {
			"override_global": false
		}
	}'

Example Response

{
    "id": "fpol_12345_ARBHLJ70Y78rGOIGBS",
    "object": "firewall_policy",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Outgoing",
    "description": "Allow outgoing traffic",
    "enabled": true,
    "action": "allow",
    "type": "outbound",
    "traffic_types": [
        "ftyp_12345_HTTP80AAABBBCCC",
        "ftyp_12345_HTTPS443DDDEEEF"
    ],
    "sources": [
        {
            "type": "system_alias",
            "value": "Any-Internal"
        }
    ],
    "destinations": [
        {
            "type": "system_alias",
            "value": "Any-External"
        }
    ],
    "idle_timeout": {
        "override_global": false
    },
    "nat": {
        "dynamic_nat": {
            "enabled": true,
            "type": "global"
        }
    },
    "sticky_connection": {
        "override_global": false
    }
}

Response Parameters

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this firewall policy.
object string	Type of object. The value is firewall_policy.
version integer	Version number of the policy object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Device this policy applies to. Example: 12345
created integer	Time that the object was created, specified in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects added or updated with the Firebox Firewall Policies API.

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Get a Firewall Policy

/{v1}/configuration/{accountid}/firewall/policies/{objectid}

Make a request to this endpoint to retrieve the specified firewall policy.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the firewall policy.

Example: fpol_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the firewall policy for the objectid fpol_108373_UgnFYgni8APTYNIq:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/policies/fpol_108373_UgnFYgni8APTYNIqrGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

{
    "account": "WGC-1-123abc456",
    "action": "allow",
    "author": "",
    "author_username": "",
    "content_filtering": {
        "action": "Guest",
        "enabled": true
    },
    "content_scanning": true,
    "created": 1779951389,
    "destinations": [
        {
            "type": "system_alias",
            "value": "Any-External"
        }
    ],
    "device": "108373",
    "enabled": true,
    "etag": "18b3a85b9cbb9d33ce787f2a",
    "geolocation": {
        "action": "Guest",
        "enabled": true
    },
    "group": "Core Policies",
    "id": "fpol_108373_UgnFYgni8APTYNIq",
    "idle_timeout": {
        "override_global": false,
        "value": 0
    },
    "inception_time": 1750689300,
    "name": "Guest",
    "nat": {
        "dynamic_nat": {
            "enabled": true,
            "source_ip": {},
            "type": "global"
        }
    },
    "object": "firewall_policy",
    "original_author": "7a6tuMvS80ax58KBmFES2Q==",
    "original_author_username": "TechPubQA",
    "referencedby": [
        "ACC-2121960/fgrp_108373_cc4ax4mKfaLGcLgh"
    ],
    "references": [
        "ftyp_108373_LDqar0c4HONw11DJ",
        "ftyp_108373_H2H58Tbf1GYXnYSS",
        "ftyp_108373_2vT8STHv1fGld5Wq",
        "geoa_108373_pQUBRhapQ2GOfEug",
        "cf_108373_ASZpTzEG4o3bkOPspO"
    ],
    "sources": [
        {
            "type": "system_alias",
            "value": "Any-Guest"
        }
    ],
    "sticky_connection": {
        "interval": 0,
        "override_global": false
    },
    "traffic_types": [
        "FTP",
        "All TCP and UDP",
        "PING"
    ],
    "type": "outbound",
    "version": 3,
    "web_traffic": {
        "enabled": true,
        "ports": [
            80,
            443
        ]
    }
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this firewall policy.
object string	Type of object. The value is firewall_policy.
version integer	Version number of the policy object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Device this policy applies to. Example: 12345
created integer	Time that the object was created, specified in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects added or updated with the Firebox Firewall Policies API.

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Update a Firewall Policy

/{v1}/configuration/{accountid}/firewall/policies/{objectid}

Make a request to this endpoint to update the details in a specific firewall policy.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the firewall policy to update.

Example: fpol_12345_ARBHLJ70Y78rGOIGBS

Request Body

In the request body, include the following parameters:

device

string | integer

REQUIRED

WatchGuard Cloud Firebox device ID.

Example: 12345

version
integer
REQUIRED

Version number of the policy object to update. Each update increments the version by one.

Example: 1

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Example Request

This request updates the action to deny for the firewall policy with the objectid fpol_12345_ARBHLJ70Y78rGOIGBS:

curl -X PUT 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/policies/fpol_12345_ARBHLJ70Y78rGOIGBSrGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-d '{
		"action": "deny",
		"author_username": "",
		"content_filtering": {
			"action": "Guest",
			"enabled": true
			},
		"content_scanning": true,
		"destinations": [
		{
			"type": "system_alias",
			"value": "Any-External"
		}
		],
		"device": "108373",
		"enabled": true,
		"etag": "18b3a85b9cbb9d33ce787f2a",
		"geolocation": {
			"action": "Guest",
			"enabled": true
			},
		"group": "Core Policies",
		"idle_timeout": {
			"override_global": false,
			"value": 0
			},
		"inception_time": 1750689300,
		"name": "Guest",
		"nat": {
			"dynamic_nat": {
				"enabled": true,
				"source_ip": {},
				"type": "global"
			}
		},
		"original_author": "7a6tu123450ax58KBmFES2Q==",
		"original_author_username": "Test",
		"referencedby": [
			"ACC-2121960/fgrp_108373_cc4ax4mKfaLGcLgh"
			],
		"references": [
			"ftyp_108373_LDqar0c4HONw11DJ",
			"ftyp_108373_H2H58Tbf1GYXnYSS",
			"ftyp_108373_2vT8STHv1fGld5Wq",
			"geoa_108373_pQUBRhapQ2GOfEug",
			"cf_108373_ASZpTzEG4o3bkOPspO"
			],
		"sources": [
			{
			"type": "system_alias",
			"value": "Any-Guest"
			}
			],
		"sticky_connection": {
			"interval": 0,
			"override_global": false
			},
		"traffic_types": [
			"FTP",
			"All TCP and UDP",
			"PING"
		],
		"type": "outbound",
		"version": 4,
		"web_traffic": {
		"enabled": true,
		"ports": [
		80,
		443
	]
	}
}'

Example Response

{
    "account": "WGC-1-123abc456",
    "action": "deny",
    "author": "",
    "author_username": "",
    "connection_rate_limit": {
        "connection_rate": 100,
        "enabled": false
    },
    "content_filtering": {
        "action": "Guest",
        "enabled": true
    },
    "content_scanning": true,
    "created": 1779959750,
    "destinations": [
        {
            "type": "system_alias",
            "value": "Any-External"
        }
    ],
    "device": "108373",
    "enabled": true,
    "etag": "18b3aff66eb7c61f2734dfbb",
    "geolocation": {
        "action": "Guest",
        "enabled": true
    },
    "group": "Core Policies",
    "id": "fpol_108373_UgnFYgni8APTYNIq",
    "idle_timeout": {
        "override_global": false,
        "value": 0
    },
    "inception_time": 1750689300,
    "name": "Guest",
    "nat": {
        "dynamic_nat": {
            "enabled": true,
            "source_ip": {},
            "type": "global"
        }
    },
    "object": "firewall_policy",
    "original_author": "7a6tu12345ax58KBmFES2Q==",
    "original_author_username": "Test",
    "referencedby": [
        "ACC-2121960/fgrp_108373_cc4ax4mKfaLGcLgh"
    ],
    "references": [
        "ftyp_108373_LDqar0c4HONw11DJ",
        "ftyp_108373_H2H58Tbf1GYXnYSS",
        "ftyp_108373_2vT8STHv1fGld5Wq",
        "geoa_108373_pQUBRhapQ2GOfEug",
        "cf_108373_ASZpTzEG4o3bkOPspO"
    ],
    "sources": [
        {
            "type": "system_alias",
            "value": "Any-Guest"
        }
    ],
    "sticky_connection": {
        "interval": 0,
        "override_global": false
    },
    "traffic_types": [
        "FTP",
        "All TCP and UDP",
        "PING"
    ],
    "type": "outbound",
    "version": 5,
    "web_traffic": {
        "enabled": true,
        "ports": [
            80,
            443
        ]
    }
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this firewall policy.
object string	Type of object. The value is firewall_policy.
version integer	Version number of the policy object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Device this policy applies to. Example: 12345
created integer	Time that the object was created, specified in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects added or updated with the Firebox Firewall Policies API.

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Enable or Disable a Firewall Policy

/{v1}/configuration/{accountid}/firewall/policies/{objectid}

Make a request to this endpoint to enable or disable a specific firewall policy.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the firewall policy to enable or disable.

Example: fpol_12345_ARBHLJ70Y78rGOIGBS

Request Body

device

string | integer

REQUIRED

WatchGuard Cloud Firebox device ID.

Example: 12345

enabled

boolean

REQUIRED

Specifies whether the policy is enabled or disabled.

Example: false

Example Request

This request disables the firewall policy with objectid fpol_108373_UgnFYgni8APTYNIq:

curl -X PATCH 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/firewall/policies/fpol_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'
	-d '{
		"device": 12345,
		"enabled": false
	}'

Example Response

{
    "account": "ACC-1234567",
    "action": "allow",
    "author": "",
    "author_username": "",
    "content_filtering": {
        "action": "Guest",
        "enabled": true
    },
    "content_scanning": true,
    "created": 1779950987,
    "destinations": [
        {
            "type": "system_alias",
            "value": "Any-External"
        }
    ],
    "device": "12345",
    "enabled": false,
    "etag": "18b3a7fe23d9b1d361dbdc25",
    "geolocation": {
        "action": "Guest",
        "enabled": true
    },
    "group": "Core Policies",
    "id": "fpol_108373_UgnFYgni8APTYNIq",
    "idle_timeout": {
        "override_global": false,
        "value": 0
    },
    "inception_time": 1750689300,
    "name": "Guest",
    "nat": {
        "dynamic_nat": {
            "enabled": true,
            "source_ip": {},
            "type": "global"
        }
    },
    "object": "firewall_policy",
    "original_author": "7a6tuMvS80ax58KBmFES2Q==",
    "original_author_username": "TestAuthor",
    "referencedby": [
        "ACC-2121960/fgrp_108373_cc4ax4mKfaLGcLgh"
    ],
    "references": [
        "ftyp_108373_LDqar0c4HONw11DJ",
        "ftyp_108373_H2H58Tbf1GYXnYSS",
        "ftyp_108373_2vT8STHv1fGld5Wq",
        "geoa_108373_pQUBRhapQ2GOfEug",
        "cf_108373_ASZpTzEG4o3bkOPspO"
    ],
    "sources": [
        {
            "type": "system_alias",
            "value": "Any-Guest"
        }
    ],
    "sticky_connection": {
        "interval": 0,
        "override_global": false
    },
    "traffic_types": [
        "FTP",
        "All TCP and UDP",
        "PING"
    ],
    "type": "outbound",
    "version": 2,
    "web_traffic": {
        "enabled": true,
        "ports": [
            80,
            443
        ]
    }
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this firewall policy.
object string	Type of object. The value is firewall_policy.
version integer	Version number of the policy object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Device this policy applies to. Example: 12345
created integer	Time that the object was created, specified in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects added or updated with the Firebox Firewall Policies API.

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Delete a Firewall Policy

/{v1}/configuration/{accountid}/firewall/policies/{objectid}

Make a request to this endpoint to delete the specified firewall policy. Permanent policies cannot be deleted.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

ID of the firewall policy to delete.

