List Change Requests

List change requests by sending an HTTPS POST request to https://graph.prod.firemon.cloud/graphql.

Set the Authorization header to the idToken from Authentication.

The body of the request:

{
  "query": "query changeRequests($nextPageKey: String, $limit: Int) { changeRequests(nextPageKey: $nextPageKey, limit: $limit) { pageInfo { nextPageKey } items { id parentPath projectId createdAt createdBy name } } }",
  "operationName": "changeRequests",
  "variables": {}
}

The response is paginated. If the response's pageInfo.nextPageKey is null, there are no more pages. Otherwise, request the next page by passing it back in variables. A page can hold fewer items than limit, or none, while more pages remain, because requests you can't view are left out after the page is read. Keep going until nextPageKey is null:

"variables": { "nextPageKey": "the nextPageKey from the previous response" }

The following query requests the fields most integrations need; the Schema lists everything available:

query changeRequests($nextPageKey: String, $limit: Int) {
  changeRequests(nextPageKey: $nextPageKey, limit: $limit) {
    pageInfo {
      nextPageKey
    }
    items {
      id
      parentPath
      projectId
      createdAt
      createdBy
      name
      results {
        boundaryAction
        boundaryId
        boundaryName
        isMatch
        message
        state
      }
      rules {
        action
        justification
        comment
        owner
        expiration
        destinations {
          ...NetworkObjectFragment
        }
        services {
          ...ServiceObjectFragment
        }
        sources {
          ...NetworkObjectFragment
        }
      }
      state
      stateReason
      updatedAt
      updatedBy
    }
  }
}

fragment NetworkObjectFragment on NetworkObject {
  type
  negate
  ... on NetworkObjectCidr {
    cidr
    comparison
  }
  ... on NetworkObjectConnectGroup {
    groupId
    comparison
  }
  ... on NetworkObjectInventoryItem {
    comparison
    itemKey {
      accountId
      region
      type
      id
    }
  }
}

fragment ServiceObjectFragment on ServiceObject {
  type
  ... on ServiceObjectCustomProtocol {
    protocol
  }
  ... on ServiceObjectIcmpV4 {
    icmpCode
    icmpType
  }
  ... on ServiceObjectIcmpV6 {
    icmpCode
    icmpType
  }
  ... on ServiceObjectTcp {
    portEnd
    portStart
  }
  ... on ServiceObjectUdp {
    portEnd
    portStart
  }
  ... on ServiceObjectPortRangeSize {
    maxSize
  }
}

An example using cURL:

curl --request POST \
 --url https://graph.prod.firemon.cloud/graphql \
 --header 'Authorization: IdToken' \
 --header 'Content-Type: application/json' \
 --data '{"query":"query changeRequests($nextPageKey: String, $limit: Int) { changeRequests(nextPageKey: $nextPageKey, limit: $limit) { pageInfo { nextPageKey } items { id parentPath projectId createdAt createdBy name results { boundaryAction boundaryId boundaryName isMatch message state } rules { action justification comment owner expiration destinations { ...NetworkObjectFragment } services { ...ServiceObjectFragment } sources { ...NetworkObjectFragment } } state stateReason updatedAt updatedBy } }}fragment NetworkObjectFragment on NetworkObject { type negate ... on NetworkObjectCidr { cidr comparison } ... on NetworkObjectConnectGroup { groupId comparison } ... on NetworkObjectInventoryItem { comparison itemKey { accountId region type id } }}fragment ServiceObjectFragment on ServiceObject { type ... on ServiceObjectCustomProtocol { protocol } ... on ServiceObjectIcmpV4 { icmpCode icmpType } ... on ServiceObjectIcmpV6 { icmpCode icmpType } ... on ServiceObjectTcp { portEnd portStart } ... on ServiceObjectUdp { portEnd portStart } ... on ServiceObjectPortRangeSize { maxSize }}","operationName":"changeRequests","variables":{}}'

An example response:

{
  "data": {
    "changeRequests": {
      "pageInfo": {
        "nextPageKey": null
      },
      "items": [
        {
          "id": "c0000000-0000-4000-8000-000000000004",
          "parentPath": "/a0000000-0000-4000-8000-000000000001",
          "projectId": "a0000000-0000-4000-8000-000000000001",
          "createdAt": "2025-07-31T16:05:01.799Z",
          "createdBy": "b0000000-0000-4000-8000-000000000002",
          "name": "Allow all outbound HTTPS from Lab",
          "state": "Fail",
          "stateReason": "This request failed the following boundaries:\n* No outbound rules to Any",
          "updatedAt": "2025-07-31T16:09:55.251Z",
          "updatedBy": "b0000000-0000-4000-8000-000000000002",
          "results": [
            {
              "boundaryAction": "Fail",
              "boundaryId": "d0000000-0000-4000-8000-000000000005",
              "boundaryName": "No outbound rules to Any",
              "isMatch": true,
              "message": "Outbound rules must name a specific destination.",
              "state": "Fail"
            }
          ],
          "rules": [
            {
              "action": "Allow",
              "justification": null,
              "comment": null,
              "owner": null,
              "expiration": null,
              "destinations": [
                {
                  "type": "Any",
                  "negate": null
                }
              ],
              "services": [
                {
                  "type": "TCP",
                  "portEnd": 443,
                  "portStart": 443
                }
              ],
              "sources": [
                {
                  "type": "Cidr",
                  "cidr": "10.10.10.0/24",
                  "comparison": null,
                  "negate": null
                }
              ]
            }
          ]
        }
      ]
    }
  }
}