Which two statements are true about creating an API interface? (Choose two answers)

When creating an API user in FortiSIEM, two key configuration steps are required for security and multi-tenancy. First, the administrator must define the specific source IP addresses or subnets that are permitted to send API requests to the interface. This acts as a network-level access control list. Second, in a multi-tenant deployment, the API user can and should be associated with a specific organization. This ensures that the API key only has access to the data and resources belonging to that designated organization, enforcing data segregation and the principle of least privilege.

C. API interfaces use a system-generated API key and a secret (labeled API Password), not a traditional interactive username and password combination for authentication.

D. While the super/global user can create any API user, an administrative user with sufficient privileges can also create an API user scoped to their own organization.

1. FortiSIEM 5.2.5 Administration Guide, Page 51, "Creating an API User".

The guide provides a screenshot and description of the "New API User" dialog box. It explicitly shows the "Organization" dropdown menu, confirming that an API user can be assigned to a specific organization.

The same section details the "Allowed IPs" field, stating, "Enter the IP addresses that are allowed to access the API," which confirms the requirement for IP-based access control.

2. FortiSIEM 6.3.0 Administration Guide, "Creating API Users" section.

This document reinforces the same principles: "From the Organization drop-down list, select the organization that this API user will belong to."

It also states, "In the Allowed IPs field, enter the IP addresses that are allowed to access the API." This directly supports both correct answers.

The guide also clarifies authentication: "FortiSIEM will generate an API Key and API Password for this user," distinguishing it from standard password authentication.