Class SecurityAPI

List firewall groups

Retrieves all firewall groups configured in the UniFi Controller. Firewall groups are used to organize IP addresses or ports for use in firewall rules.

Throws

When firewall groups retrieval fails

Example

// Get all firewall groups
const groups = await securityAPI.list_firewallgroups();
console.log(`Found ${groups.length} firewall groups`);

// Filter by group type
const addressGroups = groups.filter(group => group.group_type === 'address-group');
const portGroups = groups.filter(group => group.group_type === 'port-group');

// Find specific group by name
const serverGroup = groups.find(group => group.name === 'Internal Servers');
Copy

See

• create_firewallgroup to create new firewall groups
• delete_firewallgroup to remove firewall groups
• list_firewallrules to see how groups are used in rules

PHP: list_firewallgroups() -> return $this->fetch_results('/api/s/' . $this->site . '/list/firewallgroup');

List firewall rules

Retrieves all firewall rules configured in the UniFi Controller. Includes information about rule actions, sources, destinations, and protocols.

Throws

When firewall rules retrieval fails

Example

// Get all firewall rules
const rules = await securityAPI.list_firewallrules();
console.log(`Found ${rules.length} firewall rules`);

// Filter rules by action
const blockRules = rules.filter(rule => rule.action === 'drop');
const allowRules = rules.filter(rule => rule.action === 'accept');

// Find rules for specific protocol
const httpRules = rules.filter(rule => 
  rule.dst_port === '80' || rule.dst_port === '443'
);

// List enabled rules only
const activeRules = rules.filter(rule => rule.enabled);
Copy

See

• create_firewallrule to create new firewall rules
• delete_firewallrule to remove firewall rules
• list_firewallgroups to list firewall groups used in rules

PHP: list_firewallrules() -> return $this->fetch_results('/api/s/' . $this->site . '/list/firewallrule');

Delete firewall group

Deletes a firewall group from the UniFi Controller. Firewall rules using this group will need to be updated before deletion.

Throws

When group_id is invalid

Throws

When firewall group deletion fails or group is in use

Example

// Delete firewall group by ID
await securityAPI.delete_firewallgroup('507f1f77bcf86cd799439011');

// Find and delete firewall group by name
const groups = await securityAPI.list_firewallgroups();
const oldGroup = groups.find(group => group.name === 'Old Servers');
if (oldGroup) {
  await securityAPI.delete_firewallgroup(oldGroup._id);
}
Copy

Warning

Ensure no firewall rules reference this group before deletion

See

• list_firewallgroups to get firewall group IDs
• list_firewallrules to check if group is used in rules
• create_firewallgroup to create a new firewall group

PHP: delete_firewallgroup($group_id) -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/rest/firewallgroup/' . trim($group_id));

Edit firewall group

Updates an existing firewall group with new members or settings.

Throws

When required parameters are invalid

Throws

When firewall group update fails

Example

// Update firewall group members
await securityAPI.edit_firewallgroup(
  '507f1f77bcf86cd799439011',
  '507f1f77bcf86cd799439012',
  'Updated Server Group',
  'address-group',
  ['192.168.1.10', '192.168.1.11', '192.168.1.20']
);

// Add new members to existing group
const groups = await securityAPI.list_firewallgroups();
const serverGroup = groups.find(g => g.name === 'Web Servers');
if (serverGroup) {
  const updatedMembers = [...serverGroup.group_members, '192.168.1.30'];
  await securityAPI.edit_firewallgroup(
    serverGroup._id,
    serverGroup.site_id,
    serverGroup.name,
    serverGroup.group_type,
    updatedMembers
  );
}
Copy

See

• list_firewallgroups to get group information
• create_firewallgroup to create new firewall groups
• delete_firewallgroup to remove firewall groups

PHP: edit_firewallgroup($group_id, $site_id, $group_name, $group_type, $group_members = [])

Create RADIUS account

Creates a new RADIUS user account for network authentication. RADIUS accounts are used for enterprise wireless authentication.

Throws

When name or password validation fails

Throws

When RADIUS account creation fails

Example

// Create basic RADIUS account
await securityAPI.create_radius_account('john.doe', 'securePassword123');

// Create RADIUS account with VLAN assignment
await securityAPI.create_radius_account(
  'guest.user',
  'guestPass456',
  13,  // VLAN tunnel type
  6,   // IEEE 802 tunnel medium
  100  // VLAN ID
);
Copy

See

• list_radius_accounts to list existing RADIUS accounts
• delete_radius_account to remove RADIUS accounts
• set_radius_account_base to update RADIUS account settings

PHP: create_radius_account($name, $x_password, $tunnel_type = null, $tunnel_medium_type = null, $vlan = null)

List RADIUS accounts

Retrieves all RADIUS user accounts configured in the UniFi Controller.