Example: fpol_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request deletes the firewall policy with the objectid of fpol_108373_wu2laNI1SADBdldx:

curl -X DELETE 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/ACC-1234567/firewall/policies/fpol_108373_wu2laNI1SADBdldxrGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

When you delete a firewall policy, the version number increases by one and an inactive parameter with a true value is added to the response.

{
    "account": "ACC-1234567",
    "action": "allow",
    "author": "",
    "author_username": "",
    "content_filtering": {
        "action": "cf_108373_1L6xhM6jfLl3SMU4Tr",
        "enabled": true
    },
    "content_scanning": true,
    "created": 1779947149,
    "destinations": [
        {
            "type": "system_alias",
            "value": "Any-External"
        }
    ],
    "device": "108373",
    "enabled": true,
    "geolocation": {
        "action": "geoa_108373_pL74TEHbLmc4hLYb",
        "enabled": true
    },
    "id": "fpol_108373_wu2laNI1SADBdldx",
    "idle_timeout": {
        "override_global": false,
        "value": 0
    },
    "inactive": true,
    "inception_time": 1750689300,
    "name": "Outgoing",
    "nat": {
        "dynamic_nat": {
            "enabled": true,
            "source_ip": {},
            "type": "global"
        }
    },
    "object": "firewall_policy",
    "original_author": "7a6tuMvS80ax58KBmFES2Q==",
    "original_author_username": "TechPubQA",
    "referencedby": [],
    "references": [
        "ftyp_108373_LDqar0c4HONw11DJ",
        "ftyp_108373_H2H58Tbf1GYXnYSS",
        "ftyp_108373_2vT8STHv1fGld5Wq",
        "geoa_108373_pL74TEHbLmc4hLYb",
        "cf_108373_1L6xhM6jfLl3SMU4Tr"
    ],
    "sources": [
        {
            "type": "system_alias",
            "value": "Any-Internal"
        }
    ],
    "sticky_connection": {
        "interval": 0,
        "override_global": false
    },
    "traffic_types": [
        "ftyp_108373_LDqar0c4HONw11DJ",
        "ftyp_108373_H2H58Tbf1GYXnYSS",
        "ftyp_108373_2vT8STHv1fGld5Wq"
    ],
    "type": "outbound",
    "version": 2,
    "web_traffic": {
        "enabled": true,
        "ports": [
            80,
            443
        ]
    }
}

Data returned in the response includes the following parameters:

inactive
boolean

Indicates that the firewall policy has been deleted. The value is always true.

id string	Unique ID that identifies this firewall policy.
object string	Type of object. The value is firewall_policy.
version integer	Version number of the policy object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Device this policy applies to. Example: 12345
created integer	Time that the object was created, specified in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects added or updated with the Firebox Firewall Policies API.

name string REQUIRED	Name of the firewall policy. Example: Outgoing
description string	Description of the firewall policy. Example: Allow outgoing traffic
enabled boolean REQUIRED	Indicates whether the policy is enabled. The default value is true.
group string REQUIRED	Policy group this policy belongs to. Allowed values are: First Run Policies Last Run Policies Core Policies Example: Core Policies
immutable boolean	Indicates if users can modify this policy. The default value is false.
permanent boolean	Indicates whether this policy is permanent for a device and cannot be deleted by users. The default value is false.
togglable boolean	Indicates whether users can only toggle this policy on or off Specify this parameter with `immutable` to indicate whether the policy is only togglable. The default value is false.
action string REQUIRED	Indicates the action to take for traffic that matches this policy. The allowed values are allow and deny. The default value is allow.
type string REQUIRED	Indicates the firewall policy type. The allowed values are: first last outbound inbound custom
traffic_types array REQUIRED	Name of the traffic types. Must not be empty unless the policy type is outbound and web traffic is enabled. Example: ["ftyp_12345_HTTP80AAABBBCCC"]
sources array REQUIRED	Source addresses or objects to match against a connection.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
destinations array REQUIRED	Destination addresses or objects to match against a connection. Uses the same format as `sources`.
type string	Specifies the type of source. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group firewall_snat_action
value string	Value for the match type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or an alias name for `system_alias`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
sdwan string	Name of the SD-WAN action or reference to an SD-WAN action configuration object.
geolocation object	Geolocation action settings for this policy.
enabled boolean	Indicates whether geolocation filtering is enabled. The default value is true.
action string	Name of the Geolocation action or reference to a Geolocation action configuration object.
tor_nodes boolean	Indicates whether Tor exit node blocking is enabled for this policy. The default value is false.
idle_timeout object	Idle timeout settings for this policy.
override_global boolean	Indicates whether the global idle timeout setting is overridden. The default value is false.
value integer	Idle timeout value in seconds. The default value is 180.
nat object	Network Address Translation (NAT) settings.
global_one_to_one_nat object	1-to-1 NAT settings for this policy.
enabled boolean	Indicates whether 1-to-1 NAT is enabled for this policy. The default value is true.
dynamic_nat object	Dynamic NAT settings.
enabled boolean	Indicates whether dynamic NAT is enabled. The default value is true.
type string	Dynamic NAT type. The allowed values are global and per_policy. The default value is global.
source_ip object	Source IP address override settings for dynamic NAT.
enabled boolean	Indicates whether a specified source IP address is used for dynamic NAT. The default value is false.
ipv4_address string	IPv4 address used as the source address for dynamic NAT. Example: 192.0.2.1
sticky_connection object	Sticky connection settings for this policy.
override_global boolean	Indicates whether the global sticky connection setting is overridden. The default value is false.
interval integer	Sticky connection interval in seconds. The default value is 180.
connection_rate_limit object	Connection rate limit settings for this policy.
enabled boolean REQUIRED	Indicates whether connection rate limiting is enabled. The default value is false.
connection_rate integer	Maximum number of connections per second. Valid range: 1–100000. The default value is 100.
alarm boolean	Indicates whether an alarm is triggered when the connection rate limit is exceeded. The default value is false.
notifications object	Notification settings for this policy.
enabled boolean	Indicates whether notifications are enabled for this policy. The default value is false.
snmp boolean	Indicates whether SNMP traps are sent for this policy. The default value is false.
traffic_shaping string	Name of the traffic shaping rule or reference to a traffic shaping configuration object.
qos object	Quality of Service (QoS) marking settings for this policy.
marking_type string	QoS marking type. The allowed values are: dscp ip_precedence The default value is ip_precedence.
method string	QoS marking method. The allowed values are: preserve clear assign The default value is preserve.
value integer	QoS marking value. Valid range depends on the `marking_type`: 0–7 for `ip_precedence`, or a DSCP value for `dscp`. The default value is 0.
websocket boolean	Indicates whether WebSocket traffic is allowed by this policy. Applies to `outbound` type policies only. The default value is false.
web_action_setting object	Web action settings. Applies to `outbound` type policies only.
safe_search object	SafeSearch enforcement settings.
enabled boolean REQUIRED	Indicates whether SafeSearch is enabled. The default value is false.
enforcement_level string	SafeSearch enforcement level. The allowed values are moderate and strict. The default value is strict.
google_apps_allowed_domains object	Google Apps allowed domains settings.
enabled boolean REQUIRED	Indicates whether Google Apps domain restriction is enabled. The default value is false.
domains array	List of allowed domain names.
fastvue_enabled boolean	Indicates whether Fastvue reporting is enabled. The default value is false.
url_path_keywords_filtering object	URL path keyword filtering settings.
enabled boolean REQUIRED	Indicates whether URL path keyword filtering is enabled. The default value is false.
keywords array	List of keyword filter objects.
keyword_type string REQUIRED	Keyword match type. The allowed values are: pattern regexp string
keyword string REQUIRED	Keyword to filter. Maximum: 200 characters.
action string REQUIRED	Action to take when the keyword matches. The allowed values are allow and deny.
log boolean	Indicates whether to log keyword filter matches. The default value is true.
alarm boolean	Indicates whether to trigger an alarm on keyword filter matches. The default value is false.
smtp_setting object	SMTP settings for this policy.
max_email_size integer	Maximum email message size in MB. Valid range: 1 – 150. The default value is 20.
schedule string	Name of the schedule or reference to a schedule configuration object.
content_filtering object	Content filtering action settings. Applies to `first`, `last`, `outbound`, and `custom` type policies.
enabled boolean	Indicates whether content filtering is enabled. The default value is true.
action string	Name of the content filtering action or reference to a content filtering action configuration object.
web_traffic object	Web traffic inspection settings for selected ports. Applies to `outbound` type policies.
enabled boolean	Indicates whether web traffic inspection is enabled. The default value is false.
ports array	TCP ports to inspect for web traffic.
inspect_https boolean	Indicates whether HTTPS traffic is inspected. The default value is false.
content_scanning boolean	Indicates whether content scanning is enabled. Applies to `outbound`, `inbound`, and `custom` type policies. The default value is true.
traffic_direction string	Traffic direction setting. Applies to `custom` type policies. The allowed values are bidirectional and unidirectional.

Get Policy Groups

/{v1}/configuration/{accountid}/firewall/policy_groups

Make a request to this endpoint to retrieve a list of policy groups for an account or for a specific device or template. If you specify the device query parameter, only the policy groups for that device are returned. If you specify the templateid query parameter, only the policy groups for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves policy groups for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/policy_groups?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of policy group objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fpg_12345_ARBHLJ70Y78rGOIGBS",
            "object": "firewall_policy_group",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Core Policies",
            "policies": [
                "fpol_12345_ARBHLJ70Y78rGOIGBS"
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of policy groups returned.
objects array	List of policy group objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the policy group.
policies array	Lists references to firewall policies in the group, in order.

Get a Policy Group

/{v1}/configuration/{accountid}/firewall/policy_groups/{objectid}

Make a request to this endpoint to retrieve the specified policy group.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the policy group to retrieve.

Example: fpg_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the policy group for the objectid fpg_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/policy_groups/fpg_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified policy group object.

                {
    "id": "fpg_12345_ARBHLJ70Y78rGOIGBS",
    "object": "firewall_policy_group",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Core Policies",
    "policies": [
        "fpol_12345_ARBHLJ70Y78rGOIGBS"
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the policy group.
policies array	Lists references to firewall policies in the group, in order.

Get Traffic Types

/{v1}/configuration/{accountid}/firewall/traffic_types

Make a request to this endpoint to retrieve a list of traffic types for an account or for a specific device or template. If you specify the device query parameter, only the traffic types for that device are returned. If you specify the templateid query parameter, only the traffic types for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves traffic types for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/traffic_types?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of traffic type objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "ftyp_12345_LDqar0c4HONw11DJ",
            "object": "firewall_traffic_type",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "HTTP",
            "description": "HTTP traffic",
            "type": "custom",
            "category": "Web",
            "protocols": [
                {
                    "type": "single_port",
                    "protocol": 6,
                    "value": 80
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of traffic types returned.
objects array	List of traffic type objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the traffic type. Maximum: 58 characters.
description string	Specifies the description of the traffic type. Maximum: 127 characters.
type string	Defines whether the traffic type is predefined or custom. The allowed values are predefined and custom. The default value is custom.
category string	Specifies the traffic type category. The default value is Custom. The allowed values are: Auth Custom Database Email File General Network RemoteAccess Tunneling VoIP/Chat WatchGuard Web
protocols array REQUIRED	Lists the protocols and ports that define the traffic type. Minimum: 1 item.
protocol integer	Specifies the IP protocol number. Valid range: 0–255 when `type` is any. When `type` is single_port or port_range, the allowed values are 6 (TCP) and 17 (UDP). When `type` is icmp, the allowed values are 1 (ICMP) and 58 (ICMPv6).
type string REQUIRED	Specifies the protocol match type. The allowed values are: any single_port port_range icmp
value integer	Specifies the port or ICMP settings for the protocol. Omit this property when `type` is any. When `type` is single_port, this value is an integer port number (valid range: 0–65535). When `type` is port_range, this value is an object that contains `start` and `end`. When `type` is icmp, this value is an object that contains `icmp_type` and `icmp_code`.
start integer REQUIRED	Specifies the starting port number when `type` is port_range. Valid range: 0–65535.
end integer REQUIRED	Specifies the ending port number when `type` is port_range. Valid range: 0–65535.
icmp_type integer REQUIRED	Specifies the ICMP type when `type` is icmp. Valid range: 0–255.
icmp_code integer REQUIRED	Specifies the ICMP code when `type` is icmp. Valid range: 0–255.

