Fortinet: registered assets, support dates, and your renewal list

Fortinet's FortiCloud holds the registration record for every Fortinet unit you have ever registered: the serial, the model, and the date its support entitlement runs out. This connector reads that record and hangs each asset off the matching Current company, so the renewal conversation starts from a list instead of a spreadsheet somebody rebuilt. Current reads Fortinet and can never register, transfer, or retire an asset.

1. 1
   1 · Open the IAM portal and create a permission profile

   Sign in at support.fortinet.com/iam as an administrator and go to Permission Profiles. Create a profile that grants read access to Asset Management. Grant nothing beyond the portals you actually want read: the profile is the only place Fortinet lets you limit what this credential can do, because the token it issues always comes back with write scope attached.
2. 2
   2 · Add the API user

   Go to Users ▸ Add New ▸ API User and pick the profile you just made. Fortinet creates a machine account, so nobody has to stay signed in for the sync to run.
3. 3
   3 · Download the credentials once

   On the success screen choose Download Credentials. The downloaded file holds the API key, the password, and the client IDs this user is entitled to. Keep it somewhere your team can reach — you cannot open it again from Fortinet.
4. 4
   4 · Paste the three values into Current

   Open Settings → Integrations → Fortinet. Paste the API key as the username, the password, and the client ID — assetmanagement is the one that reaches asset data. Press Test connection. Current exchanges the three for a short-lived token on every run and never stores a token.

Fortinet has no endpoint that lists your partners. Its multi-tenancy is account- and folder-shaped, so Current works out the roster from the assets that come back: an asset folder when Fortinet returns one, otherwise the account, otherwise a single bucket. Current pairs each grouping with a Current company by normalized name — punctuation and Inc/LLC/Ltd-style suffixes stripped — and pairs only when exactly one company matches. Anything ambiguous waits on the card for you to pick. A mapping you set by hand is never overwritten by a later automatic match, and mapping one attaches its assets within seconds rather than waiting for the next sync.

Fortinet's asset search requires a filter: you ask for assets whose support ends before a date, or you ask for one serial. There is no call that returns everything. Current sweeps with a date ten years out, which reaches the whole estate in practice, but a unit carrying no entitlement date at all may not come back at all. So the card counts assets with a known entitlement date rather than claiming a full inventory. A unit Current cannot date shows as "no entitlement date on file": it never counts as covered, never counts as expired, and never raises an alert.

Two Fortinet endpoints exist in this connector's code: the sign-in call that mints a token, and the asset search. Everything else on the FortiCare API — registering a serial, consuming a licence code, downloading licence keys, editing an asset's description or address, managing folders, decommissioning a unit — is absent from the connector, so it cannot be reached by a bug either. The match is exact rather than by prefix, which matters here: the asset search and the register and decommission calls all live under the same path prefix, and a prefix rule would have admitted the writes alongside the read.

Current syncs Fortinet every six hours. Support-contract dates change on human timescales, so there is nothing to gain from running it more often, and Fortinet allows only ten failed calls per hour on an account before it throttles. That budget is why Current never retries a rejected credential: one wrong password retried in a loop would spend the whole hourly allowance in seconds and lock out an account your own admins may also be using. A rejected sign-in stops the run and shows you what Fortinet said.