Throws

When RADIUS accounts retrieval fails

Example

// Get all RADIUS accounts
const accounts = await securityAPI.list_radius_accounts();
console.log(`Found ${accounts.length} RADIUS accounts`);

// Find accounts with VLAN assignments
const vlanAccounts = accounts.filter(account => account.vlan);

// Find specific account by name
const userAccount = accounts.find(account => account.name === 'john.doe');
Copy

See

• create_radius_account to create new RADIUS accounts
• delete_radius_account to remove RADIUS accounts
• list_radius_profiles to list RADIUS server profiles

PHP: list_radius_accounts() -> return $this->fetch_results('/api/s/' . $this->site . '/rest/account');

List RADIUS profiles

Retrieves all RADIUS server profiles configured in the UniFi Controller. RADIUS profiles define the authentication servers used for enterprise security.

Throws

When RADIUS profiles retrieval fails

Example

// Get all RADIUS profiles
const profiles = await securityAPI.list_radius_profiles();
console.log(`Found ${profiles.length} RADIUS profiles`);

// Find active profiles
const activeProfiles = profiles.filter(profile => profile.enabled);

// Find profiles by authentication type
const eapProfiles = profiles.filter(profile => profile.auth_type === 'eap');
Copy

See

• create_radius_profile to create new RADIUS profiles
• list_radius_accounts to list RADIUS user accounts

PHP: list_radius_profiles() -> return $this->fetch_results('/api/s/' . $this->site . '/rest/radiusprofile');

Delete RADIUS account

Removes a RADIUS user account from the UniFi Controller.

Throws

When account_id is invalid

Throws

When RADIUS account deletion fails

Example

// Delete RADIUS account by ID
await securityAPI.delete_radius_account('507f1f77bcf86cd799439011');

// Find and delete RADIUS account by name
const accounts = await securityAPI.list_radius_accounts();
const oldAccount = accounts.find(account => account.name === 'old.user');
if (oldAccount) {
  await securityAPI.delete_radius_account(oldAccount._id);
}
Copy

See

• list_radius_accounts to get RADIUS account IDs
• create_radius_account to create new RADIUS accounts

PHP: delete_radius_account($account_id) -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/rest/account/' . trim($account_id));

Update RADIUS account, base

Updates an existing RADIUS account with new settings.

Throws

When account_id is invalid

Throws

When RADIUS account update fails

Example

// Update RADIUS account password
await securityAPI.set_radius_account_base('507f1f77bcf86cd799439011', {
  x_password: 'newSecurePassword123'
});

// Update RADIUS account with VLAN assignment
await securityAPI.set_radius_account_base('507f1f77bcf86cd799439011', {
  name: 'updated.user',
  vlan: 200,
  tunnel_type: 13,
  tunnel_medium_type: 6
});
Copy

See

• list_radius_accounts to get account information
• create_radius_account to create new RADIUS accounts
• delete_radius_account to remove RADIUS accounts

PHP: set_radius_account_base($account_id, $payload) -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/rest/account/' . trim($account_id), $payload);

Update IPS/IDS settings, base

Updates Intrusion Prevention System (IPS) and Intrusion Detection System (IDS) settings. These settings control network threat detection and prevention capabilities.

Throws

When IPS/IDS settings update fails

Example

// Enable IPS with basic settings
await securityAPI.set_ips_settings_base({
  enabled: true,
  mode: 'detection',
  suppress_alerts: false
});

// Configure IPS with custom rules
await securityAPI.set_ips_settings_base({
  enabled: true,
  mode: 'prevention',
  suppress_alerts: true,
  categories: ['malware', 'botnet', 'exploit'],
  sensitivity: 'medium'
});

// Disable IPS/IDS
await securityAPI.set_ips_settings_base({
  enabled: false
});
Copy

Warning

IPS/IDS settings affect network performance and security. Test thoroughly before deployment.

See

list_settings to view current IPS/IDS settings

PHP: set_ips_settings_base($payload) -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/set/setting/ips', $payload);

Set WLAN MAC filter

Configures MAC address filtering for a wireless network (WLAN). MAC filtering provides an additional layer of access control by allowing or denying specific devices based on their MAC addresses.

Throws

When required parameters are invalid

Throws

When MAC filter configuration fails

Example

// Allow only specific devices (whitelist)
await securityAPI.set_wlan_mac_filter(
  '507f1f77bcf86cd799439011',
  'allow',
  true,
  ['aa:bb:cc:dd:ee:ff', '11:22:33:44:55:66']
);

// Block specific devices (blacklist)
await securityAPI.set_wlan_mac_filter(
  '507f1f77bcf86cd799439011',
  'deny',
  true,
  ['ff:ee:dd:cc:bb:aa', '66:55:44:33:22:11']
);

// Disable MAC filtering
await securityAPI.set_wlan_mac_filter(
  '507f1f77bcf86cd799439011',
  'allow',
  false,
  []
);
Copy

Warning

MAC filtering can be bypassed by MAC address spoofing. Use in combination with other security measures.

See

• list_wlanconf to get WLAN IDs
• create_wlan to create new WLANs with security settings

PHP: set_wlan_mac_filter($wlan_id, $mac_filter_policy, $mac_filter_enabled, $macs) -> return $this->set_wlansettings_base($wlan_id, $payload);

Update guest login settings

Configures guest portal settings for wireless networks. Controls how guests authenticate and access the network.