Get a Traffic Type

/{v1}/configuration/{accountid}/firewall/traffic_types/{objectid}

Make a request to this endpoint to retrieve the specified traffic type.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the traffic type to retrieve.

Example: ftyp_12345_LDqar0c4HONw11DJ

Example Request

This request retrieves the traffic type for the objectid ftyp_12345_LDqar0c4HONw11DJ:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/traffic_types/ftyp_12345_LDqar0c4HONw11DJ
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified traffic type object.

                {
    "id": "ftyp_12345_LDqar0c4HONw11DJ",
    "object": "firewall_traffic_type",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "HTTP",
    "description": "HTTP traffic",
    "type": "custom",
    "category": "Web",
    "protocols": [
        {
            "type": "single_port",
            "protocol": 6,
            "value": 80
        }
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the traffic type. Maximum: 58 characters.
description string	Specifies the description of the traffic type. Maximum: 127 characters.
type string	Defines whether the traffic type is predefined or custom. The allowed values are predefined and custom. The default value is custom.
category string	Specifies the traffic type category. The default value is Custom. The allowed values are: Auth Custom Database Email File General Network RemoteAccess Tunneling VoIP/Chat WatchGuard Web
protocols array REQUIRED	Lists the protocols and ports that define the traffic type. Minimum: 1 item.
protocol integer	Specifies the IP protocol number. Valid range: 0–255 when `type` is any. When `type` is single_port or port_range, the allowed values are 6 (TCP) and 17 (UDP). When `type` is icmp, the allowed values are 1 (ICMP) and 58 (ICMPv6).
type string REQUIRED	Specifies the protocol match type. The allowed values are: any single_port port_range icmp
value integer	Specifies the port or ICMP settings for the protocol. Omit this property when `type` is any. When `type` is single_port, this value is an integer port number (valid range: 0–65535). When `type` is port_range, this value is an object that contains `start` and `end`. When `type` is icmp, this value is an object that contains `icmp_type` and `icmp_code`.
start integer REQUIRED	Specifies the starting port number when `type` is port_range. Valid range: 0–65535.
end integer REQUIRED	Specifies the ending port number when `type` is port_range. Valid range: 0–65535.
icmp_type integer REQUIRED	Specifies the ICMP type when `type` is icmp. Valid range: 0–255.
icmp_code integer REQUIRED	Specifies the ICMP code when `type` is icmp. Valid range: 0–255.

Get Aliases

/{v1}/configuration/{accountid}/firewall/aliases

Make a request to this endpoint to retrieve a list of aliases for an account or for a specific device or template. If you specify the device query parameter, only the aliases for that device are returned. If you specify the templateid query parameter, only the aliases for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves aliases for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/aliases?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of alias objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fali_12345_ARBHLJ70Y78rGOIGBS",
            "object": "firewall_alias",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Internal Servers",
            "description": "Internal server addresses",
            "members": [
                {
                    "type": "ipv4_host",
                    "value": "192.0.2.10"
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of aliases returned.
objects array	List of alias objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the alias.
description string	Specifies the description of the alias.
members array REQUIRED	Lists the addresses, networks, or objects included in the alias.
type string	Specifies the type of alias member. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Specifies the value for the member type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or a reference to an existing object for types such as `firewall_alias` or `network`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.

Get an Alias

/{v1}/configuration/{accountid}/firewall/aliases/{objectid}

Make a request to this endpoint to retrieve the specified alias.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the alias to retrieve.

Example: fali_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the alias for the objectid fali_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/aliases/fali_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified alias object.

                {
    "id": "fali_12345_ARBHLJ70Y78rGOIGBS",
    "object": "firewall_alias",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Internal Servers",
    "description": "Internal server addresses",
    "members": [
        {
            "type": "ipv4_host",
            "value": "192.0.2.10"
        }
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the alias.
description string	Specifies the description of the alias.
members array REQUIRED	Lists the addresses, networks, or objects included in the alias.
type string	Specifies the type of alias member. The allowed values are: ipv4_host ipv4_network ipv4_range ipv6_host ipv6_network ipv6_range fqdn system_alias firewall_alias network firebox_user firebox_group auth_group authpoint_user_group saml_user_group shared_user_group
value string	Specifies the value for the member type. The format depends on the type. For example, an IPv4 address for `ipv4_host`, or a reference to an existing object for types such as `firewall_alias` or `network`. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.

Get Networks

/{v1}/configuration/{accountid}/networking/networks

Make a request to this endpoint to retrieve a list of networks for an account or for a specific device or template. If you specify the device query parameter, only the networks for that device are returned. If you specify the templateid query parameter, only the networks for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves networks for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/networking/networks?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of network objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fnet_12345_ARBHLJ70Y78rGOIGBS",
            "object": "network",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Trusted",
            "type": "vlan",
            "zone": "internal",
            "vid": 10,
            "interfaces": [
                {
                    "interface": "eth1",
                    "tagged": true
                }
            ],
            "ip_addresses": {
                "primary": "192.0.2.1/24"
            }
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of networks returned.
objects array	List of network objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

type string REQUIRED	Specifies the network type. The allowed values are: standalone bridge vlan
ifnum integer	Specifies the interface number. This value is set by the system. Do not set this parameter.
vid integer	Specifies the VLAN ID for VLAN networks.
name string REQUIRED	Specifies the name of the network. Maximum: 58 characters.
zone string REQUIRED	Specifies the network zone. On the Firebox, internal maps to Trusted and guest maps to Optional. The allowed values are: internal external guest ha
interfaces array REQUIRED	Lists the interfaces assigned to the network.
interface object	Specifies the network interface. This value can be a string reference to an existing network interface object, or an inline network interface object.
type string REQUIRED	Specifies the interface type. The allowed values are: physical lag wireless modem
mode string	Specifies the interface mode. This value is set by the system. The allowed values are: standalone bridge vlan
ifnum integer	Specifies the interface number.
enabled boolean REQUIRED	Indicates whether the interface is enabled.
ethernet_settings object	Specifies Ethernet settings for the interface.
auto_negotiate boolean	Indicates whether auto-negotiation is enabled for the Ethernet link.
link_speed string	Specifies the Ethernet link speed in Mbps. The allowed values are: 10 100 1000 2500 5000 10000
full_duplex boolean	Indicates whether full-duplex mode is enabled.
mtu integer	Specifies the maximum transmission unit (MTU) for the interface. Valid range: 68–9000.
qos_type string	Specifies the QoS marking type. The allowed values are 1 (DSCP) and 2 (Precedence).
qos_method string	Specifies the QoS marking method. The allowed values are 0 (Preserve) and 1 (Assign).
qos_value integer	Specifies the QoS marking value.
wireless_settings object	Specifies wireless settings for the interface.
ssid string REQUIRED	Specifies the SSID for the wireless interface. Minimum: 1 character. Maximum: 32 characters.
operation_mode string REQUIRED	Specifies the wireless operation mode. The allowed value is wireless_ap.
broadcast_ssid boolean	Indicates whether the SSID is broadcast.
auth_mode string REQUIRED	Specifies the wireless authentication mode. The allowed values are: open_system owe psk_wpa2_only psk_wpa3_only wpa2_wpa3_mixed wpa2_enterprise wpa3_enterprise wpa2_wpa3_enterprise
passphrase string	Specifies the wireless passphrase. Minimum: 8 characters. Maximum: 63 characters.
log_authentication_events boolean	Indicates whether wireless authentication events are logged.
client_isolation boolean	Indicates whether wireless client isolation is enabled.
2_4ghz_radio boolean	Indicates whether the 2.4 GHz radio is enabled for this wireless interface.
5ghz_radio boolean	Indicates whether the 5 GHz radio is enabled for this wireless interface.
6ghz_radio boolean	Indicates whether the 6 GHz radio is enabled for this wireless interface.
domain string	Specifies a reference to an authentication domain for enterprise wireless authentication.
eap_reauth_period integer	Specifies the EAP reauthentication period in seconds. Valid range: 0–2147483647.
modem_settings object	Specifies modem settings for the interface.
builtin boolean REQUIRED	Indicates whether the modem is a built-in modem.
apn string	Specifies the Access Point Name (APN) for the modem. Minimum: 1 character. Maximum: 255 characters.
ipv6 object	Specifies IPv6 settings for the modem.
enabled boolean REQUIRED	Indicates whether IPv6 is enabled for the modem. The default value is false.
lag_settings object	Specifies link aggregation (LAG) settings for the interface.
name string REQUIRED	Specifies the name of the LAG.
mode string REQUIRED	Specifies the LAG mode. The allowed values are: dynamic static active-backup
members array REQUIRED	Lists string references to the member interfaces of the LAG.
tagged boolean	Indicates whether the interface is tagged for this network.
ip_addresses object	Specifies the IP address settings for the network.
primary string	Specifies the primary IPv4 address in CIDR notation.
secondary array	Lists secondary IPv4 addresses in CIDR notation.
gateway string	Specifies the IPv4 gateway address.
external_type string	Specifies the external network addressing type. The allowed values are: static dhcp pppoe
dhcp_client object	Specifies DHCP client settings for the network.
ip_addr string	Specifies the IPv4 address for the DHCP client.
client_id string	Specifies the DHCP client identifier. Minimum: 1 character. Maximum: 255 characters.
host_name string	Specifies the DHCP client host name. Minimum: 1 character. Maximum: 255 characters.
lease_time integer	Specifies the DHCP lease time in seconds. Valid range: 1–2147483647.
force_renew boolean	Indicates whether the DHCP client forces lease renewal.
auth_token string	Specifies the DHCP authentication token. Minimum: 1 character. Maximum: 513 characters.
pppoe_client object	Specifies PPPoE client settings for the network.
ip_addr string	Specifies the IPv4 address for the PPPoE client.
user string	Specifies the PPPoE user name. Minimum: 1 character. Maximum: 63 characters.
password string	Specifies the PPPoE password. Minimum: 1 character. Maximum: 192 characters.
dial_on_demand boolean	Indicates whether dial-on-demand is enabled for the PPPoE connection.
init_delay integer	Specifies the PPPoE initialization delay in seconds. Valid range: 0–3600. The default value is 60.
idle_timeout integer	Specifies the PPPoE idle timeout in seconds. Valid range: 0–60. The default value is 20.
retry_unique boolean	Indicates whether the PPPoE client retries with a unique Host-Uniq value.
retry_lcp boolean	Indicates whether the PPPoE client retries LCP negotiation.
lcp_retries integer	Specifies the number of LCP retries. Valid range: 1–60. The default value is 6.
lcp_timeout integer	Specifies the LCP timeout in seconds. Valid range: 1–1200. The default value is 10.
auto_restart boolean	Indicates whether the PPPoE connection automatically restarts on a schedule.
restart_day integer	Specifies the day of the week for the PPPoE automatic restart. Valid range: 0–7, where 0 is Sunday, 6 is Saturday, and 7 is Everyday.
restart_hour integer	Specifies the hour for the PPPoE automatic restart. Valid range: 0–23.
restart_minute integer	Specifies the minute for the PPPoE automatic restart. Valid range: 0–59.
service_name string	Specifies the PPPoE service name. Minimum: 1 character. Maximum: 255 characters.
ac_name string	Specifies the PPPoE access concentrator name. Minimum: 1 character. Maximum: 255 characters.
auth_retry integer	Specifies the number of PPPoE authentication retries. Valid range: 0–20. The default value is 3.
auth_timeout integer	Specifies the PPPoE authentication timeout in seconds. Valid range: 0–60. The default value is 20.
static_ip_mode string	Specifies the PPPoE static IP mode. The allowed values are: send_ip no_send_ip enforce_ip
use_peer_dns boolean	Indicates whether peer DNS servers from the PPPoE connection are used.
mac_acl object	Specifies MAC address access control list settings for the network.
enabled boolean REQUIRED	Indicates whether MAC address access control is enabled.
mac_addresses array	Lists MAC addresses in the access control list.
mac_address string	Specifies a MAC address.
name string	Specifies a name for the MAC address entry. Minimum: 1 character. Maximum: 47 characters.
dhcp_server object	Specifies DHCP server settings for the network.
server_type string REQUIRED	Specifies the DHCP server type. The allowed values are: disabled server relay
lease_time integer	Specifies the DHCP lease time in seconds. The default value is 28800.
domain_name string	Specifies the DHCP domain name. Minimum: 1 character. Maximum: 63 characters.
address_pools array	Lists DHCP address pools.
start string	Specifies the starting IPv4 address of the DHCP address pool.
end string	Specifies the ending IPv4 address of the DHCP address pool.
dns object	Specifies DNS settings for the DHCP server.
servers array	Lists IPv4 DNS server addresses. Minimum: 1. Maximum: 3.
reserved_addresses array	Lists reserved DHCP addresses.
ip string	Specifies the reserved IPv4 address.
name string	Specifies the name associated with the reserved address.
mac string	Specifies the MAC address associated with the reserved address.
dhcp_options array	Lists custom DHCP options. Maximum: 255 options.
code integer	Specifies the DHCP option code. Valid range: 1–255.
name string	Specifies the name of the DHCP option. Minimum: 1 character. Maximum: 63 characters.
type string	Specifies the DHCP option data type. The allowed values are: int8 uint8 int16 uint16 int32 uint32 bool text hex ips
value string	Specifies the DHCP option value. Minimum: 1 character. Maximum: 255 characters.
gateway_ip string	Specifies the IPv4 gateway address provided by the DHCP server.
relay_servers array	Lists IPv4 DHCP relay server addresses. Maximum: 3.
link_monitor object	Specifies link monitor settings for the network.
enabled boolean REQUIRED	Indicates whether link monitoring is enabled. The default value is false.
default boolean	Indicates whether this is the default link monitor. The default value is false.
type string	Specifies the link monitor probe type. The allowed values are: dns ping tcp
target object	Specifies the link monitor target. Use `type` and `value` to identify an IPv4 address or domain.
type string	Specifies the target type.
value string	Specifies the target value.
port integer	Specifies the TCP port for link monitoring when `type` is tcp.
domain object	Specifies a domain target for link monitoring.
type string	Specifies the domain type. The value is domain.
value string	Specifies the domain name.
nexthop string	Specifies the IPv4 next-hop address for link monitoring.
dynamic_dns object	Specifies dynamic DNS settings for the network.
enabled boolean REQUIRED	Indicates whether dynamic DNS is enabled. The default value is false.
provider string	Specifies the dynamic DNS provider. Minimum: 4 characters. Maximum: 64 characters.
username string	Specifies the dynamic DNS user name. Minimum: 4 characters. Maximum: 64 characters.
password string	Specifies the dynamic DNS password. Minimum: 4 characters. Maximum: 513 characters.
domain object	Specifies the dynamic DNS domain.
type string	Specifies the domain type.
value string	Specifies the domain value.
options string	Specifies additional dynamic DNS options. Maximum: 255 characters.
forced_update integer	Specifies the forced update interval in days. Valid range: 1–28.
allow_provider_ip_selection boolean	Indicates whether the provider can select the IP address. The default value is false.
allow_webui boolean	Indicates whether Web UI access is allowed on this network. The default value is false.
allow_ping boolean	Indicates whether ping is allowed on this network. The default value is false.
ipv6 object	Specifies IPv6 settings for the network.
enabled boolean REQUIRED	Indicates whether IPv6 is enabled. The default value is false.
addresses array	Lists IPv6 addresses for the network.
addr string REQUIRED	Specifies the IPv6 address in CIDR notation.
advert_prefix boolean	Indicates whether the prefix is advertised. The default value is false.
pd_network string	Specifies a reference to a prefix delegation network.
default_gateway string	Specifies the IPv6 default gateway address.
hop_limit integer	Specifies the IPv6 hop limit. Valid range: 1–65535. The default value is 64.
dad_transmit integer	Specifies the number of duplicate address detection (DAD) transmits. Valid range: 1–10. The default value is 1.
router_advertisements object	Specifies IPv6 router advertisement settings.
send_advertisements boolean	Indicates whether router advertisements are sent. The default value is false.
managed boolean	Indicates whether the managed address configuration flag is set. The default value is false.
other boolean	Indicates whether the other configuration flag is set. The default value is false.
default_lifetime integer	Specifies the default router lifetime in seconds. Valid range: 0–9000. The default value is 1800.
max_interval integer	Specifies the maximum router advertisement interval in seconds. Valid range: 4–1800. The default value is 600.
min_interval integer	Specifies the minimum router advertisement interval in seconds. Valid range: 3–1350. The default value is 200.
prefixes array	Lists prefixes included in router advertisements.
network_addr string REQUIRED	Specifies the IPv6 network address in CIDR notation.
pd_network string	Specifies a reference to a prefix delegation network.
valid_lifetime integer	Specifies the valid lifetime in seconds. The default value is 2592000.
prefer_lifetime integer	Specifies the preferred lifetime in seconds. The default value is 604800.
autonomous boolean	Indicates whether the autonomous address-configuration flag is set. The default value is true.
onlink boolean	Indicates whether the on-link flag is set. The default value is true.
external object	Specifies external IPv6 settings.
dhcp_client object	Specifies IPv6 DHCP client settings.
enabled boolean	Indicates whether the IPv6 DHCP client is enabled. The default value is false.
rapid_commit boolean	Indicates whether rapid commit is enabled for the IPv6 DHCP client. The default value is false.
dhcp_client_pd object	Specifies IPv6 DHCP client prefix delegation settings.
enabled boolean	Indicates whether IPv6 DHCP client prefix delegation is enabled.
rapid_commit boolean	Indicates whether rapid commit is enabled for prefix delegation.
perform_iana_query boolean	Indicates whether an IANA query is performed. The default value is false.
custom_iaid string	Specifies a custom IAID. Length: 8 characters.
autoconf boolean	Indicates whether IPv6 autoconfiguration is enabled. The default value is false.
dhcp_server object	Specifies IPv6 DHCP server settings.
server_type string REQUIRED	Specifies the IPv6 DHCP server type. The allowed values are disabled and server.
rapid_commit boolean	Indicates whether rapid commit is enabled for the IPv6 DHCP server. The default value is false.
preferred_lifetime integer	Specifies the preferred lifetime in seconds. The default value is 86400.
valid_lifetime integer	Specifies the valid lifetime in seconds. The default value is 172800.
dns object	Specifies DNS settings for the IPv6 DHCP server.
domain object	Specifies the DNS domain.
type string	Specifies the domain type.
value string	Specifies the domain value.
servers array	Lists IPv6 DNS server addresses. Minimum: 1. Maximum: 3.
sip object	Specifies SIP settings for the IPv6 DHCP server.
domain object	Specifies the SIP domain.
type string	Specifies the domain type.
value string	Specifies the domain value.
servers array	Lists IPv6 SIP server addresses. Minimum: 1. Maximum: 3.
address_pools array	Lists IPv6 address pools.
start string REQUIRED	Specifies the starting IPv6 address of the address pool.
end string REQUIRED	Specifies the ending IPv6 address of the address pool.
pd_network string	Specifies a reference to a prefix delegation network.
prefix_pools array	Lists IPv6 prefix pools.
start string REQUIRED	Specifies the starting prefix of the prefix pool.
end string REQUIRED	Specifies the ending prefix of the prefix pool.
prefix_length integer REQUIRED	Specifies the prefix length. Valid range: 1–127.
reserved_addresses array	Lists reserved IPv6 addresses.
name string	Specifies the name associated with the reserved address.
ip string	Specifies the reserved IPv6 address.
duid string REQUIRED	Specifies the DUID associated with the reserved address.
prefix string	Specifies the reserved IPv6 prefix.
pd_network string	Specifies a reference to a prefix delegation network.
intra_inspection boolean	Indicates whether intra-network inspection is enabled.
stp_enabled boolean	Indicates whether Spanning Tree Protocol (STP) is enabled. Applies to bridge and VLAN networks only. The default value is false.

Get a Network

/{v1}/configuration/{accountid}/networking/networks/{objectid}

Make a request to this endpoint to retrieve the specified network.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the network to retrieve.

Example: fnet_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the network for the objectid fnet_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/networking/networks/fnet_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified network object.

                {
    "id": "fnet_12345_ARBHLJ70Y78rGOIGBS",
    "object": "network",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Trusted",
    "type": "vlan",
    "zone": "internal",
    "vid": 10,
    "interfaces": [
        {
            "interface": "eth1",
            "tagged": true
        }
    ],
    "ip_addresses": {
        "primary": "192.0.2.1/24"
    }
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

type string REQUIRED	Specifies the network type. The allowed values are: standalone bridge vlan
ifnum integer	Specifies the interface number. This value is set by the system. Do not set this parameter.
vid integer	Specifies the VLAN ID for VLAN networks.
name string REQUIRED	Specifies the name of the network. Maximum: 58 characters.
zone string REQUIRED	Specifies the network zone. On the Firebox, internal maps to Trusted and guest maps to Optional. The allowed values are: internal external guest ha
interfaces array REQUIRED	Lists the interfaces assigned to the network.
interface object	Specifies the network interface. This value can be a string reference to an existing network interface object, or an inline network interface object.
type string REQUIRED	Specifies the interface type. The allowed values are: physical lag wireless modem
mode string	Specifies the interface mode. This value is set by the system. The allowed values are: standalone bridge vlan
ifnum integer	Specifies the interface number.
enabled boolean REQUIRED	Indicates whether the interface is enabled.
ethernet_settings object	Specifies Ethernet settings for the interface.
auto_negotiate boolean	Indicates whether auto-negotiation is enabled for the Ethernet link.
link_speed string	Specifies the Ethernet link speed in Mbps. The allowed values are: 10 100 1000 2500 5000 10000
full_duplex boolean	Indicates whether full-duplex mode is enabled.
mtu integer	Specifies the maximum transmission unit (MTU) for the interface. Valid range: 68–9000.
qos_type string	Specifies the QoS marking type. The allowed values are 1 (DSCP) and 2 (Precedence).
qos_method string	Specifies the QoS marking method. The allowed values are 0 (Preserve) and 1 (Assign).
qos_value integer	Specifies the QoS marking value.
wireless_settings object	Specifies wireless settings for the interface.
ssid string REQUIRED	Specifies the SSID for the wireless interface. Minimum: 1 character. Maximum: 32 characters.
operation_mode string REQUIRED	Specifies the wireless operation mode. The allowed value is wireless_ap.
broadcast_ssid boolean	Indicates whether the SSID is broadcast.
auth_mode string REQUIRED	Specifies the wireless authentication mode. The allowed values are: open_system owe psk_wpa2_only psk_wpa3_only wpa2_wpa3_mixed wpa2_enterprise wpa3_enterprise wpa2_wpa3_enterprise
passphrase string	Specifies the wireless passphrase. Minimum: 8 characters. Maximum: 63 characters.
log_authentication_events boolean	Indicates whether wireless authentication events are logged.
client_isolation boolean	Indicates whether wireless client isolation is enabled.
2_4ghz_radio boolean	Indicates whether the 2.4 GHz radio is enabled for this wireless interface.
5ghz_radio boolean	Indicates whether the 5 GHz radio is enabled for this wireless interface.
6ghz_radio boolean	Indicates whether the 6 GHz radio is enabled for this wireless interface.
domain string	Specifies a reference to an authentication domain for enterprise wireless authentication.
eap_reauth_period integer	Specifies the EAP reauthentication period in seconds. Valid range: 0–2147483647.
modem_settings object	Specifies modem settings for the interface.
builtin boolean REQUIRED	Indicates whether the modem is a built-in modem.
apn string	Specifies the Access Point Name (APN) for the modem. Minimum: 1 character. Maximum: 255 characters.
ipv6 object	Specifies IPv6 settings for the modem.
enabled boolean REQUIRED	Indicates whether IPv6 is enabled for the modem. The default value is false.
lag_settings object	Specifies link aggregation (LAG) settings for the interface.
name string REQUIRED	Specifies the name of the LAG.
mode string REQUIRED	Specifies the LAG mode. The allowed values are: dynamic static active-backup
members array REQUIRED	Lists string references to the member interfaces of the LAG.
tagged boolean	Indicates whether the interface is tagged for this network.
ip_addresses object	Specifies the IP address settings for the network.
primary string	Specifies the primary IPv4 address in CIDR notation.
secondary array	Lists secondary IPv4 addresses in CIDR notation.
gateway string	Specifies the IPv4 gateway address.
external_type string	Specifies the external network addressing type. The allowed values are: static dhcp pppoe
dhcp_client object	Specifies DHCP client settings for the network.
ip_addr string	Specifies the IPv4 address for the DHCP client.
client_id string	Specifies the DHCP client identifier. Minimum: 1 character. Maximum: 255 characters.
host_name string	Specifies the DHCP client host name. Minimum: 1 character. Maximum: 255 characters.
lease_time integer	Specifies the DHCP lease time in seconds. Valid range: 1–2147483647.
force_renew boolean	Indicates whether the DHCP client forces lease renewal.
auth_token string	Specifies the DHCP authentication token. Minimum: 1 character. Maximum: 513 characters.
pppoe_client object	Specifies PPPoE client settings for the network.
ip_addr string	Specifies the IPv4 address for the PPPoE client.
user string	Specifies the PPPoE user name. Minimum: 1 character. Maximum: 63 characters.
password string	Specifies the PPPoE password. Minimum: 1 character. Maximum: 192 characters.
dial_on_demand boolean	Indicates whether dial-on-demand is enabled for the PPPoE connection.
init_delay integer	Specifies the PPPoE initialization delay in seconds. Valid range: 0–3600. The default value is 60.
idle_timeout integer	Specifies the PPPoE idle timeout in seconds. Valid range: 0–60. The default value is 20.
retry_unique boolean	Indicates whether the PPPoE client retries with a unique Host-Uniq value.
retry_lcp boolean	Indicates whether the PPPoE client retries LCP negotiation.
lcp_retries integer	Specifies the number of LCP retries. Valid range: 1–60. The default value is 6.
lcp_timeout integer	Specifies the LCP timeout in seconds. Valid range: 1–1200. The default value is 10.
auto_restart boolean	Indicates whether the PPPoE connection automatically restarts on a schedule.
restart_day integer	Specifies the day of the week for the PPPoE automatic restart. Valid range: 0–7, where 0 is Sunday, 6 is Saturday, and 7 is Everyday.
restart_hour integer	Specifies the hour for the PPPoE automatic restart. Valid range: 0–23.
restart_minute integer	Specifies the minute for the PPPoE automatic restart. Valid range: 0–59.
service_name string	Specifies the PPPoE service name. Minimum: 1 character. Maximum: 255 characters.
ac_name string	Specifies the PPPoE access concentrator name. Minimum: 1 character. Maximum: 255 characters.
auth_retry integer	Specifies the number of PPPoE authentication retries. Valid range: 0–20. The default value is 3.
auth_timeout integer	Specifies the PPPoE authentication timeout in seconds. Valid range: 0–60. The default value is 20.
static_ip_mode string	Specifies the PPPoE static IP mode. The allowed values are: send_ip no_send_ip enforce_ip
use_peer_dns boolean	Indicates whether peer DNS servers from the PPPoE connection are used.
mac_acl object	Specifies MAC address access control list settings for the network.
enabled boolean REQUIRED	Indicates whether MAC address access control is enabled.
mac_addresses array	Lists MAC addresses in the access control list.
mac_address string	Specifies a MAC address.
name string	Specifies a name for the MAC address entry. Minimum: 1 character. Maximum: 47 characters.
dhcp_server object	Specifies DHCP server settings for the network.
server_type string REQUIRED	Specifies the DHCP server type. The allowed values are: disabled server relay
lease_time integer	Specifies the DHCP lease time in seconds. The default value is 28800.
domain_name string	Specifies the DHCP domain name. Minimum: 1 character. Maximum: 63 characters.
address_pools array	Lists DHCP address pools.
start string	Specifies the starting IPv4 address of the DHCP address pool.
end string	Specifies the ending IPv4 address of the DHCP address pool.
dns object	Specifies DNS settings for the DHCP server.
servers array	Lists IPv4 DNS server addresses. Minimum: 1. Maximum: 3.
reserved_addresses array	Lists reserved DHCP addresses.
ip string	Specifies the reserved IPv4 address.
name string	Specifies the name associated with the reserved address.
mac string	Specifies the MAC address associated with the reserved address.
dhcp_options array	Lists custom DHCP options. Maximum: 255 options.
code integer	Specifies the DHCP option code. Valid range: 1–255.
name string	Specifies the name of the DHCP option. Minimum: 1 character. Maximum: 63 characters.
type string	Specifies the DHCP option data type. The allowed values are: int8 uint8 int16 uint16 int32 uint32 bool text hex ips
value string	Specifies the DHCP option value. Minimum: 1 character. Maximum: 255 characters.
gateway_ip string	Specifies the IPv4 gateway address provided by the DHCP server.
relay_servers array	Lists IPv4 DHCP relay server addresses. Maximum: 3.
link_monitor object	Specifies link monitor settings for the network.
enabled boolean REQUIRED	Indicates whether link monitoring is enabled. The default value is false.
default boolean	Indicates whether this is the default link monitor. The default value is false.
type string	Specifies the link monitor probe type. The allowed values are: dns ping tcp
target object	Specifies the link monitor target. Use `type` and `value` to identify an IPv4 address or domain.
type string	Specifies the target type.
value string	Specifies the target value.
port integer	Specifies the TCP port for link monitoring when `type` is tcp.
domain object	Specifies a domain target for link monitoring.
type string	Specifies the domain type. The value is domain.
value string	Specifies the domain name.
nexthop string	Specifies the IPv4 next-hop address for link monitoring.
dynamic_dns object	Specifies dynamic DNS settings for the network.
enabled boolean REQUIRED	Indicates whether dynamic DNS is enabled. The default value is false.
provider string	Specifies the dynamic DNS provider. Minimum: 4 characters. Maximum: 64 characters.
username string	Specifies the dynamic DNS user name. Minimum: 4 characters. Maximum: 64 characters.
password string	Specifies the dynamic DNS password. Minimum: 4 characters. Maximum: 513 characters.
domain object	Specifies the dynamic DNS domain.
type string	Specifies the domain type.
value string	Specifies the domain value.
options string	Specifies additional dynamic DNS options. Maximum: 255 characters.
forced_update integer	Specifies the forced update interval in days. Valid range: 1–28.
allow_provider_ip_selection boolean	Indicates whether the provider can select the IP address. The default value is false.
allow_webui boolean	Indicates whether Web UI access is allowed on this network. The default value is false.
allow_ping boolean	Indicates whether ping is allowed on this network. The default value is false.
ipv6 object	Specifies IPv6 settings for the network.
enabled boolean REQUIRED	Indicates whether IPv6 is enabled. The default value is false.
addresses array	Lists IPv6 addresses for the network.
addr string REQUIRED	Specifies the IPv6 address in CIDR notation.
advert_prefix boolean	Indicates whether the prefix is advertised. The default value is false.
pd_network string	Specifies a reference to a prefix delegation network.
default_gateway string	Specifies the IPv6 default gateway address.
hop_limit integer	Specifies the IPv6 hop limit. Valid range: 1–65535. The default value is 64.
dad_transmit integer	Specifies the number of duplicate address detection (DAD) transmits. Valid range: 1–10. The default value is 1.
router_advertisements object	Specifies IPv6 router advertisement settings.
send_advertisements boolean	Indicates whether router advertisements are sent. The default value is false.
managed boolean	Indicates whether the managed address configuration flag is set. The default value is false.
other boolean	Indicates whether the other configuration flag is set. The default value is false.
default_lifetime integer	Specifies the default router lifetime in seconds. Valid range: 0–9000. The default value is 1800.
max_interval integer	Specifies the maximum router advertisement interval in seconds. Valid range: 4–1800. The default value is 600.
min_interval integer	Specifies the minimum router advertisement interval in seconds. Valid range: 3–1350. The default value is 200.
prefixes array	Lists prefixes included in router advertisements.
network_addr string REQUIRED	Specifies the IPv6 network address in CIDR notation.
pd_network string	Specifies a reference to a prefix delegation network.
valid_lifetime integer	Specifies the valid lifetime in seconds. The default value is 2592000.
prefer_lifetime integer	Specifies the preferred lifetime in seconds. The default value is 604800.
autonomous boolean	Indicates whether the autonomous address-configuration flag is set. The default value is true.
onlink boolean	Indicates whether the on-link flag is set. The default value is true.
external object	Specifies external IPv6 settings.
dhcp_client object	Specifies IPv6 DHCP client settings.
enabled boolean	Indicates whether the IPv6 DHCP client is enabled. The default value is false.
rapid_commit boolean	Indicates whether rapid commit is enabled for the IPv6 DHCP client. The default value is false.
dhcp_client_pd object	Specifies IPv6 DHCP client prefix delegation settings.
enabled boolean	Indicates whether IPv6 DHCP client prefix delegation is enabled.
rapid_commit boolean	Indicates whether rapid commit is enabled for prefix delegation.
perform_iana_query boolean	Indicates whether an IANA query is performed. The default value is false.
custom_iaid string	Specifies a custom IAID. Length: 8 characters.
autoconf boolean	Indicates whether IPv6 autoconfiguration is enabled. The default value is false.
dhcp_server object	Specifies IPv6 DHCP server settings.
server_type string REQUIRED	Specifies the IPv6 DHCP server type. The allowed values are disabled and server.
rapid_commit boolean	Indicates whether rapid commit is enabled for the IPv6 DHCP server. The default value is false.
preferred_lifetime integer	Specifies the preferred lifetime in seconds. The default value is 86400.
valid_lifetime integer	Specifies the valid lifetime in seconds. The default value is 172800.
dns object	Specifies DNS settings for the IPv6 DHCP server.
domain object	Specifies the DNS domain.
type string	Specifies the domain type.
value string	Specifies the domain value.
servers array	Lists IPv6 DNS server addresses. Minimum: 1. Maximum: 3.
sip object	Specifies SIP settings for the IPv6 DHCP server.
domain object	Specifies the SIP domain.
type string	Specifies the domain type.
value string	Specifies the domain value.
servers array	Lists IPv6 SIP server addresses. Minimum: 1. Maximum: 3.
address_pools array	Lists IPv6 address pools.
start string REQUIRED	Specifies the starting IPv6 address of the address pool.
end string REQUIRED	Specifies the ending IPv6 address of the address pool.
pd_network string	Specifies a reference to a prefix delegation network.
prefix_pools array	Lists IPv6 prefix pools.
start string REQUIRED	Specifies the starting prefix of the prefix pool.
end string REQUIRED	Specifies the ending prefix of the prefix pool.
prefix_length integer REQUIRED	Specifies the prefix length. Valid range: 1–127.
reserved_addresses array	Lists reserved IPv6 addresses.
name string	Specifies the name associated with the reserved address.
ip string	Specifies the reserved IPv6 address.
duid string REQUIRED	Specifies the DUID associated with the reserved address.
prefix string	Specifies the reserved IPv6 prefix.
pd_network string	Specifies a reference to a prefix delegation network.
intra_inspection boolean	Indicates whether intra-network inspection is enabled.
stp_enabled boolean	Indicates whether Spanning Tree Protocol (STP) is enabled. Applies to bridge and VLAN networks only. The default value is false.

