Change Requests

A change request describes a firewall change you intend to make: one or more rules, each with an action, sources, destinations, and services. When you save one, Connect evaluates it asynchronously against your organization's Boundaries (the policy guardrails configured in Connect) and sets the request's state:

State	Meaning
Pending	Saved and awaiting evaluation.
Pass	The request matched at least one Pass Boundary and no Fail Boundary.
Fail	The request matched at least one Fail Boundary, or failed validation; stateReason lists the reasons.
Review	No Pass or Fail Boundary matched, so the request needs manual review. Your organization can choose a different default for this case under Settings > Boundaries in Connect.
Error	Evaluation could not complete.

The per-Boundary outcomes are in the request's results; a Boundary counts toward the verdict only when its isMatch is true. A matched Score Boundary contributes its score to score without passing or failing the request.

The GraphQL API is served at https://graph.prod.firemon.cloud/graphql. Authenticate every request with the Authorization header (see Authentication). Your Connect user also needs change-request permissions: viewing firewall changes to read, and requesting firewall changes to save, evaluate, or delete.

• Schema: the change request types, inputs, queries, and mutations
• List Change Requests: page through your change requests
• Get Change Request: fetch one request with its rules and evaluation results
• Save Change Request: create or update a request and start its evaluation
• Evaluate Change Request: evaluate rules without saving anything
• Delete Change Request: delete a request by ID

The same operations are also available through the REST API.