One API
The console and toutwafctl use only the control plane's REST API: what you do in the interface also exists as an API call.
API y CLI
Everything the console does is also available through a REST API and the toutwafctl command-line tool, with scoped tokens: to script, to plug into a SOAR or to drive from CI.
Where to find it in the console : Console: Administration > Users and access (API tokens); API: /api/v1; tool: toutwafctl.
What it is for
Scoped tokens
A token carries a list of permissions (resource:action), can be limited to some sites and can expire. It never exceeds the permissions of its creator.
Readable errors
Every error has a TW-xxxx code, a message in the requested language and, in the documentation, a cause and a fix.
In your scripts and CI
toutwafctl has JSON output, exit codes usable in CI and messages in ten languages.
What toutwafctl does
It talks to the API with a token; the full reference is in the documentation.
Log in
login (with the TOTP code when two-factor authentication is on) exchanges the session for a long-lived token, or stores an existing one.
Sites and policy
apps (list, create, detect/block mode); policy (export, validate, diff, apply, publish, roll back).
Test and simulate
test runs rule tests with JUnit output; simulate replays stored traffic against a policy.
Ban, enrol, token
ban and unban for an address; nodes for the nodes and their enrolment tokens; token to create, list and revoke API tokens.
Back up and restore
backup (create, list, download, targets) and restore, including offline with the service stopped.
Diagnose
doctor reads the local installation even when the console does not answer, or asks the console with a token; the exit code is 1 when a check fails.
The REST API
Base path /api/v1.
- Authentication: cookie session with a CSRF header on state-changing requests, or a bearer token (Authorization: Bearer).
- Lists return items and a total; the language of messages follows Accept-Language or the lang parameter.
- Data-plane endpoints are served separately, on an internal port, with a node token.
- The reference is generated from the product's OpenAPI contract.
Token good practice
A CI token does not need everything.
- Create a dedicated token per use, with only the permissions needed and an expiry.
- Avoid the “*” token created by an interactive login for CI.
- A token can be limited to given sites and revoked at any time.
What is not done, or not proven
We prefer to say it plainly.
- The --insecure option of toutwafctl turns off verification of the console's TLS certificate: keep it for a lab.
- The API reference is generated from a snapshot of the product; when in doubt, the OpenAPI contract of the installed product prevails.
- A token never exceeds its creator's permissions, and a role without a permission does not get it through the API.
Use cases
Ban from a SOAR
A playbook calls the API to ban an address for a given time, with a reason recorded in the audit.
An operations script
A script creates a site, sets it to detection and publishes it with toutwafctl.
A CI that tests rules
Rule tests run on every change, with a JUnit report.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiciónGratuito Incluido en todas las ofertas, también en las dos gratuitas (Free y Free +)Pro y superiores Ofertas de pago: visible en la consola, bloqueada sin licencia. Desde Pro, salvo que se indique Agency o Enterprise
- API REST para todo lo que hace la consola, con tokens de ámbito limitadoGratuito
- Herramienta de línea de comandos: política, pruebas, simulación, copias de seguridad, diagnósticoGratuito
- Página de la flota: nodos, versiones, tokens de inscripción y actualizaciones orquestadas de los nodosGratuito
Volver al valor por defecto de una opción avanzada siempre es posible. Lo que ocurre al final de una licencia de pago se describe en las preguntas frecuentes de precios: 48 horas de gracia, 48 horas de solo lectura y después la protección WAF se desactiva hasta la renovación.
Precios Read the documentation
Ponga un escudo delante de sus aplicaciones hoy mismo
Instálelo en su propio servidor, o escríbanos para hablar de licencias.