Get Users

/{v1}/configuration/{accountid}/authentication/users

Make a request to this endpoint to retrieve a list of users for an account or for a specific device or template. If you specify the device query parameter, only the users for that device are returned. If you specify the templateid query parameter, only the users for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves users for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/users?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of user objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fusr_12345_ARBHLJ70Y78rGOIGBS",
            "object": "firebox_user",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "jsmith",
            "description": "John Smith",
            "timeout": 28800,
            "idle": 1800,
            "groups": [
                "fgrp_12345_ARBHLJ70Y78rGOIGBS"
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of users returned.
objects array	List of user objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the user name. Maximum: 58 characters.
description string	Specifies the user description. Maximum: 127 characters.
password string REQUIRED	Specifies the user password. Minimum: 8 characters. Maximum: 32 characters.
timeout integer REQUIRED	Specifies the session timeout in seconds. Valid range: 1–31536000. The default value is 28800.
idle integer REQUIRED	Specifies the idle timeout in seconds. Valid range: 1–31536000. The default value is 1800.
domain string	Specifies a reference to the authentication domain for the user.
groups array	Lists references to groups the user belongs to.
scope string	Specifies the user scope. The allowed value is AP.
ap_id string	Specifies the AuthPoint identifier associated with the user.

Get a User

/{v1}/configuration/{accountid}/authentication/users/{objectid}

Make a request to this endpoint to retrieve the specified user.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the user to retrieve.

Example: fusr_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the user for the objectid fusr_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/users/fusr_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified user object.

                {
    "id": "fusr_12345_ARBHLJ70Y78rGOIGBS",
    "object": "firebox_user",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "jsmith",
    "description": "John Smith",
    "timeout": 28800,
    "idle": 1800,
    "groups": [
        "fgrp_12345_ARBHLJ70Y78rGOIGBS"
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the user name. Maximum: 58 characters.
description string	Specifies the user description. Maximum: 127 characters.
password string REQUIRED	Specifies the user password. Minimum: 8 characters. Maximum: 32 characters.
timeout integer REQUIRED	Specifies the session timeout in seconds. Valid range: 1–31536000. The default value is 28800.
idle integer REQUIRED	Specifies the idle timeout in seconds. Valid range: 1–31536000. The default value is 1800.
domain string	Specifies a reference to the authentication domain for the user.
groups array	Lists references to groups the user belongs to.
scope string	Specifies the user scope. The allowed value is AP.
ap_id string	Specifies the AuthPoint identifier associated with the user.

Get Groups

/{v1}/configuration/{accountid}/authentication/groups

Make a request to this endpoint to retrieve a list of groups for an account or for a specific device or template. If you specify the device query parameter, only the groups for that device are returned. If you specify the templateid query parameter, only the groups for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves groups for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/groups?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of group objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fgrp_12345_ARBHLJ70Y78rGOIGBS",
            "object": "firebox_group",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Engineering",
            "description": "Engineering group",
            "members": [
                "fusr_12345_ARBHLJ70Y78rGOIGBS"
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of groups returned.
objects array	List of group objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the group name. Maximum: 58 characters.
description string	Specifies the group description. Maximum: 127 characters.
domain string	Specifies a reference to the authentication domain for the group.
members array	Lists references to users in the group.
scope string	Specifies the group scope. The allowed value is AP.

Get a Group

/{v1}/configuration/{accountid}/authentication/groups/{objectid}

Make a request to this endpoint to retrieve the specified group.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the group to retrieve.

Example: fgrp_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the group for the objectid fgrp_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/groups/fgrp_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified group object.

                {
    "id": "fgrp_12345_ARBHLJ70Y78rGOIGBS",
    "object": "firebox_group",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Engineering",
    "description": "Engineering group",
    "members": [
        "fusr_12345_ARBHLJ70Y78rGOIGBS"
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the group name. Maximum: 58 characters.
description string	Specifies the group description. Maximum: 127 characters.
domain string	Specifies a reference to the authentication domain for the group.
members array	Lists references to users in the group.
scope string	Specifies the group scope. The allowed value is AP.

Get Authentication Groups

/{v1}/configuration/{accountid}/authentication/auth_groups

Make a request to this endpoint to retrieve a list of authentication groups for an account or for a specific device or template. If you specify the device query parameter, only the authentication groups for that device are returned. If you specify the templateid query parameter, only the authentication groups for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves authentication groups for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/auth_groups?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of authentication group objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fagp_12345_ARBHLJ70Y78rGOIGBS",
            "object": "auth_group",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "VPN Users",
            "description": "VPN authentication group",
            "domains": [
                {
                    "type": "firebox_domain",
                    "value": "fdom_12345_ARBHLJ70Y78rGOIGBS"
                }
            ],
            "members": [
                {
                    "type": "firebox_user",
                    "value": "fusr_12345_ARBHLJ70Y78rGOIGBS"
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of authentication groups returned.
objects array	List of auth group objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the auth group name.
description string	Specifies the auth group description.
domains array	Lists authentication domains associated with the auth group.
type string	Specifies the type of authentication domain. The allowed values are: firebox_domain authentication_domain authpoint_domain saml_settings
value string REQUIRED	Specifies a reference to the authentication domain. Required with `type`.
members array	Lists users and groups that are members of the auth group.
type string	Specifies the type of auth group member. The allowed values are: firebox_user firebox_group shared_user_group authpoint_user_group saml_user_group
value string	Specifies the member value. This value can be a string reference to an existing user or group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `value` is an object.
movpn_enforcement boolean	Indicates whether Mobile VPN enforcement is enabled when `value` is an object.

Get an Authentication Group

/{v1}/configuration/{accountid}/authentication/auth_groups/{objectid}

Make a request to this endpoint to retrieve the specified authentication group.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the auth group to retrieve.

Example: fagp_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the authentication group for the objectid fagp_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/auth_groups/fagp_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified authentication group object.

                {
    "id": "fagp_12345_ARBHLJ70Y78rGOIGBS",
    "object": "auth_group",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "VPN Users",
    "description": "VPN authentication group",
    "domains": [
        {
            "type": "firebox_domain",
            "value": "fdom_12345_ARBHLJ70Y78rGOIGBS"
        }
    ],
    "members": [
        {
            "type": "firebox_user",
            "value": "fusr_12345_ARBHLJ70Y78rGOIGBS"
        }
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the auth group name.
description string	Specifies the auth group description.
domains array	Lists authentication domains associated with the auth group.
type string	Specifies the type of authentication domain. The allowed values are: firebox_domain authentication_domain authpoint_domain saml_settings
value string REQUIRED	Specifies a reference to the authentication domain. Required with `type`.
members array	Lists users and groups that are members of the auth group.
type string	Specifies the type of auth group member. The allowed values are: firebox_user firebox_group shared_user_group authpoint_user_group saml_user_group
value string	Specifies the member value. This value can be a string reference to an existing user or group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `value` is an object.
movpn_enforcement boolean	Indicates whether Mobile VPN enforcement is enabled when `value` is an object.

Get AuthPoint User Groups

/{v1}/configuration/{accountid}/authentication/authpoint_user_groups

Make a request to this endpoint to retrieve a list of AuthPoint user groups for an account or for a specific device or template. If you specify the device query parameter, only the AuthPoint user groups for that device are returned. If you specify the templateid query parameter, only the AuthPoint user groups for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves AuthPoint user groups for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/authpoint_user_groups?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of AuthPoint user group objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "faug_12345_ARBHLJ70Y78rGOIGBS",
            "object": "authpoint_user_group",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "AP Admins",
            "type": "group",
            "domain": "fdom_12345_ARBHLJ70Y78rGOIGBS"
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of AuthPoint user groups returned.
objects array	List of AuthPoint user group objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the AuthPoint user group name.
type string REQUIRED	Defines whether the object is a user or group. Allowed values: user, group.
domain object REQUIRED	Specifies a reference to the authentication domain.

Get an AuthPoint User Group

/{v1}/configuration/{accountid}/authentication/authpoint_user_groups/{objectid}

Make a request to this endpoint to retrieve the specified AuthPoint user group.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the AuthPoint user group to retrieve.

Example: faug_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the AuthPoint user group for the objectid faug_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/authpoint_user_groups/faug_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified AuthPoint user group object.

                {
    "id": "faug_12345_ARBHLJ70Y78rGOIGBS",
    "object": "authpoint_user_group",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "AP Admins",
    "type": "group",
    "domain": "fdom_12345_ARBHLJ70Y78rGOIGBS"
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the AuthPoint user group name.
type string REQUIRED	Defines whether the object is a user or group. Allowed values: user, group.
domain object REQUIRED	Specifies a reference to the authentication domain.

Get SAML User Groups

/{v1}/configuration/{accountid}/authentication/saml_user_groups

Make a request to this endpoint to retrieve a list of SAML user groups for an account or for a specific device or template. If you specify the device query parameter, only the SAML user groups for that device are returned. If you specify the templateid query parameter, only the SAML user groups for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves SAML user groups for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/saml_user_groups?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of SAML user group objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fsug_12345_ARBHLJ70Y78rGOIGBS",
            "object": "saml_user_group",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "SAML Users",
            "type": "group",
            "domain": "fdom_12345_ARBHLJ70Y78rGOIGBS"
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of SAML user groups returned.
objects array	List of SAML user group objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the SAML user or group name.
type string REQUIRED	Defines whether the object is a user or group. Allowed values: user, group.
domain object REQUIRED	Specifies a reference to the SAML authentication domain.
movpn_enforcement boolean	Indicates whether Mobile VPN enforcement is enabled for the SAML user group.

Get a SAML User Group

/{v1}/configuration/{accountid}/authentication/saml_user_groups/{objectid}

Make a request to this endpoint to retrieve the specified SAML user group.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the SAML user group to retrieve.

