API & Automation

Automate firewall rule management

A full REST API automates firewall rules, NAT, VLANs, and VPN configuration - so MSPs and IT teams can manage configuration as code instead of clicking through a UI one appliance at a time. Scoped API tokens, scheduled configuration backup with rollback, and a full audit trail come standard.

REST API /api/v1
Scoped API tokens
Config backup & rollback
Full audit trail
Service discovery

Automate Every Layer of the Appliance

The same REST API that powers the web console is available to your scripts and tooling. Every endpoint below is authenticated with a bearer token scoped to a role.

Firewall & NAT
GET/POST /firewall/rulesCRUD + reorder
POST /firewall/rules/{id}/enabletoggle a rule
GET/POST /firewall/nat/rulesNAT & PAT
POST /firewall/nat/port-forwardsport forwarding
Network
GET/POST /network/interfacesinterface config
GET/POST /network/vlansVLAN management
GET/POST /network/routesrouting table
GET/POST /network/bondslink bonding
Monitoring & Threats
GET /firewall/connectionslive connection table
GET /firewall/threats/alertsthreat detection
GET /firewall/threats/logs/exportCSV / JSON export
GET /firewall/connections/statsconnection stats
Platform & Automation
POST /backup-configsnapshot config
POST /backup-config/{id}/rollbackroll back a change
GET /system/auditconfig-change audit trail
POST /api-tokensscoped bearer tokens

Every mutating call can be followed by an apply call to push desired state to the running configuration.

How It Works

Token → Script → Apply. Three steps from idea to running configuration.

1
Generate an API Token
Create a scoped token tied to a role (viewer, operator, or admin) from the cloud dashboard. Every call authenticates with a bearer token - no shared admin password.
2
Script Your Configuration
Call /api/v1/firewall/rules, /network/vlans, or any other endpoint with curl, Python, or your own tooling to define desired state as code.
3
Apply & Verify
Trigger apply to push desired state to the appliance, then poll status for object counts and error state. Every change lands in the audit trail automatically.

What Gets Automated

Anything you can click in the console, you can script against the API - plus a few things you can't.

Firewall Rules
  • Bulk create & update
  • Priority reorder
  • Enable / disable in bulk
  • Rule templates via script
VLANs & Interfaces
  • Create & tag VLANs
  • Assign interfaces
  • Bring interfaces up/down
  • Bond configuration
NAT & Port Forwarding
  • Map internal services
  • Outbound NAT rules
  • Port forward templates
  • No manual UI clicks
VPN Configuration
  • Deploy tunnel configs
  • New-site provisioning
  • Peer credential rotation
  • Consistent policy across sites
Configuration Backup
  • Scheduled snapshots
  • One-call rollback
  • sha256-verified generations
  • Pre-change auto-snapshot
Service Discovery
  • Auto-register new appliances
  • Register rules from a peer appliance
  • Dynamic rule creation from events
  • Ecosystem-wide policy sync

Every Change, Tracked and Reversible

Firecradle snapshots configuration into versioned generations and diffs each one against the previous version. At a glance you can see exactly what an automated change did to a rule, a route, or a VLAN - and roll back with a single API call if it wasn't what you wanted.

Line-by-line diff between consecutive config generations
Every generation is timestamped and checksummed
One-call rollback to any previous generation
Full audit trail: who changed what, from which token
firewall_rule "Allow-SSH-Admin" - diff 2026-07-05 vs 2026-07-01
"direction": "inbound",
- "source": "192.168.1.0/24",
+ "source": "192.168.10.0/24",
"port": { "from": 22, "to": 22 },
- "logging": false,
+ "logging": true,
"action": "allow",
- "priority": 120
+ "priority": 100

Common Issues

401 Unauthorized
The token is missing, expired, or was revoked. Regenerate a token from the API Tokens tab and update your script's credentials.
403 Forbidden on a write call
The token's role is below what the endpoint requires - a viewer-scoped token can read rules but can't create or reorder them. Issue an operator or admin token instead.
Change didn't take effect
The object was written but apply was never called, or apply returned a dry-run result because the appliance isn't running with the expected privileges. Check the status endpoint for the last applied result.

Best Practices

Use least-privilege tokens - issue viewer-only tokens for monitoring scripts
Batch changes, then call apply once rather than after every single write
Poll the status endpoint and alert on a dry-run or error result
Snapshot configuration before large automated changes so you can roll back with one call
Rotate API tokens on a schedule and revoke immediately when a script is retired
Review the audit trail after any unattended automation run

Part of the Full Firecradle Platform

Firewall Rules Engine
The same rules engine the API drives - direction, protocol, source/destination, port ranges, and priority ordering.
Learn more
VLAN Segmentation
Script VLAN creation and interface assignment across every appliance instead of clicking through each one.
Learn more
Cloud Management
Monitor API-driven changes and audit trail entries across every appliance from a single dashboard.
Learn more

Automate Every Appliance from One API

REST API access, scoped tokens, configuration backup and rollback, and a full audit trail - included with every Firecradle appliance.

In development · early access · Onboarded hands-on by our team