The Firezone REST API is generally available | Firezone Blog

The Firezone REST API is now generally available. This release adds the capabilities needed for reliable, end-to-end automation.

Why the beta ran as long as it did

Firezone's REST API has been in closed beta since it was originally released more than a year and a half ago. That was longer than we anticipated, but Firezone's domain model was still maturing and we didn't want to break anyone's integration. The model has now matured, and we're pleased to make the API generally available.

The endpoints, fields, and semantics documented in the OpenAPI spec are stable. You can browse the full surface, and try requests against it, in the interactive UI.

What's new

This release closes several gaps that made full API-driven automation difficult. For complete endpoint and request details, see the OpenAPI spec.

Provision a Gateway in one call

You can now provision, manage, and delete long-lived Gateways with their own identity through the API. Creating a Gateway returns its token in the same response, making unattended deployment straightforward.

Filtering on every list endpoint

Every list endpoint now supports server-side filtering, using the same engine as the admin portal. Filters can be combined with one another and pagination, and unsupported filters return a clear 400 error instead of being silently ignored.

Disable without delete

is_disabled is now writable on actors and readable on policies. Disabling an actor immediately revokes its client tokens and portal sessions; disabling a policy retains it but grants no access. To prevent accidental lockouts, an actor cannot disable itself through the API.

Clearer errors on bad input

Invalid pagination input now returns a clear 400 error rather than a 500, so automation can identify and correct malformed requests quickly.

What's intentionally left out

External integrations are not manageable over the REST API. You cannot create or reconfigure an authentication provider, set up directory sync, or wire up any other external integration through the API. Those stay in the admin portal, as some integrations require an interactive OAuth flow to verify the connection.

There is also an important security consideration. These integrations hold credentials for systems outside Firezone and determine who can access your account. An API token that could rewrite your identity provider configuration could redirect authentication itself, turning one leaked credential into a much larger problem than a single misconfigured Resource.

Reading is unaffected. Auth providers and directories still appear in list responses, with name filtering like everything else, so your tooling can see how your account is configured. It just cannot reconfigure it.

What's coming

With the REST API stabilized, we've now been able to focus on building a Terraform provider for Firezone. Your Sites, Gateways, Resources, Policies, and Groups become configuration you write, review, and version alongside the rest of your infrastructure, instead of clicks in the portal or custom curl scripts.

In the meantime, the API is stable and ready to build against. Browse the full surface in the interactive UI, or point your generator at the OpenAPI spec and start automating today. We're announcing the Terraform provider soon, so subscribe to our newsletter to hear about it first.

Firezone Newsletter<br>Sign up with your email to receive roadmap updates, how-tos, and product announcements from the Firezone team.<br>EmailFirst name (optional)Last name (optional)<br>Website<br>By checking the box below, you agree to receive communications from Firezone. You can unsubscribe anytime.<br>I agree to receive other communications from Firezone.To deliver your service, we need your permission to store and process your personal data. We care about your privacy. Learn how we handle your data in our Privacy Policy.

Subscribe