One API
The console and toutwafctl use only the control plane's REST API: what you do in the interface also exists as an API call.
API e CLI
Everything the console does is also available through a REST API and the toutwafctl command-line tool, with scoped tokens: to script, to plug into a SOAR or to drive from CI.
Where to find it in the console : Console: Administration > Users and access (API tokens); API: /api/v1; tool: toutwafctl.
What it is for
Scoped tokens
A token carries a list of permissions (resource:action), can be limited to some sites and can expire. It never exceeds the permissions of its creator.
Readable errors
Every error has a TW-xxxx code, a message in the requested language and, in the documentation, a cause and a fix.
In your scripts and CI
toutwafctl has JSON output, exit codes usable in CI and messages in ten languages.
What toutwafctl does
It talks to the API with a token; the full reference is in the documentation.
Log in
login (with the TOTP code when two-factor authentication is on) exchanges the session for a long-lived token, or stores an existing one.
Sites and policy
apps (list, create, detect/block mode); policy (export, validate, diff, apply, publish, roll back).
Test and simulate
test runs rule tests with JUnit output; simulate replays stored traffic against a policy.
Ban, enrol, token
ban and unban for an address; nodes for the nodes and their enrolment tokens; token to create, list and revoke API tokens.
Back up and restore
backup (create, list, download, targets) and restore, including offline with the service stopped.
Diagnose
doctor reads the local installation even when the console does not answer, or asks the console with a token; the exit code is 1 when a check fails.
The REST API
Base path /api/v1.
- Authentication: cookie session with a CSRF header on state-changing requests, or a bearer token (Authorization: Bearer).
- Lists return items and a total; the language of messages follows Accept-Language or the lang parameter.
- Data-plane endpoints are served separately, on an internal port, with a node token.
- The reference is generated from the product's OpenAPI contract.
Token good practice
A CI token does not need everything.
- Create a dedicated token per use, with only the permissions needed and an expiry.
- Avoid the “*” token created by an interactive login for CI.
- A token can be limited to given sites and revoked at any time.
What is not done, or not proven
We prefer to say it plainly.
- The --insecure option of toutwafctl turns off verification of the console's TLS certificate: keep it for a lab.
- The API reference is generated from a snapshot of the product; when in doubt, the OpenAPI contract of the installed product prevails.
- A token never exceeds its creator's permissions, and a role without a permission does not get it through the API.
Use cases
Ban from a SOAR
A playbook calls the API to ban an address for a given time, with a reason recorded in the audit.
An operations script
A script creates a site, sets it to detection and publishes it with toutwafctl.
A CI that tests rules
Rule tests run on every change, with a JUnit report.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
- API REST per tutto ciò che fa la console, con token ad ambito limitatoGratuito
- Strumento da riga di comando: policy, test, simulazione, backup, diagnosticaGratuito
- Pagina della flotta: nodi, versioni, token di registrazione e aggiornamenti orchestrati dei nodiGratuito
Tornare al valore predefinito di un'opzione avanzata è sempre possibile. Che cosa accade alla fine di una licenza a pagamento è descritto nelle domande frequenti sui prezzi: 48 ore di tolleranza, 48 ore di sola lettura, poi la protezione WAF viene disattivata fino al rinnovo.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.