Skip to main content
API & Automation

Script It Once. Deploy It to Every Appliance.

A full API lets you script firewall rules, NAT, VLANs, and VPN setup. MSPs and IT teams can manage many appliances as code, instead of clicking through each one by hand. Role-based tokens, scheduled config backup with rollback, and a full audit trail all come standard.

REST API /api/v1
Role-based API tokens
Config backup & rollback
Full audit trail
Service discovery

Automate Every Layer of the Appliance

The same API that runs the web console is open to your own scripts and tools. Every endpoint below checks a token tied to a role before it runs.

Firewall & NAT
GET/POST /firewall/rulescreate, edit, reorder
POST /firewall/rules/{id}/enableturn a rule on/off
GET/POST /firewall/nat/rulesNAT & PAT
POST /firewall/nat/port-forwardsport forwarding
Network
GET/POST /network/interfacesinterface config
GET/POST /network/vlansVLAN management
GET/POST /network/routesrouting table
GET/POST /network/bondslink bonding
Monitoring & Threats
GET /firewall/connectionslive connection table
GET /firewall/threats/alertsthreat detection
GET /firewall/threats/logs/exportCSV / JSON export
GET /firewall/connections/statsconnection stats
Platform & Automation
POST /backup-configsnapshot config
POST /backup-config/{id}/rollbackroll back a change
GET /system/auditconfig-change audit trail
POST /api-tokensscoped bearer tokens

After any change, follow up with an apply call to push it live.

How It Works

Token, then script, then apply. Three steps from idea to a running setup.

1
Generate an API Token
Create a token tied to a role: viewer, operator, or admin. Every call uses this token to log in. There is no shared admin password.
2
Script Your Configuration
Call the firewall rules, VLANs, or any other endpoint with curl, Python, or your own tools. Write your setup as code.
3
Apply & Verify
Trigger apply to push your changes to the appliance. Then check status to confirm it worked. Every change lands in the audit trail on its own.

What Gets Automated

Anything you can click in the console, you can script through the API. Plus a few things you cannot click at all.

Firewall Rules
  • Bulk create & update
  • Priority reorder
  • Enable / disable in bulk
  • Rule templates via script
VLANs & Interfaces
  • Create & tag VLANs
  • Assign interfaces
  • Bring interfaces up/down
  • Bond configuration
NAT & Port Forwarding
  • Map internal services
  • Outbound NAT rules
  • Port forward templates
  • No manual UI clicks
VPN Configuration
  • Deploy tunnel configs
  • New-site provisioning
  • Peer credential rotation
  • Consistent policy across sites
Configuration Backup
  • Scheduled snapshots
  • One-call rollback
  • sha256-verified generations
  • Pre-change auto-snapshot
Service Discovery
  • Auto-register new appliances
  • Register rules from a peer appliance
  • Dynamic rule creation from events
  • Ecosystem-wide policy sync

Every Change, Tracked and Reversible

Firecradle saves each config change as a new numbered version. It compares each one to the last. At a glance, you can see exactly what an automated change did to a rule, a route, or a VLAN. If it was not what you wanted, roll it back with one call.

A line-by-line diff between one config version and the next
Every version is timestamped and checksummed
One call rolls back to any earlier version
A full audit trail: who changed what, and from which token
firewall_rule "Allow-SSH-Admin" - diff 2026-07-05 vs 2026-07-01
"direction": "inbound",
- "source": "192.168.1.0/24",
+ "source": "192.168.10.0/24",
"port": { "from": 22, "to": 22 },
- "logging": false,
+ "logging": true,
"action": "allow",
- "priority": 120
+ "priority": 100

Common Issues

401 Unauthorized
The token is missing, expired, or was revoked. Make a new token from the API Tokens tab and update your script.
403 Forbidden on a write call
The token's role is too low for this action. A viewer token can read rules but cannot create or reorder them. Use an operator or admin token instead.
Change didn't take effect
Either apply was never called, or it returned a test result instead of a real one. Check the status endpoint to see the last result.

Best Practices

Use low-privilege tokens: give monitoring scripts a viewer-only token
Batch your changes, then call apply once instead of after each write
Check the status endpoint and get alerted on a test or error result
Save a config snapshot before big automated changes, so you can roll back
Rotate API tokens on a schedule, and cancel them when a script retires
Review the audit trail after any automation run that ran unattended

Part of the Full Firecradle Platform

Firewall Rules Engine
The same rules engine the API drives, with direction, protocol, address, port range, and priority order.
Learn more
VLAN Segmentation
Script VLAN creation and interface setup across every appliance, instead of clicking through each one.
Learn more
Cloud Management
Watch API-driven changes and audit entries across every appliance from one dashboard.
Learn more

Automate Every Appliance from One API

API access, role-based tokens, config backup with rollback, and a full audit trail, included with every Firecradle appliance.

No credit card required · Cancel anytime · 30-day free trial