Install Jentic One Beta

Connect the DefGuard API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the DefGuard API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdefguard.net%2Fdefguard" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdefguard.net%2Fdefguard" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with DefGuard API.

Provision and revoke WireGuard device configurations attached to user accounts

Create and manage WireGuard networks with peer membership and statistics

Authenticate users and verify TOTP codes for multi-factor login flows

Manage OpenID Connect clients used to federate logins into DefGuard

Group users for role-based access and assign group membership

GET STARTED

Start building with DefGuard API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use DefGuard API for, with concrete tasks.

★ Self-Hosted VPN User Onboarding

Onboard a new employee onto a self-hosted WireGuard VPN by creating a DefGuard user, adding them to the right group, and provisioning a device configuration they can import into the WireGuard client. The /user, /user/{username}/device, and /group endpoints together cover the full onboarding flow without external IDP dependencies.

Create a user via POST /user, assign them to a group, then POST /user/{username}/device to generate a WireGuard device configuration.

OIDC Federation for Internal Apps

Use DefGuard as the OpenID Connect provider for internal applications by registering each app as an OIDC client. The /oauth/client endpoints let operators rotate client credentials and inspect registered apps, so internal tools can sign users in through the same identity store that issues their VPN access.

Call POST /oauth/client to register a new internal app with the required redirect URIs and store the issued client credentials.

MFA Enforcement During Login

Drive a custom login UI that authenticates a user with /auth and then verifies their TOTP code with /auth/totp/verify before issuing a session. This gives bespoke clients full control of the login UX while still relying on DefGuard's identity store and MFA enforcement.

POST username and password to /auth, prompt the user for their TOTP code, then POST it to /auth/totp/verify to complete MFA.

Network Lifecycle Automation

Treat WireGuard networks as managed resources by creating, updating, and tearing them down through the /network endpoints, and pulling /network/{id}/stats for capacity dashboards. This is well suited to platform teams running multiple environments per team.

Call GET /network to list networks, then GET /network/{id}/stats for each and emit metrics to the monitoring pipeline.

AI Agent Integration via Jentic

An ops agent can use Jentic to onboard a new joiner into DefGuard end-to-end: create the user, assign group membership, and provision a WireGuard device. Jentic resolves the Bearer token from the vault and provides typed schemas for each step, so the agent does not need to read DefGuard documentation to chain the calls.

Use Jentic to search for 'create a wireguard device for a defguard user', load the operation, and execute with the user and device parameters.

Key Endpoints

33 endpoints — jentic publishes the only available openapi specification for defguard api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/auth

Authenticate a user with username and password

POST

/auth/totp/verify

Verify a TOTP code during MFA

POST

/user

Create a new user

POST

/user/{username}/device

Provision a WireGuard device for a user

POST

/network

Create a WireGuard network

GET

/network/{id}/stats

Get statistics for a WireGuard network

POST

/oauth/client

POST

/auth

Authenticate a user with username and password

POST

/auth/totp/verify

Verify a TOTP code during MFA

POST

/user

Create a new user

POST

/user/{username}/device

Provision a WireGuard device for a user

POST

/network

Create a WireGuard network

GET

/network/{id}/stats

Get statistics for a WireGuard network

POST

/oauth/client

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the DefGuard API by hand means learning its bearer auth, pointing at your self-hosted DefGuard host, minting a token from /auth, and carrying it across the user, WireGuard, OIDC, and MFA endpoints. Through Jentic you install once, import the DefGuard API from the API Directory, store the bearer token once, and your agent calls it.

Permission scoping

DefGuard puts the username and network id in the URL path (/user/{username}/device, /network/{id}/stats), so a rule can pin your agent to one user or network. You choose the operations it may call, so state-changing ones like creating users or OAuth clients are included only if you add them.

Credential isolation

Your DefGuard bearer token is stored once, encrypted, by your own Jentic One instance and injected into the Authorization header at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'add a wireguard device for a user', and Jentic returns the matching DefGuard operation with its full input schema so the agent fills in the parameters and calls the right endpoint without reading docs.

FAQs

Specific to using DefGuard API through Jentic.

Why is there no official OpenAPI spec for DefGuard API?

DefGuard does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DefGuard API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the DefGuard API use?

The DefGuard API uses HTTP Bearer token authentication. Tokens are issued by the DefGuard server you deploy and passed in the Authorization header. Through Jentic, the token is stored encrypted in the vault and never exposed to the agent.

Can I provision a WireGuard device with the DefGuard API?

Yes. POST /user/{username}/device creates a new WireGuard device for the named user and returns the configuration the user imports into their WireGuard client. List existing devices with GET /user/{username}/device.

Does the DefGuard API support MFA?

Yes. After authenticating with POST /auth, call POST /auth/totp/verify with the user's TOTP code to complete an MFA-protected login flow against DefGuard's built-in TOTP support.

What is the base URL for the DefGuard API?

DefGuard is self-hosted, so the base URL is your deployment host plus /api/v1, for example https://defguard.example.com/api/v1. The OpenAPI server entry uses {defguard-host} as a placeholder for that hostname.

How do I onboard a new user end-to-end through Jentic?

Run `pip install jentic`, then search for 'create a defguard user', load and execute POST /user, follow up by searching for 'add a wireguard device for a defguard user' to call POST /user/{username}/device, and Jentic chains the credentials and schemas across both calls.

Can I limit what my agent is allowed to do with the DefGuard API?

Yes. Because you run Jentic One yourself, your own rules decide which DefGuard operations and credentials the agent may use. DefGuard puts the username and network id in the URL path, as in POST /user/{username}/device and GET /network/{id}/stats, so you can pin the agent to a single user or network. You also choose which operations it can call, so state-changing ones like POST /user or POST /oauth/client are available only if you add them.

DefGuard API

Name: DefGuard API
Brand: DefGuard API
Availability: InStock

Agent-ready OpenAPI document · curated by JenticIdentity AuthAuthenticationbearer33 EndpointsREST

Know of an official OpenAPI document? Contribute it →

For Agents

Manage DefGuard users, WireGuard devices and networks, groups, OIDC clients, and MFA flows on a self-hosted identity platform.

Use for: I want to add a new WireGuard device for a user, Create a new WireGuard network in DefGuard, List all users in the DefGuard directory, Get the WireGuard configuration for a specific device

Not supported: Does not handle SaaS SSO marketplaces, device MDM, or endpoint security agents - use for DefGuard user, WireGuard, OIDC, and MFA management only.

Jentic publishes the only available OpenAPI specification for DefGuard API, keeping it validated and agent-ready. DefGuard is an open-source identity and access management platform built around WireGuard VPN, OpenID Connect, and YubiKey hardware tokens. The API exposes 33 endpoints across users, devices, WireGuard networks and peers, groups, OIDC clients, webhooks, and authentication, including TOTP-based MFA. It self-hosts, so the base URL is parameterised by the deployment host, and authentication uses Bearer tokens issued by the DefGuard server.

Jentic One on Github View OpenAPI Document

Connect the DefGuard API to your agent

Capabilities

Start building with DefGuard API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

DefGuard API