One API
The console and toutwafctl use only the control plane's REST API: what you do in the interface also exists as an API call.
API en CLI
Everything the console does is also available through a REST API and the toutwafctl command-line tool, with scoped tokens: to script, to plug into a SOAR or to drive from CI.
Where to find it in the console : Console: Administration > Users and access (API tokens); API: /api/v1; tool: toutwafctl.
What it is for
Scoped tokens
A token carries a list of permissions (resource:action), can be limited to some sites and can expire. It never exceeds the permissions of its creator.
Readable errors
Every error has a TW-xxxx code, a message in the requested language and, in the documentation, a cause and a fix.
In your scripts and CI
toutwafctl has JSON output, exit codes usable in CI and messages in ten languages.
What toutwafctl does
It talks to the API with a token; the full reference is in the documentation.
Log in
login (with the TOTP code when two-factor authentication is on) exchanges the session for a long-lived token, or stores an existing one.
Sites and policy
apps (list, create, detect/block mode); policy (export, validate, diff, apply, publish, roll back).
Test and simulate
test runs rule tests with JUnit output; simulate replays stored traffic against a policy.
Ban, enrol, token
ban and unban for an address; nodes for the nodes and their enrolment tokens; token to create, list and revoke API tokens.
Back up and restore
backup (create, list, download, targets) and restore, including offline with the service stopped.
Diagnose
doctor reads the local installation even when the console does not answer, or asks the console with a token; the exit code is 1 when a check fails.
The REST API
Base path /api/v1.
- Authentication: cookie session with a CSRF header on state-changing requests, or a bearer token (Authorization: Bearer).
- Lists return items and a total; the language of messages follows Accept-Language or the lang parameter.
- Data-plane endpoints are served separately, on an internal port, with a node token.
- The reference is generated from the product's OpenAPI contract.
Token good practice
A CI token does not need everything.
- Create a dedicated token per use, with only the permissions needed and an expiry.
- Avoid the “*” token created by an interactive login for CI.
- A token can be limited to given sites and revoked at any time.
What is not done, or not proven
We prefer to say it plainly.
- The --insecure option of toutwafctl turns off verification of the console's TLS certificate: keep it for a lab.
- The API reference is generated from a snapshot of the product; when in doubt, the OpenAPI contract of the installed product prevails.
- A token never exceeds its creator's permissions, and a role without a permission does not get it through the API.
Use cases
Ban from a SOAR
A playbook calls the API to ban an address for a given time, with a reason recorded in the audit.
An operations script
A script creates a site, sets it to detection and publishes it with toutwafctl.
A CI that tests rules
Rule tests run on every change, with a JUnit report.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
- REST-API voor alles wat de console doet, met tokens met beperkte scopeGratis
- Opdrachtregeltool: beleid, tests, simulatie, back-ups, diagnoseGratis
- Vlootpagina: nodes, versies, inschrijvingstokens en georkestreerde updates van de nodesGratis
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.