Learn Zabbix - Zabbix API & Automation

#Introduction

You've seen curl calls to /api_jsonrpc.php many times in previous episodes. Episode 14 opens that box fully: the Zabbix API is the automation gateway that turns the entire frontend — hosts, items, triggers, alerts — into programmable objects. Everything you can do through the UI can be done through the API.

This capability changes how teams work. Host provisioning, configuration synchronization, and report generation can be run by pipelines instead of humans clicking through the frontend. This episode also introduces three tools that wrap the API: curl, Python with pyzabbix, and Terraform.

#Understanding the Zabbix API

#JSON-RPC and Endpoints

The Zabbix API follows the JSON-RPC 2.0 protocol. All requests are sent as POST to the /api_jsonrpc.php endpoint with this format:

{
  "jsonrpc": "2.0",
  "method": "host.get",
  "params": {},
  "id": 1,
  "auth": "<token>"
}

The method field defines the operation, params carries the arguments, and auth carries the authentication token. The command curl -s -X POST http://localhost/api_jsonrpc.php from previous episodes was exactly this kind of request.

#Authentication: API Tokens

The recommended way to authenticate automation is an API token created per user in the Users → API tokens menu. The token replaces the password and can have an expiration. Once created, the token is used as the auth value in every request.

To check whether the endpoint is alive, call the apiinfo.version method:

curl -s -X POST http://localhost/api_jsonrpc.php \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"apiinfo.version","id":1,"params":{}}'

A response like {"result":"7.0.29"} means the API endpoint is alive. This method doesn't require authentication and is the simplest health check.

#Basic API Operations

#Hosts, Items, and Triggers

The API uses the <object>.<action> naming pattern: host.get, host.create, item.get, trigger.get, and so on. Here's an example of fetching the list of hosts along with their host groups:

curl -s -X POST http://localhost/api_jsonrpc.php \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"host.get","params":{"output":["hostid","host"],"selectGroups":["name"]},"id":1,"auth":"<token>"}'

The parameter selectGroups is an example of API syntax for fetching referenced objects — a pattern used in many methods to enrich query results.

#Fetching Alerts and Events

The API also exposes operational data. For notification audits, alert.get fetches alert history, and event.get fetches the list of problem events. These are useful for building external reports or integrating with ticketing systems.

#Automation with Your Tool of Choice

#Python with pyzabbix

pyzabbix is a Python client for the Zabbix API. Install it, then write a simple script:

pip install pyzabbix

Example pyzabbix script

from pyzabbix import ZabbixAPI
 
zapi = ZabbixAPI("http://localhost")
zapi.login(user="automation", password="StrongPassword")
 
hosts = zapi.host.get(output=["host"], selectGroups=["name"])
for h in hosts:
    print(h["host"])

The script above logs into the API and prints the host list. zapi.host.get(output=["host"]) returns host objects ready to be processed in Python.

#zabbix-cli and Terraform

• zabbix-cli is an official Python-based CLI that wraps the API into interactive commands, for example zabbix host list.
• The Terraform provider zabbix/zabbix lets hosts, host groups, and templates be managed as code (Infrastructure as Code).

resource "zabbix_host" "app01" {
  host = "app01.example.com"
  hostgroup_name = "Linux servers"
}

The zabbix_host resource above defines one host in Terraform. This way, the entire Zabbix configuration can be reviewed, versioned, and deployed reproducibly.

#Healthy Automation Patterns

Some patterns that keep automation safe:

• Store tokens in environment variables or a secret manager, not inside scripts.
• Idempotency: a script run twice must produce the same state.
• Test API methods with get before create or update.
• Log the result of every operation for audit.

#Closing

Episode 14 opened up automation: a JSON-RPC-based Zabbix API with API tokens, host, item, trigger, and alert operations, and three practical tools — curl, Python pyzabbix, and Terraform — for managing Zabbix as code.

Key takeaways:

• Every frontend operation is available through the JSON-RPC API at /api_jsonrpc.php.
• API tokens are the recommended authentication method for automation.
• The <object>.<action> pattern applies to hosts, items, triggers, alerts, and more.
• pyzabbix, zabbix-cli, and Terraform wrap the API for larger scale.
• Store tokens securely and grant the minimum permissions needed.

In the next episode 15 we'll discuss authentication, RBAC, and security hardening — authentication with built-in users, LDAP, SAML SSO, and 2FA, role- and permission-based access control, and hardening with TLS/PSK, an HTTPS reverse proxy, and security patches.