Throws

When required parameters are invalid

Throws

When guest login settings update fails

Example

// Configure guest portal with password
await securityAPI.set_guestlogin_settings(
  true,    // portal enabled
  false,   // use default portal design
  true,    // redirect after auth
  'https://company.com/welcome',
  'guest123',  // portal password
  4,       // expire after 4
  3600,    // hours (3600 seconds = 1 hour)
  '507f1f77bcf86cd799439011'
);

// Simple guest access without password
await securityAPI.set_guestlogin_settings(
  true,    // portal enabled
  false,   // default design
  false,   // no redirect
  '',      // no redirect URL
  '',      // no password required
  24,      // expire after 24
  3600,    // hours
  '507f1f77bcf86cd799439011'
);
Copy

See

• set_guestlogin_settings_base for advanced guest settings
• authorize_guest to manually authorize guest devices
• list_guests to view current guest sessions

PHP: set_guestlogin_settings($portal_enabled, $portal_customized, $redirect_enabled, $redirect_url, $x_password, $expire_number, $expire_unit, $section_id)

Update guest login settings, base

Advanced method for updating guest access settings with custom payload. Provides more flexibility than the standard guest login settings method.

Throws

When guest login settings update fails

Example

// Advanced guest portal configuration
await securityAPI.set_guestlogin_settings_base({
  portal_enabled: true,
  portal_customized: true,
  portal_use_hostname: false,
  redirect_enabled: true,
  redirect_url: 'https://company.com/guest-welcome',
  redirect_to_https: true,
  auth_cache: true,
  expire_enabled: true,
  expire_number: 8,
  expire_unit: 3600,
  template_engine: 'angular'
}, '507f1f77bcf86cd799439011');

// Update global guest settings
await securityAPI.set_guestlogin_settings_base({
  portal_enabled: false,
  auth_cache: false
});
Copy

See

• set_guestlogin_settings for standard guest portal configuration
• set_site_guest_access for site-specific guest access settings

PHP: set_guestlogin_settings_base($payload, $section_id = '') -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/set/setting/guest_access' . $section_id, $payload);

Update site guest access settings

Updates guest access settings for a specific site configuration.

Throws

When guest_access_id is invalid

Throws

When site guest access settings update fails

Example

// Update site-specific guest access
await securityAPI.set_site_guest_access('507f1f77bcf86cd799439011', {
  portal_enabled: true,
  portal_customized: false,
  auth_cache: true,
  expire_number: 24,
  expire_unit: 3600
});
Copy

See

• set_guestlogin_settings for standard guest portal configuration
• set_guestlogin_settings_base for advanced guest settings

PHP: set_site_guest_access($guest_access_id, $payload) -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/rest/setting/guest_access/' . trim($guest_access_id), $payload);

Update site SNMP settings

Configures SNMP (Simple Network Management Protocol) settings for network monitoring. SNMP settings control how network devices can be monitored and managed remotely.

Throws

When snmp_id is invalid

Throws

When SNMP settings update fails

Example

// Enable SNMP v2c with community string
await securityAPI.set_site_snmp('507f1f77bcf86cd799439011', {
  enabled: true,
  version: 'v2c',
  community: 'public',
  contact: 'admin@company.com',
  location: 'Server Room A'
});

// Configure SNMP v3 with authentication
await securityAPI.set_site_snmp('507f1f77bcf86cd799439011', {
  enabled: true,
  version: 'v3',
  username: 'snmpuser',
  auth_protocol: 'SHA',
  auth_password: 'authPassword123',
  priv_protocol: 'AES',
  priv_password: 'privPassword456'
});

// Disable SNMP
await securityAPI.set_site_snmp('507f1f77bcf86cd799439011', {
  enabled: false
});
Copy

Warning

SNMP v1 and v2c use plain-text community strings. Use SNMP v3 for secure environments.

See

list_settings to view current SNMP settings

PHP: set_site_snmp($snmp_id, $payload) -> return $this->fetch_results_boolean('/api/s/' . $this->site . '/rest/setting/snmp/' . trim($snmp_id), $payload);

Create firewall group

Creates a new firewall group for organizing IP addresses or ports. Firewall groups simplify rule management by grouping related addresses or ports.

Throws

When group_name or group_type validation fails

Throws

When firewall group creation fails

Example

// Create address group for internal servers
const serverGroup = await securityAPI.create_firewallgroup(
  'Internal Servers',
  'address-group',
  ['192.168.1.10', '192.168.1.11', '192.168.1.12']
);

// Create port group for web services
await securityAPI.create_firewallgroup(
  'Web Ports',
  'port-group',
  ['80', '443', '8080', '8443']
);

// Create IPv6 address group
await securityAPI.create_firewallgroup(
  'IPv6 Servers',
  'ipv6-address-group',
  ['2001:db8::1', '2001:db8::2']
);

// Create empty group (add members later)
await securityAPI.create_firewallgroup('DMZ Hosts', 'address-group');
Copy

See

• list_firewallgroups to list existing firewall groups
• delete_firewallgroup to remove a firewall group
• edit_firewallgroup to modify firewall group members

PHP: create_firewallgroup($group_name, $group_type, $group_members = [])