DefGuard API

Name: DefGuard API
Brand: DefGuard API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationbearer33 EndpointsREST

For Agents

Manage DefGuard users, WireGuard devices and networks, groups, OIDC clients, and MFA flows on a self-hosted identity platform.

Install Jentic One Beta

Connect the DefGuard API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the DefGuard API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with DefGuard API.

Provision and revoke WireGuard device configurations attached to user accounts

Create and manage WireGuard networks with peer membership and statistics

Authenticate users and verify TOTP codes for multi-factor login flows

GET STARTED

Start building with DefGuard API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for DefGuard API, keeping it validated and agent-ready. DefGuard is an open-source identity and access management platform built around WireGuard VPN, OpenID Connect, and YubiKey hardware tokens. The API exposes 33 endpoints across users, devices, WireGuard networks and peers, groups, OIDC clients, webhooks, and authentication, including TOTP-based MFA. It self-hosts, so the base URL is parameterised by the deployment host, and authentication uses Bearer tokens issued by the DefGuard server.

Use Cases

Patterns agents use DefGuard API for, with concrete tasks.

★ Self-Hosted VPN User Onboarding

Onboard a new employee onto a self-hosted WireGuard VPN by creating a DefGuard user, adding them to the right group, and provisioning a device configuration they can import into the WireGuard client. The /user, /user/{username}/device, and /group endpoints together cover the full onboarding flow without external IDP dependencies.

Create a user via POST /user, assign them to a group, then POST /user/{username}/device to generate a WireGuard device configuration.

OIDC Federation for Internal Apps

Use DefGuard as the OpenID Connect provider for internal applications by registering each app as an OIDC client. The /oauth/client endpoints let operators rotate client credentials and inspect registered apps, so internal tools can sign users in through the same identity store that issues their VPN access.

Call POST /oauth/client to register a new internal app with the required redirect URIs and store the issued client credentials.

MFA Enforcement During Login

Drive a custom login UI that authenticates a user with /auth and then verifies their TOTP code with /auth/totp/verify before issuing a session. This gives bespoke clients full control of the login UX while still relying on DefGuard's identity store and MFA enforcement.

POST username and password to /auth, prompt the user for their TOTP code, then POST it to /auth/totp/verify to complete MFA.

Network Lifecycle Automation

Treat WireGuard networks as managed resources by creating, updating, and tearing them down through the /network endpoints, and pulling /network/{id}/stats for capacity dashboards. This is well suited to platform teams running multiple environments per team.

Call GET /network to list networks, then GET /network/{id}/stats for each and emit metrics to the monitoring pipeline.

AI Agent Integration via Jentic

An ops agent can use Jentic to onboard a new joiner into DefGuard end-to-end: create the user, assign group membership, and provision a WireGuard device. Jentic resolves the Bearer token from the vault and provides typed schemas for each step, so the agent does not need to read DefGuard documentation to chain the calls.

Use Jentic to search for 'create a wireguard device for a defguard user', load the operation, and execute with the user and device parameters.

Key Endpoints

33 endpoints — jentic publishes the only available openapi specification for defguard api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/auth

Authenticate a user with username and password

POST

/auth/totp/verify

Verify a TOTP code during MFA

POST

/user

Create a new user

POST

/user/{username}/device

Provision a WireGuard device for a user

POST

/network

Create a WireGuard network

GET

/network/{id}/stats

Get statistics for a WireGuard network

POST

/oauth/client

POST

/auth

Authenticate a user with username and password

POST

/auth/totp/verify

Verify a TOTP code during MFA

POST

/user

Create a new user

POST

/user/{username}/device

Provision a WireGuard device for a user

POST

/network

Create a WireGuard network

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

DefGuard Bearer tokens are stored encrypted in the Jentic vault. Agents reference the operation, and Jentic injects the Authorization header at execution time so the token never reaches the agent's context.

Intent-based discovery

Agents search by intent (e.g. 'add a wireguard device for a user') and Jentic returns the matching DefGuard operation along with its full input schema, so the agent can fill in the parameters and execute without reading docs.

Time to first call

Direct DefGuard integration: 1-2 days to wire auth, MFA flow, and resource lifecycle. Through Jentic: under an hour to chain user, device, and network operations.

FAQs

Specific to using DefGuard API through Jentic.

Why is there no official OpenAPI spec for DefGuard API?

DefGuard does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DefGuard API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the DefGuard API use?

The DefGuard API uses HTTP Bearer token authentication. Tokens are issued by the DefGuard server you deploy and passed in the Authorization header. Through Jentic, the token is stored encrypted in the vault and never exposed to the agent.

Can I provision a WireGuard device with the DefGuard API?

Yes. POST /user/{username}/device creates a new WireGuard device for the named user and returns the configuration the user imports into their WireGuard client. List existing devices with GET /user/{username}/device.

Does the DefGuard API support MFA?

Yes. After authenticating with POST /auth, call POST /auth/totp/verify with the user's TOTP code to complete an MFA-protected login flow against DefGuard's built-in TOTP support.

What is the base URL for the DefGuard API?

DefGuard is self-hosted, so the base URL is your deployment host plus /api/v1, for example https://defguard.example.com/api/v1. The OpenAPI server entry uses {defguard-host} as a placeholder for that hostname.

How do I onboard a new user end-to-end through Jentic?

Run `pip install jentic`, then search for 'create a defguard user', load and execute POST /user, follow up by searching for 'add a wireguard device for a defguard user' to call POST /user/{username}/device, and Jentic chains the credentials and schemas across both calls.

DefGuard API

Connect the DefGuard API to your agent

Capabilities

Start building with DefGuard API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs