Save Change Request

Save a change request by sending an HTTPS POST request to https://graph.prod.firemon.cloud/graphql.

Set the Authorization header to the idToken from Authentication.

Saving stores the request, sets its state to Pending, and starts evaluation against every enforced Boundary asynchronously. Check the outcome with Get Change Request. To evaluate rules without saving anything, see Evaluate Change Request.

Input fields

Field	Notes
id	Leave blank to create a new change request. Provide an existing request's ID to update it. Only an administrator, the request's creator, or its last updater can update a request.
name	The request's display name.
projectId	The project to create the request in. Leave blank to use the root project if you have permission to request firewall changes there, otherwise the first project where you do.
rules[].action	Allow or Deny.
rules[].sources, rules[].destinations	Network objects. Set type to Any; Cidr with cidr; ConnectGroup with groupId; or InventoryItem with itemKey (accountId, region, type, and id, all found on an Inventory item).
rules[].services	Service objects. Set type to TCP or UDP with portStart and portEnd; ICMPv4 or ICMPv6 with icmpType and icmpCode; CustomProtocol with protocol; PortRangeSize with maxSize; or one of AllTCP, AllUDP, AllICMPv4, AllICMPv6, AllTraffic.
rules[].justification, comment, owner, expiration	Optional rule metadata. Additional optional fields (summary, notes, application and risk-owner details) are listed in the Schema under ChangeRequestRuleInput.

An invalid request is rejected with a list of the validation errors: in the GraphQL response's errors array, or as a 400 response from the REST API.

Example

{
  "query": "mutation saveChangeRequest($input: ChangeRequestInput!) { saveChangeRequest(input: $input) { id } }",
  "operationName": "saveChangeRequest",
  "variables": {
    "input": {
      "id": "",
      "name": "Allow all outbound HTTPS from Lab",
      "projectId": "",
      "rules": [
        {
          "action": "Allow",
          "sources": [
            {
              "type": "Cidr",
              "cidr": "10.10.10.0/24"
            }
          ],
          "destinations": [
            {
              "type": "Any"
            }
          ],
          "services": [
            {
              "type": "TCP",
              "portStart": 443,
              "portEnd": 443
            }
          ]
        }
      ]
    }
  }
}

An example using cURL:

curl --request POST \
  --url https://graph.prod.firemon.cloud/graphql \
  --header 'Authorization: IdToken' \
  --header 'Content-Type: application/json' \
  --data '{"query":"mutation saveChangeRequest($input: ChangeRequestInput!) { saveChangeRequest(input: $input) { id } }","operationName":"saveChangeRequest","variables":{"input":{"id":"","name":"Allow all outbound HTTPS from Lab","projectId":"","rules":[{"action":"Allow","sources":[{"type":"Cidr","cidr":"10.10.10.0/24"}],"destinations":[{"type":"Any"}],"services":[{"type":"TCP","portStart":443,"portEnd":443}]}]}}}'