API
Everything you can do in the Connect app is available through its APIs, so change requests, inventory searches, and Group lookups can run from your own scripts, pipelines, and ticketing tools.
There are two APIs, and they share one login:
| API | Endpoint | Covers |
|---|---|---|
| GraphQL | https://graph.prod.firemon.cloud/graphql | Everything in Connect |
| REST | https://api.prod.firemon.cloud | Change requests, inventory search, and Group lookups, documented with an OpenAPI specification |
Before you start
- A Connect user for the integration. API calls run as the user who authenticated, with that user's permissions: saving a change request needs a user who can request firewall changes, and reading inventory needs a user who can view it. A dedicated service user keeps that access separate from any one person's account.
- A token. Authenticate with the user's username and password to get an
idToken, and send it in theAuthorizationheader on every call. Tokens expire, so authenticate again when yours does. See Authentication. - Outbound HTTPS to the two endpoints above.
API keys
Connect can also issue long-lived API keys under Settings > API Keys. The Group lookup endpoints, GET /connect-lists and GET /connect-lists/{id}, accept one in an x-api-key header, which suits a firewall or script that only reads Group membership and shouldn't hold a user's password. Every other endpoint requires a user token. Copy a new key when you create it; it isn't shown again.
In this section
- Authentication: get the API token that every API uses
- Change Requests: create, evaluate, and track change requests
- Inventory API: search the inventory your Groups are built from
- REST API reference: every REST endpoint, documented with an OpenAPI specification