Example: fsug_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the SAML user group for the objectid fsug_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/authentication/saml_user_groups/fsug_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified SAML user group object.

                {
    "id": "fsug_12345_ARBHLJ70Y78rGOIGBS",
    "object": "saml_user_group",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "SAML Users",
    "type": "group",
    "domain": "fdom_12345_ARBHLJ70Y78rGOIGBS"
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the SAML user or group name.
type string REQUIRED	Defines whether the object is a user or group. Allowed values: user, group.
domain object REQUIRED	Specifies a reference to the SAML authentication domain.
movpn_enforcement boolean	Indicates whether Mobile VPN enforcement is enabled for the SAML user group.

Get SNAT Actions

/{v1}/configuration/{accountid}/firewall/snat_actions

Make a request to this endpoint to retrieve a list of SNAT actions for an account or for a specific device or template. If you specify the device query parameter, only the SNAT actions for that device are returned. If you specify the templateid query parameter, only the SNAT actions for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves SNAT actions for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/snat_actions?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of SNAT action objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fsna_12345_ARBHLJ70Y78rGOIGBS",
            "object": "firewall_snat_action",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Public Web SNAT",
            "description": "SNAT for web servers",
            "rules": [
                {
                    "external_address": {
                        "type": "ipv4_host",
                        "value": "203.0.113.10"
                    },
                    "internal_address": "192.0.2.10",
                    "destination_port": 443
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of SNAT actions returned.
objects array	List of SNAT action objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the SNAT action.
description string	Specifies the description of the SNAT action.
rules array REQUIRED	Lists the SNAT rules that define address translation settings.
external_address object REQUIRED	Specifies the external address for the SNAT rule. This value can be an IPv4 host (`type` ipv4_host with an IPv4 address), a network reference (`type` network with a reference to a network object), or a system alias (`type` system_alias with the value Any-External).
type string	Specifies the type of external address. The allowed values are: ipv4_host network system_alias
value string	Specifies the external address value. For `ipv4_host`, this value is an IPv4 address. For `network`, this value is a reference to a network object. For `system_alias`, this value is Any-External.
internal_address string REQUIRED	Specifies the internal IPv4 address for the SNAT rule.
destination_port integer	Specifies the destination port for the SNAT rule.
source_address string	Specifies the source IPv4 address for the SNAT rule.

Get an SNAT Action

/{v1}/configuration/{accountid}/firewall/snat_actions/{objectid}

Make a request to this endpoint to retrieve the specified SNAT action.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the SNAT action to retrieve.

Example: fsna_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the SNAT action for the objectid fsna_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/firewall/snat_actions/fsna_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified SNAT action object.

                {
    "id": "fsna_12345_ARBHLJ70Y78rGOIGBS",
    "object": "firewall_snat_action",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Public Web SNAT",
    "description": "SNAT for web servers",
    "rules": [
        {
            "external_address": {
                "type": "ipv4_host",
                "value": "203.0.113.10"
            },
            "internal_address": "192.0.2.10",
            "destination_port": 443
        }
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the SNAT action.
description string	Specifies the description of the SNAT action.
rules array REQUIRED	Lists the SNAT rules that define address translation settings.
external_address object REQUIRED	Specifies the external address for the SNAT rule. This value can be an IPv4 host (`type` ipv4_host with an IPv4 address), a network reference (`type` network with a reference to a network object), or a system alias (`type` system_alias with the value Any-External).
type string	Specifies the type of external address. The allowed values are: ipv4_host network system_alias
value string	Specifies the external address value. For `ipv4_host`, this value is an IPv4 address. For `network`, this value is a reference to a network object. For `system_alias`, this value is Any-External.
internal_address string REQUIRED	Specifies the internal IPv4 address for the SNAT rule.
destination_port integer	Specifies the destination port for the SNAT rule.
source_address string	Specifies the source IPv4 address for the SNAT rule.

Get SD-WANs

/{v1}/configuration/{accountid}/networking/sdwans

Make a request to this endpoint to retrieve a list of SD-WANs for an account or for a specific device or template. If you specify the device query parameter, only the SD-WANs for that device are returned. If you specify the templateid query parameter, only the SD-WANs for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves SD-WANs for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/networking/sdwans?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of SD-WAN objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fsdw_12345_ARBHLJ70Y78rGOIGBS",
            "object": "networking_sdwan",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "WAN Failover",
            "global": false,
            "mode": "failover",
            "members": [
                {
                    "type": "network",
                    "value": "fnet_12345_ARBHLJ70Y78rGOIGBS",
                    "weight": 1
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of SD-WANs returned.
objects array	List of SD-WAN objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the SD-WAN configuration.
global boolean	Indicates whether this object is a global WAN object. The default value is false.
mode string REQUIRED	Defines the SD-WAN mode. The allowed values are failover and round-robin.
failback string	Specifies the failback behavior when a preferred link becomes available again. The allowed values are: immediate gradual dont
sticky_tcp integer	Specifies the sticky connection timeout for TCP traffic, in seconds. Valid range: 0–2147483647. The default value is 180.
sticky_udp integer	Specifies the sticky connection timeout for UDP traffic, in seconds. The default value is 180.
sticky_others integer	Specifies the sticky connection timeout for other traffic, in seconds. The default value is 180.
measurements object	Defines the link measurement thresholds used for SD-WAN decisions.
enabled boolean REQUIRED	Indicates whether link measurements are enabled. The default value is false.
loss integer	Specifies the packet loss threshold as a percentage. Valid range: 0–100.
latency integer	Specifies the latency threshold in milliseconds. Valid range: 0–2000.
jitter integer	Specifies the jitter threshold in milliseconds. Valid range: 0–1000.
members array REQUIRED	Lists the networks or VPN tunnels that are members of the SD-WAN configuration.
type string REQUIRED	Specifies the type of SD-WAN member. The allowed values are network and ipsec_vpn.
value string REQUIRED	Specifies a reference to the network or IPSec VPN tunnel member.
weight integer	Specifies the weight of the member for round-robin load balancing.

Get an SD-WAN

/{v1}/configuration/{accountid}/networking/sdwans/{objectid}

Make a request to this endpoint to retrieve the specified SD-WAN.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the SD-WAN to retrieve.

Example: fsdw_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the SD-WAN for the objectid fsdw_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/networking/sdwans/fsdw_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified SD-WAN object.

                {
    "id": "fsdw_12345_ARBHLJ70Y78rGOIGBS",
    "object": "networking_sdwan",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "WAN Failover",
    "global": false,
    "mode": "failover",
    "members": [
        {
            "type": "network",
            "value": "fnet_12345_ARBHLJ70Y78rGOIGBS",
            "weight": 1
        }
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the SD-WAN configuration.
global boolean	Indicates whether this object is a global WAN object. The default value is false.
mode string REQUIRED	Defines the SD-WAN mode. The allowed values are failover and round-robin.
failback string	Specifies the failback behavior when a preferred link becomes available again. The allowed values are: immediate gradual dont
sticky_tcp integer	Specifies the sticky connection timeout for TCP traffic, in seconds. Valid range: 0–2147483647. The default value is 180.
sticky_udp integer	Specifies the sticky connection timeout for UDP traffic, in seconds. The default value is 180.
sticky_others integer	Specifies the sticky connection timeout for other traffic, in seconds. The default value is 180.
measurements object	Defines the link measurement thresholds used for SD-WAN decisions.
enabled boolean REQUIRED	Indicates whether link measurements are enabled. The default value is false.
loss integer	Specifies the packet loss threshold as a percentage. Valid range: 0–100.
latency integer	Specifies the latency threshold in milliseconds. Valid range: 0–2000.
jitter integer	Specifies the jitter threshold in milliseconds. Valid range: 0–1000.
members array REQUIRED	Lists the networks or VPN tunnels that are members of the SD-WAN configuration.
type string REQUIRED	Specifies the type of SD-WAN member. The allowed values are network and ipsec_vpn.
value string REQUIRED	Specifies a reference to the network or IPSec VPN tunnel member.
weight integer	Specifies the weight of the member for round-robin load balancing.

Get Traffic Shaping Rules

/{v1}/configuration/{accountid}/traffic_shaping/rules

Make a request to this endpoint to retrieve a list of traffic shaping rules for an account or for a specific device or template. If you specify the device query parameter, only the traffic shaping rules for that device are returned. If you specify the templateid query parameter, only the traffic shaping rules for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves traffic shaping rules for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/traffic_shaping/rules?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of traffic shaping rule objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "ftsr_12345_ARBHLJ70Y78rGOIGBS",
            "object": "traffic_shaping_rule",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Limit Upload",
            "enabled": true,
            "rule_type": "outbound",
            "behavior": "limit",
            "method": "all_users",
            "upload": 10000,
            "download": 50000
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of traffic shaping rules returned.
objects array	List of traffic shaping rule objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the traffic shaping rule. Maximum: 58 characters.
enabled boolean REQUIRED	Indicates whether the traffic shaping rule is enabled. The default value is true.
rule_type string REQUIRED	Specifies the traffic shaping rule type. The allowed values are: outbound inbound custom first last content_filtering mixed
behavior string REQUIRED	Specifies the bandwidth behavior. The allowed values are limit and guarantee. The default value is limit.
method string REQUIRED	Specifies how bandwidth is applied. The allowed values are all_users and per_user. The default value is all_users.
max_users integer	Specifies the maximum number of users for per-user traffic shaping. Valid range: 1–256. The default value is 128.
upload integer	Specifies the upload (source-to-destination) bandwidth in Kbps. Valid range: 1–1000000000.
download integer	Specifies the download (destination-to-source) bandwidth in Kbps. Valid range: 1–1000000000.
bandwidth integer	Specifies the application total bandwidth in Kbps. Valid range: 1–1000000000.

Get a Traffic Shaping Rule

/{v1}/configuration/{accountid}/traffic_shaping/rules/{objectid}

Make a request to this endpoint to retrieve the specified traffic shaping rule.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the traffic shaping rule to retrieve.

Example: ftsr_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the traffic shaping rule for the objectid ftsr_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/traffic_shaping/rules/ftsr_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified traffic shaping rule object.

                {
    "id": "ftsr_12345_ARBHLJ70Y78rGOIGBS",
    "object": "traffic_shaping_rule",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Limit Upload",
    "enabled": true,
    "rule_type": "outbound",
    "behavior": "limit",
    "method": "all_users",
    "upload": 10000,
    "download": 50000
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the traffic shaping rule. Maximum: 58 characters.
enabled boolean REQUIRED	Indicates whether the traffic shaping rule is enabled. The default value is true.
rule_type string REQUIRED	Specifies the traffic shaping rule type. The allowed values are: outbound inbound custom first last content_filtering mixed
behavior string REQUIRED	Specifies the bandwidth behavior. The allowed values are limit and guarantee. The default value is limit.
method string REQUIRED	Specifies how bandwidth is applied. The allowed values are all_users and per_user. The default value is all_users.
max_users integer	Specifies the maximum number of users for per-user traffic shaping. Valid range: 1–256. The default value is 128.
upload integer	Specifies the upload (source-to-destination) bandwidth in Kbps. Valid range: 1–1000000000.
download integer	Specifies the download (destination-to-source) bandwidth in Kbps. Valid range: 1–1000000000.
bandwidth integer	Specifies the application total bandwidth in Kbps. Valid range: 1–1000000000.

