Get Change Request

Get a single change request by ID by sending an HTTPS POST request to https://graph.prod.firemon.cloud/graphql.

Set the Authorization header to the idToken from Authentication.

The body of the request:

{
  "query": "query changeRequest($id: String!) { changeRequest(id: $id) { id name state stateReason } }",
  "operationName": "changeRequest",
  "variables": { "id": "the change request's ID" }
}

The following query requests the fields most integrations need; the Schema lists everything available:

query changeRequest($id: String!) {
  changeRequest(id: $id) {
    id
    parentPath
    projectId
    createdAt
    createdBy
    name
    results {
      boundaryAction
      boundaryId
      boundaryName
      isMatch
      message
      state
    }
    rules {
      action
      justification
      comment
      owner
      expiration
      destinations {
        ...NetworkObjectFragment
      }
      services {
        ...ServiceObjectFragment
      }
      sources {
        ...NetworkObjectFragment
      }
    }
    state
    stateReason
    updatedAt
    updatedBy
  }
}

fragment NetworkObjectFragment on NetworkObject {
  type
  negate
  ... on NetworkObjectCidr {
    cidr
    comparison
  }
  ... on NetworkObjectConnectGroup {
    groupId
    comparison
  }
  ... on NetworkObjectInventoryItem {
    comparison
    itemKey {
      accountId
      region
      type
      id
    }
  }
}

fragment ServiceObjectFragment on ServiceObject {
  type
  ... on ServiceObjectCustomProtocol {
    protocol
  }
  ... on ServiceObjectIcmpV4 {
    icmpCode
    icmpType
  }
  ... on ServiceObjectIcmpV6 {
    icmpCode
    icmpType
  }
  ... on ServiceObjectTcp {
    portEnd
    portStart
  }
  ... on ServiceObjectUdp {
    portEnd
    portStart
  }
  ... on ServiceObjectPortRangeSize {
    maxSize
  }
}

An example using cURL:

curl --request POST \
  --url https://graph.prod.firemon.cloud/graphql \
  --header 'Authorization: IdToken' \
  --header 'Content-Type: application/json' \
  --data '{"query":"query changeRequest($id: String!) { changeRequest(id: $id) { id parentPath projectId createdAt createdBy name results { boundaryAction boundaryId boundaryName isMatch message state } rules { action justification comment owner expiration destinations { ...NetworkObjectFragment } services { ...ServiceObjectFragment } sources { ...NetworkObjectFragment } } state stateReason updatedAt updatedBy }}fragment NetworkObjectFragment on NetworkObject { type negate ... on NetworkObjectCidr { cidr comparison } ... on NetworkObjectConnectGroup { groupId comparison } ... on NetworkObjectInventoryItem { comparison itemKey { accountId region type id } }}fragment ServiceObjectFragment on ServiceObject { type ... on ServiceObjectCustomProtocol { protocol } ... on ServiceObjectIcmpV4 { icmpCode icmpType } ... on ServiceObjectIcmpV6 { icmpCode icmpType } ... on ServiceObjectTcp { portEnd portStart } ... on ServiceObjectUdp { portEnd portStart } ... on ServiceObjectPortRangeSize { maxSize }}","operationName":"changeRequest","variables": { "id": "ID" } }'

An example response:

{
  "data": {
    "changeRequest": {
      "id": "c0000000-0000-4000-8000-000000000003",
      "parentPath": "/a0000000-0000-4000-8000-000000000001",
      "projectId": "a0000000-0000-4000-8000-000000000001",
      "createdAt": "2025-07-31T16:05:01.799Z",
      "createdBy": "b0000000-0000-4000-8000-000000000002",
      "name": "Allow all outbound HTTPS from Lab",
      "state": "Fail",
      "stateReason": "This request failed the following boundaries:\n* No outbound rules to Any",
      "updatedAt": "2025-07-31T16:09:55.251Z",
      "updatedBy": "b0000000-0000-4000-8000-000000000002",
      "results": [
        {
          "boundaryAction": "Fail",
          "boundaryId": "d0000000-0000-4000-8000-000000000005",
          "boundaryName": "No outbound rules to Any",
          "isMatch": true,
          "message": "Outbound rules must name a specific destination.",
          "state": "Fail"
        }
      ],
      "rules": [
        {
          "action": "Allow",
          "justification": null,
          "comment": null,
          "owner": null,
          "expiration": null,
          "destinations": [
            {
              "type": "Any",
              "negate": null
            }
          ],
          "services": [
            {
              "type": "TCP",
              "portEnd": 443,
              "portStart": 443
            }
          ],
          "sources": [
            {
              "type": "Cidr",
              "cidr": "10.10.10.0/24",
              "comparison": null,
              "negate": null
            }
          ]
        }
      ]
    }
  }
}