PHP FortiGate Device/User Context

A minimal PHP script to search FortiGate user and device context (user device store) by username or IP address. I prepared it for a local IT team to quickly check which user or device is associated with an IP and how the user is authenticated. The team found it useful for day‑to‑day troubleshooting.

FortiGate can provide user context from several integrations, such as:

• Active Directory
• Intune
• FortiEMS
• FortiNAC

This script queries two FortiGates by default, but you can extend it to more devices.

Features

• Search by username or IP address
• Queries two FortiGates (authenticated users + unauthenticated devices)
• Simple HTML output (no framework)
• Basic error reporting when API is unreachable

FortiGate Terminology

FortiGate builds an internal user device store (also referred to as Device Inventory) using device detection. The API endpoint used in this script (/api/v2/monitor/user/device/query) returns that device inventory list in JSON format. See the references below for details. https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/940602/using-apis

File Tree

.
├── config.sample.php
├── fortigate_api_user-search.php
├── index.php
└── README.md

Requirements

• PHP 8.x
• PHP cURL extension

Setup

1. Copy the sample config and fill in your FortiGate details:

cp config.sample.php config.php

2. Update config.php with your host(s), API token(s), and VDOM.

Usage

Start the built‑in PHP server in the project directory:

php -S 127.0.0.1:8080

Then open:

http://127.0.0.1:8080/index.php

Enter a username or an IP address and press Search.

Notes

• The script currently targets two FortiGates ($fghost and $fghost2). To add more, duplicate the request block in fortigate_api_user-search.php and merge results.
• The output is a simple HTML table to keep the tool easy to deploy.

Security

• API tokens are loaded from config.php (not committed to Git). Keep this file private.
• The script uses HTTPS and validates SSL certificates by default.

Disclaimer

This is a lightweight internal tool and not a full‑featured product. It is intended for local IT use and can be customized further to match your environment.

References

• FortiOS Administration Guide: Device Inventory
• Fortinet Community: API example for device inventory export