Get Schedules

/{v1}/configuration/{accountid}/system/schedule

Make a request to this endpoint to retrieve a list of schedules for an account or for a specific device or template. If you specify the device query parameter, only the schedules for that device are returned. If you specify the templateid query parameter, only the schedules for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves schedules for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/system/schedule?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of schedule objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fsch_12345_ARBHLJ70Y78rGOIGBS",
            "object": "system_schedule",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Business Hours",
            "description": "Weekday schedule",
            "enabled": true,
            "schedule_type": 2,
            "immutable": false,
            "members": [
                {
                    "day_of_week": 1,
                    "members": [
                        {
                            "from_hour": 8,
                            "from_min": 0,
                            "to_hour": 17,
                            "to_min": 0
                        }
                    ]
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of schedules returned.
objects array	List of schedule objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the schedule name. Maximum: 47 characters.
description string REQUIRED	Specifies the schedule description. Maximum: 127 characters.
enabled boolean REQUIRED	Indicates whether the schedule is enabled. The default value is true.
schedule_type integer REQUIRED	Defines the schedule type. The default value is 2. The allowed values are: 0 — Always On 1 — Daily 2 — Weekly
immutable boolean REQUIRED	Indicates whether end users can modify this schedule. The default value is false.
members array REQUIRED	Lists the day-of-week schedule entries.
day_of_week integer REQUIRED	Specifies the day of the week for the schedule entry. Valid range: 0–6, where 0 is Sunday and 6 is Saturday.
members array REQUIRED	Lists the time periods for the specified day of the week.
from_hour integer REQUIRED	Specifies the starting hour of the time period. Valid range: 0–23.
from_min integer REQUIRED	Specifies the starting minute of the time period. Valid range: 0–59.
to_hour integer REQUIRED	Specifies the ending hour of the time period. Valid range: 0–24.
to_min integer REQUIRED	Specifies the ending minute of the time period. Valid range: 0–59.

Get a Schedule

/{v1}/configuration/{accountid}/system/schedule/{objectid}

Make a request to this endpoint to retrieve the specified schedule.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid

string

REQUIRED

ID of the schedule to retrieve.

Example: fsch_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the schedule for the objectid fsch_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/system/schedule/fsch_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified schedule object.

                {
    "id": "fsch_12345_ARBHLJ70Y78rGOIGBS",
    "object": "system_schedule",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Business Hours",
    "description": "Weekday schedule",
    "enabled": true,
    "schedule_type": 2,
    "immutable": false,
    "members": [
        {
            "day_of_week": 1,
            "members": [
                {
                    "from_hour": 8,
                    "from_min": 0,
                    "to_hour": 17,
                    "to_min": 0
                }
            ]
        }
    ]
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the schedule name. Maximum: 47 characters.
description string REQUIRED	Specifies the schedule description. Maximum: 127 characters.
enabled boolean REQUIRED	Indicates whether the schedule is enabled. The default value is true.
schedule_type integer REQUIRED	Defines the schedule type. The default value is 2. The allowed values are: 0 — Always On 1 — Daily 2 — Weekly
immutable boolean REQUIRED	Indicates whether end users can modify this schedule. The default value is false.
members array REQUIRED	Lists the day-of-week schedule entries.
day_of_week integer REQUIRED	Specifies the day of the week for the schedule entry. Valid range: 0–6, where 0 is Sunday and 6 is Saturday.
members array REQUIRED	Lists the time periods for the specified day of the week.
from_hour integer REQUIRED	Specifies the starting hour of the time period. Valid range: 0–23.
from_min integer REQUIRED	Specifies the starting minute of the time period. Valid range: 0–59.
to_hour integer REQUIRED	Specifies the ending hour of the time period. Valid range: 0–24.
to_min integer REQUIRED	Specifies the ending minute of the time period. Valid range: 0–59.

Get Content Filtering Rules

/{v1}/configuration/{accountid}/content_filtering

Make a request to this endpoint to retrieve a list of content filtering rules for an account or for a specific device or template.

If you specify the device query parameter, only the content filtering rules for that device are returned. If you specify the templateid query parameter, only the content filtering rules for that template are returned.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid

string

REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

Query Parameters

When you send a request to this endpoint, you can include these request parameters:

device
string

Specifies the Firebox ID in WatchGuard Cloud. If specified, only configuration objects for this device are returned.

Example: 12345

Example: FBCL-12345

templateid
string

Specifies the device template ID used to filter configuration objects. Mutually exclusive with the device parameter.

Example Request

This request retrieves content filtering rules for device 12345 from the specified WatchGuard Cloud account:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/content_filtering?device=12345
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response includes a count and a list of content filtering rule objects.

                {
    "count": 1,
    "objects": [
        {
            "id": "fcf_12345_ARBHLJ70Y78rGOIGBS",
            "object": "content_filtering",
            "version": 1,
            "account": "WGC-1-123abc456",
            "device": 12345,
            "created": 1579907960,
            "author": "testuser",
            "name": "Default Web Filter",
            "appcontrol": [
                {
                    "application_name": "Facebook",
                    "category_id": 1,
                    "action": "block"
                }
            ],
            "webblocker": [
                {
                    "category_id": 10,
                    "action": "deny",
                    "log": true
                }
            ],
            "deny_uncategorized": false
        }
    ]
}

Data returned in the response includes the following parameters:

count integer	Total number of content filtering rules returned.
objects array	List of content filtering rule objects.

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the content filtering rule. Maximum: 58 characters.
appcontrol array REQUIRED	Lists Application Control settings for the content filtering rule.
application_id integer	Specifies the Application Control application identifier.
application_name string REQUIRED	Specifies the Application Control application name. Minimum: 1 character. Maximum: 255 characters.
category_id integer REQUIRED	Specifies the Application Control category identifier.
action string REQUIRED	Specifies the action to take for the application. The allowed values are allow and block.
traffic_shaping string	Specifies a reference to a traffic shaping configuration object.
webblocker array REQUIRED	Lists WebBlocker category settings for the content filtering rule.
category_id integer REQUIRED	Specifies the WebBlocker category identifier.
action string REQUIRED	Specifies the action to take for the WebBlocker category. The allowed values are: allow bypass deny warn
log boolean REQUIRED	Indicates whether to log matches for the WebBlocker category. The default value is true.
alarm boolean	Indicates whether to generate an alarm for matches for the WebBlocker category. The default value is false.
deny_uncategorized boolean	Indicates whether to deny uncategorized web content. The default value is false.
webblocker_override object	Specifies WebBlocker override settings for the content filtering rule.
enabled boolean REQUIRED	Indicates whether WebBlocker override is enabled. The default value is false.
wbo_method string	Specifies the WebBlocker override method. The allowed values are password and user_group.
user_group object	Specifies the user group that can use WebBlocker override when `wbo_method` is `user_group`.
type string	Specifies the type of user group. The allowed values are: firebox_group auth_group shared_user_group
value string	Specifies a reference to the user group. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
password string	Specifies the WebBlocker override password when `wbo_method` is `password`. Minimum: 8 characters. Maximum: 255 characters.
timeout integer	Specifies the WebBlocker override timeout in minutes. Valid range: 3–1440. The default value is 5.
alarm boolean	Indicates whether to generate an alarm when WebBlocker override is used. The default value is false.

Get a Content Filtering Rule

/{v1}/configuration/{accountid}/content_filtering/{objectid}

Make a request to this endpoint to retrieve the specified content filtering rule.

Path Parameters

When you send a request to this endpoint, you must include these path parameters:

accountid
string
REQUIRED

Your WatchGuard Cloud account ID. You can see your accountId on the My Account page in WatchGuard Cloud.

Example: WGC-1-123abc456 or ACC-1234567

objectid
string
REQUIRED

ID of the content filtering rule to retrieve.

Example: fcf_12345_ARBHLJ70Y78rGOIGBS

Example Request

This request retrieves the content filtering rule for the objectid fcf_12345_ARBHLJ70Y78rGOIGBS:

curl -X GET 
	https://api.usa.cloud.watchguard.com/rest/firebox/management/v1/configuration/WGC-1-123abc456/content_filtering/fcf_12345_ARBHLJ70Y78rGOIGBS
	-H 'Authorization: Bearer eyJraWQiOiJNWnpabklNK2V6Q3BXUE...'
	-H 'Accept: application/json'
	-H 'Content-Type: application/json' 
	-H 'WatchGuard-API-Key: s9t7El6RZFg8UcmRhYKdwXqBhyuioiWER83Nqd0tL'

Example Response

The response returns the specified content filtering rule object.

                {
    "id": "fcf_12345_ARBHLJ70Y78rGOIGBS",
    "object": "content_filtering",
    "version": 1,
    "account": "WGC-1-123abc456",
    "device": 12345,
    "created": 1579907960,
    "author": "testuser",
    "name": "Default Web Filter",
    "appcontrol": [
        {
            "application_name": "Facebook",
            "category_id": 1,
            "action": "block"
        }
    ],
    "webblocker": [
        {
            "category_id": 10,
            "action": "deny",
            "log": true
        }
    ],
    "deny_uncategorized": false
}

Data returned in the response includes the following parameters:

id string	Unique ID that identifies this configuration object.
object string	Type of configuration object returned by the endpoint.
version integer	Version number of the configuration object. Example: 1
account string	Your WatchGuard Cloud account ID. Example: WGC-1-123abc456
device string \| integer	Specifies the device this configuration object applies to. Example: 12345
created integer	Object creation time in Unix epoch time format. Example: 1579907960
author string	Author of the object. This is always empty for objects retrieved with the Firebox Firewall Policies API.

name string REQUIRED	Specifies the name of the content filtering rule. Maximum: 58 characters.
appcontrol array REQUIRED	Lists Application Control settings for the content filtering rule.
application_id integer	Specifies the Application Control application identifier.
application_name string REQUIRED	Specifies the Application Control application name. Minimum: 1 character. Maximum: 255 characters.
category_id integer REQUIRED	Specifies the Application Control category identifier.
action string REQUIRED	Specifies the action to take for the application. The allowed values are allow and block.
traffic_shaping string	Specifies a reference to a traffic shaping configuration object.
webblocker array REQUIRED	Lists WebBlocker category settings for the content filtering rule.
category_id integer REQUIRED	Specifies the WebBlocker category identifier.
action string REQUIRED	Specifies the action to take for the WebBlocker category. The allowed values are: allow bypass deny warn
log boolean REQUIRED	Indicates whether to log matches for the WebBlocker category. The default value is true.
alarm boolean	Indicates whether to generate an alarm for matches for the WebBlocker category. The default value is false.
deny_uncategorized boolean	Indicates whether to deny uncategorized web content. The default value is false.
webblocker_override object	Specifies WebBlocker override settings for the content filtering rule.
enabled boolean REQUIRED	Indicates whether WebBlocker override is enabled. The default value is false.
wbo_method string	Specifies the WebBlocker override method. The allowed values are password and user_group.
user_group object	Specifies the user group that can use WebBlocker override when `wbo_method` is `user_group`.
type string	Specifies the type of user group. The allowed values are: firebox_group auth_group shared_user_group
value string	Specifies a reference to the user group. For `shared_user_group`, this value can be a string reference to an existing shared user group, or an object that contains `usergrp_id` and `domain_id`.
usergrp_id string REQUIRED	Specifies the user group identifier when `type` is `shared_user_group` and `value` is an object.
domain_id string REQUIRED	Specifies the authentication domain identifier when `type` is `shared_user_group` and `value` is an object.
password string	Specifies the WebBlocker override password when `wbo_method` is `password`. Minimum: 8 characters. Maximum: 255 characters.
timeout integer	Specifies the WebBlocker override timeout in minutes. Valid range: 3–1440. The default value is 5.
alarm boolean	Indicates whether to generate an alarm when WebBlocker override is used. The default value is false.