One API
The console and toutwafctl use only the control plane's REST API: what you do in the interface also exists as an API call.
API and CLI
Everything the console does is also available through a REST API and the toutwafctl command-line tool, with scoped tokens: to script, to plug into a SOAR or to drive from CI.
Where to find it in the console : Console: Administration > Users and access (API tokens); API: /api/v1; tool: toutwafctl.
What it is for
Scoped tokens
A token carries a list of permissions (resource:action), can be limited to some sites and can expire. It never exceeds the permissions of its creator.
Readable errors
Every error has a TW-xxxx code, a message in the requested language and, in the documentation, a cause and a fix.
In your scripts and CI
toutwafctl has JSON output, exit codes usable in CI and messages in ten languages.
What toutwafctl does
It talks to the API with a token; the full reference is in the documentation.
Log in
login (with the TOTP code when two-factor authentication is on) exchanges the session for a long-lived token, or stores an existing one.
Sites and policy
apps (list, create, detect/block mode); policy (export, validate, diff, apply, publish, roll back).
Test and simulate
test runs rule tests with JUnit output; simulate replays stored traffic against a policy.
Ban, enrol, token
ban and unban for an address; nodes for the nodes and their enrolment tokens; token to create, list and revoke API tokens.
Back up and restore
backup (create, list, download, targets) and restore, including offline with the service stopped.
Diagnose
doctor reads the local installation even when the console does not answer, or asks the console with a token; the exit code is 1 when a check fails.
The REST API
Base path /api/v1.
- Authentication: cookie session with a CSRF header on state-changing requests, or a bearer token (Authorization: Bearer).
- Lists return items and a total; the language of messages follows Accept-Language or the lang parameter.
- Data-plane endpoints are served separately, on an internal port, with a node token.
- The reference is generated from the product's OpenAPI contract.
Token good practice
A CI token does not need everything.
- Create a dedicated token per use, with only the permissions needed and an expiry.
- Avoid the “*” token created by an interactive login for CI.
- A token can be limited to given sites and revoked at any time.
What is not done, or not proven
We prefer to say it plainly.
- The --insecure option of toutwafctl turns off verification of the console's TLS certificate: keep it for a lab.
- The API reference is generated from a snapshot of the product; when in doubt, the OpenAPI contract of the installed product prevails.
- A token never exceeds its creator's permissions, and a role without a permission does not get it through the API.
Use cases
Ban from a SOAR
A playbook calls the API to ban an address for a given time, with a reason recorded in the audit.
An operations script
A script creates a site, sets it to detection and publishes it with toutwafctl.
A CI that tests rules
Rule tests run on every change, with a JUnit report.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
- REST API for everything the console does, with scoped tokensFree
- Command-line tool: policy, tests, simulation, backups, diagnosticsFree
- Fleet page: nodes, versions, enrolment tokens and orchestrated updates of the nodesFree
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.