After a successful authentication request to the FortiManager JSON API, the system returns a unique session ID. This session ID acts as a temporary authentication token. For all subsequent API calls within the same session, this ID must be included in the JSON RPC request payload. This allows FortiManager to verify that the request is coming from an authenticated and authorized user, eliminating the need to send login credentials with every single request. The session remains valid until it is explicitly terminated or times out.

A. The session ID is an authentication credential, not a mechanism for identifying or managing client-side metadata related to the FortiManager.

B. The session ID is a token for session management and authentication; it is not a cryptographic hash used for verifying the integrity of JSON responses.

C. The HTTP request method (e.g., POST) is part of the HTTP protocol itself and is independent of the session ID, which is part of the JSON payload for authentication.

1. Fortinet FortiManager Administration Guide 7.4.0

Page 598

Section: "JSON API". The guide states

"After you log in

you receive a session ID that you must use for all subsequent requests." This confirms its role as a token for subsequent requests.

2. Fortinet FortiManager API Reference 7.4.0

Page 10

Section: "Authentication". The documentation details the login process and shows that the response contains a "session" key. It further explains

"The session key is required for all subsequent requests to the FortiManager unit." An example request on page 11 demonstrates including the "session": "..." key-value pair in a subsequent API call.