Change Requests
A change request describes a firewall change you intend to make: one or more rules, each with an action, sources, destinations, and services. When you save one, Connect evaluates it asynchronously against your organization's Boundaries (the policy guardrails configured in Connect) and sets the request's state:
| State | Meaning |
|---|---|
Pending | Saved and awaiting evaluation. |
Pass | The request matched at least one Pass Boundary and no Fail Boundary. |
Fail | The request matched at least one Fail Boundary; stateReason lists them. (Saving rejects an invalid request outright; only Evaluate returns Fail for one.) |
Review | No Pass or Fail Boundary matched, so the request needs manual review. Your organization can choose a different default for this case under Settings > Boundaries in Connect. |
Error | Evaluation could not complete. |
The per-Boundary outcomes are in the request's results; a Boundary counts toward the verdict only when its isMatch is true. When no Pass or Fail Boundary matches, score is the highest score among the matched Score Boundaries; otherwise it is 0.
How a Boundary decides whether it matches a rule, and how the results combine, is explained under Boundaries.
The GraphQL API is served at https://graph.prod.firemon.cloud/graphql. Authenticate every request with the Authorization header (see Authentication). Your Connect user also needs change-request permissions. Listing needs permission to view firewall changes. Fetching one request by ID works for its creator, its last updater, or anyone who can request, approve, or view firewall changes in its project. Saving, evaluating, or deleting needs permission to request firewall changes.
- Schema: the change request types, inputs, queries, and mutations
- List Change Requests: page through your change requests
- Get Change Request: fetch one request with its rules and evaluation results
- Save Change Request: create or update a request and start its evaluation
- Evaluate Change Request: evaluate rules without saving anything
- Delete Change Request: delete a request by ID
The same operations are also available through the REST API.