One API
The console and toutwafctl use only the control plane's REST API: what you do in the interface also exists as an API call.
API und CLI
Everything the console does is also available through a REST API and the toutwafctl command-line tool, with scoped tokens: to script, to plug into a SOAR or to drive from CI.
Where to find it in the console : Console: Administration > Users and access (API tokens); API: /api/v1; tool: toutwafctl.
What it is for
Scoped tokens
A token carries a list of permissions (resource:action), can be limited to some sites and can expire. It never exceeds the permissions of its creator.
Readable errors
Every error has a TW-xxxx code, a message in the requested language and, in the documentation, a cause and a fix.
In your scripts and CI
toutwafctl has JSON output, exit codes usable in CI and messages in ten languages.
What toutwafctl does
It talks to the API with a token; the full reference is in the documentation.
Log in
login (with the TOTP code when two-factor authentication is on) exchanges the session for a long-lived token, or stores an existing one.
Sites and policy
apps (list, create, detect/block mode); policy (export, validate, diff, apply, publish, roll back).
Test and simulate
test runs rule tests with JUnit output; simulate replays stored traffic against a policy.
Ban, enrol, token
ban and unban for an address; nodes for the nodes and their enrolment tokens; token to create, list and revoke API tokens.
Back up and restore
backup (create, list, download, targets) and restore, including offline with the service stopped.
Diagnose
doctor reads the local installation even when the console does not answer, or asks the console with a token; the exit code is 1 when a check fails.
The REST API
Base path /api/v1.
- Authentication: cookie session with a CSRF header on state-changing requests, or a bearer token (Authorization: Bearer).
- Lists return items and a total; the language of messages follows Accept-Language or the lang parameter.
- Data-plane endpoints are served separately, on an internal port, with a node token.
- The reference is generated from the product's OpenAPI contract.
Token good practice
A CI token does not need everything.
- Create a dedicated token per use, with only the permissions needed and an expiry.
- Avoid the “*” token created by an interactive login for CI.
- A token can be limited to given sites and revoked at any time.
What is not done, or not proven
We prefer to say it plainly.
- The --insecure option of toutwafctl turns off verification of the console's TLS certificate: keep it for a lab.
- The API reference is generated from a snapshot of the product; when in doubt, the OpenAPI contract of the installed product prevails.
- A token never exceeds its creator's permissions, and a role without a permission does not get it through the API.
Use cases
Ban from a SOAR
A playbook calls the API to ban an address for a given time, with a reason recorded in the audit.
An operations script
A script creates a site, sets it to detection and publishes it with toutwafctl.
A CI that tests rules
Rule tests run on every change, with a JUnit report.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionKostenlos In allen Angeboten enthalten, auch in den beiden kostenlosen (Free und Free +)Pro und höher Kostenpflichtige Angebote: in der Konsole sichtbar, ohne Lizenz gesperrt. Ab Pro, sofern nicht Agency oder Enterprise angegeben ist
- REST-API für alles, was die Konsole kann, mit Tokens begrenzten GeltungsbereichsKostenlos
- Kommandozeilenwerkzeug: Richtlinie, Tests, Simulation, Sicherungen, DiagnoseKostenlos
- Flottenseite: Knoten, Versionen, Registrierungstoken und koordinierte Updates der KnotenKostenlos
Zum Standardwert einer erweiterten Option zurückzukehren ist immer möglich. Was am Ende einer kostenpflichtigen Lizenz geschieht, steht in den FAQ zu den Preisen: 48 Stunden Karenzzeit, 48 Stunden Nur-Lesen, danach WAF-Schutz aus bis zur Verlängerung.
Stellen Sie noch heute einen Schild vor Ihre Anwendungen
Installieren Sie es auf Ihrem eigenen Server oder schreiben Sie uns, um über Lizenzen zu sprechen.