Save Change Request

Save a change request by sending an HTTPS POST request to https://graph.prod.firemon.cloud/graphql.

Set the Authorization header to the idToken from Authentication.

Saving stores the request, sets its state to Pending, and starts evaluation against every enforced Boundary asynchronously. Check the outcome with Get Change Request. To evaluate rules without saving anything, see Evaluate Change Request.

Input fields

Field	Notes
id	Leave blank to create a new change request. Provide an existing request's ID to update it. Only an administrator, the request's creator, or its last updater can update a request.
name	The request's display name.
projectId	The project to create the request in. Leave blank to use the root project if you have permission to request firewall changes there, otherwise the first project where you do.
rules[].id	Leave blank and Connect assigns one when the request is saved; Get Change Request returns it. Send it back unchanged when updating a request: exports match the rules they wrote to it, so a rule saved with a new id is exported as a new rule.
rules[].action	Allow or Deny.
rules[].sources, rules[].destinations	Network objects. Set type to Any; Cidr with cidr; ConnectGroup with groupId; or InventoryItem with itemKey (accountId, region, type, and id, all found on an Inventory item). A ConnectGroup saved without comparison is stored as Contains.
rules[].services	Service objects. Set type to TCP or UDP with portStart and portEnd; ICMPv4 or ICMPv6 with icmpType and icmpCode; CustomProtocol with protocol; PortRangeSize with maxSize; or one of AllTCP, AllUDP, AllICMPv4, AllICMPv6, AllTraffic.
rules[].justification, comment, owner, expiration	Optional rule metadata. Additional optional fields (summary, notes, application and risk-owner details) are listed in the Schema under ChangeRequestRuleInput.

A request that fails validation (a missing name, an invalid CIDR, a port out of range) is rejected with the list of errors: in the GraphQL response's errors array, or as a 400 response from the REST API. A source, destination or service missing the field its type needs, such as Cidr without cidr or TCP without portStart and portEnd, fails with an internal server error rather than a validation message, so send every field listed above for the type.

Example

{
  "query": "mutation saveChangeRequest($input: ChangeRequestInput!) { saveChangeRequest(input: $input) { id } }",
  "operationName": "saveChangeRequest",
  "variables": {
    "input": {
      "id": "",
      "name": "Allow all outbound HTTPS from Lab",
      "projectId": "",
      "rules": [
        {
          "action": "Allow",
          "sources": [
            {
              "type": "Cidr",
              "cidr": "10.10.10.0/24"
            }
          ],
          "destinations": [
            {
              "type": "Any"
            }
          ],
          "services": [
            {
              "type": "TCP",
              "portStart": 443,
              "portEnd": 443
            }
          ]
        }
      ]
    }
  }
}

An example using cURL:

curl --request POST \
  --url https://graph.prod.firemon.cloud/graphql \
  --header 'Authorization: IdToken' \
  --header 'Content-Type: application/json' \
  --data '{"query":"mutation saveChangeRequest($input: ChangeRequestInput!) { saveChangeRequest(input: $input) { id } }","operationName":"saveChangeRequest","variables":{"input":{"id":"","name":"Allow all outbound HTTPS from Lab","projectId":"","rules":[{"action":"Allow","sources":[{"type":"Cidr","cidr":"10.10.10.0/24"}],"destinations":[{"type":"Any"}],"services":[{"type":"TCP","portStart":443,"portEnd":443}]}]}}}'